turva-llms-txt-validator 0.1.3 → 0.1.5

package/README.md

@@ -1,8 +1,8 @@
 # turva-llms-txt-validator
 
-Validate a site's llms.txt structure from the command line, from Node, or in CI. Seven checks, each reported as pass, warn or fail, with a one-line detail. No score on purpose: a structure check can say what is there and what is missing, and a number on top of seven checks would look like an agent-readiness score without measuring one.
+Validate a site's llms.txt structure from the command line, from Node or in CI. Eight checks, each reported as pass, warn or fail, with a one-line detail. No score on purpose: a structure check can say what is there and what is missing, and a number on top of eight checks would look like an agent-readiness score without measuring one.
 
-This is the open-source form of the hosted validator at [turva.dev/llms-txt-validator](https://turva.dev/llms-txt-validator), which runs the same logic inside the open [turva.dev Cloudflare Worker](https://codeberg.org/erekola/turva-worker). The hosted validator stays canonical: if the two ever disagree, the hosted one wins and this package gets the fix.
+This is the open-source form of the hosted validator at [turva.dev/llms-txt-validator](https://turva.dev/llms-txt-validator), which runs the same logic inside the open [turva.dev Cloudflare Worker](https://github.com/erekola/turva-worker). The hosted validator stays canonical: if the two ever disagree, the hosted one wins and this package gets the fix.
 
 ## Install
 
@@ -20,7 +20,9 @@ Or run it without installing:
 
 Exit codes: 0 valid (warnings allowed), 1 not valid (with --strict, warnings also exit 1), 2 fetch or input error. Only the target site's /llms.txt is fetched over https, following a redirect only to the same host or its www/apex twin (an off-site or unsafe redirect fails the first check), the fetch times out after 8 seconds and the read is capped at 256 KB. Nothing is stored.
 
-## The seven checks
+The target has to be a public domain name: an IP literal, a bracketed IPv6 address, localhost and the internal-use TLDs local, internal, home, lan, corp, test and invalid are all refused before any request goes out, and every redirect hop is checked by the same rule. Names are not resolved here, so a public name that points at a private address is stopped by the network the fetch runs on rather than by this code. On the hosted validator that network is the Cloudflare edge, which does not route to private address space.
+
+## The eight checks
 
 | # | Check | fail | warn |
 |---|-------|------|------|
@@ -31,8 +33,7 @@ Exit codes: 0 valid (warnings allowed), 1 not valid (with --strict, warnings als
 | 5 | H2 sections group the content | | no H2 sections |
 | 6 | Markdown links an agent can follow | | no links, or relative links |
 | 7 | Small enough to be cheap to read | | over 50 KB, or read truncated at 256 KB |
-
-An eighth signal, inline HTML in the file, is reported in the same list as a warning.
+| 8 | No HTML markup in the file | | HTML tags found |
 
 ## Node API
 
@@ -57,8 +58,8 @@ Woodpecker or any other runner: the same npx line works anywhere Node 18.17 or n
 
 ## Why these checks
 
-The llms.txt format is a plain text map of a site for AI agents: an H1 title, a one-line blockquote summary, and H2 sections of markdown links. The checks test exactly that structure and nothing else. What the format is and why it matters is written out at [llms.txt explained](https://turva.dev/guides/llms-txt), and the free tools this package belongs to are collected at [turva.dev/tools](https://turva.dev/tools).
+The llms.txt format is a plain text map of a site for AI agents: an H1 title, a one-line blockquote summary and H2 sections of markdown links. The checks test exactly that structure and nothing else. What the format is and why it matters is written out at [llms.txt explained](https://turva.dev/guides/llms-txt), and the free tools this package belongs to are collected at [turva.dev/tools](https://turva.dev/tools).
 
 ## License
 
-MIT. Source at [codeberg.org/erekola/llms-txt-validator](https://codeberg.org/erekola/llms-txt-validator), mirrored at [github.com/erekola/llms-txt-validator](https://github.com/erekola/llms-txt-validator). Published to npm from GitHub Actions with provenance, a signed attestation of where and how the package was built, verifiable on the npm package page.
+MIT. Source at [github.com/erekola/llms-txt-validator](https://github.com/erekola/llms-txt-validator). Published to npm from GitHub Actions with provenance, a signed attestation of where and how the package was built, verifiable on the npm package page.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "turva-llms-txt-validator",
-  "version": "0.1.3",
-  "description": "Validate a site's llms.txt structure: seven checks, pass/warn/fail, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
+  "version": "0.1.5",
+  "description": "Validate a site's llms.txt structure: eight checks, pass/warn/fail, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
   "type": "module",
   "main": "./src/index.mjs",
   "exports": "./src/index.mjs",
@@ -36,6 +36,6 @@
   },
   "homepage": "https://turva.dev/llms-txt-validator",
   "bugs": {
-    "url": "https://codeberg.org/erekola/llms-txt-validator/issues"
+    "url": "https://github.com/erekola/llms-txt-validator/issues"
   }
 }

package/src/index.mjs

@@ -1,11 +1,17 @@
 // turva-llms-txt-validator: validate a site's llms.txt structure.
 // The checks mirror the hosted validator at https://turva.dev/llms-txt-validator,
 // which runs this same logic inside the turva.dev Cloudflare Worker
-// (https://codeberg.org/erekola/turva-worker). The hosted validator stays
+// (https://github.com/erekola/turva-worker). The hosted validator stays
 // canonical: if the two ever disagree, the hosted one wins and this package
 // gets the fix.
 
-export const VERSION = "0.1.2";
+import { readFileSync } from "node:fs";
+
+// Version comes from package.json so the two can never drift again
+// (0.1.1 and 0.1.3 both shipped with a stale hardcoded VERSION).
+export const VERSION = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+).version;
 const UA = "turva-llms-txt-validator/" + VERSION + " (+https://turva.dev/llms-txt-validator)";
 
 export function normalizeHostInput(raw) {