Changeset 3777340

auditae-ai-search-toolkit/tags/0.38.0/auditae.php

-              r3775803
+              r3777340
  * Plugin URI:        https://auditae.app/wordpress-ai-plugin
  * Description:       WordPress MCP server for Claude & ChatGPT: let AI agents draft, edit and publish. Free AI search readiness: llms.txt, AI crawler log, score, schema.
  * Version:           0.37.0
+ * Version:           0.38.0
  * Requires at least: 6.0
  * Requires PHP:      7.4
 …
 defined( 'ABSPATH' ) || exit;
 define( 'AUDITAE_VERSION', '0.37.0' );
+define( 'AUDITAE_VERSION', '0.38.0' );
 // REST contract version the app can check before relying on newer fields.
 // Bump when a route gains or changes a field the app depends on.
 …
 // seo_provider; POST /posts/{id}/untrash and /elementor-restore; GET /posts
 // status=trash; builder gutenberg|classic|aeo_template|empty; /status
+// features).
+define( 'AUDITAE_API_VERSION', 6 );
+// features); 7 = 0.38.0 (body edits keep their undo on the site:
+// content_restore_id + POST /posts/{id}/restore, no old body in answers;
+// internal-link target check + undo; redirect live-source refusal; menu
+// links in the graph; GET /broken-links + POST /posts/{id}/fix-link; POST
+// /media/alt-text; /posts/{id}/seo robots + rendered_*; schema if_output;
+// see auditae_rest_features()).
+define( 'AUDITAE_API_VERSION', 7 );
 define( 'AUDITAE_PLUGIN_FILE', __FILE__ );
 define( 'AUDITAE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 …
 // dead end), so it loads after redirects.php.
 require_once AUDITAE_PLUGIN_DIR . 'includes/broken-links.php';
+require_once AUDITAE_PLUGIN_DIR . 'includes/broken-links-rest.php';
 // Fan-out reads the link index (anchor phrases, stopwords) and the readiness
 // helpers (builder detection), so it loads after both.

auditae-ai-search-toolkit/tags/0.38.0/includes/elementor.php

-              r3775803
+              r3777340
+}
+// The post body an AuditAE edit replaced on a non-Elementor post (a full
+// `content` write, `replacements`, an inserted internal link, a broken-link
+// fix), kept on the post so the edit can be undone by id
+// (POST /posts/{id}/restore) instead of echoing the whole old body back in
+// every answer. Same limits and same changed-since check as the Elementor
+// store above.
+define( 'AUDITAE_CONTENT_UNDO_KEY', '_auditae_content_undo' );
+/**
+ * Keep the body an edit just replaced. Call after the new body is saved.
+ * Returns the restore id ('cu_…'), or '' when the body is too big to keep
+ * or nothing changed.
+ *
+ * @param int    $post_id Post ID.
+ * @param string $before  post_content before the edit.
+ * @return string
+ */
+function auditae_content_undo_push( $post_id, $before ) {
+        $post_id = (int) $post_id;
+        $before  = (string) $before;
+        $after   = (string) get_post_field( 'post_content', $post_id, 'raw' );
+        if ( strlen( $before ) > AUDITAE_ELEMENTOR_UNDO_MAX_BYTES || $before === $after ) {
+                return '';
+        }
+        $list   = get_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, true );
+        $list   = is_array( $list ) ? array_values( $list ) : array();
+        $id     = 'cu_' . strtolower( wp_generate_password( 16, false, false ) );
+        $list[] = array(
+                'id'        => $id,
+                'at'        => time(),
+                'before'    => $before,
+                'after_sha' => sha1( $after ),
+        );
+        $list = array_slice( $list, -AUDITAE_ELEMENTOR_UNDO_MAX );
+        update_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, wp_slash( $list ) );
+        return $id;
+}
+/**
+ * Put back the body a kept edit replaced. The body was already stored on
+ * this site, so it is saved with the post kses filter lifted (as user 0 it
+ * would strip the embeds the edit never touched).
+ *
+ * @param int    $post_id    Post ID.
+ * @param string $restore_id Id from auditae_content_undo_push().
+ * @param bool   $force      Restore even if the post changed since.
+ * @return array{previous:string,restore_id:string}|WP_Error
+ */
+function auditae_content_undo_restore( $post_id, $restore_id, $force = false ) {
+        $post_id = (int) $post_id;
+        $list    = get_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, true );
+        $list    = is_array( $list ) ? array_values( $list ) : array();
+        $index   = null;
+        foreach ( $list as $i => $entry ) {
+                if ( is_array( $entry ) && isset( $entry['id'] ) && hash_equals( (string) $entry['id'], (string) $restore_id ) ) {
+                        $index = $i;
+                }
+        }
+        if ( null === $index ) {
+                return new WP_Error( 'auditae_restore_not_found', 'No kept AuditAE edit with that restore id on this post (only the last ' . AUDITAE_ELEMENTOR_UNDO_MAX . ' are kept). Older versions are in the post\'s Revisions in wp-admin.', array( 'status' => 404 ) );
+        }
+        $entry   = $list[ $index ];
+        $current = (string) get_post_field( 'post_content', $post_id, 'raw' );
+        if ( ! $force && sha1( $current ) !== (string) $entry['after_sha'] ) {
+                return new WP_Error( 'auditae_changed_since', 'This post was changed after that edit (in wp-admin or by another edit), so restoring it would undo those changes too. Nothing was changed. Pass force: true to restore it anyway.', array( 'status' => 409 ) );
+        }
+        $prio = has_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        if ( false !== $prio ) {
+                remove_filter( 'content_save_pre', 'wp_filter_post_kses', $prio );
+        }
+        try {
+                $res = wp_update_post(
+                        array(
+                                'ID'           => $post_id,
+                                'post_content' => wp_slash( (string) $entry['before'] ),
+                        ),
+                        true
+                );
+        } finally {
+                if ( false !== $prio ) {
+                        add_filter( 'content_save_pre', 'wp_filter_post_kses', $prio );
+                }
+        }
+        if ( is_wp_error( $res ) ) {
+                return new WP_Error( 'auditae_update_failed', $res->get_error_message(), array( 'status' => 500 ) );
+        }
+        $list = array_slice( $list, 0, $index );
+        if ( empty( $list ) ) {
+                delete_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY );
+        } else {
+                update_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, wp_slash( $list ) );
+        }
+        if ( function_exists( 'auditae_links_invalidate' ) ) {
+                auditae_links_invalidate();
+        }
+        return array(
+                'previous'   => $current,
+                'restore_id' => auditae_content_undo_push( $post_id, $current ),
+        );
+}
+/**
+ * Undo pairs for a plain-post `replacements` edit: each replacement turned
+ * back into its find, in reverse order. Only returned when replaying them
+ * on the new body gives back the old body exactly (a replacement whose new
+ * text already appeared elsewhere, or one that also changed block
+ * attributes, would not); otherwise the restore id is the undo.
+ *
+ * @param string $before   Body before the edit.
+ * @param string $after    Body after the edit.
+ * @param array  $replaced auditae_apply_replacements() result.
+ * @param array  $sent     The request's replacements.
+ * @return array|null
+ */
+function auditae_replacements_undo_pairs( $before, $after, array $replaced, array $sent ) {
+        if ( empty( $replaced['matches'] ) || ! is_array( $replaced['matches'] ) ) {
+                return null;
+        }
+        $undo = array();
+        $text = (string) $after;
+        foreach ( array_reverse( array_keys( $sent ) ) as $i ) {
+                $r = $sent[ $i ];
+                if ( ! is_array( $r ) || ! isset( $r['find'], $r['replace'] ) || '' === (string) $r['replace'] ) {
+                        return null;
+                }
+                $stored = wp_kses_post( (string) $r['replace'] );
+                $n      = isset( $replaced['counts'][ $i ] ) ? (int) $replaced['counts'][ $i ] : 0;
+                if ( $n < 1 || substr_count( $text, $stored ) !== $n ) {
+                        return null;
+                }
+                $text   = str_replace( $stored, (string) $r['find'], $text );
+                $pair   = array(
+                        'find'    => $stored,
+                        'replace' => (string) $r['find'],
+                );
+                if ( $n > 1 ) {
+                        $pair['expected_count'] = $n;
+                }
+                $undo[] = $pair;
+        }
+        return $text === (string) $before ? $undo : null;
+}
+/**
+ * Restore by id: 'eu_…' (Elementor tree) or 'cu_…' (post body).
+ *
+ * @param int    $post_id    Post ID.
+ * @param string $restore_id Restore id.
+ * @param bool   $force      Restore even if the post changed since.
+ * @return array{previous:string,restore_id:string,kind:string}|WP_Error
+ */
+function auditae_undo_restore( $post_id, $restore_id, $force = false ) {
+        $restore_id = (string) $restore_id;
+        if ( 0 === strpos( $restore_id, 'eu_' ) ) {
+                if ( ! auditae_elementor_is_built( $post_id ) ) {
+                        return new WP_Error( 'auditae_bad_request', 'That restore id is for an Elementor edit, and this post is no longer built with Elementor.', array( 'status' => 400 ) );
+                }
+                $res = auditae_elementor_undo_restore( $post_id, $restore_id, $force );
+                $kind = 'elementor';
+        } else {
+                if ( auditae_elementor_is_built( $post_id ) ) {
+                        return new WP_Error( 'auditae_bad_request', 'That restore id is for a post-body edit, and this post is now built with Elementor (its body is a mirror). Nothing was changed.', array( 'status' => 400 ) );
+                }
+                $res  = auditae_content_undo_restore( $post_id, $restore_id, $force );
+                $kind = 'content';
+        }
+        if ( is_wp_error( $res ) ) {
+                return $res;
+        }
+        $res['kind'] = $kind;
+        return $res;
+}
 /**
  * The post_content mirror Elementor's own save would write for this tree

auditae-ai-search-toolkit/tags/0.38.0/includes/internal-links.php

-              r3733266
+              r3777340
         // the graph is missing or out of date a background rebuild is queued
         // and the response says so ('building').
         $status = auditae_links_index_status();
+        $status = auditae_links_index_status_catch_up();
         $index  = $status['index'];
 …
                 $items[] = array(
                         'id'             => (int) $p->ID,
                         'title'          => get_the_title( $p ),
+                        'title'          => auditae_rest_plain_title( $p ),
                         'slug'           => $p->post_name,
                         'view_url'       => get_permalink( $p ),
                         'outgoing_count' => (int) $stats['out'],
                         'incoming_count' => (int) $stats['in'],
+                        'orphan'         => ( 0 === (int) $stats['in'] && $stats['known'] && ! in_array( (int) $p->ID, $exempt, true ) ),
+                        // Links from the site's navigation menus, counted apart from
+                        // links in other posts' content (0.38.0).
+                        'menu_links'     => (int) $stats['menu'],
+                        'orphan'         => ( 0 === (int) $stats['in'] && 0 === (int) $stats['menu'] && $stats['known'] && ! in_array( (int) $p->ID, $exempt, true ) ),
                         // False when the post sits outside the indexed window, so a
                         // consumer can tell "no incoming links" from "not measured".
 …
                                 // Non-null while a sliced rebuild runs: pages scanned so far.
                                 'rebuilding' => $status['progress'],
+                                // True when WP-Cron isn't running the rebuild here (each read
+                                // then advances it a little itself).
+                                'stalled'     => (bool) $status['stalled'],
+                                'age_seconds' => isset( $index['built'] ) ? max( 0, time() - (int) $index['built'] ) : null,
                         ),
+                )
 …
                                 if ( in_array( auditae_links_normalize_path( $link['href'] ), $target_keys, true ) ) {
                                         $incoming[] = array(
+                                                'source'       => 'content',
                                                 'source_id'    => (int) $cand->ID,
                                                 'source_title' => get_the_title( $cand->ID ),
+                                                'source_title' => auditae_rest_plain_title( $cand->ID ),
                                                 'anchor_text'  => $link['anchor'],
                                                 'href'         => $link['href'],
 …
+        }
+        // Navigation menu links count as incoming too (source "menu"), so a
+        // page reached only from the menu isn't presented as unlinked.
+        $menu      = auditae_links_menu_inlinks();
+        $menu_hits = isset( $menu[ (int) $post->ID ] ) ? (int) $menu[ (int) $post->ID ] : 0;
+        if ( $menu_hits > 0 ) {
+                $incoming[] = array(
+                        'source'       => 'menu',
+                        'source_id'    => 0,
+                        'source_title' => 'Navigation menu',
+                        'anchor_text'  => '',
+                        'href'         => (string) $permalink,
+                        'count'        => $menu_hits,
+                );
+        }
         return rest_ensure_response(
                 array(
                         'post' => array(
                                 'id'    => (int) $post->ID,
                                 'title' => get_the_title( $post ),
+                                'title' => auditae_rest_plain_title( $post ),
                                 'slug'  => $post->post_name,
                         ),
+                        'outgoing' => $outgoing,
+                        'incoming' => $incoming,
+                        'outgoing'   => $outgoing,
+                        'incoming'   => $incoming,
+                        'menu_links' => $menu_hits,
                         // Only computed when there's nothing incoming, since that's the
                         // only case where a suggestion is the next action. Each one is
                         // pre-verified to be insertable, so AEBOT can act on it without
                         // a round trip that might 422.
                         'suggestions' => empty( $incoming ) ? auditae_links_suggest_sources( (int) $post->ID, 5 ) : array(),
+                        'suggestions' => count( $incoming ) === ( $menu_hits > 0 ? 1 : 0 ) ? auditae_links_suggest_sources( (int) $post->ID, 5 ) : array(),
+                )
         );
 …
                 return new WP_Error( 'auditae_not_found', 'post not found', array( 'status' => 404 ) );
+        }
+        if ( 'trash' === $post->post_status ) {
+                return new WP_Error( 'auditae_post_trashed', 'This post is in the trash. Restore it first (POST /posts/' . $id . '/untrash).', array( 'status' => 409 ) );
+        }
         $json = $request->get_json_params();
 …
         $anchor = isset( $body['anchor_text'] ) ? trim( (string) $body['anchor_text'] ) : '';
         $href   = isset( $body['target_url'] ) ? (string) $body['target_url'] : '';
+        $original = auditae_elementor_is_built( $id ) ? get_post_meta( $id, '_elementor_data', true ) : $post->post_content;
+        $force  = isset( $body['force'] ) && rest_sanitize_boolean( $body['force'] );
+        // The target must be a page that exists and is public: a host check
+        // alone let /does-not-exist/ through, writing a broken link (and the
+        // app billed for it). Resolved the way the broken-link checker does
+        // (posts, pages, terms, archives, files, redirects) before anything is
+        // written. force: true skips it, for a path another app on the same
+        // host serves.
+        $is_elementor = auditae_elementor_is_built( $id );
+        $target       = null;
+        $site_host    = wp_parse_url( home_url(), PHP_URL_HOST );
+        $target_host  = wp_parse_url( $href, PHP_URL_HOST );
+        if ( '' !== $anchor && '' !== $href && ( ! $target_host || auditae_is_site_host( $target_host, $site_host ) ) ) {
+                $target = auditae_links_check_target( $href );
+                if ( ! $force && 'broken' === $target['status'] ) {
+                        return new WP_Error(
+                                'auditae_link_target_not_found',
+                                sprintf( 'Nothing was changed: %s is not a page on this site (no published post, page, category, archive, file or redirect answers it), so the link would be broken. Link to a published page (wp_list_posts gives each one\'s view_url), or pass force: true if another app on this host serves that path.', $href ),
+                                array(
+                                        'status'        => 422,
+                                        'target_status' => 'not_found',
+                                )
+                        );
+                }
+                if ( ! $force && 'unpublished' === $target['status'] ) {
+                        // Same code as not_found (the app maps one refusal);
+                        // data.target_status says which.
+                        return new WP_Error(
+                                'auditae_link_target_not_found',
+                                sprintf( 'Nothing was changed: %1$s is post %2$d, which is %3$s, so visitors following the link would get a 404. Publish it first, or link to a published page.', $href, (int) $target['post_id'], $target['post_status'] ),
+                                array(
+                                        'status'        => 422,
+                                        'target_status' => $target['post_status'],
+                                        'target_id'     => (int) $target['post_id'],
+                                )
+                        );
+                }
+        }
+        $content_before   = (string) $post->post_content;
+        $elementor_before = $is_elementor ? (string) get_post_meta( $id, '_elementor_data', true ) : '';
         // Validation, the kses/slashing dance and the save all live in
         // auditae_links_insert() so this endpoint and the one-click button on
         // the Links tab cannot drift apart.
+        $result = auditae_links_insert( $id, $anchor, $href );
+        $info   = array();
+        $result = auditae_links_insert( $id, $anchor, $href, $info );
         if ( is_wp_error( $result ) ) {
                 $status = array(
 …
+        }
+        auditae_log_action( 'internal_link_inserted', 'id=' . $id );
+        return rest_ensure_response(
+                array(
+                        'post_id'        => (int) $id,
+                        'anchor_text'    => $anchor,
+                        'target_url'     => esc_url_raw( $href ),
+                        'previous_state' => auditae_elementor_is_built( $id )
+                                ? array( '_elementor_data' => $original )
+                                : array( 'post_content' => $original ),
+                )
+        );
+        // Undone by id (POST /posts/{id}/restore), like wp_update_post's text
+        // edits: an Elementor page's tree can't be written back by the app, and
+        // echoing the whole old body made every link answer as big as the page.
+        $answer = array(
+                'post_id'     => (int) $id,
+                'anchor_text' => $anchor,
+                'target_url'  => esc_url_raw( $href ),
+                'builder'     => auditae_rest_builder( get_post( $id ) ),
+        );
+        if ( null !== $target && $target['post_id'] > 0 ) {
+                $answer['target_id'] = (int) $target['post_id'];
+        }
+        if ( $is_elementor ) {
+                $rid = auditae_elementor_undo_push( $id, $elementor_before );
+                if ( '' !== $rid ) {
+                        $answer['elementor_restore_id'] = $rid;
+                }
+        } else {
+                $rid = auditae_content_undo_push( $id, $content_before );
+                if ( '' !== $rid ) {
+                        $answer['content_restore_id'] = $rid;
+                }
+        }
+        if ( ! empty( $info['inserted'] ) ) {
+                // One-pair undo through wp_update_post `replacements` (Elementor
+                // pages too): the anchor written back to the phrase it wrapped.
+                $answer['inserted_html'] = $info['inserted'];
+                $answer['undo']          = array(
+                        'replacements' => array(
+                                array(
+                                        'find'    => $info['inserted'],
+                                        'replace' => (string) $info['phrase'],
+                                ),
+                        ),
+                );
+        }
+        if ( null !== $target && 'ok' !== $target['status'] ) {
+                $answer['warning'] = 'force: true, so the target was not verified as a page on this site.';
+        }
+        if ( isset( $body['include_previous_content'] ) && rest_sanitize_boolean( $body['include_previous_content'] ) ) {
+                $answer['previous_state'] = $is_elementor ? array( '_elementor_data' => $elementor_before ) : array( 'post_content' => $content_before );
+        }
+        auditae_log_action( 'internal_link_inserted', 'id=' . $id . ( '' !== $rid ? ' restore_id=' . $rid : '' ) );
+        return rest_ensure_response( $answer );
+}
 …
  * @return string Content with at most one new anchor.
  */
+function auditae_wrap_first_anchor_occurrence( $content, $anchor, $href ) {
+function auditae_wrap_first_anchor_occurrence( $content, $anchor, $href, &$inserted = null ) {
+        $inserted = '';
         if ( ! is_string( $content ) || '' === $content || '' === trim( (string) $anchor ) ) {
                 return $content;
 …
         // A callback, not a replacement string: esc_url() allows "$", so a
         // target URL containing "$1" was expanded as a backreference.
+        $replace  = static function ( $m ) use ( $href_att ) {
+                return '<a href="' . $href_att . '">' . $m[1] . '</a>';
+        $made     = '';
+        $replace  = static function ( $m ) use ( $href_att, &$made ) {
+                $made = '<a href="' . $href_att . '">' . $m[1] . '</a>';
+                return $made;
         };
 …
+        }
+        if ( $replaced ) {
+                // The exact anchor written, so a caller can offer it back as a
+                // one-pair undo (find: this, replace: the phrase).
+                $inserted = $made;
+        }
         return $replaced ? $out : $content;
+}

auditae-ai-search-toolkit/tags/0.38.0/includes/link-index.php

-              r3733266
+              r3777340
 /**
+ * auditae_links_index_status() for the REST graph, which an agent reads
+ * with nobody to press "Build link graph now": when nothing has advanced a
+ * build lately (no slice in the last couple of minutes) and WP-Cron is
+ * evidently not running it (an overdue event), or the graph is long past
+ * its TTL, run one short slice in this request. Without it, `building`
+ * stayed true next to an 18-hour-old built_at on a host where WP-Cron never
+ * fired, and the graph never refreshed. The wp-admin tab keeps the
+ * never-build-in-the-request behaviour (it has the button).
+ *
+ * @return array Same shape as auditae_links_index_status().
+ */
+function auditae_links_index_status_catch_up() {
+        $status = auditae_links_index_status();
+        if ( ! $status['building'] ) {
+                return $status;
+        }
+        $stored = $status['index'];
+        $state  = get_option( AUDITAE_LINK_INDEX_STATE );
+        $last   = is_array( $state ) ? (int) ( isset( $state['updated'] ) ? $state['updated'] : ( isset( $state['started'] ) ? $state['started'] : 0 ) ) : 0;
+        $idle   = ( time() - $last ) > AUDITAE_LINK_INDEX_RESUME_DELAY + 60;
+        $old    = null !== $stored && ( time() - (int) $stored['built'] ) > AUDITAE_LINK_INDEX_TTL + HOUR_IN_SECONDS;
+        if ( ! $idle || ! ( $status['stalled'] || $old ) ) {
+                return $status;
+        }
+        $built = auditae_links_index_build( (float) apply_filters( 'auditae_link_index_inline_budget', 3 ) );
+        if ( is_array( $built ) ) {
+                return array(
+                        'index'    => $built,
+                        'building' => ! auditae_links_index_is_usable( get_option( AUDITAE_LINK_INDEX_OPTION ) ),
+                        'progress' => null,
+                        'stalled'  => false,
+                );
+        }
+        $status['progress'] = auditae_links_index_progress();
+        return $status;
+}
+/**
  * Queue the next build slice to run as soon as cron fires. Safe to call on
  * every read: WordPress refuses a single event when one for the same hook
 …
  * @return array|null The freshly built index, or null when a continuation was scheduled.
  */
 function auditae_links_index_build() {
+function auditae_links_index_build( $budget = null ) {
         global $wpdb;
 …
+        }
+        $budget   = (float) apply_filters( 'auditae_link_index_time_budget', AUDITAE_LINK_INDEX_TIME_BUDGET );
+        $deadline = microtime( true ) + max( 0.0, $budget );
+        if ( null === $budget ) {
+                $budget = (float) apply_filters( 'auditae_link_index_time_budget', AUDITAE_LINK_INDEX_TIME_BUDGET );
+        }
+        $deadline = microtime( true ) + max( 0.0, (float) $budget );
         $host     = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
         $total    = count( $state['ids'] );
 …
                         'in'    => 0,
                         'out'   => 0,
+                        'menu'  => 0,
                         'known' => false,
                 );
+        }
+        $menu = auditae_links_menu_inlinks();
         return array(
                 'in'    => isset( $index['in'][ $post_id ] ) ? (int) $index['in'][ $post_id ] : 0,
                 'out'   => isset( $index['out'][ $post_id ] ) ? (int) $index['out'][ $post_id ] : 0,
+                // Links from the site's navigation menus (not in `in`).
+                'menu'  => isset( $menu[ $post_id ] ) ? (int) $menu[ $post_id ] : 0,
                 'known' => in_array( $post_id, $index['ids'], true ),
         );
+}
+/**
+ * Posts and pages the site's navigation links to: items of the classic
+ * menus assigned to a theme location (every menu when none is assigned, as
+ * with an Elementor header's Nav Menu widget), and the links of published
+ * block-theme Navigation menus (wp_navigation). A page reached only from
+ * the menu was reported as an orphan: on a typical brochure site that was
+ * every page but the home page.
+ *
+ * Read live (menus are small and cached), so it is never stale and needs
+ * no index rebuild.
+ *
+ * @return array<int,int> post ID => number of menu links to it.
+ */
+function auditae_links_menu_inlinks( $reset = false ) {
+        static $cache = null;
+        if ( null !== $cache && ! $reset ) {
+                return $cache;
+        }
+        $cache = array();
+        $add   = static function ( $id ) use ( &$cache ) {
+                $id = (int) $id;
+                if ( $id > 0 ) {
+                        $cache[ $id ] = isset( $cache[ $id ] ) ? $cache[ $id ] + 1 : 1;
+                }
+        };
+        $host  = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
+        $by_url = static function ( $url ) use ( $add, $host ) {
+                $url      = (string) $url;
+                $url_host = wp_parse_url( $url, PHP_URL_HOST );
+                if ( '' === $url || ( $url_host && ! auditae_is_site_host( $url_host, $host ) ) ) {
+                        return;
+                }
+                $abs = $url_host ? $url : home_url( '/' . ltrim( $url, '/' ) );
+                $add( url_to_postid( $abs ) );
+        };
+        $menu_ids = array_filter( array_map( 'intval', array_values( (array) get_nav_menu_locations() ) ) );
+        if ( empty( $menu_ids ) ) {
+                $menus    = wp_get_nav_menus( array( 'fields' => 'ids' ) );
+                $menu_ids = is_array( $menus ) ? array_map( 'intval', $menus ) : array();
+        }
+        $seen_items = 0;
+        foreach ( array_unique( $menu_ids ) as $menu_id ) {
+                $items = wp_get_nav_menu_items( $menu_id, array( 'update_post_term_cache' => false ) );
+                foreach ( (array) $items as $item ) {
+                        if ( ++$seen_items > 500 ) {
+                                break 2;
+                        }
+                        if ( 'post_type' === $item->type ) {
+                                $add( $item->object_id );
+                        } elseif ( 'custom' === $item->type ) {
+                                $by_url( $item->url );
+                        }
+                }
+        }
+        // Block themes: navigation-link / navigation-submenu blocks carry the
+        // linked post's id (kind post-type) or a URL.
+        $navs = get_posts(
+                array(
+                        'post_type'      => 'wp_navigation',
+                        'post_status'    => 'publish',
+                        'posts_per_page' => 20,
+                        'no_found_rows'  => true,
+                )
+        );
+        foreach ( $navs as $nav ) {
+                $walk = static function ( $blocks ) use ( &$walk, $add, $by_url ) {
+                        foreach ( (array) $blocks as $b ) {
+                                if ( in_array( $b['blockName'], array( 'core/navigation-link', 'core/navigation-submenu', 'core/home-link' ), true ) ) {
+                                        $attrs = (array) $b['attrs'];
+                                        if ( isset( $attrs['kind'], $attrs['id'] ) && 'post-type' === $attrs['kind'] ) {
+                                                $add( $attrs['id'] );
+                                        } elseif ( ! empty( $attrs['url'] ) ) {
+                                                $by_url( $attrs['url'] );
+                                        }
+                                }
+                                if ( ! empty( $b['innerBlocks'] ) ) {
+                                        $walk( $b['innerBlocks'] );
+                                }
+                        }
+                };
+                $walk( parse_blocks( $nav->post_content ) );
+        }
+        return $cache;
+}
 …
         $limit   = max( 1, (int) $limit );
         $exempt  = auditae_links_orphan_exempt_ids();
+        $menu    = auditae_links_menu_inlinks();
         $orphans = array();
         foreach ( $index['ids'] as $id ) {
                 if ( isset( $index['in'][ $id ] ) || in_array( (int) $id, $exempt, true ) ) {
+                if ( isset( $index['in'][ $id ] ) || isset( $menu[ (int) $id ] ) || in_array( (int) $id, $exempt, true ) ) {
                         continue;
+                }
 …
+        }
         $exempt = auditae_links_orphan_exempt_ids();
+        $menu   = auditae_links_menu_inlinks();
         $n      = 0;
         foreach ( $index['ids'] as $id ) {
                 if ( ! isset( $index['in'][ $id ] ) && ! in_array( (int) $id, $exempt, true ) ) {
+                if ( ! isset( $index['in'][ $id ] ) && ! isset( $menu[ (int) $id ] ) && ! in_array( (int) $id, $exempt, true ) ) {
                         $n++;
+                }
 …
  * @return bool Whether a link was placed.
  */
+function auditae_elementor_wrap_first_anchor( array &$data, $anchor, $href ) {
+function auditae_elementor_wrap_first_anchor( array &$data, $anchor, $href, &$inserted = null ) {
+        $inserted = '';
         return auditae_elementor_map_slots(
                 $data,
                 function ( $value, $kind, &$stop ) use ( $anchor, $href ) {
+                function ( $value, $kind, &$stop ) use ( $anchor, $href, &$inserted ) {
                         if ( 'rich' !== $kind ) {
                                 return $value;
+                        }
+                        $new = auditae_wrap_first_anchor_occurrence( $value, $anchor, $href );
+                        $made = '';
+                        $new  = auditae_wrap_first_anchor_occurrence( $value, $anchor, $href, $made );
                         if ( $new !== $value ) {
+                                $stop = true;
+                                $stop     = true;
+                                $inserted = $made;
+                        }
                         return $new;
 …
  * @param string $anchor    Text to wrap.
  * @param string $href      Destination URL (must be same-host).
+ * @param array  $info      Filled on success: inserted (the <a> written), phrase (the text it wraps).
  * @return true|WP_Error
  */
+function auditae_links_insert( $source_id, $anchor, $href ) {
+function auditae_links_insert( $source_id, $anchor, $href, &$info = null ) {
+        $info      = array();
         $source_id = (int) $source_id;
         $post      = get_post( $source_id );
 …
         if ( auditae_elementor_is_built( $source_id ) ) {
                 $data = auditae_elementor_data( $source_id );
+                if ( ! auditae_elementor_wrap_first_anchor( $data, $anchor, $href ) ) {
+                $made = '';
+                if ( ! auditae_elementor_wrap_first_anchor( $data, $anchor, $href, $made ) ) {
                         return $not_found;
+                }
+                $info = auditae_links_insert_info( $made );
                 $result = auditae_elementor_save( $source_id, $data );
                 if ( is_wp_error( $result ) ) {
 …
         $original = $post->post_content;
+        $updated  = auditae_wrap_first_anchor_occurrence( $original, $anchor, $href );
+        $made     = '';
+        $updated  = auditae_wrap_first_anchor_occurrence( $original, $anchor, $href, $made );
         if ( $updated === $original ) {
                 return $not_found;
+        }
+        $info = auditae_links_insert_info( $made );
         // Requests authenticated by bearer token run as user 0, where kses is
 …
+}
+/**
+ * What auditae_links_insert() wrote, for an undo pair.
+ *
+ * @param string $made The <a> written.
+ * @return array{inserted:string,phrase:string}
+ */
+function auditae_links_insert_info( $made ) {
+        $phrase = preg_replace( '#^<a\b[^>]*>(.*)</a>$#s', '$1', (string) $made );
+        return array(
+                'inserted' => (string) $made,
+                'phrase'   => is_string( $phrase ) ? $phrase : '',
+        );
+}
+/**
+ * Whether a link target resolves to something public on this site, the way
+ * the broken-link checker decides it (auditae_broken_classify(): posts,
+ * pages, terms, archives, files, redirects; conservative: anything it
+ * can't rule out is 'ok').
+ *
+ * @param string $href Target URL (absolute same-host or host-relative).
+ * @return array{status:string,post_id:int,post_status:string} status ok | broken | unpublished.
+ */
+function auditae_links_check_target( $href ) {
+        $href = trim( (string) $href );
+        $out  = array(
+                'status'      => 'ok',
+                'post_id'     => 0,
+                'post_status' => '',
+        );
+        if ( ! function_exists( 'auditae_broken_classify' ) ) {
+                return $out;
+        }
+        $site_host = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
+        // A relative path without a leading slash resolves against home.
+        if ( '' !== $href && ! preg_match( '#^([a-z][a-z0-9+.\-]*:|/|\#|\?)#i', $href ) ) {
+                $href = '/' . $href;
+        }
+        if ( ! auditae_broken_is_checkable_internal( $href, $site_host ) ) {
+                return $out; // fragment, query-only, mailto:, another app's path
+        }
+        return auditae_broken_classify( $href, auditae_broken_normalize_path( $href ), auditae_broken_known_paths() );
+}
 // ────────────────────────────────────────────────────────────────────
 // Scheduled rebuild

auditae-ai-search-toolkit/tags/0.38.0/includes/media.php

-              r3775803
+              r3777340
         // references inside published post content, so it carries more risk
         // and a distinct audit-log entry. write_seo tier, same as alt/caption.
+        // Alt text for up to 50 images in one call, with one undo token
+        // (0.38.0). write_seo, like the single-image PATCH.
+        register_rest_route(
+                $namespace,
+                '/media/bulk-alt',
+                array(
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_bulk_alt_text',
+                        'permission_callback' => 'auditae_rest_authorize_seo_write',
+                )
+        );
+        register_rest_route(
+                $namespace,
+                '/media/bulk-alt/undo',
+                array(
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_bulk_alt_text_undo',
+                        'permission_callback' => 'auditae_rest_authorize_seo_write',
+                )
+        );
         register_rest_route(
                 $namespace,
 …
                         'media'          => auditae_format_media( get_post( $id ), true ),
                         'previous_state' => $previous_state,
+                )
+        );
+}
+// ────────────────────────────────────────────────────────────────────
+// POST /media/bulk-alt — bulk alt text, with undo (0.38.0)
+// ────────────────────────────────────────────────────────────────────
+// Undo tokens for bulk alt writes: token => {at, items: {id: {before, after}}}.
+// Last 10 kept for 30 days, one non-autoloaded option.
+define( 'AUDITAE_OPT_ALT_UNDO', 'auditae_alt_undo' );
+define( 'AUDITAE_ALT_BULK_MAX', 50 );
+/**
+ * POST /media/bulk-alt {items: [{id, alt_text}, …]} (≤ 50). Per item: updated,
+ * unchanged (already that alt: a no-op), not_found (not an attachment) or
+ * invalid. One undo_token covers every updated item.
+ */
+function auditae_rest_bulk_alt_text( WP_REST_Request $request ) {
+        $items = $request->get_param( 'items' );
+        if ( ! is_array( $items ) || empty( $items ) ) {
+                return new WP_Error( 'auditae_bad_request', 'items is required: [{id, alt_text}, …] (up to ' . AUDITAE_ALT_BULK_MAX . ').', array( 'status' => 400 ) );
+        }
+        if ( count( $items ) > AUDITAE_ALT_BULK_MAX ) {
+                return new WP_Error( 'auditae_bad_request', 'At most ' . AUDITAE_ALT_BULK_MAX . ' items per call; nothing was changed. Split the list.', array( 'status' => 400 ) );
+        }
+        $results = array();
+        $undo    = array();
+        $seen    = array();
+        foreach ( array_values( $items ) as $item ) {
+                $id  = is_array( $item ) && isset( $item['id'] ) ? absint( $item['id'] ) : 0;
+                $alt = is_array( $item ) && array_key_exists( 'alt_text', $item ) ? $item['alt_text'] : ( is_array( $item ) && array_key_exists( 'alt', $item ) ? $item['alt'] : null );
+                if ( $id <= 0 || ! ( is_string( $alt ) || null === $alt ) || isset( $seen[ $id ] ) ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'invalid',
+                                'error'  => isset( $seen[ $id ] ) ? 'duplicate id in this call' : 'each item needs a numeric id and a string alt_text',
+                        );
+                        continue;
+                }
+                $seen[ $id ] = true;
+                $att         = get_post( $id );
+                if ( ! $att || 'attachment' !== $att->post_type ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'not_found',
+                        );
+                        continue;
+                }
+                $new    = trim( wp_strip_all_tags( (string) $alt ) );
+                $before = (string) get_post_meta( $id, '_wp_attachment_image_alt', true );
+                if ( $new === $before ) {
+                        $results[] = array(
+                                'id'       => $id,
+                                'status'   => 'unchanged',
+                                'alt_text' => $new,
+                        );
+                        continue;
+                }
+                update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( $new ) );
+                clean_post_cache( $id );
+                $undo[ $id ] = array(
+                        'before' => $before,
+                        'after'  => $new,
+                );
+                $results[]   = array(
+                        'id'                => $id,
+                        'status'            => 'updated',
+                        'alt_text'          => $new,
+                        'previous_alt_text' => $before,
+                );
+        }
+        $updated = count( $undo );
+        $answer  = array(
+                'results'   => $results,
+                'updated'   => $updated,
+                'unchanged' => count( wp_list_filter( $results, array( 'status' => 'unchanged' ) ) ),
+                'failed'    => count( $results ) - $updated - count( wp_list_filter( $results, array( 'status' => 'unchanged' ) ) ),
+        );
+        if ( $updated > 0 ) {
+                $token = 'au_' . strtolower( wp_generate_password( 16, false, false ) );
+                $store = get_option( AUDITAE_OPT_ALT_UNDO, array() );
+                $store = is_array( $store ) ? $store : array();
+                foreach ( $store as $k => $entry ) {
+                        if ( ! is_array( $entry ) || (int) ( $entry['at'] ?? 0 ) < time() - 30 * DAY_IN_SECONDS ) {
+                                unset( $store[ $k ] );
+                        }
+                }
+                $store[ $token ] = array(
+                        'at'    => time(),
+                        'items' => $undo,
+                );
+                $store = array_slice( $store, -10, null, true );
+                update_option( AUDITAE_OPT_ALT_UNDO, $store, false );
+                // POST /media/bulk-alt/undo {undo_token} puts every updated alt back.
+                $answer['undo_token'] = $token;
+                auditae_log_action( 'media_alt_bulk', 'updated=' . $updated . ' undo_token=' . $token );
+        }
+        return rest_ensure_response( $answer );
+}
+/**
+ * POST /media/bulk-alt/undo {undo_token, force?}: put back the alts a bulk
+ * write replaced. An image whose alt changed again since is skipped
+ * (changed_since) unless force.
+ */
+function auditae_rest_bulk_alt_text_undo( WP_REST_Request $request ) {
+        $token = (string) $request->get_param( 'undo_token' );
+        $store = get_option( AUDITAE_OPT_ALT_UNDO, array() );
+        $store = is_array( $store ) ? $store : array();
+        if ( ! preg_match( '/^au_[a-z0-9]{16}$/', $token ) || ! isset( $store[ $token ] ) ) {
+                return new WP_Error( 'auditae_restore_not_found', 'No bulk alt-text write with that undo_token (the last 10, for 30 days, are kept). Nothing was changed.', array( 'status' => 404 ) );
+        }
+        $force    = rest_sanitize_boolean( $request->get_param( 'force' ) );
+        $results  = array();
+        $restored = 0;
+        foreach ( (array) $store[ $token ]['items'] as $id => $pair ) {
+                $id  = (int) $id;
+                $cur = (string) get_post_meta( $id, '_wp_attachment_image_alt', true );
+                if ( 'attachment' !== get_post_type( $id ) ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'not_found',
+                        );
+                        continue;
+                }
+                if ( ! $force && $cur !== (string) $pair['after'] ) {
+                        $results[] = array(
+                                'id'       => $id,
+                                'status'   => 'changed_since',
+                                'alt_text' => $cur,
+                        );
+                        continue;
+                }
+                update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( (string) $pair['before'] ) );
+                clean_post_cache( $id );
+                $restored++;
+                $results[] = array(
+                        'id'       => $id,
+                        'status'   => 'restored',
+                        'alt_text' => (string) $pair['before'],
+                );
+        }
+        if ( 0 === $restored ) {
+                // Nothing put back: keep the token so a retry with force works.
+                return new WP_Error(
+                        'auditae_changed_since',
+                        'Nothing was changed: every image\'s alt text was changed again (or the image deleted) since that write. Pass force: true to put the old alts back anyway.',
+                        array(
+                                'status'  => 409,
+                                'results' => $results,
+                        )
+                );
+        }
+        unset( $store[ $token ] );
+        update_option( AUDITAE_OPT_ALT_UNDO, $store, false );
+        auditae_log_action( 'media_alt_bulk_undo', 'restored=' . $restored . ' undo_token=' . $token );
+        return rest_ensure_response(
+                array(
+                        'results'  => $results,
+                        'restored' => $restored,
+                )
         );
 …
         $rewrote_posts = 0;
+        $rewrote_revs  = 0;
         $rewrote_meta  = 0;
         $leftovers     = array();
 …
                 // Pre-filter on the size stem (a prefix of the -scaled stem), so
                 // posts embedding only intermediate-size URLs still match.
                 $rewrote_posts = auditae_rewrite_media_references( $old_size_stem, $url_map );
+                $rewrote_posts = auditae_rewrite_media_references( $old_size_stem, $url_map, $rewrote_revs );
                 $rewrote_meta  = auditae_rewrite_media_meta_references( $old_size_stem, $url_map );
                 auditae_rewrite_media_option_references( $url_map );
 …
         return array(
                 'media'          => auditae_format_media( get_post( $id ), true ),
+                'rewrote_posts'  => $rewrote_posts,
+                // Posts, pages and other content (any status but trash) whose body
+                // or Elementor data named the file. Revisions are rewritten too and
+                // counted apart (0.38.0; before, they were in rewrote_posts).
+                'rewrote_posts'     => $rewrote_posts,
+                'rewrote_revisions' => $rewrote_revs,
                 // Posts that still mention an old file name after the rewrite (a
                 // reference in a form we couldn't safely rewrite). Empty is good.
 …
  * @param string $old_stem Filename stem (no extension) to pre-filter on.
  * @param array  $url_map  old URL => new URL pairs (full size + each size).
+ * @return int Number of posts updated.
+ * @param int    $revisions Set to the number of revisions updated (not in the return value).
+ * @return int Number of posts updated, revisions not counted.
  */
+function auditae_rewrite_media_references( $old_stem, array $url_map ) {
+function auditae_rewrite_media_references( $old_stem, array $url_map, &$revisions = null ) {
+        $revisions = 0;
         global $wpdb;
 …
                                 $el_done[ $pid ] = true;
+                        }
+                        $updated++;
+                        // Revisions are rewritten too (restoring one shouldn't bring a
+                        // broken image back) but reported apart: counting them as posts
+                        // said a rename touched 6 posts when no live post used the image.
+                        if ( 'revision' === get_post_type( $pid ) ) {
+                                $revisions++;
+                        } else {
+                                $updated++;
+                        }
+                }
+        }
 …
                         clean_post_cache( $pid );
                         if ( ! isset( $el_done[ $pid ] ) ) {
+                                $updated++; // An Elementor page was already counted with its tree.
+                                // An Elementor page was already counted with its tree.
+                                if ( 'revision' === get_post_type( $pid ) ) {
+                                        $revisions++;
+                                } else {
+                                        $updated++;
+                                }
+                        }
+                }

auditae-ai-search-toolkit/tags/0.38.0/includes/redirects.php

-              r3773612
+              r3777340
+        }
         return true;
+}
+/**
+ * What a redirect source still serves, when it isn't a 404. Rules only run
+ * on a 404 (auditae_redirects_maybe_redirect()), so a rule for a live page
+ * never fires. Null when nothing answers the path (the rule would work).
+ *
+ * Checks what WordPress itself answers the path with: a published post or
+ * page of a viewable type, the front page, a term / post type / author
+ * archive (auditae_broken_known_paths()), or a file on disk.
+ *
+ * @param string $source_n Normalized source (auditae_redirects_normalize_source()).
+ * @return array{kind:string,post_id:int,title:string,view_url:string}|null
+ */
+function auditae_redirects_source_live( $source_n ) {
+        $source_n = (string) $source_n;
+        $parts    = wp_parse_url( home_url( '/' ) );
+        $origin   = ( isset( $parts['scheme'] ) ? $parts['scheme'] : 'https' ) . '://' . ( isset( $parts['host'] ) ? $parts['host'] : '' ) . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' );
+        $abs      = $origin . $source_n;
+        $post_id  = url_to_postid( $abs );
+        if ( $post_id <= 0 ) {
+                $post_id = url_to_postid( $abs . '/' );
+        }
+        if ( $post_id > 0 ) {
+                $post = get_post( $post_id );
+                if ( $post && 'publish' === $post->post_status && 'attachment' !== $post->post_type && is_post_type_viewable( $post->post_type ) ) {
+                        return array(
+                                'kind'     => 'page' === $post->post_type ? 'page' : 'post',
+                                'post_id'  => (int) $post_id,
+                                'title'    => html_entity_decode( wp_strip_all_tags( get_the_title( $post ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ),
+                                'view_url' => (string) get_permalink( $post ),
+                        );
+                }
+        }
+        if ( ! function_exists( 'auditae_broken_known_paths' ) ) {
+                return null;
+        }
+        $path = auditae_broken_normalize_path( $abs );
+        if ( '' === $path ) {
+                return array(
+                        'kind'     => 'front_page',
+                        'post_id'  => (int) get_option( 'page_on_front' ),
+                        'title'    => '',
+                        'view_url' => home_url( '/' ),
+                );
+        }
+        $known = auditae_broken_known_paths();
+        if ( isset( $known[ $path ] ) ) {
+                return array(
+                        'kind'     => 'archive',
+                        'post_id'  => 0,
+                        'title'    => '',
+                        'view_url' => home_url( '/' . $path . '/' ),
+                );
+        }
+        $raw = ltrim( rawurldecode( (string) wp_parse_url( $abs, PHP_URL_PATH ) ), '/' );
+        if ( '' !== $raw && false === strpos( $raw, '..' ) && is_file( ABSPATH . $raw ) ) {
+                return array(
+                        'kind'     => 'file',
+                        'post_id'  => 0,
+                        'title'    => '',
+                        'view_url' => $abs,
+                );
+        }
+        return null;
+}

auditae-ai-search-toolkit/tags/0.38.0/includes/rest-routes.php

-              r3775803
+              r3777340
         register_rest_route(
                 $namespace,
+                '/posts/(?P<id>\d+)/restore',
+                array(
+                        // Undo of a body edit (content_restore_id) or an Elementor text
+                        // edit (elementor_restore_id), by id. 0.38.0.
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_elementor_restore',
+                        'permission_callback' => 'auditae_rest_authorize_post_update',
+                )
+        );
+        register_rest_route(
+                $namespace,
                 '/seo/yoast/settings',
                 array(
 …
+        }
         return true;
+}
+/**
+ * A post title as plain text for REST answers. get_the_title() is
+ * texturized and HTML-encoded for templates ("Tips &amp; Tricks"), which
+ * agents then quoted back literally.
+ *
+ * @param int|WP_Post $post Post.
+ * @return string
+ */
+function auditae_rest_plain_title( $post ) {
+        return html_entity_decode( wp_strip_all_tags( (string) get_the_title( $post ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+}
 …
                         // Behaviours the app may rely on (api_version 6+).
                         'features'       => auditae_rest_features(),
+                        // The IndexNow key file this plugin serves (always served, even
+                        // with auto-ping off), so the app can submit this site's URLs
+                        // under the site's own key. 0.38.0.
+                        'indexnow'       => array(
+                                'key_location' => auditae_indexnow_key_location(),
+                                'enabled'      => (bool) auditae_indexnow_enabled(),
+                                'paused'       => (string) auditae_indexnow_paused_reason(),
+                        ),
+                )
         );
 …
                 'untrash',                  // POST /posts/{id}/untrash, GET /posts?status=trash
                 'elementor_restore',        // POST /posts/{id}/elementor-restore
+                // 0.38.0 (api_version 7):
+                'content_restore',          // content_restore_id on body edits; POST /posts/{id}/restore takes cu_ and eu_ ids
+                'compact_previous_state',   // PATCH /posts/{id} and internal-link answer no old body (include_previous_content: true for it)
+                'link_target_check',        // internal-link refuses a target that isn't a public page (auditae_link_target_not_found / _unpublished)
+                'internal_link_undo',       // internal-link answers undo.replacements + a restore id
+                'redirect_source_check',    // redirects write refuses a live source (auditae_redirect_source_live) unless force
+                'menu_links',               // link graph counts navigation menu links (menu_links), orphans exclude them
+                'media_rename_revisions',   // rename reports rewrote_revisions apart from rewrote_posts
+                'list_any_viewable',        // GET /posts?post_type=any lists only viewable content types
+                'llms_txt_compact',         // llms.txt write/reset answer rendered_bytes, not rendered (include_rendered: true)
+                'probe_handled_by',         // /probe-schema handled_by; found_foreign only when it differs
+                'schema_if_output',         // /posts/{id}/schema write if_output: true refuses types another plugin prints
+                'robots_meta',              // /posts/{id}/seo yoast / rankmath blocks read + write noindex / nofollow
+                'rendered_seo',             // /posts/{id}/seo read: each engine block's rendered_title / rendered_description
+                'broken_links_fix',         // GET /broken-links, POST /posts/{id}/broken-link
+                'bulk_media_alt',           // POST /media/bulk-alt (+ /media/bulk-alt/undo)
+                'indexnow_key',             // /status indexnow { key_location, enabled, paused }
         );
+}
 …
                 $query_type = array();
                 foreach ( get_post_types( array( 'public' => true ), 'objects' ) as $obj ) {
                         if ( auditae_rest_post_type_allowed( $obj ) ) {
+                        if ( auditae_rest_post_type_allowed( $obj ) && auditae_rest_post_type_in_any( $obj ) ) {
                                 $query_type[] = $obj->name;
+                        }
 …
                         'post_type'     => $p->post_type,
                         'is_front_page' => auditae_rest_is_front_page( $p ),
                         'title'     => get_the_title( $p ),
+                        'title'     => auditae_rest_plain_title( $p ),
                         'status'    => $p->post_status,
                         'date'      => auditae_rest_post_date( $p ),
 …
 /**
+ * POST /posts/{id}/elementor-restore {restore_id, force?} — put back the
+ * Elementor tree an AuditAE `replacements` edit replaced. Only trees this
+ * plugin kept itself (auditae_elementor_undo_push()) can be restored, by
+ * id; refused when the page changed since, unless force.
+ * POST /posts/{id}/restore (and its 0.37.0 name /elementor-restore)
+ * {restore_id, force?} — put back what an AuditAE edit replaced, by the id
+ * the edit answered with: an Elementor tree (elementor_restore_id, 'eu_…')
+ * or a post body (content_restore_id, 'cu_…': a `content` or
+ * `replacements` edit, an inserted internal link, a broken-link fix). Only
+ * what this plugin kept itself can be restored; refused when the post
+ * changed since, unless force. The restore answers its own restore id, so
+ * it can be undone too.
  */
 function auditae_rest_elementor_restore( WP_REST_Request $request ) {
 …
                 return new WP_Error( 'auditae_not_found', 'post not found', array( 'status' => 404 ) );
+        }
-        if ( ! auditae_elementor_is_built( $post_id ) ) {
-                return new WP_Error( 'auditae_bad_request', 'This post is not built with Elementor. Undo other edits with previous_state (wp_update_post with the old values).', array( 'status' => 400 ) );
+        }
         $restore_id = $request->get_param( 'restore_id' );
+        if ( ! is_string( $restore_id ) || ! preg_match( '/^eu_[a-z0-9]{16}$/', $restore_id ) ) {
+                return new WP_Error( 'auditae_bad_request', 'restore_id is required: the elementor_restore_id an Elementor text edit answered with.', array( 'status' => 400 ) );
+        }
+        $res = auditae_elementor_undo_restore( $post_id, $restore_id, rest_sanitize_boolean( $request->get_param( 'force' ) ) );
+        if ( ! is_string( $restore_id ) || ! preg_match( '/^(eu|cu)_[a-z0-9]{16}$/', $restore_id ) ) {
+                return new WP_Error( 'auditae_bad_request', 'restore_id is required: the elementor_restore_id or content_restore_id an edit answered with.', array( 'status' => 400 ) );
+        }
+        if ( 'trash' === $post->post_status ) {
+                return new WP_Error( 'auditae_post_trashed', 'This post is in the trash. Restore it first (POST /posts/' . $post_id . '/untrash).', array( 'status' => 409 ) );
+        }
+        $res = auditae_undo_restore( $post_id, $restore_id, rest_sanitize_boolean( $request->get_param( 'force' ) ) );
         if ( is_wp_error( $res ) ) {
                 return $res;
+        }
+        auditae_log_action( 'elementor_restore', 'post_id=' . $post_id . ' restore_id=' . $restore_id, array( '_elementor_data' => $res['previous'] ) );
+        $elementor = 'elementor' === $res['kind'];
+        auditae_log_action(
+                $elementor ? 'elementor_restore' : 'content_restore',
+                'post_id=' . $post_id . ' restore_id=' . $restore_id . ( '' !== $res['restore_id'] ? ' new_restore_id=' . $res['restore_id'] : '' ),
+                $elementor ? array( '_elementor_data' => $res['previous'] ) : array()
+        );
         $answer = array(
+                'post_id'        => $post_id,
+                'status'         => get_post_status( $post_id ),
+                'restored'       => $restore_id,
+                'builder'        => 'elementor',
+                'edit_url'       => auditae_rest_edit_url( $post_id ),
+                'previous_state' => array( '_elementor_data' => $res['previous'] ),
+        );
+                'post_id'  => $post_id,
+                'status'   => get_post_status( $post_id ),
+                'restored' => $restore_id,
+                'builder'  => auditae_rest_builder( get_post( $post_id ) ),
+                'edit_url' => auditae_rest_edit_url( $post_id ),
+        );
+        if ( rest_sanitize_boolean( $request->get_param( 'include_previous_content' ) ) ) {
+                $answer['previous_state'] = $elementor ? array( '_elementor_data' => $res['previous'] ) : array( 'content' => $res['previous'] );
+        }
         if ( '' !== $res['restore_id'] ) {
                 $answer['elementor_restore_id'] = $res['restore_id'];
+                $answer[ $elementor ? 'elementor_restore_id' : 'content_restore_id' ] = $res['restore_id'];
+        }
         return rest_ensure_response( $answer );
 …
+}
+/**
+ * Whether GET /posts?post_type=any lists this type: content visitors can
+ * open, not page-builder template stores. Elementor's elementor_library
+ * ("Default Kit", headers, popups) is registered public but isn't viewable
+ * by visitors, and its URLs 404 for them. Those types stay readable by
+ * name (post_type=elementor_library).
+ *
+ * @param WP_Post_Type $pt_obj Post type.
+ * @return bool
+ */
+function auditae_rest_post_type_in_any( $pt_obj ) {
+        if ( ! $pt_obj || ! $pt_obj->public ) {
+                return false;
+        }
+        $templates = array(
+                'elementor_library',
+                'e-floating-buttons',
+                'elementor_snippet',
+                'elementor_font',
+                'elementor_icons',
+                'jet-theme-core',
+                'jet-engine',
+                'ae_global_templates',
+                'oceanwp_library',
+                'astra-advanced-hook',
+                'fl-builder-template',
+                'et_pb_layout',
+                'brizy_template',
+                'ct_template',
+                'kadence_element',
+                'gp_elements',
+        );
+        /**
+         * Filter the post types left out of GET /posts?post_type=any.
+         *
+         * @param string[] $templates Post type names.
+         */
+        $templates = (array) apply_filters( 'auditae_rest_any_excluded_types', $templates );
+        if ( in_array( $pt_obj->name, $templates, true ) ) {
+                return false;
+        }
+        // A type visitors can't open (not publicly queryable) has no public URL.
+        return 'page' === $pt_obj->name || is_post_type_viewable( $pt_obj );
+}
 // Idempotency transient value while the create it guards is still running.
 define( 'AUDITAE_IDEM_PENDING', 'pending' );
 …
                 $remember( 'title', $post->post_title );
+        }
+        // The old body is no longer echoed back (it made every edit's answer as
+        // big as the page): it is kept on the post and restored by id
+        // (content_restore_id / elementor_restore_id → POST /posts/{id}/restore).
+        // include_previous_content: true brings the 0.37.0 shape back.
+        $full_previous = rest_sanitize_boolean( $request->get_param( 'include_previous_content' ) );
+        $content_before = (string) $post->post_content;
+        // Fields sent whose value is already stored (title, content, excerpt,
+        // slug, status), so the app can tell a resend from a change.
+        $unchanged = array();
+        foreach ( array( 'title' => $post->post_title, 'content' => $post->post_content, 'excerpt' => $post->post_excerpt, 'slug' => $post->post_name, 'status' => $post->post_status ) as $field => $stored ) {
+                $sent = $request->get_param( $field );
+                if ( is_string( $sent ) && $sent === (string) $stored ) {
+                        $unchanged[] = $field;
+                }
+        }
         if ( is_string( $content ) ) {
                 $update['post_content'] = $content;
+                $remember( 'content', $post->post_content );
+                if ( $full_previous ) {
+                        $remember( 'content', $post->post_content );
+                }
+        }
         $replaced        = null;
 …
         if ( is_array( $replacements ) ) {
                 $elementor_before = $is_elementor ? (string) get_post_meta( $post_id, '_elementor_data', true ) : '';
+                if ( $is_elementor ) {
+                        $previous['_elementor_data'] = $elementor_before;
+                } else {
+                        $remember( 'content', $post->post_content );
+                if ( $full_previous ) {
+                        if ( $is_elementor ) {
+                                $previous['_elementor_data'] = $elementor_before;
+                        } else {
+                                $remember( 'content', $post->post_content );
+                        }
+                }
                 // Elementor pages are saved inside; plain posts hand back the new
 …
+        }
+        auditae_log_action( 'update_post', 'post_id=' . $post_id . ( '' !== $elementor_undo ? ' elementor_restore_id=' . $elementor_undo : '' ), $previous );
+        // A changed plain-post body is kept for undo by id.
+        $content_undo = '';
+        $undo_pairs   = null;
+        if ( ! $is_elementor && ( is_string( $content ) || ( is_array( $replacements ) && null !== $replaced && ! $replaced['elementor'] ) ) ) {
+                $content_undo = auditae_content_undo_push( $post_id, $content_before );
+                if ( is_array( $replacements ) && '' !== $content_undo ) {
+                        $undo_pairs = auditae_replacements_undo_pairs( $content_before, (string) get_post_field( 'post_content', $post_id, 'raw' ), $replaced, array_values( $replacements ) );
+                }
+        }
+        $log_detail = 'post_id=' . $post_id . ( '' !== $elementor_undo ? ' elementor_restore_id=' . $elementor_undo : '' ) . ( '' !== $content_undo ? ' content_restore_id=' . $content_undo : '' );
+        auditae_log_action( 'update_post', $log_detail, $previous );
         $answer = array(
                 'post_id'              => $post_id,
                 'status'               => get_post_status( $post_id ),
+                'previous_state'       => $previous,
+                // Old values of the small fields changed ({} when only the body
+                // changed: its undo is content_restore_id / elementor_restore_id).
+                'previous_state'       => empty( $previous ) ? new stdClass() : $previous,
                 'edit_url'             => auditae_rest_edit_url( $post_id ),
                 'builder'              => auditae_rest_builder( get_post( $post_id ) ),
 …
         if ( '' !== $elementor_undo ) {
                 $answer['elementor_restore_id'] = $elementor_undo;
+        }
+        if ( '' !== $content_undo ) {
+                // Undo of the body change: POST /posts/{id}/restore {restore_id}.
+                $answer['content_restore_id'] = $content_undo;
+        }
+        if ( null !== $undo_pairs ) {
+                // Or send these as `replacements` (verified to give back the old body).
+                $answer['undo_replacements'] = $undo_pairs;
+        }
+        if ( $unchanged ) {
+                $answer['unchanged_fields'] = $unchanged;
+        }
         return rest_ensure_response( $answer );
 …
+        }
+        // Only the engines that run: an inactive one's block was always empty
+        // (or stale leftovers) and read as if it applied.
+        $engines  = array_keys( array_filter( array( 'yoast' => $yoast_active, 'rankmath' => $rm_active ) ) );
         $map      = auditae_post_seo_meta_map();
         $snapshot = array();
         foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
+        foreach ( $engines as $engine ) {
                 $snapshot[ $engine ] = array();
                 foreach ( $map[ $engine ] as $logical => $meta_key ) {
                         $snapshot[ $engine ][ $logical ] = get_post_meta( $post_id, $meta_key, true );
+                }
+                // noindex / nofollow as this engine renders them for the post
+                // (its own per-post setting, else the site / post type default).
+                $robots                          = auditae_seo_robots_get( $post_id, $engine );
+                $snapshot[ $engine ]['noindex']  = $robots['noindex'];
+                $snapshot[ $engine ]['nofollow'] = $robots['nofollow'];
+        }
         if ( 'read' === $action ) {
+                foreach ( $engines as $engine ) {
+                        // The title and description that actually print, templates
+                        // resolved (an empty field shows the template's output); null
+                        // when the engine's API can't say outside a page view.
+                        $snapshot[ $engine ] += auditae_seo_rendered( $post_id, $engine );
+                        $snapshot[ $engine ]['robots_source'] = auditae_seo_robots_get( $post_id, $engine )['source'];
+                }
                 return rest_ensure_response(
                         array(
                                 'action'           => 'read',
                                 'post_id'          => $post_id,
                                 'provider'         => auditae_seo_meta_provider(),
                                 'yoast_active'     => $yoast_active,
                                 'rankmath_active'  => $rm_active,
                                 'seo'              => $snapshot,
+                                'action'          => 'read',
+                                'post_id'         => $post_id,
+                                'provider'        => auditae_seo_meta_provider(),
+                                'yoast_active'    => $yoast_active,
+                                'rankmath_active' => $rm_active,
+                                'seo'             => $snapshot,
+                        )
                 );
 …
         // SEO fields are single strings; an array or object would be stored
         // as-is and break the SEO plugin's output. Checked before any write so
+        // a bad field doesn't leave the other engine half-updated.
+        // a bad field doesn't leave the other engine half-updated. noindex /
+        // nofollow are booleans (null: back to the default).
+        $robots_by_engine = array();
         foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
                 $requested = $request->get_param( $engine );
 …
+                        }
+                }
+                $robot_keys = array_intersect_key( $requested, array( 'noindex' => 1, 'nofollow' => 1 ) );
+                if ( $robot_keys ) {
+                        $parsed = auditae_seo_robots_parse( $robot_keys );
+                        if ( is_wp_error( $parsed ) ) {
+                                return $parsed;
+                        }
+                        $robots_by_engine[ $engine ] = $parsed;
+                }
+        }
+        // A top-level robots {noindex, nofollow} applies to every active engine.
+        if ( null !== $request->get_param( 'robots' ) ) {
+                $parsed = auditae_seo_robots_parse( $request->get_param( 'robots' ) );
+                if ( is_wp_error( $parsed ) ) {
+                        return $parsed;
+                }
+                foreach ( $engines as $engine ) {
+                        $robots_by_engine[ $engine ] = isset( $robots_by_engine[ $engine ] ) ? $robots_by_engine[ $engine ] + $parsed : $parsed;
+                }
+        }
         $applied  = array();
+        $previous = $snapshot;
+        foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
+                $engine_active = ( 'yoast' === $engine ) ? $yoast_active : $rm_active;
+                if ( ! $engine_active ) {
+                        continue;
+                }
+        $previous = array();
+        foreach ( $engines as $engine ) {
                 $requested = $request->get_param( $engine );
+                if ( ! is_array( $requested ) ) {
+                        continue;
+                }
+                $applied[ $engine ] = array();
+                foreach ( $map[ $engine ] as $logical => $meta_key ) {
+                        if ( ! array_key_exists( $logical, $requested ) ) {
+                                continue;
+                $done      = array();
+                if ( is_array( $requested ) ) {
+                        foreach ( $map[ $engine ] as $logical => $meta_key ) {
+                                if ( ! array_key_exists( $logical, $requested ) ) {
+                                        continue;
+                                }
+                                $value = wp_strip_all_tags( (string) $requested[ $logical ] );
+                                update_post_meta( $post_id, $meta_key, wp_slash( $value ) );
+                                $done[ $logical ] = $value;
+                        }
+                        $value = wp_strip_all_tags( (string) $requested[ $logical ] );
+                        update_post_meta( $post_id, $meta_key, wp_slash( $value ) );
+                        $applied[ $engine ][ $logical ] = $value;
+                }
+                if ( empty( $applied[ $engine ] ) ) {
+                        unset( $applied[ $engine ] );
+                }
+                if ( isset( $robots_by_engine[ $engine ] ) ) {
+                        auditae_seo_robots_set( $post_id, $engine, $robots_by_engine[ $engine ] );
+                        $after = auditae_seo_robots_get( $post_id, $engine );
+                        foreach ( array_keys( $robots_by_engine[ $engine ] ) as $k ) {
+                                $done[ $k ] = $after[ $k ];
+                        }
+                }
+                if ( $done ) {
+                        $applied[ $engine ] = $done;
+                        // Old values of the fields written only (the full snapshot of
+                        // both engines was echoed before).
+                        $previous[ $engine ] = array_intersect_key( $snapshot[ $engine ], $done );
+                }
+        }
 …
                 return new WP_Error(
                         'auditae_bad_request',
                         'No applicable SEO fields supplied. Send {yoast: {...}} and/or {rankmath: {...}}.',
+                        'No applicable SEO fields supplied. Send {' . implode( ': {...}} and/or {', $engines ) . ': {...}} (the active SEO plugin) with title, description, canonical, focus_keyword, noindex and/or nofollow.',
                         array( 'status' => 400 )
                 );
 …
                                 'yoast_active'    => false,
                                 'rankmath_active' => false,
+                                'seo'             => array( 'auditae' => $current ),
+                                // noindex / nofollow are among the stored fields; rendered_*
+                                // are the title and description that print (0.38.0).
+                                'seo'             => array( 'auditae' => $current + auditae_seo_rendered( $post_id, 'auditae' ) ),
                                 'output'          => $output,
+                        )
 …
+        }
         $fields = is_array( $requested ) ? array_intersect_key( $requested, auditae_seo_meta_empty() ) : array();
+        // robots: {noindex, nofollow} works on every provider; here it is the
+        // same two stored fields (null = off, the default).
+        if ( null !== $request->get_param( 'robots' ) ) {
+                $robots_in = auditae_seo_robots_parse( $request->get_param( 'robots' ) );
+                if ( is_wp_error( $robots_in ) ) {
+                        return $robots_in;
+                }
+                foreach ( $robots_in as $k => $v ) {
+                        $fields[ $k ] = (bool) $v;
+                }
+        }
         if ( empty( $fields ) ) {
                 return new WP_Error(
 …
                 );
+        }
+        // if_output: true — refuse before saving when another source already
+        // prints FAQPage for this post (AuditAE's pairs would never be output).
+        $faq_owner = auditae_faq_foreign_source( $post_id );
+        if ( '' !== $faq_owner && rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                return new WP_Error(
+                        'auditae_schema_not_output',
+                        sprintf( 'Nothing was saved: %s already prints FAQPage on this post, so AuditAE would store these pairs but never print them. Edit the FAQ there instead.', $faq_owner ),
+                        array(
+                                'status'     => 409,
+                                'handled_by' => array( array( 'type' => 'FAQPage', 'handled_by' => $faq_owner ) ),
+                        )
+                );
+        }
         $res = auditae_faq_save( $post_id, $qas );
         if ( 0 === $res['applied'] ) {
 …
                 );
+        }
+        // if_output: true — refuse before saving when a node's type would be
+        // stored but not printed because another plugin prints that type here
+        // (an SEO plugin's Article, WooCommerce's Product): a paid write that
+        // changes nothing on the page. The answer names who handles each.
+        if ( rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                $list    = isset( $schemas['@type'] ) ? array( $schemas ) : $schemas;
+                $handled = array();
+                foreach ( (array) $list as $node ) {
+                        $type = auditae_schema_primary_type( $node );
+                        if ( '' !== $type && ! auditae_should_emit_schema_type( $type, $post_id ) ) {
+                                $owner     = auditae_schema_type_owner( $type, $post_id );
+                                $handled[] = array(
+                                        'type'       => $type,
+                                        'handled_by' => '' !== $owner ? $owner : 'another plugin',
+                                );
+                        }
+                }
+                if ( $handled ) {
+                        return new WP_Error(
+                                'auditae_schema_not_output',
+                                sprintf(
+                                        'Nothing was saved: %s, so AuditAE would store this but never print it. Edit the schema in that plugin instead, or send only the other types.',
+                                        implode(
+                                                '; ',
+                                                array_map(
+                                                        static function ( $h ) {
+                                                                return $h['handled_by'] . ' prints ' . $h['type'] . ' on this post';
+                                                        },
+                                                        $handled
+                                                )
+                                        )
+                                ),
+                                array(
+                                        'status'     => 409,
+                                        'handled_by' => $handled,
+                                )
+                        );
+                }
+        }
         $res = auditae_post_schema_save( $post_id, $schemas );
         if ( ! empty( $res['error'] ) ) {
 …
                 );
+        }
+        // if_output: true — a write of Organization nodes only is refused before
+        // saving when AuditAE would hold them back (an SEO plugin prints the
+        // site's publisher, or the theme / another plugin already does).
+        if ( rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                $list  = isset( $schemas['@type'] ) ? array( $schemas ) : $schemas;
+                $types = array_unique( array_filter( array_map( 'auditae_schema_primary_type', (array) $list ) ) );
+                if ( array( 'Organization' ) === array_values( $types ) ) {
+                        $signal = auditae_org_seo_signal();
+                        if ( ! in_array( $signal, array( 'none', 'seo_silent' ), true ) ) {
+                                $owner = 'other_verified' === $signal ? 'the theme or another plugin' : auditae_seo_plugin_label();
+                                return new WP_Error(
+                                        'auditae_schema_not_output',
+                                        sprintf( 'Nothing was saved: %s already prints the site\'s Organization, so AuditAE would store this one but hold it back. Edit it there, or reuse its @id (wp_probe_schema).', $owner ),
+                                        array(
+                                                'status'     => 409,
+                                                'handled_by' => array( array( 'type' => 'Organization', 'handled_by' => $owner ) ),
+                                        )
+                                );
+                        }
+                }
+        }
         $res = auditae_org_schema_save( $schemas );
         if ( ! empty( $res['error'] ) ) {
 …
         // { @type: [@id, …] } maps: an empty PHP array would encode as [] and
         // read as a list, not an object.
+        foreach ( array( 'found', 'found_foreign' ) as $key ) {
+        if ( is_array( $probe ) ) {
+                // found_foreign repeated found on every site where AuditAE prints
+                // nothing on the homepage. Sent only when it differs; when it's
+                // left out it equals found (foreign_same_as_found: true).
+                $found   = isset( $probe['found'] ) && is_array( $probe['found'] ) ? $probe['found'] : array();
+                $foreign = isset( $probe['found_foreign'] ) && is_array( $probe['found_foreign'] ) ? $probe['found_foreign'] : null;
+                if ( null !== $foreign && wp_json_encode( $foreign ) === wp_json_encode( $found ) ) {
+                        unset( $probe['found_foreign'] );
+                        $probe['foreign_same_as_found'] = true;
+                } elseif ( null !== $foreign ) {
+                        $probe['foreign_same_as_found'] = false;
+                }
+                // Which schema types another plugin prints instead of AuditAE (so
+                // an AuditAE node of that type is stored but not output), by type:
+                // { "Article": "Yoast SEO", … }; {} when AuditAE prints them all.
+                // Per-post owners (WooCommerce Product, an SEO plugin's HowTo
+                // block) are answered by /posts/{id}/schema's not_output.
+                $probe['handled_by'] = auditae_rest_schema_handled_by();
+        }
+        // { @type: [@id, …] } maps: an empty PHP array would encode as [] and
+        // read as a list, not an object.
+        foreach ( array( 'found', 'found_foreign', 'handled_by' ) as $key ) {
                 if ( is_array( $probe ) && array_key_exists( $key, $probe ) && is_array( $probe[ $key ] ) && empty( $probe[ $key ] ) ) {
                         $probe[ $key ] = new stdClass();
 …
+        }
         return rest_ensure_response( $probe );
+}
+/**
+ * Site-wide: schema type => the plugin that prints it instead of AuditAE.
+ *
+ * @return array<string,string>
+ */
+function auditae_rest_schema_handled_by() {
+        $out = array();
+        foreach ( array_unique( array_merge( auditae_schema_seo_owned_types(), auditae_schema_supported_types() ) ) as $type ) {
+                if ( ! is_string( $type ) || auditae_should_emit_schema_type( $type, 0 ) ) {
+                        continue;
+                }
+                $owner        = auditae_schema_type_owner( $type, 0 );
+                $out[ $type ] = '' !== $owner ? $owner : 'another plugin (auditae_should_emit_schema_type filter)';
+        }
+        return $out;
+}
 …
                 );
                 return rest_ensure_response(
+                        array(
+                                'action'         => 'reset',
+                                'previous_state' => array( 'config' => $res['previous'] ),
+                                'config'         => $res['applied'],
+                                'rendered'       => auditae_llms_txt_render(),
+                        auditae_rest_llms_txt_write_answer(
+                                $request,
+                                array(
+                                        'action'         => 'reset',
+                                        'previous_state' => array( 'config' => $res['previous'] ),
+                                        'config'         => $res['applied'],
+                                )
+                        )
                 );
 …
         );
         return rest_ensure_response(
+                array(
+                        'action'         => 'write',
+                        'mode'           => 'replace' === $mode ? 'replace' : 'merge',
+                        'previous_state' => array( 'config' => $res['previous'] ),
+                        'config'         => $res['applied'],
+                        'rendered'       => auditae_llms_txt_render(),
+                )
+        );
+                auditae_rest_llms_txt_write_answer(
+                        $request,
+                        array(
+                                'action'         => 'write',
+                                'mode'           => 'replace' === $mode ? 'replace' : 'merge',
+                                'previous_state' => array( 'config' => $res['previous'] ),
+                                'config'         => $res['applied'],
+                        )
+                )
+        );
+}
+/**
+ * A write/reset answer without the whole rendered file (it is served at
+ * `url`, and GET /llms-txt returns it): its size and line count instead,
+ * so the answer stays small. include_rendered: true adds it back.
+ *
+ * @param WP_REST_Request $request Request.
+ * @param array           $answer  Answer so far.
+ * @return array
+ */
+function auditae_rest_llms_txt_write_answer( WP_REST_Request $request, array $answer ) {
+        $rendered          = (string) auditae_llms_txt_render();
+        $answer['url']     = home_url( '/llms.txt' );
+        $answer['rendered_bytes'] = strlen( $rendered );
+        $answer['rendered_lines'] = '' === $rendered ? 0 : substr_count( $rendered, "\n" ) + 1;
+        if ( rest_sanitize_boolean( $request->get_param( 'include_rendered' ) ) ) {
+                $answer['rendered'] = $rendered;
+        }
+        return $answer;
+}
 …
                                 break;
+                        }
+                }
+                // A rule only runs when WordPress would answer 404, so one for a page
+                // that is live never fires: the write succeeded (and was billed)
+                // while the page kept answering 200. Refuse before saving, unless
+                // force (then it's saved, inactive until the page is gone).
+                $force = rest_sanitize_boolean( $request->get_param( 'force' ) );
+                $live  = auditae_redirects_source_live( $source_norm );
+                if ( null !== $live && ! $force ) {
+                        $what = 'front_page' === $live['kind'] ? 'the front page'
+                                : ( 'archive' === $live['kind'] ? 'a live archive (category, tag, author or post type)'
+                                : ( 'file' === $live['kind'] ? 'a file on disk'
+                                : sprintf( 'a published %1$s ("%2$s", id %3$d)', $live['kind'], $live['title'], $live['post_id'] ) ) );
+                        return new WP_Error(
+                                'auditae_redirect_source_live',
+                                sprintf(
+                                        'Nothing was saved: %1$s is %2$s. AuditAE redirects only fire when WordPress would answer 404 for the path, so this one would never run and the page would keep loading. To move a post or page, change its slug (wp_update_post slug: WordPress then sends the old address to the new one itself), or trash it first (wp_trash_post) and then add the redirect. force: true saves the rule anyway, inactive until the page is gone.',
+                                        $source_norm,
+                                        $what
+                                ),
+                                array(
+                                        'status'      => 409,
+                                        'source_kind' => $live['kind'],
+                                        'post_id'     => $live['post_id'],
+                                        'view_url'    => $live['view_url'],
+                                )
+                        );
+                }
 …
                 );
+                return rest_ensure_response(
+                        array(
+                                'action'         => 'write',
+                                'rule'           => $applied,
+                                'previous_state' => $previous, // null if this was a new rule
+                        )
+                );
+                $answer = array(
+                        'action'         => 'write',
+                        'rule'           => $applied,
+                        'previous_state' => $previous, // null if this was a new rule
+                        // False when the source still serves a live page (saved with
+                        // force): the rule runs only once that page answers 404.
+                        'active'         => null === $live,
+                );
+                if ( null !== $live ) {
+                        $answer['warning'] = 'Saved inactive: ' . $source_norm . ' still serves a live ' . str_replace( '_', ' ', $live['kind'] ) . ', and redirects only fire on a 404. It starts working once that page is trashed or its slug changes.';
+                }
+                return rest_ensure_response( $answer );
+        }

auditae-ai-search-toolkit/tags/0.38.0/includes/seo-meta.php

-              r3775803
+              r3777340
         return 1 === preg_match( $pattern, (string) $html );
+}
+// ────────────────────────────────────────────────────────────────────
+// Per-post robots (noindex / nofollow) and the title / description that
+// actually render, for every provider (0.38.0)
+// ────────────────────────────────────────────────────────────────────
+/**
+ * Rank Math's titles options (robots defaults, title templates).
+ *
+ * @return array
+ */
+function auditae_seo_rankmath_titles() {
+        $opt = get_option( 'rank-math-options-titles', array() );
+        return is_array( $opt ) ? $opt : array();
+}
+/**
+ * A post's robots as the provider stores them: {noindex, nofollow, source}.
+ * source is 'post' when the post sets them itself, 'default' when it
+ * follows the site / post type default (whose effective value is given).
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath | auditae.
+ * @return array{noindex:bool,nofollow:bool,source:string}
+ */
+function auditae_seo_robots_get( $post_id, $provider ) {
+        $post_id = (int) $post_id;
+        $type    = (string) get_post_type( $post_id );
+        if ( 'yoast' === $provider ) {
+                $ni  = (string) get_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex', true );
+                $nf  = (string) get_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow', true );
+                $def = false;
+                if ( class_exists( 'WPSEO_Options' ) && method_exists( 'WPSEO_Options', 'get' ) ) {
+                        $def = (bool) WPSEO_Options::get( 'noindex-' . $type, false );
+                }
+                return array(
+                        'noindex'  => '1' === $ni || ( '2' !== $ni && $def ),
+                        'nofollow' => '1' === $nf,
+                        'source'   => ( in_array( $ni, array( '1', '2' ), true ) || '1' === $nf ) ? 'post' : 'default',
+                );
+        }
+        if ( 'rankmath' === $provider ) {
+                $own = get_post_meta( $post_id, 'rank_math_robots', true );
+                $own = is_array( $own ) ? array_values( array_filter( array_map( 'strval', $own ) ) ) : array();
+                if ( ! empty( $own ) ) {
+                        $robots = $own;
+                        $source = 'post';
+                } else {
+                        $titles = auditae_seo_rankmath_titles();
+                        $custom = isset( $titles[ 'pt_' . $type . '_custom_robots' ] ) && 'on' === $titles[ 'pt_' . $type . '_custom_robots' ] && isset( $titles[ 'pt_' . $type . '_robots' ] );
+                        $robots = $custom ? (array) $titles[ 'pt_' . $type . '_robots' ] : ( isset( $titles['robots_global'] ) ? (array) $titles['robots_global'] : array() );
+                        $source = 'default';
+                }
+                return array(
+                        'noindex'  => in_array( 'noindex', $robots, true ),
+                        'nofollow' => in_array( 'nofollow', $robots, true ),
+                        'source'   => $source,
+                );
+        }
+        $f = auditae_seo_meta_get( $post_id );
+        return array(
+                'noindex'  => (bool) $f['noindex'],
+                'nofollow' => (bool) $f['nofollow'],
+                'source'   => ( $f['noindex'] || $f['nofollow'] ) ? 'post' : 'default',
+        );
+}
+/**
+ * Validate a robots write: {noindex?, nofollow?} booleans (null = back to
+ * the default).
+ *
+ * @param mixed $in Request value.
+ * @return array|WP_Error Keys present only for what was sent.
+ */
+function auditae_seo_robots_parse( $in ) {
+        if ( ! is_array( $in ) ) {
+                return new WP_Error( 'auditae_bad_request', '`robots` must be an object {noindex?: boolean, nofollow?: boolean}.', array( 'status' => 400 ) );
+        }
+        $out = array();
+        foreach ( array( 'noindex', 'nofollow' ) as $k ) {
+                if ( ! array_key_exists( $k, $in ) ) {
+                        continue;
+                }
+                $v = $in[ $k ];
+                if ( null !== $v && ! is_bool( $v ) && ! is_int( $v ) && ! is_string( $v ) ) {
+                        return new WP_Error( 'auditae_bad_request', sprintf( 'robots.%s must be true, false or null.', $k ), array( 'status' => 400 ) );
+                }
+                $out[ $k ] = null === $v ? null : rest_sanitize_boolean( $v );
+        }
+        if ( empty( $out ) ) {
+                return new WP_Error( 'auditae_bad_request', '`robots` needs noindex and/or nofollow.', array( 'status' => 400 ) );
+        }
+        return $out;
+}
+/**
+ * Write robots into Yoast's or Rank Math's own per-post fields (the ones
+ * their Advanced tab edits). false writes an explicit "index" / removes
+ * "nofollow"; null puts the post back on the site default.
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath.
+ * @param array  $robots   auditae_seo_robots_parse() result.
+ */
+function auditae_seo_robots_set( $post_id, $provider, array $robots ) {
+        $post_id = (int) $post_id;
+        if ( 'yoast' === $provider ) {
+                if ( array_key_exists( 'noindex', $robots ) ) {
+                        if ( null === $robots['noindex'] ) {
+                                delete_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex' );
+                        } else {
+                                update_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex', $robots['noindex'] ? '1' : '2' );
+                        }
+                }
+                if ( array_key_exists( 'nofollow', $robots ) ) {
+                        if ( $robots['nofollow'] ) {
+                                update_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow', '1' );
+                        } else {
+                                delete_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow' );
+                        }
+                }
+                return;
+        }
+        if ( 'rankmath' === $provider ) {
+                $cur = auditae_seo_robots_get( $post_id, 'rankmath' );
+                $own = get_post_meta( $post_id, 'rank_math_robots', true );
+                $own = is_array( $own ) ? array_values( array_filter( array_map( 'strval', $own ) ) ) : array();
+                // Rank Math reads the per-post list whole once it's set, so start
+                // from what the post renders now and change only what was sent.
+                $noindex  = array_key_exists( 'noindex', $robots ) ? $robots['noindex'] : $cur['noindex'];
+                $nofollow = array_key_exists( 'nofollow', $robots ) ? $robots['nofollow'] : $cur['nofollow'];
+                if ( null === $noindex && null === $nofollow ) {
+                        delete_post_meta( $post_id, 'rank_math_robots' );
+                        return;
+                }
+                // Other directives the post set (noarchive, nosnippet…) are kept.
+                $list   = array_values( array_diff( $own, array( 'index', 'noindex', 'nofollow' ) ) );
+                $list[] = $noindex ? 'noindex' : 'index';
+                if ( $nofollow ) {
+                        $list[] = 'nofollow';
+                }
+                update_post_meta( $post_id, 'rank_math_robots', array_values( array_unique( $list ) ) );
+        }
+}
+/**
+ * The title tag and meta description the provider renders for a post,
+ * templates resolved (a post with empty fields shows its template's
+ * output). '' for a description nothing prints. Null when it can't be
+ * worked out outside a page view (the provider's API is unavailable).
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath | auditae.
+ * @return array{rendered_title:?string,rendered_description:?string}
+ */
+function auditae_seo_rendered( $post_id, $provider ) {
+        $post_id = (int) $post_id;
+        $post    = get_post( $post_id );
+        $out     = array(
+                'rendered_title'       => null,
+                'rendered_description' => null,
+        );
+        if ( ! $post ) {
+                return $out;
+        }
+        $clean = static function ( $s ) {
+                return trim( html_entity_decode( wp_strip_all_tags( (string) $s ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
+        };
+        try {
+                if ( 'yoast' === $provider ) {
+                        if ( function_exists( 'YoastSEO' ) ) {
+                                $meta = YoastSEO()->meta->for_post( $post_id );
+                                if ( $meta ) {
+                                        $out['rendered_title']       = $clean( $meta->title );
+                                        $out['rendered_description'] = $clean( $meta->description );
+                                }
+                        }
+                        return $out;
+                }
+                if ( 'rankmath' === $provider ) {
+                        if ( class_exists( '\RankMath\Helper' ) && method_exists( '\RankMath\Helper', 'replace_vars' ) ) {
+                                // Rank Math registers its %vars% on the front end's `wp`
+                                // action, which a REST request never reaches; its setup()
+                                // runs once and is public.
+                                $rm = function_exists( 'rank_math' ) ? rank_math() : null;
+                                if ( ! is_object( $rm ) || ! isset( $rm->variables ) || ! is_object( $rm->variables ) ) {
+                                        // Rank Math before its account step (connect or skip)
+                                        // loads none of its front end and prints no title or
+                                        // description: WordPress's own title is what shows.
+                                        return array(
+                                                'rendered_title'       => auditae_seo_wp_document_title( $post ),
+                                                'rendered_description' => '',
+                                        );
+                                }
+                                if ( method_exists( $rm->variables, 'setup' ) ) {
+                                        $rm->variables->setup();
+                                }
+                                $titles = auditae_seo_rankmath_titles();
+                                $type   = $post->post_type;
+                                $title  = (string) get_post_meta( $post_id, 'rank_math_title', true );
+                                if ( '' === $title ) {
+                                        $title = isset( $titles[ 'pt_' . $type . '_title' ] ) ? (string) $titles[ 'pt_' . $type . '_title' ] : '%title% %sep% %sitename%';
+                                }
+                                $desc = (string) get_post_meta( $post_id, 'rank_math_description', true );
+                                if ( '' === $desc ) {
+                                        $desc = isset( $titles[ 'pt_' . $type . '_description' ] ) ? (string) $titles[ 'pt_' . $type . '_description' ] : '%excerpt%';
+                                }
+                                $out['rendered_title']       = $clean( \RankMath\Helper::replace_vars( $title, $post ) );
+                                $out['rendered_description'] = $clean( \RankMath\Helper::replace_vars( $desc, $post ) );
+                        }
+                        return $out;
+                }
+        } catch ( \Throwable $e ) {
+                return $out;
+        }
+        if ( 'auditae' !== $provider ) {
+                return $out;
+        }
+        // No SEO plugin: AuditAE's stored title, else WordPress's own document
+        // title (title-tag themes); the description only when one is stored
+        // (nothing else prints one).
+        $f = auditae_seo_meta_get( $post_id );
+        $out['rendered_title']       = '' !== $f['title'] ? $f['title'] : auditae_seo_wp_document_title( $post );
+        $out['rendered_description'] = $f['description'];
+        return $out;
+}
+/**
+ * The <title> WordPress itself prints for a post (themes with title-tag
+ * support and block themes), or null when the theme prints its own.
+ *
+ * @param WP_Post $post Post.
+ * @return string|null
+ */
+function auditae_seo_wp_document_title( $post ) {
+        if ( ! current_theme_supports( 'title-tag' ) && ! ( function_exists( 'wp_is_block_theme' ) && wp_is_block_theme() ) ) {
+                return null;
+        }
+        $sep   = apply_filters( 'document_title_separator', '-' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- core's filter.
+        $front = 'page' === get_option( 'show_on_front' ) && (int) get_option( 'page_on_front' ) === (int) $post->ID;
+        $parts = $front
+                ? array( get_bloginfo( 'name', 'display' ), get_bloginfo( 'description', 'display' ) )
+                : array( get_the_title( $post ), get_bloginfo( 'name', 'display' ) );
+        return trim( html_entity_decode( wp_strip_all_tags( implode( ' ' . $sep . ' ', array_filter( $parts ) ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
+}

auditae-ai-search-toolkit/tags/0.38.0/languages/auditae-ai-search-toolkit.pot

-              r3775803
+              r3777340
 msgid ""
 msgstr ""
 "Project-Id-Version: AuditAE – MCP Server & AI SEO 0.37.0\n"
+"Project-Id-Version: AuditAE – MCP Server & AI SEO 0.38.0\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/auditae-ai-search-toolkit\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 …
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "POT-Creation-Date: 2026-10-30T14:57:49+00:00\n"
+"POT-Creation-Date: 2026-10-31T19:49:26+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.12.0\n"
 …
 msgstr[1] ""
 #: includes/link-index.php:850
+#: includes/link-index.php:988
 msgid "Post not found."
 msgstr ""
 #: includes/link-index.php:856
+#: includes/link-index.php:994
 msgid "Anchor text and target URL are both required."
 msgstr ""
 #: includes/link-index.php:862
+#: includes/link-index.php:1000
 msgid "Internal links only — the target must be on this site."
 msgstr ""
 #: includes/link-index.php:867
+#: includes/link-index.php:1005
 msgid "That phrase is no longer available as plain text in the post — it may have been edited or already linked."
 msgstr ""
 …
 msgstr ""
 #: includes/media.php:1040
 #: includes/media.php:1095
+#: includes/media.php:1242
+#: includes/media.php:1297
 msgid "Rename file"
 msgstr ""
 #: includes/media.php:1056
+#: includes/media.php:1258
 msgid "You don't have permission to rename this file."
 msgstr ""
 #: includes/media.php:1093
+#: includes/media.php:1295
 msgid "New file name (without extension). Renames every size and updates references in your posts:"
 msgstr ""
 #: includes/media.php:1094
+#: includes/media.php:1296
 msgid "Renaming…"
 msgstr ""
 #: includes/media.php:1096
+#: includes/media.php:1298
 msgid "Rename failed."
 msgstr ""

auditae-ai-search-toolkit/tags/0.38.0/readme.txt

-              r3775803
+              r3777340
 Tested up to: 7.1
 Requires PHP: 7.4
 Stable tag: 0.37.0
+Stable tag: 0.38.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 characters, so older entries are kept in the plugin's development history
 rather than here, where they would push the current release out of view.
+= 0.38.0 =
+* Internal links: a link to a page that doesn't exist, or to a draft, is refused before anything is written. Pages linked from your navigation menu no longer show up as orphans, and link-graph titles read as plain text.
+* Redirects: a redirect whose source is a live page (which would never fire, since redirects run only on a 404) is refused with a clear explanation.
+* Undo: every AI text edit, inserted link and link fix keeps a restore point on the site, so it can be undone in one step, Elementor pages included. Edit answers are much smaller.
+* New for paired agents: list and fix broken internal links, set alt text on up to 50 images at once (with undo), and read or set a post's noindex / nofollow through Yoast, Rank Math or AuditAE. Reading a post's SEO also shows the title and description that actually print.
+* Schema: an agent can ask that a schema type another plugin prints (Yoast's Article, WooCommerce's Product) be refused rather than saved unseen.
+* Renaming an image reports revisions separately from posts, and "all content types" listings skip page-builder templates.
 = 0.37.0 =
 …
 * New, for paired sites: AuditAE can compress Media Library images in place. Each JPEG, PNG or WebP keeps its file name and URL, its thumbnail sizes are compressed too, and the originals are kept in uploads/auditae-originals/: Restore original in the Media Library puts them back. It won't replace files while another image optimizer, image CDN or WebP copy is in place (Smush, ShortPixel, EWWW, Imagify, Jetpack's image CDN…) unless you confirm, and it skips protected folders such as WooCommerce downloads.
-= 0.34.0 =
-* New: a free Schema box in the post editor adds Article, Blog post, How-to or Product schema to a post, with a JSON-LD preview. No account needed.
-* Elementor 4: AuditAE can read and edit the text of atomic Heading, Paragraph and Button widgets.
-* Renaming an image also updates Elementor page settings, block widgets, header images and the social images Yoast, Rank Math and SEOPress store.
-* Coexistence: no duplicate FAQ schema next to Elementor's FAQ Schema switch or Rank Math's Schema Builder, Product schema is left to WooCommerce on product pages, and an Organization your theme or another plugin already prints is respected.
-* Faster: IndexNow URLs are queued and sent in batches (a post unpublished or set to noindex before its turn is skipped), the crawler log prunes once a day, and page views and 404s skip database reads for Organization schema and redirects.
-* The Links tab and the Dashboard widget no longer make the page wait: the link graph rebuilds and the scorecard refreshes in the background.
-* Connect tab: a free sign-up link with your site address filled in, a warning to paste the pairing code only at auditae.app, and how to use the site from Claude or ChatGPT over MCP. A pairing AuditAE no longer accepts asks you to re-pair.
-* Accessibility: higher-contrast colours, visible keyboard focus and screen-reader text on badges, new-tab links and repeated links.
-* A one-time review request on the AI crawlers tab after the first AI crawler visit.
-* Redirects tab: the Suggested redirects table fits its card, so the destination field and Save button are always visible.
 == Upgrade Notice ==
+= 0.38.0 =
+Safer AI links and redirects (broken targets and live sources refused), one-step undo for AI edits, menu-aware orphan report, and new bulk alt text, broken-link and robots tools for paired agents. No re-pair required.
 = 0.37.0 =

auditae-ai-search-toolkit/tags/0.38.0/uninstall.php

-              r3775803
+              r3777340
         'auditae_redirect_sources',
         'auditae_org_fill_gap',
+        // 0.38.0: bulk alt-text undo tokens.
+        'auditae_alt_undo',
 );
 …
         $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_seo' ) );
         $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_elementor_undo' ) );
+        $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_content_undo' ) );
         // Not deleted: _auditae_media_backup and uploads/auditae-originals/
         // (0.35.0). They hold the only copy of the images as they were before

auditae-ai-search-toolkit/trunk/auditae.php

-              r3775803
+              r3777340
  * Plugin URI:        https://auditae.app/wordpress-ai-plugin
  * Description:       WordPress MCP server for Claude & ChatGPT: let AI agents draft, edit and publish. Free AI search readiness: llms.txt, AI crawler log, score, schema.
  * Version:           0.37.0
+ * Version:           0.38.0
  * Requires at least: 6.0
  * Requires PHP:      7.4
 …
 defined( 'ABSPATH' ) || exit;
 define( 'AUDITAE_VERSION', '0.37.0' );
+define( 'AUDITAE_VERSION', '0.38.0' );
 // REST contract version the app can check before relying on newer fields.
 // Bump when a route gains or changes a field the app depends on.
 …
 // seo_provider; POST /posts/{id}/untrash and /elementor-restore; GET /posts
 // status=trash; builder gutenberg|classic|aeo_template|empty; /status
+// features).
+define( 'AUDITAE_API_VERSION', 6 );
+// features); 7 = 0.38.0 (body edits keep their undo on the site:
+// content_restore_id + POST /posts/{id}/restore, no old body in answers;
+// internal-link target check + undo; redirect live-source refusal; menu
+// links in the graph; GET /broken-links + POST /posts/{id}/fix-link; POST
+// /media/alt-text; /posts/{id}/seo robots + rendered_*; schema if_output;
+// see auditae_rest_features()).
+define( 'AUDITAE_API_VERSION', 7 );
 define( 'AUDITAE_PLUGIN_FILE', __FILE__ );
 define( 'AUDITAE_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 …
 // dead end), so it loads after redirects.php.
 require_once AUDITAE_PLUGIN_DIR . 'includes/broken-links.php';
+require_once AUDITAE_PLUGIN_DIR . 'includes/broken-links-rest.php';
 // Fan-out reads the link index (anchor phrases, stopwords) and the readiness
 // helpers (builder detection), so it loads after both.

auditae-ai-search-toolkit/trunk/includes/elementor.php

-              r3775803
+              r3777340
+}
+// The post body an AuditAE edit replaced on a non-Elementor post (a full
+// `content` write, `replacements`, an inserted internal link, a broken-link
+// fix), kept on the post so the edit can be undone by id
+// (POST /posts/{id}/restore) instead of echoing the whole old body back in
+// every answer. Same limits and same changed-since check as the Elementor
+// store above.
+define( 'AUDITAE_CONTENT_UNDO_KEY', '_auditae_content_undo' );
+/**
+ * Keep the body an edit just replaced. Call after the new body is saved.
+ * Returns the restore id ('cu_…'), or '' when the body is too big to keep
+ * or nothing changed.
+ *
+ * @param int    $post_id Post ID.
+ * @param string $before  post_content before the edit.
+ * @return string
+ */
+function auditae_content_undo_push( $post_id, $before ) {
+        $post_id = (int) $post_id;
+        $before  = (string) $before;
+        $after   = (string) get_post_field( 'post_content', $post_id, 'raw' );
+        if ( strlen( $before ) > AUDITAE_ELEMENTOR_UNDO_MAX_BYTES || $before === $after ) {
+                return '';
+        }
+        $list   = get_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, true );
+        $list   = is_array( $list ) ? array_values( $list ) : array();
+        $id     = 'cu_' . strtolower( wp_generate_password( 16, false, false ) );
+        $list[] = array(
+                'id'        => $id,
+                'at'        => time(),
+                'before'    => $before,
+                'after_sha' => sha1( $after ),
+        );
+        $list = array_slice( $list, -AUDITAE_ELEMENTOR_UNDO_MAX );
+        update_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, wp_slash( $list ) );
+        return $id;
+}
+/**
+ * Put back the body a kept edit replaced. The body was already stored on
+ * this site, so it is saved with the post kses filter lifted (as user 0 it
+ * would strip the embeds the edit never touched).
+ *
+ * @param int    $post_id    Post ID.
+ * @param string $restore_id Id from auditae_content_undo_push().
+ * @param bool   $force      Restore even if the post changed since.
+ * @return array{previous:string,restore_id:string}|WP_Error
+ */
+function auditae_content_undo_restore( $post_id, $restore_id, $force = false ) {
+        $post_id = (int) $post_id;
+        $list    = get_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, true );
+        $list    = is_array( $list ) ? array_values( $list ) : array();
+        $index   = null;
+        foreach ( $list as $i => $entry ) {
+                if ( is_array( $entry ) && isset( $entry['id'] ) && hash_equals( (string) $entry['id'], (string) $restore_id ) ) {
+                        $index = $i;
+                }
+        }
+        if ( null === $index ) {
+                return new WP_Error( 'auditae_restore_not_found', 'No kept AuditAE edit with that restore id on this post (only the last ' . AUDITAE_ELEMENTOR_UNDO_MAX . ' are kept). Older versions are in the post\'s Revisions in wp-admin.', array( 'status' => 404 ) );
+        }
+        $entry   = $list[ $index ];
+        $current = (string) get_post_field( 'post_content', $post_id, 'raw' );
+        if ( ! $force && sha1( $current ) !== (string) $entry['after_sha'] ) {
+                return new WP_Error( 'auditae_changed_since', 'This post was changed after that edit (in wp-admin or by another edit), so restoring it would undo those changes too. Nothing was changed. Pass force: true to restore it anyway.', array( 'status' => 409 ) );
+        }
+        $prio = has_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        if ( false !== $prio ) {
+                remove_filter( 'content_save_pre', 'wp_filter_post_kses', $prio );
+        }
+        try {
+                $res = wp_update_post(
+                        array(
+                                'ID'           => $post_id,
+                                'post_content' => wp_slash( (string) $entry['before'] ),
+                        ),
+                        true
+                );
+        } finally {
+                if ( false !== $prio ) {
+                        add_filter( 'content_save_pre', 'wp_filter_post_kses', $prio );
+                }
+        }
+        if ( is_wp_error( $res ) ) {
+                return new WP_Error( 'auditae_update_failed', $res->get_error_message(), array( 'status' => 500 ) );
+        }
+        $list = array_slice( $list, 0, $index );
+        if ( empty( $list ) ) {
+                delete_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY );
+        } else {
+                update_post_meta( $post_id, AUDITAE_CONTENT_UNDO_KEY, wp_slash( $list ) );
+        }
+        if ( function_exists( 'auditae_links_invalidate' ) ) {
+                auditae_links_invalidate();
+        }
+        return array(
+                'previous'   => $current,
+                'restore_id' => auditae_content_undo_push( $post_id, $current ),
+        );
+}
+/**
+ * Undo pairs for a plain-post `replacements` edit: each replacement turned
+ * back into its find, in reverse order. Only returned when replaying them
+ * on the new body gives back the old body exactly (a replacement whose new
+ * text already appeared elsewhere, or one that also changed block
+ * attributes, would not); otherwise the restore id is the undo.
+ *
+ * @param string $before   Body before the edit.
+ * @param string $after    Body after the edit.
+ * @param array  $replaced auditae_apply_replacements() result.
+ * @param array  $sent     The request's replacements.
+ * @return array|null
+ */
+function auditae_replacements_undo_pairs( $before, $after, array $replaced, array $sent ) {
+        if ( empty( $replaced['matches'] ) || ! is_array( $replaced['matches'] ) ) {
+                return null;
+        }
+        $undo = array();
+        $text = (string) $after;
+        foreach ( array_reverse( array_keys( $sent ) ) as $i ) {
+                $r = $sent[ $i ];
+                if ( ! is_array( $r ) || ! isset( $r['find'], $r['replace'] ) || '' === (string) $r['replace'] ) {
+                        return null;
+                }
+                $stored = wp_kses_post( (string) $r['replace'] );
+                $n      = isset( $replaced['counts'][ $i ] ) ? (int) $replaced['counts'][ $i ] : 0;
+                if ( $n < 1 || substr_count( $text, $stored ) !== $n ) {
+                        return null;
+                }
+                $text   = str_replace( $stored, (string) $r['find'], $text );
+                $pair   = array(
+                        'find'    => $stored,
+                        'replace' => (string) $r['find'],
+                );
+                if ( $n > 1 ) {
+                        $pair['expected_count'] = $n;
+                }
+                $undo[] = $pair;
+        }
+        return $text === (string) $before ? $undo : null;
+}
+/**
+ * Restore by id: 'eu_…' (Elementor tree) or 'cu_…' (post body).
+ *
+ * @param int    $post_id    Post ID.
+ * @param string $restore_id Restore id.
+ * @param bool   $force      Restore even if the post changed since.
+ * @return array{previous:string,restore_id:string,kind:string}|WP_Error
+ */
+function auditae_undo_restore( $post_id, $restore_id, $force = false ) {
+        $restore_id = (string) $restore_id;
+        if ( 0 === strpos( $restore_id, 'eu_' ) ) {
+                if ( ! auditae_elementor_is_built( $post_id ) ) {
+                        return new WP_Error( 'auditae_bad_request', 'That restore id is for an Elementor edit, and this post is no longer built with Elementor.', array( 'status' => 400 ) );
+                }
+                $res = auditae_elementor_undo_restore( $post_id, $restore_id, $force );
+                $kind = 'elementor';
+        } else {
+                if ( auditae_elementor_is_built( $post_id ) ) {
+                        return new WP_Error( 'auditae_bad_request', 'That restore id is for a post-body edit, and this post is now built with Elementor (its body is a mirror). Nothing was changed.', array( 'status' => 400 ) );
+                }
+                $res  = auditae_content_undo_restore( $post_id, $restore_id, $force );
+                $kind = 'content';
+        }
+        if ( is_wp_error( $res ) ) {
+                return $res;
+        }
+        $res['kind'] = $kind;
+        return $res;
+}
 /**
  * The post_content mirror Elementor's own save would write for this tree

auditae-ai-search-toolkit/trunk/includes/internal-links.php

-              r3733266
+              r3777340
         // the graph is missing or out of date a background rebuild is queued
         // and the response says so ('building').
         $status = auditae_links_index_status();
+        $status = auditae_links_index_status_catch_up();
         $index  = $status['index'];
 …
                 $items[] = array(
                         'id'             => (int) $p->ID,
                         'title'          => get_the_title( $p ),
+                        'title'          => auditae_rest_plain_title( $p ),
                         'slug'           => $p->post_name,
                         'view_url'       => get_permalink( $p ),
                         'outgoing_count' => (int) $stats['out'],
                         'incoming_count' => (int) $stats['in'],
+                        'orphan'         => ( 0 === (int) $stats['in'] && $stats['known'] && ! in_array( (int) $p->ID, $exempt, true ) ),
+                        // Links from the site's navigation menus, counted apart from
+                        // links in other posts' content (0.38.0).
+                        'menu_links'     => (int) $stats['menu'],
+                        'orphan'         => ( 0 === (int) $stats['in'] && 0 === (int) $stats['menu'] && $stats['known'] && ! in_array( (int) $p->ID, $exempt, true ) ),
                         // False when the post sits outside the indexed window, so a
                         // consumer can tell "no incoming links" from "not measured".
 …
                                 // Non-null while a sliced rebuild runs: pages scanned so far.
                                 'rebuilding' => $status['progress'],
+                                // True when WP-Cron isn't running the rebuild here (each read
+                                // then advances it a little itself).
+                                'stalled'     => (bool) $status['stalled'],
+                                'age_seconds' => isset( $index['built'] ) ? max( 0, time() - (int) $index['built'] ) : null,
                         ),
+                )
 …
                                 if ( in_array( auditae_links_normalize_path( $link['href'] ), $target_keys, true ) ) {
                                         $incoming[] = array(
+                                                'source'       => 'content',
                                                 'source_id'    => (int) $cand->ID,
                                                 'source_title' => get_the_title( $cand->ID ),
+                                                'source_title' => auditae_rest_plain_title( $cand->ID ),
                                                 'anchor_text'  => $link['anchor'],
                                                 'href'         => $link['href'],
 …
+        }
+        // Navigation menu links count as incoming too (source "menu"), so a
+        // page reached only from the menu isn't presented as unlinked.
+        $menu      = auditae_links_menu_inlinks();
+        $menu_hits = isset( $menu[ (int) $post->ID ] ) ? (int) $menu[ (int) $post->ID ] : 0;
+        if ( $menu_hits > 0 ) {
+                $incoming[] = array(
+                        'source'       => 'menu',
+                        'source_id'    => 0,
+                        'source_title' => 'Navigation menu',
+                        'anchor_text'  => '',
+                        'href'         => (string) $permalink,
+                        'count'        => $menu_hits,
+                );
+        }
         return rest_ensure_response(
                 array(
                         'post' => array(
                                 'id'    => (int) $post->ID,
                                 'title' => get_the_title( $post ),
+                                'title' => auditae_rest_plain_title( $post ),
                                 'slug'  => $post->post_name,
                         ),
+                        'outgoing' => $outgoing,
+                        'incoming' => $incoming,
+                        'outgoing'   => $outgoing,
+                        'incoming'   => $incoming,
+                        'menu_links' => $menu_hits,
                         // Only computed when there's nothing incoming, since that's the
                         // only case where a suggestion is the next action. Each one is
                         // pre-verified to be insertable, so AEBOT can act on it without
                         // a round trip that might 422.
                         'suggestions' => empty( $incoming ) ? auditae_links_suggest_sources( (int) $post->ID, 5 ) : array(),
+                        'suggestions' => count( $incoming ) === ( $menu_hits > 0 ? 1 : 0 ) ? auditae_links_suggest_sources( (int) $post->ID, 5 ) : array(),
+                )
         );
 …
                 return new WP_Error( 'auditae_not_found', 'post not found', array( 'status' => 404 ) );
+        }
+        if ( 'trash' === $post->post_status ) {
+                return new WP_Error( 'auditae_post_trashed', 'This post is in the trash. Restore it first (POST /posts/' . $id . '/untrash).', array( 'status' => 409 ) );
+        }
         $json = $request->get_json_params();
 …
         $anchor = isset( $body['anchor_text'] ) ? trim( (string) $body['anchor_text'] ) : '';
         $href   = isset( $body['target_url'] ) ? (string) $body['target_url'] : '';
+        $original = auditae_elementor_is_built( $id ) ? get_post_meta( $id, '_elementor_data', true ) : $post->post_content;
+        $force  = isset( $body['force'] ) && rest_sanitize_boolean( $body['force'] );
+        // The target must be a page that exists and is public: a host check
+        // alone let /does-not-exist/ through, writing a broken link (and the
+        // app billed for it). Resolved the way the broken-link checker does
+        // (posts, pages, terms, archives, files, redirects) before anything is
+        // written. force: true skips it, for a path another app on the same
+        // host serves.
+        $is_elementor = auditae_elementor_is_built( $id );
+        $target       = null;
+        $site_host    = wp_parse_url( home_url(), PHP_URL_HOST );
+        $target_host  = wp_parse_url( $href, PHP_URL_HOST );
+        if ( '' !== $anchor && '' !== $href && ( ! $target_host || auditae_is_site_host( $target_host, $site_host ) ) ) {
+                $target = auditae_links_check_target( $href );
+                if ( ! $force && 'broken' === $target['status'] ) {
+                        return new WP_Error(
+                                'auditae_link_target_not_found',
+                                sprintf( 'Nothing was changed: %s is not a page on this site (no published post, page, category, archive, file or redirect answers it), so the link would be broken. Link to a published page (wp_list_posts gives each one\'s view_url), or pass force: true if another app on this host serves that path.', $href ),
+                                array(
+                                        'status'        => 422,
+                                        'target_status' => 'not_found',
+                                )
+                        );
+                }
+                if ( ! $force && 'unpublished' === $target['status'] ) {
+                        // Same code as not_found (the app maps one refusal);
+                        // data.target_status says which.
+                        return new WP_Error(
+                                'auditae_link_target_not_found',
+                                sprintf( 'Nothing was changed: %1$s is post %2$d, which is %3$s, so visitors following the link would get a 404. Publish it first, or link to a published page.', $href, (int) $target['post_id'], $target['post_status'] ),
+                                array(
+                                        'status'        => 422,
+                                        'target_status' => $target['post_status'],
+                                        'target_id'     => (int) $target['post_id'],
+                                )
+                        );
+                }
+        }
+        $content_before   = (string) $post->post_content;
+        $elementor_before = $is_elementor ? (string) get_post_meta( $id, '_elementor_data', true ) : '';
         // Validation, the kses/slashing dance and the save all live in
         // auditae_links_insert() so this endpoint and the one-click button on
         // the Links tab cannot drift apart.
+        $result = auditae_links_insert( $id, $anchor, $href );
+        $info   = array();
+        $result = auditae_links_insert( $id, $anchor, $href, $info );
         if ( is_wp_error( $result ) ) {
                 $status = array(
 …
+        }
+        auditae_log_action( 'internal_link_inserted', 'id=' . $id );
+        return rest_ensure_response(
+                array(
+                        'post_id'        => (int) $id,
+                        'anchor_text'    => $anchor,
+                        'target_url'     => esc_url_raw( $href ),
+                        'previous_state' => auditae_elementor_is_built( $id )
+                                ? array( '_elementor_data' => $original )
+                                : array( 'post_content' => $original ),
+                )
+        );
+        // Undone by id (POST /posts/{id}/restore), like wp_update_post's text
+        // edits: an Elementor page's tree can't be written back by the app, and
+        // echoing the whole old body made every link answer as big as the page.
+        $answer = array(
+                'post_id'     => (int) $id,
+                'anchor_text' => $anchor,
+                'target_url'  => esc_url_raw( $href ),
+                'builder'     => auditae_rest_builder( get_post( $id ) ),
+        );
+        if ( null !== $target && $target['post_id'] > 0 ) {
+                $answer['target_id'] = (int) $target['post_id'];
+        }
+        if ( $is_elementor ) {
+                $rid = auditae_elementor_undo_push( $id, $elementor_before );
+                if ( '' !== $rid ) {
+                        $answer['elementor_restore_id'] = $rid;
+                }
+        } else {
+                $rid = auditae_content_undo_push( $id, $content_before );
+                if ( '' !== $rid ) {
+                        $answer['content_restore_id'] = $rid;
+                }
+        }
+        if ( ! empty( $info['inserted'] ) ) {
+                // One-pair undo through wp_update_post `replacements` (Elementor
+                // pages too): the anchor written back to the phrase it wrapped.
+                $answer['inserted_html'] = $info['inserted'];
+                $answer['undo']          = array(
+                        'replacements' => array(
+                                array(
+                                        'find'    => $info['inserted'],
+                                        'replace' => (string) $info['phrase'],
+                                ),
+                        ),
+                );
+        }
+        if ( null !== $target && 'ok' !== $target['status'] ) {
+                $answer['warning'] = 'force: true, so the target was not verified as a page on this site.';
+        }
+        if ( isset( $body['include_previous_content'] ) && rest_sanitize_boolean( $body['include_previous_content'] ) ) {
+                $answer['previous_state'] = $is_elementor ? array( '_elementor_data' => $elementor_before ) : array( 'post_content' => $content_before );
+        }
+        auditae_log_action( 'internal_link_inserted', 'id=' . $id . ( '' !== $rid ? ' restore_id=' . $rid : '' ) );
+        return rest_ensure_response( $answer );
+}
 …
  * @return string Content with at most one new anchor.
  */
+function auditae_wrap_first_anchor_occurrence( $content, $anchor, $href ) {
+function auditae_wrap_first_anchor_occurrence( $content, $anchor, $href, &$inserted = null ) {
+        $inserted = '';
         if ( ! is_string( $content ) || '' === $content || '' === trim( (string) $anchor ) ) {
                 return $content;
 …
         // A callback, not a replacement string: esc_url() allows "$", so a
         // target URL containing "$1" was expanded as a backreference.
+        $replace  = static function ( $m ) use ( $href_att ) {
+                return '<a href="' . $href_att . '">' . $m[1] . '</a>';
+        $made     = '';
+        $replace  = static function ( $m ) use ( $href_att, &$made ) {
+                $made = '<a href="' . $href_att . '">' . $m[1] . '</a>';
+                return $made;
         };
 …
+        }
+        if ( $replaced ) {
+                // The exact anchor written, so a caller can offer it back as a
+                // one-pair undo (find: this, replace: the phrase).
+                $inserted = $made;
+        }
         return $replaced ? $out : $content;
+}

auditae-ai-search-toolkit/trunk/includes/link-index.php

-              r3733266
+              r3777340
 /**
+ * auditae_links_index_status() for the REST graph, which an agent reads
+ * with nobody to press "Build link graph now": when nothing has advanced a
+ * build lately (no slice in the last couple of minutes) and WP-Cron is
+ * evidently not running it (an overdue event), or the graph is long past
+ * its TTL, run one short slice in this request. Without it, `building`
+ * stayed true next to an 18-hour-old built_at on a host where WP-Cron never
+ * fired, and the graph never refreshed. The wp-admin tab keeps the
+ * never-build-in-the-request behaviour (it has the button).
+ *
+ * @return array Same shape as auditae_links_index_status().
+ */
+function auditae_links_index_status_catch_up() {
+        $status = auditae_links_index_status();
+        if ( ! $status['building'] ) {
+                return $status;
+        }
+        $stored = $status['index'];
+        $state  = get_option( AUDITAE_LINK_INDEX_STATE );
+        $last   = is_array( $state ) ? (int) ( isset( $state['updated'] ) ? $state['updated'] : ( isset( $state['started'] ) ? $state['started'] : 0 ) ) : 0;
+        $idle   = ( time() - $last ) > AUDITAE_LINK_INDEX_RESUME_DELAY + 60;
+        $old    = null !== $stored && ( time() - (int) $stored['built'] ) > AUDITAE_LINK_INDEX_TTL + HOUR_IN_SECONDS;
+        if ( ! $idle || ! ( $status['stalled'] || $old ) ) {
+                return $status;
+        }
+        $built = auditae_links_index_build( (float) apply_filters( 'auditae_link_index_inline_budget', 3 ) );
+        if ( is_array( $built ) ) {
+                return array(
+                        'index'    => $built,
+                        'building' => ! auditae_links_index_is_usable( get_option( AUDITAE_LINK_INDEX_OPTION ) ),
+                        'progress' => null,
+                        'stalled'  => false,
+                );
+        }
+        $status['progress'] = auditae_links_index_progress();
+        return $status;
+}
+/**
  * Queue the next build slice to run as soon as cron fires. Safe to call on
  * every read: WordPress refuses a single event when one for the same hook
 …
  * @return array|null The freshly built index, or null when a continuation was scheduled.
  */
 function auditae_links_index_build() {
+function auditae_links_index_build( $budget = null ) {
         global $wpdb;
 …
+        }
+        $budget   = (float) apply_filters( 'auditae_link_index_time_budget', AUDITAE_LINK_INDEX_TIME_BUDGET );
+        $deadline = microtime( true ) + max( 0.0, $budget );
+        if ( null === $budget ) {
+                $budget = (float) apply_filters( 'auditae_link_index_time_budget', AUDITAE_LINK_INDEX_TIME_BUDGET );
+        }
+        $deadline = microtime( true ) + max( 0.0, (float) $budget );
         $host     = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
         $total    = count( $state['ids'] );
 …
                         'in'    => 0,
                         'out'   => 0,
+                        'menu'  => 0,
                         'known' => false,
                 );
+        }
+        $menu = auditae_links_menu_inlinks();
         return array(
                 'in'    => isset( $index['in'][ $post_id ] ) ? (int) $index['in'][ $post_id ] : 0,
                 'out'   => isset( $index['out'][ $post_id ] ) ? (int) $index['out'][ $post_id ] : 0,
+                // Links from the site's navigation menus (not in `in`).
+                'menu'  => isset( $menu[ $post_id ] ) ? (int) $menu[ $post_id ] : 0,
                 'known' => in_array( $post_id, $index['ids'], true ),
         );
+}
+/**
+ * Posts and pages the site's navigation links to: items of the classic
+ * menus assigned to a theme location (every menu when none is assigned, as
+ * with an Elementor header's Nav Menu widget), and the links of published
+ * block-theme Navigation menus (wp_navigation). A page reached only from
+ * the menu was reported as an orphan: on a typical brochure site that was
+ * every page but the home page.
+ *
+ * Read live (menus are small and cached), so it is never stale and needs
+ * no index rebuild.
+ *
+ * @return array<int,int> post ID => number of menu links to it.
+ */
+function auditae_links_menu_inlinks( $reset = false ) {
+        static $cache = null;
+        if ( null !== $cache && ! $reset ) {
+                return $cache;
+        }
+        $cache = array();
+        $add   = static function ( $id ) use ( &$cache ) {
+                $id = (int) $id;
+                if ( $id > 0 ) {
+                        $cache[ $id ] = isset( $cache[ $id ] ) ? $cache[ $id ] + 1 : 1;
+                }
+        };
+        $host  = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
+        $by_url = static function ( $url ) use ( $add, $host ) {
+                $url      = (string) $url;
+                $url_host = wp_parse_url( $url, PHP_URL_HOST );
+                if ( '' === $url || ( $url_host && ! auditae_is_site_host( $url_host, $host ) ) ) {
+                        return;
+                }
+                $abs = $url_host ? $url : home_url( '/' . ltrim( $url, '/' ) );
+                $add( url_to_postid( $abs ) );
+        };
+        $menu_ids = array_filter( array_map( 'intval', array_values( (array) get_nav_menu_locations() ) ) );
+        if ( empty( $menu_ids ) ) {
+                $menus    = wp_get_nav_menus( array( 'fields' => 'ids' ) );
+                $menu_ids = is_array( $menus ) ? array_map( 'intval', $menus ) : array();
+        }
+        $seen_items = 0;
+        foreach ( array_unique( $menu_ids ) as $menu_id ) {
+                $items = wp_get_nav_menu_items( $menu_id, array( 'update_post_term_cache' => false ) );
+                foreach ( (array) $items as $item ) {
+                        if ( ++$seen_items > 500 ) {
+                                break 2;
+                        }
+                        if ( 'post_type' === $item->type ) {
+                                $add( $item->object_id );
+                        } elseif ( 'custom' === $item->type ) {
+                                $by_url( $item->url );
+                        }
+                }
+        }
+        // Block themes: navigation-link / navigation-submenu blocks carry the
+        // linked post's id (kind post-type) or a URL.
+        $navs = get_posts(
+                array(
+                        'post_type'      => 'wp_navigation',
+                        'post_status'    => 'publish',
+                        'posts_per_page' => 20,
+                        'no_found_rows'  => true,
+                )
+        );
+        foreach ( $navs as $nav ) {
+                $walk = static function ( $blocks ) use ( &$walk, $add, $by_url ) {
+                        foreach ( (array) $blocks as $b ) {
+                                if ( in_array( $b['blockName'], array( 'core/navigation-link', 'core/navigation-submenu', 'core/home-link' ), true ) ) {
+                                        $attrs = (array) $b['attrs'];
+                                        if ( isset( $attrs['kind'], $attrs['id'] ) && 'post-type' === $attrs['kind'] ) {
+                                                $add( $attrs['id'] );
+                                        } elseif ( ! empty( $attrs['url'] ) ) {
+                                                $by_url( $attrs['url'] );
+                                        }
+                                }
+                                if ( ! empty( $b['innerBlocks'] ) ) {
+                                        $walk( $b['innerBlocks'] );
+                                }
+                        }
+                };
+                $walk( parse_blocks( $nav->post_content ) );
+        }
+        return $cache;
+}
 …
         $limit   = max( 1, (int) $limit );
         $exempt  = auditae_links_orphan_exempt_ids();
+        $menu    = auditae_links_menu_inlinks();
         $orphans = array();
         foreach ( $index['ids'] as $id ) {
                 if ( isset( $index['in'][ $id ] ) || in_array( (int) $id, $exempt, true ) ) {
+                if ( isset( $index['in'][ $id ] ) || isset( $menu[ (int) $id ] ) || in_array( (int) $id, $exempt, true ) ) {
                         continue;
+                }
 …
+        }
         $exempt = auditae_links_orphan_exempt_ids();
+        $menu   = auditae_links_menu_inlinks();
         $n      = 0;
         foreach ( $index['ids'] as $id ) {
                 if ( ! isset( $index['in'][ $id ] ) && ! in_array( (int) $id, $exempt, true ) ) {
+                if ( ! isset( $index['in'][ $id ] ) && ! isset( $menu[ (int) $id ] ) && ! in_array( (int) $id, $exempt, true ) ) {
                         $n++;
+                }
 …
  * @return bool Whether a link was placed.
  */
+function auditae_elementor_wrap_first_anchor( array &$data, $anchor, $href ) {
+function auditae_elementor_wrap_first_anchor( array &$data, $anchor, $href, &$inserted = null ) {
+        $inserted = '';
         return auditae_elementor_map_slots(
                 $data,
                 function ( $value, $kind, &$stop ) use ( $anchor, $href ) {
+                function ( $value, $kind, &$stop ) use ( $anchor, $href, &$inserted ) {
                         if ( 'rich' !== $kind ) {
                                 return $value;
+                        }
+                        $new = auditae_wrap_first_anchor_occurrence( $value, $anchor, $href );
+                        $made = '';
+                        $new  = auditae_wrap_first_anchor_occurrence( $value, $anchor, $href, $made );
                         if ( $new !== $value ) {
+                                $stop = true;
+                                $stop     = true;
+                                $inserted = $made;
+                        }
                         return $new;
 …
  * @param string $anchor    Text to wrap.
  * @param string $href      Destination URL (must be same-host).
+ * @param array  $info      Filled on success: inserted (the <a> written), phrase (the text it wraps).
  * @return true|WP_Error
  */
+function auditae_links_insert( $source_id, $anchor, $href ) {
+function auditae_links_insert( $source_id, $anchor, $href, &$info = null ) {
+        $info      = array();
         $source_id = (int) $source_id;
         $post      = get_post( $source_id );
 …
         if ( auditae_elementor_is_built( $source_id ) ) {
                 $data = auditae_elementor_data( $source_id );
+                if ( ! auditae_elementor_wrap_first_anchor( $data, $anchor, $href ) ) {
+                $made = '';
+                if ( ! auditae_elementor_wrap_first_anchor( $data, $anchor, $href, $made ) ) {
                         return $not_found;
+                }
+                $info = auditae_links_insert_info( $made );
                 $result = auditae_elementor_save( $source_id, $data );
                 if ( is_wp_error( $result ) ) {
 …
         $original = $post->post_content;
+        $updated  = auditae_wrap_first_anchor_occurrence( $original, $anchor, $href );
+        $made     = '';
+        $updated  = auditae_wrap_first_anchor_occurrence( $original, $anchor, $href, $made );
         if ( $updated === $original ) {
                 return $not_found;
+        }
+        $info = auditae_links_insert_info( $made );
         // Requests authenticated by bearer token run as user 0, where kses is
 …
+}
+/**
+ * What auditae_links_insert() wrote, for an undo pair.
+ *
+ * @param string $made The <a> written.
+ * @return array{inserted:string,phrase:string}
+ */
+function auditae_links_insert_info( $made ) {
+        $phrase = preg_replace( '#^<a\b[^>]*>(.*)</a>$#s', '$1', (string) $made );
+        return array(
+                'inserted' => (string) $made,
+                'phrase'   => is_string( $phrase ) ? $phrase : '',
+        );
+}
+/**
+ * Whether a link target resolves to something public on this site, the way
+ * the broken-link checker decides it (auditae_broken_classify(): posts,
+ * pages, terms, archives, files, redirects; conservative: anything it
+ * can't rule out is 'ok').
+ *
+ * @param string $href Target URL (absolute same-host or host-relative).
+ * @return array{status:string,post_id:int,post_status:string} status ok | broken | unpublished.
+ */
+function auditae_links_check_target( $href ) {
+        $href = trim( (string) $href );
+        $out  = array(
+                'status'      => 'ok',
+                'post_id'     => 0,
+                'post_status' => '',
+        );
+        if ( ! function_exists( 'auditae_broken_classify' ) ) {
+                return $out;
+        }
+        $site_host = strtolower( (string) wp_parse_url( home_url(), PHP_URL_HOST ) );
+        // A relative path without a leading slash resolves against home.
+        if ( '' !== $href && ! preg_match( '#^([a-z][a-z0-9+.\-]*:|/|\#|\?)#i', $href ) ) {
+                $href = '/' . $href;
+        }
+        if ( ! auditae_broken_is_checkable_internal( $href, $site_host ) ) {
+                return $out; // fragment, query-only, mailto:, another app's path
+        }
+        return auditae_broken_classify( $href, auditae_broken_normalize_path( $href ), auditae_broken_known_paths() );
+}
 // ────────────────────────────────────────────────────────────────────
 // Scheduled rebuild

auditae-ai-search-toolkit/trunk/includes/media.php

-              r3775803
+              r3777340
         // references inside published post content, so it carries more risk
         // and a distinct audit-log entry. write_seo tier, same as alt/caption.
+        // Alt text for up to 50 images in one call, with one undo token
+        // (0.38.0). write_seo, like the single-image PATCH.
+        register_rest_route(
+                $namespace,
+                '/media/bulk-alt',
+                array(
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_bulk_alt_text',
+                        'permission_callback' => 'auditae_rest_authorize_seo_write',
+                )
+        );
+        register_rest_route(
+                $namespace,
+                '/media/bulk-alt/undo',
+                array(
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_bulk_alt_text_undo',
+                        'permission_callback' => 'auditae_rest_authorize_seo_write',
+                )
+        );
         register_rest_route(
                 $namespace,
 …
                         'media'          => auditae_format_media( get_post( $id ), true ),
                         'previous_state' => $previous_state,
+                )
+        );
+}
+// ────────────────────────────────────────────────────────────────────
+// POST /media/bulk-alt — bulk alt text, with undo (0.38.0)
+// ────────────────────────────────────────────────────────────────────
+// Undo tokens for bulk alt writes: token => {at, items: {id: {before, after}}}.
+// Last 10 kept for 30 days, one non-autoloaded option.
+define( 'AUDITAE_OPT_ALT_UNDO', 'auditae_alt_undo' );
+define( 'AUDITAE_ALT_BULK_MAX', 50 );
+/**
+ * POST /media/bulk-alt {items: [{id, alt_text}, …]} (≤ 50). Per item: updated,
+ * unchanged (already that alt: a no-op), not_found (not an attachment) or
+ * invalid. One undo_token covers every updated item.
+ */
+function auditae_rest_bulk_alt_text( WP_REST_Request $request ) {
+        $items = $request->get_param( 'items' );
+        if ( ! is_array( $items ) || empty( $items ) ) {
+                return new WP_Error( 'auditae_bad_request', 'items is required: [{id, alt_text}, …] (up to ' . AUDITAE_ALT_BULK_MAX . ').', array( 'status' => 400 ) );
+        }
+        if ( count( $items ) > AUDITAE_ALT_BULK_MAX ) {
+                return new WP_Error( 'auditae_bad_request', 'At most ' . AUDITAE_ALT_BULK_MAX . ' items per call; nothing was changed. Split the list.', array( 'status' => 400 ) );
+        }
+        $results = array();
+        $undo    = array();
+        $seen    = array();
+        foreach ( array_values( $items ) as $item ) {
+                $id  = is_array( $item ) && isset( $item['id'] ) ? absint( $item['id'] ) : 0;
+                $alt = is_array( $item ) && array_key_exists( 'alt_text', $item ) ? $item['alt_text'] : ( is_array( $item ) && array_key_exists( 'alt', $item ) ? $item['alt'] : null );
+                if ( $id <= 0 || ! ( is_string( $alt ) || null === $alt ) || isset( $seen[ $id ] ) ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'invalid',
+                                'error'  => isset( $seen[ $id ] ) ? 'duplicate id in this call' : 'each item needs a numeric id and a string alt_text',
+                        );
+                        continue;
+                }
+                $seen[ $id ] = true;
+                $att         = get_post( $id );
+                if ( ! $att || 'attachment' !== $att->post_type ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'not_found',
+                        );
+                        continue;
+                }
+                $new    = trim( wp_strip_all_tags( (string) $alt ) );
+                $before = (string) get_post_meta( $id, '_wp_attachment_image_alt', true );
+                if ( $new === $before ) {
+                        $results[] = array(
+                                'id'       => $id,
+                                'status'   => 'unchanged',
+                                'alt_text' => $new,
+                        );
+                        continue;
+                }
+                update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( $new ) );
+                clean_post_cache( $id );
+                $undo[ $id ] = array(
+                        'before' => $before,
+                        'after'  => $new,
+                );
+                $results[]   = array(
+                        'id'                => $id,
+                        'status'            => 'updated',
+                        'alt_text'          => $new,
+                        'previous_alt_text' => $before,
+                );
+        }
+        $updated = count( $undo );
+        $answer  = array(
+                'results'   => $results,
+                'updated'   => $updated,
+                'unchanged' => count( wp_list_filter( $results, array( 'status' => 'unchanged' ) ) ),
+                'failed'    => count( $results ) - $updated - count( wp_list_filter( $results, array( 'status' => 'unchanged' ) ) ),
+        );
+        if ( $updated > 0 ) {
+                $token = 'au_' . strtolower( wp_generate_password( 16, false, false ) );
+                $store = get_option( AUDITAE_OPT_ALT_UNDO, array() );
+                $store = is_array( $store ) ? $store : array();
+                foreach ( $store as $k => $entry ) {
+                        if ( ! is_array( $entry ) || (int) ( $entry['at'] ?? 0 ) < time() - 30 * DAY_IN_SECONDS ) {
+                                unset( $store[ $k ] );
+                        }
+                }
+                $store[ $token ] = array(
+                        'at'    => time(),
+                        'items' => $undo,
+                );
+                $store = array_slice( $store, -10, null, true );
+                update_option( AUDITAE_OPT_ALT_UNDO, $store, false );
+                // POST /media/bulk-alt/undo {undo_token} puts every updated alt back.
+                $answer['undo_token'] = $token;
+                auditae_log_action( 'media_alt_bulk', 'updated=' . $updated . ' undo_token=' . $token );
+        }
+        return rest_ensure_response( $answer );
+}
+/**
+ * POST /media/bulk-alt/undo {undo_token, force?}: put back the alts a bulk
+ * write replaced. An image whose alt changed again since is skipped
+ * (changed_since) unless force.
+ */
+function auditae_rest_bulk_alt_text_undo( WP_REST_Request $request ) {
+        $token = (string) $request->get_param( 'undo_token' );
+        $store = get_option( AUDITAE_OPT_ALT_UNDO, array() );
+        $store = is_array( $store ) ? $store : array();
+        if ( ! preg_match( '/^au_[a-z0-9]{16}$/', $token ) || ! isset( $store[ $token ] ) ) {
+                return new WP_Error( 'auditae_restore_not_found', 'No bulk alt-text write with that undo_token (the last 10, for 30 days, are kept). Nothing was changed.', array( 'status' => 404 ) );
+        }
+        $force    = rest_sanitize_boolean( $request->get_param( 'force' ) );
+        $results  = array();
+        $restored = 0;
+        foreach ( (array) $store[ $token ]['items'] as $id => $pair ) {
+                $id  = (int) $id;
+                $cur = (string) get_post_meta( $id, '_wp_attachment_image_alt', true );
+                if ( 'attachment' !== get_post_type( $id ) ) {
+                        $results[] = array(
+                                'id'     => $id,
+                                'status' => 'not_found',
+                        );
+                        continue;
+                }
+                if ( ! $force && $cur !== (string) $pair['after'] ) {
+                        $results[] = array(
+                                'id'       => $id,
+                                'status'   => 'changed_since',
+                                'alt_text' => $cur,
+                        );
+                        continue;
+                }
+                update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( (string) $pair['before'] ) );
+                clean_post_cache( $id );
+                $restored++;
+                $results[] = array(
+                        'id'       => $id,
+                        'status'   => 'restored',
+                        'alt_text' => (string) $pair['before'],
+                );
+        }
+        if ( 0 === $restored ) {
+                // Nothing put back: keep the token so a retry with force works.
+                return new WP_Error(
+                        'auditae_changed_since',
+                        'Nothing was changed: every image\'s alt text was changed again (or the image deleted) since that write. Pass force: true to put the old alts back anyway.',
+                        array(
+                                'status'  => 409,
+                                'results' => $results,
+                        )
+                );
+        }
+        unset( $store[ $token ] );
+        update_option( AUDITAE_OPT_ALT_UNDO, $store, false );
+        auditae_log_action( 'media_alt_bulk_undo', 'restored=' . $restored . ' undo_token=' . $token );
+        return rest_ensure_response(
+                array(
+                        'results'  => $results,
+                        'restored' => $restored,
+                )
         );
 …
         $rewrote_posts = 0;
+        $rewrote_revs  = 0;
         $rewrote_meta  = 0;
         $leftovers     = array();
 …
                 // Pre-filter on the size stem (a prefix of the -scaled stem), so
                 // posts embedding only intermediate-size URLs still match.
                 $rewrote_posts = auditae_rewrite_media_references( $old_size_stem, $url_map );
+                $rewrote_posts = auditae_rewrite_media_references( $old_size_stem, $url_map, $rewrote_revs );
                 $rewrote_meta  = auditae_rewrite_media_meta_references( $old_size_stem, $url_map );
                 auditae_rewrite_media_option_references( $url_map );
 …
         return array(
                 'media'          => auditae_format_media( get_post( $id ), true ),
+                'rewrote_posts'  => $rewrote_posts,
+                // Posts, pages and other content (any status but trash) whose body
+                // or Elementor data named the file. Revisions are rewritten too and
+                // counted apart (0.38.0; before, they were in rewrote_posts).
+                'rewrote_posts'     => $rewrote_posts,
+                'rewrote_revisions' => $rewrote_revs,
                 // Posts that still mention an old file name after the rewrite (a
                 // reference in a form we couldn't safely rewrite). Empty is good.
 …
  * @param string $old_stem Filename stem (no extension) to pre-filter on.
  * @param array  $url_map  old URL => new URL pairs (full size + each size).
+ * @return int Number of posts updated.
+ * @param int    $revisions Set to the number of revisions updated (not in the return value).
+ * @return int Number of posts updated, revisions not counted.
  */
+function auditae_rewrite_media_references( $old_stem, array $url_map ) {
+function auditae_rewrite_media_references( $old_stem, array $url_map, &$revisions = null ) {
+        $revisions = 0;
         global $wpdb;
 …
                                 $el_done[ $pid ] = true;
+                        }
+                        $updated++;
+                        // Revisions are rewritten too (restoring one shouldn't bring a
+                        // broken image back) but reported apart: counting them as posts
+                        // said a rename touched 6 posts when no live post used the image.
+                        if ( 'revision' === get_post_type( $pid ) ) {
+                                $revisions++;
+                        } else {
+                                $updated++;
+                        }
+                }
+        }
 …
                         clean_post_cache( $pid );
                         if ( ! isset( $el_done[ $pid ] ) ) {
+                                $updated++; // An Elementor page was already counted with its tree.
+                                // An Elementor page was already counted with its tree.
+                                if ( 'revision' === get_post_type( $pid ) ) {
+                                        $revisions++;
+                                } else {
+                                        $updated++;
+                                }
+                        }
+                }

auditae-ai-search-toolkit/trunk/includes/redirects.php

-              r3773612
+              r3777340
+        }
         return true;
+}
+/**
+ * What a redirect source still serves, when it isn't a 404. Rules only run
+ * on a 404 (auditae_redirects_maybe_redirect()), so a rule for a live page
+ * never fires. Null when nothing answers the path (the rule would work).
+ *
+ * Checks what WordPress itself answers the path with: a published post or
+ * page of a viewable type, the front page, a term / post type / author
+ * archive (auditae_broken_known_paths()), or a file on disk.
+ *
+ * @param string $source_n Normalized source (auditae_redirects_normalize_source()).
+ * @return array{kind:string,post_id:int,title:string,view_url:string}|null
+ */
+function auditae_redirects_source_live( $source_n ) {
+        $source_n = (string) $source_n;
+        $parts    = wp_parse_url( home_url( '/' ) );
+        $origin   = ( isset( $parts['scheme'] ) ? $parts['scheme'] : 'https' ) . '://' . ( isset( $parts['host'] ) ? $parts['host'] : '' ) . ( isset( $parts['port'] ) ? ':' . $parts['port'] : '' );
+        $abs      = $origin . $source_n;
+        $post_id  = url_to_postid( $abs );
+        if ( $post_id <= 0 ) {
+                $post_id = url_to_postid( $abs . '/' );
+        }
+        if ( $post_id > 0 ) {
+                $post = get_post( $post_id );
+                if ( $post && 'publish' === $post->post_status && 'attachment' !== $post->post_type && is_post_type_viewable( $post->post_type ) ) {
+                        return array(
+                                'kind'     => 'page' === $post->post_type ? 'page' : 'post',
+                                'post_id'  => (int) $post_id,
+                                'title'    => html_entity_decode( wp_strip_all_tags( get_the_title( $post ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ),
+                                'view_url' => (string) get_permalink( $post ),
+                        );
+                }
+        }
+        if ( ! function_exists( 'auditae_broken_known_paths' ) ) {
+                return null;
+        }
+        $path = auditae_broken_normalize_path( $abs );
+        if ( '' === $path ) {
+                return array(
+                        'kind'     => 'front_page',
+                        'post_id'  => (int) get_option( 'page_on_front' ),
+                        'title'    => '',
+                        'view_url' => home_url( '/' ),
+                );
+        }
+        $known = auditae_broken_known_paths();
+        if ( isset( $known[ $path ] ) ) {
+                return array(
+                        'kind'     => 'archive',
+                        'post_id'  => 0,
+                        'title'    => '',
+                        'view_url' => home_url( '/' . $path . '/' ),
+                );
+        }
+        $raw = ltrim( rawurldecode( (string) wp_parse_url( $abs, PHP_URL_PATH ) ), '/' );
+        if ( '' !== $raw && false === strpos( $raw, '..' ) && is_file( ABSPATH . $raw ) ) {
+                return array(
+                        'kind'     => 'file',
+                        'post_id'  => 0,
+                        'title'    => '',
+                        'view_url' => $abs,
+                );
+        }
+        return null;
+}

auditae-ai-search-toolkit/trunk/includes/rest-routes.php

-              r3775803
+              r3777340
         register_rest_route(
                 $namespace,
+                '/posts/(?P<id>\d+)/restore',
+                array(
+                        // Undo of a body edit (content_restore_id) or an Elementor text
+                        // edit (elementor_restore_id), by id. 0.38.0.
+                        'methods'             => 'POST',
+                        'callback'            => 'auditae_rest_elementor_restore',
+                        'permission_callback' => 'auditae_rest_authorize_post_update',
+                )
+        );
+        register_rest_route(
+                $namespace,
                 '/seo/yoast/settings',
                 array(
 …
+        }
         return true;
+}
+/**
+ * A post title as plain text for REST answers. get_the_title() is
+ * texturized and HTML-encoded for templates ("Tips &amp; Tricks"), which
+ * agents then quoted back literally.
+ *
+ * @param int|WP_Post $post Post.
+ * @return string
+ */
+function auditae_rest_plain_title( $post ) {
+        return html_entity_decode( wp_strip_all_tags( (string) get_the_title( $post ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' );
+}
 …
                         // Behaviours the app may rely on (api_version 6+).
                         'features'       => auditae_rest_features(),
+                        // The IndexNow key file this plugin serves (always served, even
+                        // with auto-ping off), so the app can submit this site's URLs
+                        // under the site's own key. 0.38.0.
+                        'indexnow'       => array(
+                                'key_location' => auditae_indexnow_key_location(),
+                                'enabled'      => (bool) auditae_indexnow_enabled(),
+                                'paused'       => (string) auditae_indexnow_paused_reason(),
+                        ),
+                )
         );
 …
                 'untrash',                  // POST /posts/{id}/untrash, GET /posts?status=trash
                 'elementor_restore',        // POST /posts/{id}/elementor-restore
+                // 0.38.0 (api_version 7):
+                'content_restore',          // content_restore_id on body edits; POST /posts/{id}/restore takes cu_ and eu_ ids
+                'compact_previous_state',   // PATCH /posts/{id} and internal-link answer no old body (include_previous_content: true for it)
+                'link_target_check',        // internal-link refuses a target that isn't a public page (auditae_link_target_not_found / _unpublished)
+                'internal_link_undo',       // internal-link answers undo.replacements + a restore id
+                'redirect_source_check',    // redirects write refuses a live source (auditae_redirect_source_live) unless force
+                'menu_links',               // link graph counts navigation menu links (menu_links), orphans exclude them
+                'media_rename_revisions',   // rename reports rewrote_revisions apart from rewrote_posts
+                'list_any_viewable',        // GET /posts?post_type=any lists only viewable content types
+                'llms_txt_compact',         // llms.txt write/reset answer rendered_bytes, not rendered (include_rendered: true)
+                'probe_handled_by',         // /probe-schema handled_by; found_foreign only when it differs
+                'schema_if_output',         // /posts/{id}/schema write if_output: true refuses types another plugin prints
+                'robots_meta',              // /posts/{id}/seo yoast / rankmath blocks read + write noindex / nofollow
+                'rendered_seo',             // /posts/{id}/seo read: each engine block's rendered_title / rendered_description
+                'broken_links_fix',         // GET /broken-links, POST /posts/{id}/broken-link
+                'bulk_media_alt',           // POST /media/bulk-alt (+ /media/bulk-alt/undo)
+                'indexnow_key',             // /status indexnow { key_location, enabled, paused }
         );
+}
 …
                 $query_type = array();
                 foreach ( get_post_types( array( 'public' => true ), 'objects' ) as $obj ) {
                         if ( auditae_rest_post_type_allowed( $obj ) ) {
+                        if ( auditae_rest_post_type_allowed( $obj ) && auditae_rest_post_type_in_any( $obj ) ) {
                                 $query_type[] = $obj->name;
+                        }
 …
                         'post_type'     => $p->post_type,
                         'is_front_page' => auditae_rest_is_front_page( $p ),
                         'title'     => get_the_title( $p ),
+                        'title'     => auditae_rest_plain_title( $p ),
                         'status'    => $p->post_status,
                         'date'      => auditae_rest_post_date( $p ),
 …
 /**
+ * POST /posts/{id}/elementor-restore {restore_id, force?} — put back the
+ * Elementor tree an AuditAE `replacements` edit replaced. Only trees this
+ * plugin kept itself (auditae_elementor_undo_push()) can be restored, by
+ * id; refused when the page changed since, unless force.
+ * POST /posts/{id}/restore (and its 0.37.0 name /elementor-restore)
+ * {restore_id, force?} — put back what an AuditAE edit replaced, by the id
+ * the edit answered with: an Elementor tree (elementor_restore_id, 'eu_…')
+ * or a post body (content_restore_id, 'cu_…': a `content` or
+ * `replacements` edit, an inserted internal link, a broken-link fix). Only
+ * what this plugin kept itself can be restored; refused when the post
+ * changed since, unless force. The restore answers its own restore id, so
+ * it can be undone too.
  */
 function auditae_rest_elementor_restore( WP_REST_Request $request ) {
 …
                 return new WP_Error( 'auditae_not_found', 'post not found', array( 'status' => 404 ) );
+        }
-        if ( ! auditae_elementor_is_built( $post_id ) ) {
-                return new WP_Error( 'auditae_bad_request', 'This post is not built with Elementor. Undo other edits with previous_state (wp_update_post with the old values).', array( 'status' => 400 ) );
+        }
         $restore_id = $request->get_param( 'restore_id' );
+        if ( ! is_string( $restore_id ) || ! preg_match( '/^eu_[a-z0-9]{16}$/', $restore_id ) ) {
+                return new WP_Error( 'auditae_bad_request', 'restore_id is required: the elementor_restore_id an Elementor text edit answered with.', array( 'status' => 400 ) );
+        }
+        $res = auditae_elementor_undo_restore( $post_id, $restore_id, rest_sanitize_boolean( $request->get_param( 'force' ) ) );
+        if ( ! is_string( $restore_id ) || ! preg_match( '/^(eu|cu)_[a-z0-9]{16}$/', $restore_id ) ) {
+                return new WP_Error( 'auditae_bad_request', 'restore_id is required: the elementor_restore_id or content_restore_id an edit answered with.', array( 'status' => 400 ) );
+        }
+        if ( 'trash' === $post->post_status ) {
+                return new WP_Error( 'auditae_post_trashed', 'This post is in the trash. Restore it first (POST /posts/' . $post_id . '/untrash).', array( 'status' => 409 ) );
+        }
+        $res = auditae_undo_restore( $post_id, $restore_id, rest_sanitize_boolean( $request->get_param( 'force' ) ) );
         if ( is_wp_error( $res ) ) {
                 return $res;
+        }
+        auditae_log_action( 'elementor_restore', 'post_id=' . $post_id . ' restore_id=' . $restore_id, array( '_elementor_data' => $res['previous'] ) );
+        $elementor = 'elementor' === $res['kind'];
+        auditae_log_action(
+                $elementor ? 'elementor_restore' : 'content_restore',
+                'post_id=' . $post_id . ' restore_id=' . $restore_id . ( '' !== $res['restore_id'] ? ' new_restore_id=' . $res['restore_id'] : '' ),
+                $elementor ? array( '_elementor_data' => $res['previous'] ) : array()
+        );
         $answer = array(
+                'post_id'        => $post_id,
+                'status'         => get_post_status( $post_id ),
+                'restored'       => $restore_id,
+                'builder'        => 'elementor',
+                'edit_url'       => auditae_rest_edit_url( $post_id ),
+                'previous_state' => array( '_elementor_data' => $res['previous'] ),
+        );
+                'post_id'  => $post_id,
+                'status'   => get_post_status( $post_id ),
+                'restored' => $restore_id,
+                'builder'  => auditae_rest_builder( get_post( $post_id ) ),
+                'edit_url' => auditae_rest_edit_url( $post_id ),
+        );
+        if ( rest_sanitize_boolean( $request->get_param( 'include_previous_content' ) ) ) {
+                $answer['previous_state'] = $elementor ? array( '_elementor_data' => $res['previous'] ) : array( 'content' => $res['previous'] );
+        }
         if ( '' !== $res['restore_id'] ) {
                 $answer['elementor_restore_id'] = $res['restore_id'];
+                $answer[ $elementor ? 'elementor_restore_id' : 'content_restore_id' ] = $res['restore_id'];
+        }
         return rest_ensure_response( $answer );
 …
+}
+/**
+ * Whether GET /posts?post_type=any lists this type: content visitors can
+ * open, not page-builder template stores. Elementor's elementor_library
+ * ("Default Kit", headers, popups) is registered public but isn't viewable
+ * by visitors, and its URLs 404 for them. Those types stay readable by
+ * name (post_type=elementor_library).
+ *
+ * @param WP_Post_Type $pt_obj Post type.
+ * @return bool
+ */
+function auditae_rest_post_type_in_any( $pt_obj ) {
+        if ( ! $pt_obj || ! $pt_obj->public ) {
+                return false;
+        }
+        $templates = array(
+                'elementor_library',
+                'e-floating-buttons',
+                'elementor_snippet',
+                'elementor_font',
+                'elementor_icons',
+                'jet-theme-core',
+                'jet-engine',
+                'ae_global_templates',
+                'oceanwp_library',
+                'astra-advanced-hook',
+                'fl-builder-template',
+                'et_pb_layout',
+                'brizy_template',
+                'ct_template',
+                'kadence_element',
+                'gp_elements',
+        );
+        /**
+         * Filter the post types left out of GET /posts?post_type=any.
+         *
+         * @param string[] $templates Post type names.
+         */
+        $templates = (array) apply_filters( 'auditae_rest_any_excluded_types', $templates );
+        if ( in_array( $pt_obj->name, $templates, true ) ) {
+                return false;
+        }
+        // A type visitors can't open (not publicly queryable) has no public URL.
+        return 'page' === $pt_obj->name || is_post_type_viewable( $pt_obj );
+}
 // Idempotency transient value while the create it guards is still running.
 define( 'AUDITAE_IDEM_PENDING', 'pending' );
 …
                 $remember( 'title', $post->post_title );
+        }
+        // The old body is no longer echoed back (it made every edit's answer as
+        // big as the page): it is kept on the post and restored by id
+        // (content_restore_id / elementor_restore_id → POST /posts/{id}/restore).
+        // include_previous_content: true brings the 0.37.0 shape back.
+        $full_previous = rest_sanitize_boolean( $request->get_param( 'include_previous_content' ) );
+        $content_before = (string) $post->post_content;
+        // Fields sent whose value is already stored (title, content, excerpt,
+        // slug, status), so the app can tell a resend from a change.
+        $unchanged = array();
+        foreach ( array( 'title' => $post->post_title, 'content' => $post->post_content, 'excerpt' => $post->post_excerpt, 'slug' => $post->post_name, 'status' => $post->post_status ) as $field => $stored ) {
+                $sent = $request->get_param( $field );
+                if ( is_string( $sent ) && $sent === (string) $stored ) {
+                        $unchanged[] = $field;
+                }
+        }
         if ( is_string( $content ) ) {
                 $update['post_content'] = $content;
+                $remember( 'content', $post->post_content );
+                if ( $full_previous ) {
+                        $remember( 'content', $post->post_content );
+                }
+        }
         $replaced        = null;
 …
         if ( is_array( $replacements ) ) {
                 $elementor_before = $is_elementor ? (string) get_post_meta( $post_id, '_elementor_data', true ) : '';
+                if ( $is_elementor ) {
+                        $previous['_elementor_data'] = $elementor_before;
+                } else {
+                        $remember( 'content', $post->post_content );
+                if ( $full_previous ) {
+                        if ( $is_elementor ) {
+                                $previous['_elementor_data'] = $elementor_before;
+                        } else {
+                                $remember( 'content', $post->post_content );
+                        }
+                }
                 // Elementor pages are saved inside; plain posts hand back the new
 …
+        }
+        auditae_log_action( 'update_post', 'post_id=' . $post_id . ( '' !== $elementor_undo ? ' elementor_restore_id=' . $elementor_undo : '' ), $previous );
+        // A changed plain-post body is kept for undo by id.
+        $content_undo = '';
+        $undo_pairs   = null;
+        if ( ! $is_elementor && ( is_string( $content ) || ( is_array( $replacements ) && null !== $replaced && ! $replaced['elementor'] ) ) ) {
+                $content_undo = auditae_content_undo_push( $post_id, $content_before );
+                if ( is_array( $replacements ) && '' !== $content_undo ) {
+                        $undo_pairs = auditae_replacements_undo_pairs( $content_before, (string) get_post_field( 'post_content', $post_id, 'raw' ), $replaced, array_values( $replacements ) );
+                }
+        }
+        $log_detail = 'post_id=' . $post_id . ( '' !== $elementor_undo ? ' elementor_restore_id=' . $elementor_undo : '' ) . ( '' !== $content_undo ? ' content_restore_id=' . $content_undo : '' );
+        auditae_log_action( 'update_post', $log_detail, $previous );
         $answer = array(
                 'post_id'              => $post_id,
                 'status'               => get_post_status( $post_id ),
+                'previous_state'       => $previous,
+                // Old values of the small fields changed ({} when only the body
+                // changed: its undo is content_restore_id / elementor_restore_id).
+                'previous_state'       => empty( $previous ) ? new stdClass() : $previous,
                 'edit_url'             => auditae_rest_edit_url( $post_id ),
                 'builder'              => auditae_rest_builder( get_post( $post_id ) ),
 …
         if ( '' !== $elementor_undo ) {
                 $answer['elementor_restore_id'] = $elementor_undo;
+        }
+        if ( '' !== $content_undo ) {
+                // Undo of the body change: POST /posts/{id}/restore {restore_id}.
+                $answer['content_restore_id'] = $content_undo;
+        }
+        if ( null !== $undo_pairs ) {
+                // Or send these as `replacements` (verified to give back the old body).
+                $answer['undo_replacements'] = $undo_pairs;
+        }
+        if ( $unchanged ) {
+                $answer['unchanged_fields'] = $unchanged;
+        }
         return rest_ensure_response( $answer );
 …
+        }
+        // Only the engines that run: an inactive one's block was always empty
+        // (or stale leftovers) and read as if it applied.
+        $engines  = array_keys( array_filter( array( 'yoast' => $yoast_active, 'rankmath' => $rm_active ) ) );
         $map      = auditae_post_seo_meta_map();
         $snapshot = array();
         foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
+        foreach ( $engines as $engine ) {
                 $snapshot[ $engine ] = array();
                 foreach ( $map[ $engine ] as $logical => $meta_key ) {
                         $snapshot[ $engine ][ $logical ] = get_post_meta( $post_id, $meta_key, true );
+                }
+                // noindex / nofollow as this engine renders them for the post
+                // (its own per-post setting, else the site / post type default).
+                $robots                          = auditae_seo_robots_get( $post_id, $engine );
+                $snapshot[ $engine ]['noindex']  = $robots['noindex'];
+                $snapshot[ $engine ]['nofollow'] = $robots['nofollow'];
+        }
         if ( 'read' === $action ) {
+                foreach ( $engines as $engine ) {
+                        // The title and description that actually print, templates
+                        // resolved (an empty field shows the template's output); null
+                        // when the engine's API can't say outside a page view.
+                        $snapshot[ $engine ] += auditae_seo_rendered( $post_id, $engine );
+                        $snapshot[ $engine ]['robots_source'] = auditae_seo_robots_get( $post_id, $engine )['source'];
+                }
                 return rest_ensure_response(
                         array(
                                 'action'           => 'read',
                                 'post_id'          => $post_id,
                                 'provider'         => auditae_seo_meta_provider(),
                                 'yoast_active'     => $yoast_active,
                                 'rankmath_active'  => $rm_active,
                                 'seo'              => $snapshot,
+                                'action'          => 'read',
+                                'post_id'         => $post_id,
+                                'provider'        => auditae_seo_meta_provider(),
+                                'yoast_active'    => $yoast_active,
+                                'rankmath_active' => $rm_active,
+                                'seo'             => $snapshot,
+                        )
                 );
 …
         // SEO fields are single strings; an array or object would be stored
         // as-is and break the SEO plugin's output. Checked before any write so
+        // a bad field doesn't leave the other engine half-updated.
+        // a bad field doesn't leave the other engine half-updated. noindex /
+        // nofollow are booleans (null: back to the default).
+        $robots_by_engine = array();
         foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
                 $requested = $request->get_param( $engine );
 …
+                        }
+                }
+                $robot_keys = array_intersect_key( $requested, array( 'noindex' => 1, 'nofollow' => 1 ) );
+                if ( $robot_keys ) {
+                        $parsed = auditae_seo_robots_parse( $robot_keys );
+                        if ( is_wp_error( $parsed ) ) {
+                                return $parsed;
+                        }
+                        $robots_by_engine[ $engine ] = $parsed;
+                }
+        }
+        // A top-level robots {noindex, nofollow} applies to every active engine.
+        if ( null !== $request->get_param( 'robots' ) ) {
+                $parsed = auditae_seo_robots_parse( $request->get_param( 'robots' ) );
+                if ( is_wp_error( $parsed ) ) {
+                        return $parsed;
+                }
+                foreach ( $engines as $engine ) {
+                        $robots_by_engine[ $engine ] = isset( $robots_by_engine[ $engine ] ) ? $robots_by_engine[ $engine ] + $parsed : $parsed;
+                }
+        }
         $applied  = array();
+        $previous = $snapshot;
+        foreach ( array( 'yoast', 'rankmath' ) as $engine ) {
+                $engine_active = ( 'yoast' === $engine ) ? $yoast_active : $rm_active;
+                if ( ! $engine_active ) {
+                        continue;
+                }
+        $previous = array();
+        foreach ( $engines as $engine ) {
                 $requested = $request->get_param( $engine );
+                if ( ! is_array( $requested ) ) {
+                        continue;
+                }
+                $applied[ $engine ] = array();
+                foreach ( $map[ $engine ] as $logical => $meta_key ) {
+                        if ( ! array_key_exists( $logical, $requested ) ) {
+                                continue;
+                $done      = array();
+                if ( is_array( $requested ) ) {
+                        foreach ( $map[ $engine ] as $logical => $meta_key ) {
+                                if ( ! array_key_exists( $logical, $requested ) ) {
+                                        continue;
+                                }
+                                $value = wp_strip_all_tags( (string) $requested[ $logical ] );
+                                update_post_meta( $post_id, $meta_key, wp_slash( $value ) );
+                                $done[ $logical ] = $value;
+                        }
+                        $value = wp_strip_all_tags( (string) $requested[ $logical ] );
+                        update_post_meta( $post_id, $meta_key, wp_slash( $value ) );
+                        $applied[ $engine ][ $logical ] = $value;
+                }
+                if ( empty( $applied[ $engine ] ) ) {
+                        unset( $applied[ $engine ] );
+                }
+                if ( isset( $robots_by_engine[ $engine ] ) ) {
+                        auditae_seo_robots_set( $post_id, $engine, $robots_by_engine[ $engine ] );
+                        $after = auditae_seo_robots_get( $post_id, $engine );
+                        foreach ( array_keys( $robots_by_engine[ $engine ] ) as $k ) {
+                                $done[ $k ] = $after[ $k ];
+                        }
+                }
+                if ( $done ) {
+                        $applied[ $engine ] = $done;
+                        // Old values of the fields written only (the full snapshot of
+                        // both engines was echoed before).
+                        $previous[ $engine ] = array_intersect_key( $snapshot[ $engine ], $done );
+                }
+        }
 …
                 return new WP_Error(
                         'auditae_bad_request',
                         'No applicable SEO fields supplied. Send {yoast: {...}} and/or {rankmath: {...}}.',
+                        'No applicable SEO fields supplied. Send {' . implode( ': {...}} and/or {', $engines ) . ': {...}} (the active SEO plugin) with title, description, canonical, focus_keyword, noindex and/or nofollow.',
                         array( 'status' => 400 )
                 );
 …
                                 'yoast_active'    => false,
                                 'rankmath_active' => false,
+                                'seo'             => array( 'auditae' => $current ),
+                                // noindex / nofollow are among the stored fields; rendered_*
+                                // are the title and description that print (0.38.0).
+                                'seo'             => array( 'auditae' => $current + auditae_seo_rendered( $post_id, 'auditae' ) ),
                                 'output'          => $output,
+                        )
 …
+        }
         $fields = is_array( $requested ) ? array_intersect_key( $requested, auditae_seo_meta_empty() ) : array();
+        // robots: {noindex, nofollow} works on every provider; here it is the
+        // same two stored fields (null = off, the default).
+        if ( null !== $request->get_param( 'robots' ) ) {
+                $robots_in = auditae_seo_robots_parse( $request->get_param( 'robots' ) );
+                if ( is_wp_error( $robots_in ) ) {
+                        return $robots_in;
+                }
+                foreach ( $robots_in as $k => $v ) {
+                        $fields[ $k ] = (bool) $v;
+                }
+        }
         if ( empty( $fields ) ) {
                 return new WP_Error(
 …
                 );
+        }
+        // if_output: true — refuse before saving when another source already
+        // prints FAQPage for this post (AuditAE's pairs would never be output).
+        $faq_owner = auditae_faq_foreign_source( $post_id );
+        if ( '' !== $faq_owner && rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                return new WP_Error(
+                        'auditae_schema_not_output',
+                        sprintf( 'Nothing was saved: %s already prints FAQPage on this post, so AuditAE would store these pairs but never print them. Edit the FAQ there instead.', $faq_owner ),
+                        array(
+                                'status'     => 409,
+                                'handled_by' => array( array( 'type' => 'FAQPage', 'handled_by' => $faq_owner ) ),
+                        )
+                );
+        }
         $res = auditae_faq_save( $post_id, $qas );
         if ( 0 === $res['applied'] ) {
 …
                 );
+        }
+        // if_output: true — refuse before saving when a node's type would be
+        // stored but not printed because another plugin prints that type here
+        // (an SEO plugin's Article, WooCommerce's Product): a paid write that
+        // changes nothing on the page. The answer names who handles each.
+        if ( rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                $list    = isset( $schemas['@type'] ) ? array( $schemas ) : $schemas;
+                $handled = array();
+                foreach ( (array) $list as $node ) {
+                        $type = auditae_schema_primary_type( $node );
+                        if ( '' !== $type && ! auditae_should_emit_schema_type( $type, $post_id ) ) {
+                                $owner     = auditae_schema_type_owner( $type, $post_id );
+                                $handled[] = array(
+                                        'type'       => $type,
+                                        'handled_by' => '' !== $owner ? $owner : 'another plugin',
+                                );
+                        }
+                }
+                if ( $handled ) {
+                        return new WP_Error(
+                                'auditae_schema_not_output',
+                                sprintf(
+                                        'Nothing was saved: %s, so AuditAE would store this but never print it. Edit the schema in that plugin instead, or send only the other types.',
+                                        implode(
+                                                '; ',
+                                                array_map(
+                                                        static function ( $h ) {
+                                                                return $h['handled_by'] . ' prints ' . $h['type'] . ' on this post';
+                                                        },
+                                                        $handled
+                                                )
+                                        )
+                                ),
+                                array(
+                                        'status'     => 409,
+                                        'handled_by' => $handled,
+                                )
+                        );
+                }
+        }
         $res = auditae_post_schema_save( $post_id, $schemas );
         if ( ! empty( $res['error'] ) ) {
 …
                 );
+        }
+        // if_output: true — a write of Organization nodes only is refused before
+        // saving when AuditAE would hold them back (an SEO plugin prints the
+        // site's publisher, or the theme / another plugin already does).
+        if ( rest_sanitize_boolean( $request->get_param( 'if_output' ) ) ) {
+                $list  = isset( $schemas['@type'] ) ? array( $schemas ) : $schemas;
+                $types = array_unique( array_filter( array_map( 'auditae_schema_primary_type', (array) $list ) ) );
+                if ( array( 'Organization' ) === array_values( $types ) ) {
+                        $signal = auditae_org_seo_signal();
+                        if ( ! in_array( $signal, array( 'none', 'seo_silent' ), true ) ) {
+                                $owner = 'other_verified' === $signal ? 'the theme or another plugin' : auditae_seo_plugin_label();
+                                return new WP_Error(
+                                        'auditae_schema_not_output',
+                                        sprintf( 'Nothing was saved: %s already prints the site\'s Organization, so AuditAE would store this one but hold it back. Edit it there, or reuse its @id (wp_probe_schema).', $owner ),
+                                        array(
+                                                'status'     => 409,
+                                                'handled_by' => array( array( 'type' => 'Organization', 'handled_by' => $owner ) ),
+                                        )
+                                );
+                        }
+                }
+        }
         $res = auditae_org_schema_save( $schemas );
         if ( ! empty( $res['error'] ) ) {
 …
         // { @type: [@id, …] } maps: an empty PHP array would encode as [] and
         // read as a list, not an object.
+        foreach ( array( 'found', 'found_foreign' ) as $key ) {
+        if ( is_array( $probe ) ) {
+                // found_foreign repeated found on every site where AuditAE prints
+                // nothing on the homepage. Sent only when it differs; when it's
+                // left out it equals found (foreign_same_as_found: true).
+                $found   = isset( $probe['found'] ) && is_array( $probe['found'] ) ? $probe['found'] : array();
+                $foreign = isset( $probe['found_foreign'] ) && is_array( $probe['found_foreign'] ) ? $probe['found_foreign'] : null;
+                if ( null !== $foreign && wp_json_encode( $foreign ) === wp_json_encode( $found ) ) {
+                        unset( $probe['found_foreign'] );
+                        $probe['foreign_same_as_found'] = true;
+                } elseif ( null !== $foreign ) {
+                        $probe['foreign_same_as_found'] = false;
+                }
+                // Which schema types another plugin prints instead of AuditAE (so
+                // an AuditAE node of that type is stored but not output), by type:
+                // { "Article": "Yoast SEO", … }; {} when AuditAE prints them all.
+                // Per-post owners (WooCommerce Product, an SEO plugin's HowTo
+                // block) are answered by /posts/{id}/schema's not_output.
+                $probe['handled_by'] = auditae_rest_schema_handled_by();
+        }
+        // { @type: [@id, …] } maps: an empty PHP array would encode as [] and
+        // read as a list, not an object.
+        foreach ( array( 'found', 'found_foreign', 'handled_by' ) as $key ) {
                 if ( is_array( $probe ) && array_key_exists( $key, $probe ) && is_array( $probe[ $key ] ) && empty( $probe[ $key ] ) ) {
                         $probe[ $key ] = new stdClass();
 …
+        }
         return rest_ensure_response( $probe );
+}
+/**
+ * Site-wide: schema type => the plugin that prints it instead of AuditAE.
+ *
+ * @return array<string,string>
+ */
+function auditae_rest_schema_handled_by() {
+        $out = array();
+        foreach ( array_unique( array_merge( auditae_schema_seo_owned_types(), auditae_schema_supported_types() ) ) as $type ) {
+                if ( ! is_string( $type ) || auditae_should_emit_schema_type( $type, 0 ) ) {
+                        continue;
+                }
+                $owner        = auditae_schema_type_owner( $type, 0 );
+                $out[ $type ] = '' !== $owner ? $owner : 'another plugin (auditae_should_emit_schema_type filter)';
+        }
+        return $out;
+}
 …
                 );
                 return rest_ensure_response(
+                        array(
+                                'action'         => 'reset',
+                                'previous_state' => array( 'config' => $res['previous'] ),
+                                'config'         => $res['applied'],
+                                'rendered'       => auditae_llms_txt_render(),
+                        auditae_rest_llms_txt_write_answer(
+                                $request,
+                                array(
+                                        'action'         => 'reset',
+                                        'previous_state' => array( 'config' => $res['previous'] ),
+                                        'config'         => $res['applied'],
+                                )
+                        )
                 );
 …
         );
         return rest_ensure_response(
+                array(
+                        'action'         => 'write',
+                        'mode'           => 'replace' === $mode ? 'replace' : 'merge',
+                        'previous_state' => array( 'config' => $res['previous'] ),
+                        'config'         => $res['applied'],
+                        'rendered'       => auditae_llms_txt_render(),
+                )
+        );
+                auditae_rest_llms_txt_write_answer(
+                        $request,
+                        array(
+                                'action'         => 'write',
+                                'mode'           => 'replace' === $mode ? 'replace' : 'merge',
+                                'previous_state' => array( 'config' => $res['previous'] ),
+                                'config'         => $res['applied'],
+                        )
+                )
+        );
+}
+/**
+ * A write/reset answer without the whole rendered file (it is served at
+ * `url`, and GET /llms-txt returns it): its size and line count instead,
+ * so the answer stays small. include_rendered: true adds it back.
+ *
+ * @param WP_REST_Request $request Request.
+ * @param array           $answer  Answer so far.
+ * @return array
+ */
+function auditae_rest_llms_txt_write_answer( WP_REST_Request $request, array $answer ) {
+        $rendered          = (string) auditae_llms_txt_render();
+        $answer['url']     = home_url( '/llms.txt' );
+        $answer['rendered_bytes'] = strlen( $rendered );
+        $answer['rendered_lines'] = '' === $rendered ? 0 : substr_count( $rendered, "\n" ) + 1;
+        if ( rest_sanitize_boolean( $request->get_param( 'include_rendered' ) ) ) {
+                $answer['rendered'] = $rendered;
+        }
+        return $answer;
+}
 …
                                 break;
+                        }
+                }
+                // A rule only runs when WordPress would answer 404, so one for a page
+                // that is live never fires: the write succeeded (and was billed)
+                // while the page kept answering 200. Refuse before saving, unless
+                // force (then it's saved, inactive until the page is gone).
+                $force = rest_sanitize_boolean( $request->get_param( 'force' ) );
+                $live  = auditae_redirects_source_live( $source_norm );
+                if ( null !== $live && ! $force ) {
+                        $what = 'front_page' === $live['kind'] ? 'the front page'
+                                : ( 'archive' === $live['kind'] ? 'a live archive (category, tag, author or post type)'
+                                : ( 'file' === $live['kind'] ? 'a file on disk'
+                                : sprintf( 'a published %1$s ("%2$s", id %3$d)', $live['kind'], $live['title'], $live['post_id'] ) ) );
+                        return new WP_Error(
+                                'auditae_redirect_source_live',
+                                sprintf(
+                                        'Nothing was saved: %1$s is %2$s. AuditAE redirects only fire when WordPress would answer 404 for the path, so this one would never run and the page would keep loading. To move a post or page, change its slug (wp_update_post slug: WordPress then sends the old address to the new one itself), or trash it first (wp_trash_post) and then add the redirect. force: true saves the rule anyway, inactive until the page is gone.',
+                                        $source_norm,
+                                        $what
+                                ),
+                                array(
+                                        'status'      => 409,
+                                        'source_kind' => $live['kind'],
+                                        'post_id'     => $live['post_id'],
+                                        'view_url'    => $live['view_url'],
+                                )
+                        );
+                }
 …
                 );
+                return rest_ensure_response(
+                        array(
+                                'action'         => 'write',
+                                'rule'           => $applied,
+                                'previous_state' => $previous, // null if this was a new rule
+                        )
+                );
+                $answer = array(
+                        'action'         => 'write',
+                        'rule'           => $applied,
+                        'previous_state' => $previous, // null if this was a new rule
+                        // False when the source still serves a live page (saved with
+                        // force): the rule runs only once that page answers 404.
+                        'active'         => null === $live,
+                );
+                if ( null !== $live ) {
+                        $answer['warning'] = 'Saved inactive: ' . $source_norm . ' still serves a live ' . str_replace( '_', ' ', $live['kind'] ) . ', and redirects only fire on a 404. It starts working once that page is trashed or its slug changes.';
+                }
+                return rest_ensure_response( $answer );
+        }

auditae-ai-search-toolkit/trunk/includes/seo-meta.php

-              r3775803
+              r3777340
         return 1 === preg_match( $pattern, (string) $html );
+}
+// ────────────────────────────────────────────────────────────────────
+// Per-post robots (noindex / nofollow) and the title / description that
+// actually render, for every provider (0.38.0)
+// ────────────────────────────────────────────────────────────────────
+/**
+ * Rank Math's titles options (robots defaults, title templates).
+ *
+ * @return array
+ */
+function auditae_seo_rankmath_titles() {
+        $opt = get_option( 'rank-math-options-titles', array() );
+        return is_array( $opt ) ? $opt : array();
+}
+/**
+ * A post's robots as the provider stores them: {noindex, nofollow, source}.
+ * source is 'post' when the post sets them itself, 'default' when it
+ * follows the site / post type default (whose effective value is given).
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath | auditae.
+ * @return array{noindex:bool,nofollow:bool,source:string}
+ */
+function auditae_seo_robots_get( $post_id, $provider ) {
+        $post_id = (int) $post_id;
+        $type    = (string) get_post_type( $post_id );
+        if ( 'yoast' === $provider ) {
+                $ni  = (string) get_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex', true );
+                $nf  = (string) get_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow', true );
+                $def = false;
+                if ( class_exists( 'WPSEO_Options' ) && method_exists( 'WPSEO_Options', 'get' ) ) {
+                        $def = (bool) WPSEO_Options::get( 'noindex-' . $type, false );
+                }
+                return array(
+                        'noindex'  => '1' === $ni || ( '2' !== $ni && $def ),
+                        'nofollow' => '1' === $nf,
+                        'source'   => ( in_array( $ni, array( '1', '2' ), true ) || '1' === $nf ) ? 'post' : 'default',
+                );
+        }
+        if ( 'rankmath' === $provider ) {
+                $own = get_post_meta( $post_id, 'rank_math_robots', true );
+                $own = is_array( $own ) ? array_values( array_filter( array_map( 'strval', $own ) ) ) : array();
+                if ( ! empty( $own ) ) {
+                        $robots = $own;
+                        $source = 'post';
+                } else {
+                        $titles = auditae_seo_rankmath_titles();
+                        $custom = isset( $titles[ 'pt_' . $type . '_custom_robots' ] ) && 'on' === $titles[ 'pt_' . $type . '_custom_robots' ] && isset( $titles[ 'pt_' . $type . '_robots' ] );
+                        $robots = $custom ? (array) $titles[ 'pt_' . $type . '_robots' ] : ( isset( $titles['robots_global'] ) ? (array) $titles['robots_global'] : array() );
+                        $source = 'default';
+                }
+                return array(
+                        'noindex'  => in_array( 'noindex', $robots, true ),
+                        'nofollow' => in_array( 'nofollow', $robots, true ),
+                        'source'   => $source,
+                );
+        }
+        $f = auditae_seo_meta_get( $post_id );
+        return array(
+                'noindex'  => (bool) $f['noindex'],
+                'nofollow' => (bool) $f['nofollow'],
+                'source'   => ( $f['noindex'] || $f['nofollow'] ) ? 'post' : 'default',
+        );
+}
+/**
+ * Validate a robots write: {noindex?, nofollow?} booleans (null = back to
+ * the default).
+ *
+ * @param mixed $in Request value.
+ * @return array|WP_Error Keys present only for what was sent.
+ */
+function auditae_seo_robots_parse( $in ) {
+        if ( ! is_array( $in ) ) {
+                return new WP_Error( 'auditae_bad_request', '`robots` must be an object {noindex?: boolean, nofollow?: boolean}.', array( 'status' => 400 ) );
+        }
+        $out = array();
+        foreach ( array( 'noindex', 'nofollow' ) as $k ) {
+                if ( ! array_key_exists( $k, $in ) ) {
+                        continue;
+                }
+                $v = $in[ $k ];
+                if ( null !== $v && ! is_bool( $v ) && ! is_int( $v ) && ! is_string( $v ) ) {
+                        return new WP_Error( 'auditae_bad_request', sprintf( 'robots.%s must be true, false or null.', $k ), array( 'status' => 400 ) );
+                }
+                $out[ $k ] = null === $v ? null : rest_sanitize_boolean( $v );
+        }
+        if ( empty( $out ) ) {
+                return new WP_Error( 'auditae_bad_request', '`robots` needs noindex and/or nofollow.', array( 'status' => 400 ) );
+        }
+        return $out;
+}
+/**
+ * Write robots into Yoast's or Rank Math's own per-post fields (the ones
+ * their Advanced tab edits). false writes an explicit "index" / removes
+ * "nofollow"; null puts the post back on the site default.
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath.
+ * @param array  $robots   auditae_seo_robots_parse() result.
+ */
+function auditae_seo_robots_set( $post_id, $provider, array $robots ) {
+        $post_id = (int) $post_id;
+        if ( 'yoast' === $provider ) {
+                if ( array_key_exists( 'noindex', $robots ) ) {
+                        if ( null === $robots['noindex'] ) {
+                                delete_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex' );
+                        } else {
+                                update_post_meta( $post_id, '_yoast_wpseo_meta-robots-noindex', $robots['noindex'] ? '1' : '2' );
+                        }
+                }
+                if ( array_key_exists( 'nofollow', $robots ) ) {
+                        if ( $robots['nofollow'] ) {
+                                update_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow', '1' );
+                        } else {
+                                delete_post_meta( $post_id, '_yoast_wpseo_meta-robots-nofollow' );
+                        }
+                }
+                return;
+        }
+        if ( 'rankmath' === $provider ) {
+                $cur = auditae_seo_robots_get( $post_id, 'rankmath' );
+                $own = get_post_meta( $post_id, 'rank_math_robots', true );
+                $own = is_array( $own ) ? array_values( array_filter( array_map( 'strval', $own ) ) ) : array();
+                // Rank Math reads the per-post list whole once it's set, so start
+                // from what the post renders now and change only what was sent.
+                $noindex  = array_key_exists( 'noindex', $robots ) ? $robots['noindex'] : $cur['noindex'];
+                $nofollow = array_key_exists( 'nofollow', $robots ) ? $robots['nofollow'] : $cur['nofollow'];
+                if ( null === $noindex && null === $nofollow ) {
+                        delete_post_meta( $post_id, 'rank_math_robots' );
+                        return;
+                }
+                // Other directives the post set (noarchive, nosnippet…) are kept.
+                $list   = array_values( array_diff( $own, array( 'index', 'noindex', 'nofollow' ) ) );
+                $list[] = $noindex ? 'noindex' : 'index';
+                if ( $nofollow ) {
+                        $list[] = 'nofollow';
+                }
+                update_post_meta( $post_id, 'rank_math_robots', array_values( array_unique( $list ) ) );
+        }
+}
+/**
+ * The title tag and meta description the provider renders for a post,
+ * templates resolved (a post with empty fields shows its template's
+ * output). '' for a description nothing prints. Null when it can't be
+ * worked out outside a page view (the provider's API is unavailable).
+ *
+ * @param int    $post_id  Post ID.
+ * @param string $provider yoast | rankmath | auditae.
+ * @return array{rendered_title:?string,rendered_description:?string}
+ */
+function auditae_seo_rendered( $post_id, $provider ) {
+        $post_id = (int) $post_id;
+        $post    = get_post( $post_id );
+        $out     = array(
+                'rendered_title'       => null,
+                'rendered_description' => null,
+        );
+        if ( ! $post ) {
+                return $out;
+        }
+        $clean = static function ( $s ) {
+                return trim( html_entity_decode( wp_strip_all_tags( (string) $s ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
+        };
+        try {
+                if ( 'yoast' === $provider ) {
+                        if ( function_exists( 'YoastSEO' ) ) {
+                                $meta = YoastSEO()->meta->for_post( $post_id );
+                                if ( $meta ) {
+                                        $out['rendered_title']       = $clean( $meta->title );
+                                        $out['rendered_description'] = $clean( $meta->description );
+                                }
+                        }
+                        return $out;
+                }
+                if ( 'rankmath' === $provider ) {
+                        if ( class_exists( '\RankMath\Helper' ) && method_exists( '\RankMath\Helper', 'replace_vars' ) ) {
+                                // Rank Math registers its %vars% on the front end's `wp`
+                                // action, which a REST request never reaches; its setup()
+                                // runs once and is public.
+                                $rm = function_exists( 'rank_math' ) ? rank_math() : null;
+                                if ( ! is_object( $rm ) || ! isset( $rm->variables ) || ! is_object( $rm->variables ) ) {
+                                        // Rank Math before its account step (connect or skip)
+                                        // loads none of its front end and prints no title or
+                                        // description: WordPress's own title is what shows.
+                                        return array(
+                                                'rendered_title'       => auditae_seo_wp_document_title( $post ),
+                                                'rendered_description' => '',
+                                        );
+                                }
+                                if ( method_exists( $rm->variables, 'setup' ) ) {
+                                        $rm->variables->setup();
+                                }
+                                $titles = auditae_seo_rankmath_titles();
+                                $type   = $post->post_type;
+                                $title  = (string) get_post_meta( $post_id, 'rank_math_title', true );
+                                if ( '' === $title ) {
+                                        $title = isset( $titles[ 'pt_' . $type . '_title' ] ) ? (string) $titles[ 'pt_' . $type . '_title' ] : '%title% %sep% %sitename%';
+                                }
+                                $desc = (string) get_post_meta( $post_id, 'rank_math_description', true );
+                                if ( '' === $desc ) {
+                                        $desc = isset( $titles[ 'pt_' . $type . '_description' ] ) ? (string) $titles[ 'pt_' . $type . '_description' ] : '%excerpt%';
+                                }
+                                $out['rendered_title']       = $clean( \RankMath\Helper::replace_vars( $title, $post ) );
+                                $out['rendered_description'] = $clean( \RankMath\Helper::replace_vars( $desc, $post ) );
+                        }
+                        return $out;
+                }
+        } catch ( \Throwable $e ) {
+                return $out;
+        }
+        if ( 'auditae' !== $provider ) {
+                return $out;
+        }
+        // No SEO plugin: AuditAE's stored title, else WordPress's own document
+        // title (title-tag themes); the description only when one is stored
+        // (nothing else prints one).
+        $f = auditae_seo_meta_get( $post_id );
+        $out['rendered_title']       = '' !== $f['title'] ? $f['title'] : auditae_seo_wp_document_title( $post );
+        $out['rendered_description'] = $f['description'];
+        return $out;
+}
+/**
+ * The <title> WordPress itself prints for a post (themes with title-tag
+ * support and block themes), or null when the theme prints its own.
+ *
+ * @param WP_Post $post Post.
+ * @return string|null
+ */
+function auditae_seo_wp_document_title( $post ) {
+        if ( ! current_theme_supports( 'title-tag' ) && ! ( function_exists( 'wp_is_block_theme' ) && wp_is_block_theme() ) ) {
+                return null;
+        }
+        $sep   = apply_filters( 'document_title_separator', '-' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- core's filter.
+        $front = 'page' === get_option( 'show_on_front' ) && (int) get_option( 'page_on_front' ) === (int) $post->ID;
+        $parts = $front
+                ? array( get_bloginfo( 'name', 'display' ), get_bloginfo( 'description', 'display' ) )
+                : array( get_the_title( $post ), get_bloginfo( 'name', 'display' ) );
+        return trim( html_entity_decode( wp_strip_all_tags( implode( ' ' . $sep . ' ', array_filter( $parts ) ) ), ENT_QUOTES | ENT_HTML5, 'UTF-8' ) );
+}

auditae-ai-search-toolkit/trunk/languages/auditae-ai-search-toolkit.pot

-              r3775803
+              r3777340
 msgid ""
 msgstr ""
 "Project-Id-Version: AuditAE – MCP Server & AI SEO 0.37.0\n"
+"Project-Id-Version: AuditAE – MCP Server & AI SEO 0.38.0\n"
 "Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/auditae-ai-search-toolkit\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 …
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "POT-Creation-Date: 2026-10-30T14:57:49+00:00\n"
+"POT-Creation-Date: 2026-10-31T19:49:26+00:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "X-Generator: WP-CLI 2.12.0\n"
 …
 msgstr[1] ""
 #: includes/link-index.php:850
+#: includes/link-index.php:988
 msgid "Post not found."
 msgstr ""
 #: includes/link-index.php:856
+#: includes/link-index.php:994
 msgid "Anchor text and target URL are both required."
 msgstr ""
 #: includes/link-index.php:862
+#: includes/link-index.php:1000
 msgid "Internal links only — the target must be on this site."
 msgstr ""
 #: includes/link-index.php:867
+#: includes/link-index.php:1005
 msgid "That phrase is no longer available as plain text in the post — it may have been edited or already linked."
 msgstr ""
 …
 msgstr ""
 #: includes/media.php:1040
 #: includes/media.php:1095
+#: includes/media.php:1242
+#: includes/media.php:1297
 msgid "Rename file"
 msgstr ""
 #: includes/media.php:1056
+#: includes/media.php:1258
 msgid "You don't have permission to rename this file."
 msgstr ""
 #: includes/media.php:1093
+#: includes/media.php:1295
 msgid "New file name (without extension). Renames every size and updates references in your posts:"
 msgstr ""
 #: includes/media.php:1094
+#: includes/media.php:1296
 msgid "Renaming…"
 msgstr ""
 #: includes/media.php:1096
+#: includes/media.php:1298
 msgid "Rename failed."
 msgstr ""

auditae-ai-search-toolkit/trunk/readme.txt

-              r3775803
+              r3777340
 Tested up to: 7.1
 Requires PHP: 7.4
 Stable tag: 0.37.0
+Stable tag: 0.38.0
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 …
 characters, so older entries are kept in the plugin's development history
 rather than here, where they would push the current release out of view.
+= 0.38.0 =
+* Internal links: a link to a page that doesn't exist, or to a draft, is refused before anything is written. Pages linked from your navigation menu no longer show up as orphans, and link-graph titles read as plain text.
+* Redirects: a redirect whose source is a live page (which would never fire, since redirects run only on a 404) is refused with a clear explanation.
+* Undo: every AI text edit, inserted link and link fix keeps a restore point on the site, so it can be undone in one step, Elementor pages included. Edit answers are much smaller.
+* New for paired agents: list and fix broken internal links, set alt text on up to 50 images at once (with undo), and read or set a post's noindex / nofollow through Yoast, Rank Math or AuditAE. Reading a post's SEO also shows the title and description that actually print.
+* Schema: an agent can ask that a schema type another plugin prints (Yoast's Article, WooCommerce's Product) be refused rather than saved unseen.
+* Renaming an image reports revisions separately from posts, and "all content types" listings skip page-builder templates.
 = 0.37.0 =
 …
 * New, for paired sites: AuditAE can compress Media Library images in place. Each JPEG, PNG or WebP keeps its file name and URL, its thumbnail sizes are compressed too, and the originals are kept in uploads/auditae-originals/: Restore original in the Media Library puts them back. It won't replace files while another image optimizer, image CDN or WebP copy is in place (Smush, ShortPixel, EWWW, Imagify, Jetpack's image CDN…) unless you confirm, and it skips protected folders such as WooCommerce downloads.
-= 0.34.0 =
-* New: a free Schema box in the post editor adds Article, Blog post, How-to or Product schema to a post, with a JSON-LD preview. No account needed.
-* Elementor 4: AuditAE can read and edit the text of atomic Heading, Paragraph and Button widgets.
-* Renaming an image also updates Elementor page settings, block widgets, header images and the social images Yoast, Rank Math and SEOPress store.
-* Coexistence: no duplicate FAQ schema next to Elementor's FAQ Schema switch or Rank Math's Schema Builder, Product schema is left to WooCommerce on product pages, and an Organization your theme or another plugin already prints is respected.
-* Faster: IndexNow URLs are queued and sent in batches (a post unpublished or set to noindex before its turn is skipped), the crawler log prunes once a day, and page views and 404s skip database reads for Organization schema and redirects.
-* The Links tab and the Dashboard widget no longer make the page wait: the link graph rebuilds and the scorecard refreshes in the background.
-* Connect tab: a free sign-up link with your site address filled in, a warning to paste the pairing code only at auditae.app, and how to use the site from Claude or ChatGPT over MCP. A pairing AuditAE no longer accepts asks you to re-pair.
-* Accessibility: higher-contrast colours, visible keyboard focus and screen-reader text on badges, new-tab links and repeated links.
-* A one-time review request on the AI crawlers tab after the first AI crawler visit.
-* Redirects tab: the Suggested redirects table fits its card, so the destination field and Save button are always visible.
 == Upgrade Notice ==
+= 0.38.0 =
+Safer AI links and redirects (broken targets and live sources refused), one-step undo for AI edits, menu-aware orphan report, and new bulk alt text, broken-link and robots tools for paired agents. No re-pair required.
 = 0.37.0 =

auditae-ai-search-toolkit/trunk/uninstall.php

-              r3775803
+              r3777340
         'auditae_redirect_sources',
         'auditae_org_fill_gap',
+        // 0.38.0: bulk alt-text undo tokens.
+        'auditae_alt_undo',
 );
 …
         $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_seo' ) );
         $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_elementor_undo' ) );
+        $wpdb->delete( $wpdb->postmeta, array( 'meta_key' => '_auditae_content_undo' ) );
         // Not deleted: _auditae_media_backup and uploads/auditae-originals/
         // (0.35.0). They hold the only copy of the images as they were before

Plugin Directory

Context Navigation

Legend:

auditae-ai-search-toolkit/tags/0.38.0/auditae.php

auditae-ai-search-toolkit/tags/0.38.0/includes/elementor.php

auditae-ai-search-toolkit/tags/0.38.0/includes/internal-links.php

auditae-ai-search-toolkit/tags/0.38.0/includes/link-index.php

auditae-ai-search-toolkit/tags/0.38.0/includes/media.php

auditae-ai-search-toolkit/tags/0.38.0/includes/redirects.php

auditae-ai-search-toolkit/tags/0.38.0/includes/rest-routes.php

auditae-ai-search-toolkit/tags/0.38.0/includes/seo-meta.php

auditae-ai-search-toolkit/tags/0.38.0/languages/auditae-ai-search-toolkit.pot

auditae-ai-search-toolkit/tags/0.38.0/readme.txt

auditae-ai-search-toolkit/tags/0.38.0/uninstall.php

auditae-ai-search-toolkit/trunk/auditae.php

auditae-ai-search-toolkit/trunk/includes/elementor.php

auditae-ai-search-toolkit/trunk/includes/internal-links.php

auditae-ai-search-toolkit/trunk/includes/link-index.php

auditae-ai-search-toolkit/trunk/includes/media.php

auditae-ai-search-toolkit/trunk/includes/redirects.php

auditae-ai-search-toolkit/trunk/includes/rest-routes.php

auditae-ai-search-toolkit/trunk/includes/seo-meta.php

auditae-ai-search-toolkit/trunk/languages/auditae-ai-search-toolkit.pot

auditae-ai-search-toolkit/trunk/readme.txt

auditae-ai-search-toolkit/trunk/uninstall.php

Download in other formats: