host-consensus 0.1.0 → 0.1.2

package/README.md

@@ -7,7 +7,7 @@
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![provenance](https://img.shields.io/badge/provenance-attested-brightgreen.svg)](https://www.npmjs.com/package/host-consensus)
 
-A runtime-path library — you import it into request-validation code and ship it.
+A runtime-path library: you import it into request-validation code and ship it.
 Zero runtime dependencies. TypeScript, ES2022, dual ESM/CJS, with a small CLI.
 
 ```bash
@@ -16,8 +16,8 @@ npm install host-consensus
 
 |  | reads the host as |
 |---|---|
-| `new URL()` — WHATWG, what every browser and Node run | **example.com** |
-| `urllib.parse` — RFC 3986, what most of the non-browser world runs | **evil.com** |
+| `new URL()`, the WHATWG rules every browser and Node run | **example.com** |
+| `urllib.parse`, the RFC 3986 rules most of the non-browser world runs | **evil.com** |
 
 Validate that URL in Node against an allowlist and it passes as `example.com`.
 Hand the same *string* to a Python service, a Go proxy, or anything else built
@@ -74,10 +74,10 @@ $ echo $?
 
 ## The seven constructions
 
-Over a deterministic enumeration of 312 URLs — 2 schemes x 26 authority
-constructions x 6 path suffixes — **84 rows** are read as a different host by
+Over a deterministic enumeration of 312 URLs (2 schemes x 26 authority
+constructions x 6 path suffixes), **84 rows** are read as a different host by
 the two conventions. Seven distinct authority constructions sit behind them, and
-each is a different mechanism:
+each one works differently:
 
 | authority | WHATWG reads | RFC 3986 reads | why |
 |---|---|---|---|
@@ -94,19 +94,19 @@ The IPv4 rows run the other way from the backslash row: `http://2130706433` is
 hostname to anything RFC-derived. Whichever side does the blocking, the other
 side disagrees about what it is blocking.
 
-A further **48 rows** across four constructions are an *acceptance* difference —
-one convention refuses the URL outright and the other returns a host:
+A further **48 rows** across four constructions are an *acceptance* difference,
+where one convention refuses the URL outright and the other returns a host:
 `exa mple.com`, `example.com:65536`, `example.com:+80`, `example.com: 80`.
 
 The remaining **180 rows** are reported as agreeing. That matters as much as the
-rest: differences in spelling — IPv6 brackets, host case — are normalised away
+rest: differences in spelling, such as IPv6 brackets and host case, are normalised away
 and never reported, so ordinary URLs come back clean.
 
 ## What this does not do
 
 It does not resolve DNS, classify addresses as private, or make requests. Those
 are a different job, and [`request-filtering-agent`](https://www.npmjs.com/package/request-filtering-agent)
-does them well — it blocks requests to private ranges at the agent level. Use it
+does them well, blocking requests to private ranges at the agent level. Use it
 for that; use this to check that the URL string you validated is the one your
 next hop will read.
 
@@ -125,9 +125,9 @@ class HostDisagreementError extends Error { readonly consensus: Consensus }
 
 `verdict` is one of:
 
-- `'agreed'` — every convention names the same host.
-- `'host-differs'` — all parsed, and they name different hosts.
-- `'acceptance-differs'` — at least one refused and at least one accepted.
+- `'agreed'`: every convention names the same host.
+- `'host-differs'`: all parsed, and they name different hosts.
+- `'acceptance-differs'`: at least one refused and at least one accepted.
 
 `inspect` throws `TypeError` on a non-string and nothing else. `agrees` never
 throws on a malformed URL: a predicate that throws gets read as `false` by the
@@ -135,8 +135,8 @@ next person to use it, and "this URL is dangerous" must not be reachable by
 accident. `assertConsensus` also throws when both conventions refuse, because
 there is no host to return.
 
-`inspect` performs no I/O — no network, no filesystem, no clock — and is a pure
-function of its argument.
+`inspect` performs no I/O at all (no network, no filesystem, no clock) and is a
+pure function of its argument.
 
 ## How the RFC 3986 reading is checked
 
@@ -150,8 +150,8 @@ headline claim from a clean install in under a minute.
 
 [`yaml-drift`](https://www.npmjs.com/package/yaml-drift) reports every value
 whose meaning changed converting YAML to JSON; `host-consensus` reports hosts
-that two URL conventions read differently. Same shape — a boundary that silently
-changes meaning — at a different boundary.
+that two URL conventions read differently. Same shape, a boundary that quietly
+changes meaning, in a different place.
 
 ## License
 

package/VERIFY.md

@@ -5,7 +5,7 @@ different hosts depending on which convention reads it, and that
 `host-consensus` catches that.
 
 Reproduce it from a clean directory. Nothing here needs a checkout of this
-repository — it installs the published package from the registry.
+repository, since it installs the published package from the registry.
 
 ## 1. Install
 

package/dist/index.d.cts

@@ -6,7 +6,7 @@ interface Reading {
     host: string | null;
     /**
      * The port as a string; `''` when the URL carries no port. `null` when this
-     * convention produced no usable port — either because it refused the URL, or
+     * convention produced no usable port, either because it refused the URL, or
      * because the port is present but not an integer in 0-65535.
      */
     port: string | null;
@@ -35,7 +35,7 @@ interface Consensus {
  * and ASCII case is folded; nothing else. A difference that survives this is a
  * disagreement about which host is named. A difference that does not survive it
  * is a difference in spelling, and reporting those would make the tool
- * unusable — it would flag every IPv6 URL in the world.
+ * unusable, because it would flag every IPv6 URL in the world.
  */
 declare function normaliseHost(host: string): string;
 
@@ -48,7 +48,7 @@ declare function inspect(url: string): Consensus;
 /**
  * `true` when every convention names the same host.
  *
- * Never throws on a malformed URL — a predicate that throws gets read as
+ * Never throws on a malformed URL. A predicate that throws gets read as
  * `false` by the next person to use it, and "this URL is dangerous" must not
  * be reachable by accident.
  */

package/dist/index.d.ts

@@ -6,7 +6,7 @@ interface Reading {
     host: string | null;
     /**
      * The port as a string; `''` when the URL carries no port. `null` when this
-     * convention produced no usable port — either because it refused the URL, or
+     * convention produced no usable port, either because it refused the URL, or
      * because the port is present but not an integer in 0-65535.
      */
     port: string | null;
@@ -35,7 +35,7 @@ interface Consensus {
  * and ASCII case is folded; nothing else. A difference that survives this is a
  * disagreement about which host is named. A difference that does not survive it
  * is a difference in spelling, and reporting those would make the tool
- * unusable — it would flag every IPv6 URL in the world.
+ * unusable, because it would flag every IPv6 URL in the world.
  */
 declare function normaliseHost(host: string): string;
 
@@ -48,7 +48,7 @@ declare function inspect(url: string): Consensus;
 /**
  * `true` when every convention names the same host.
  *
- * Never throws on a malformed URL — a predicate that throws gets read as
+ * Never throws on a malformed URL. A predicate that throws gets read as
  * `false` by the next person to use it, and "this URL is dangerous" must not
  * be reachable by accident.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "host-consensus",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Reports whether every URL-parsing convention agrees on the host a URL names.",
   "keywords": [
     "url",