turva-llms-txt-validator 0.3.6 → 0.3.7

package/README.md

@@ -14,7 +14,7 @@ Requires **Node.js 18.17 or newer**. Run it without a global install:
 npx --yes turva-llms-txt-validator example.com
 ```
 
-Replace `example.com` with the domain you want to check. A domain, HTTP URL or HTTPS URL is accepted. Validation uses the host's `/llms.txt` and home page over HTTPS, regardless of the supplied path.
+Replace `example.com` with the domain you want to check. A domain, HTTP URL or HTTPS URL is accepted. Validation uses the host's `/llms.txt` and home page over HTTPS, regardless of the supplied path. If the address has a path other than `/` or `/llms.txt`, the result names that path first in an `info` line.
 
 For repeated use, install the CLI globally:
 
@@ -65,7 +65,7 @@ Completed validation returns `{ target, summary, checks }`. Each check contains
 | 1 | `/llms.txt` returns HTTP 200 | Non-200 response, rejected or excessive redirects | none |
 | 2 | Response is plain text | Body looks like an HTML page | Content type is neither `text/plain` nor `text/markdown` |
 | 3 | First non-empty line is a Markdown H1 | Missing H1, including a title indented as a code block | none |
-| 4 | Blockquote summary follows the title | none | Missing summary |
+| 4 | Blockquote summary follows the title | none | Missing summary, or a blockquote after other text but before the first H2, named by its line |
 | 5 | H2 sections group the content | none | No H2 sections, or no section contains a Markdown link list |
 | 6 | Markdown links have names and absolute HTTP or HTTPS targets | none | Missing links, empty names, relative targets or unsupported targets |
 | 7 | File is small enough to read cheaply | none | Over 50 KB, or truncated at the 256 KB read limit |

package/bin/cli.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 // CLI for turva-llms-txt-validator. Exit codes: 0 = valid (or valid with
 // warnings), 1 = not valid (or warnings with --strict), 2 = could not fetch
-// or bad input. The two v2 discovery checks carry status "info" and move no
-// exit code, by design. Same checks and JSON shape as the hosted validator:
+// or bad input. The two v2 discovery checks and the input-path note carry status
+// "info" and move no exit code, by design. Same checks and JSON shape as the hosted validator:
 // curl -H "Accept: application/json" "https://turva.dev/llms-txt-validator?url=example.com"
 import { validateHost } from "../src/index.mjs";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turva-llms-txt-validator",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Validate a site's llms.txt structure: eight checks as pass/warn/fail plus two llms.txt v2 discovery checks that read pass or info and never move the summary, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/index.mjs

@@ -86,6 +86,21 @@ export function normalizeHostInput(raw) {
   return typedHost.length > 1 && typedHost.endsWith(".") ? typedHost.slice(0, -1) : typedHost;
 }
 
+// The path of the address as typed, when it is neither the root nor /llms.txt. validateHost keeps its
+// reads pinned to /llms.txt and the home page, because a fixed path is part of the guard against use
+// as a fetch proxy, so a typed /docs/llms.txt used to be dropped without a word while the result
+// described the root file (outside retest 2026-09-26). The result now names the unused path in an
+// info check. The case of the path is kept, and the query and fragment are never returned.
+// Mirrors worker.js enteredPath() (v3.176.0).
+export function enteredPath(raw) {
+  let s = String(raw || "").trim();
+  if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) s = "https://" + s;
+  let u;
+  try { u = new URL(s); } catch { return ""; }
+  const path = u.pathname;
+  return path === "/" || path === "" || path === "/llms.txt" ? "" : path;
+}
+
 export function isValidPublicHost(host) {
   if (!host || host.length > 253) return false;
   if (host.startsWith("[") || /^\d+\.\d+\.\d+\.\d+$/.test(host)) return false;
@@ -316,7 +331,20 @@ export function validateLlmsTxt(f) {
   if (afterH1.trim().startsWith("> ")) {
     add("summary", "pass", "Blockquote summary after the title", JSON.stringify(cut(afterH1.trim(), 80)));
   } else {
-    add("summary", "warn", "Blockquote summary after the title", "recommended by the format (> one-line summary), not required");
+    // A blockquote further down, before the first H2, is a summary in the wrong place and not a
+    // missing one, and the detail says which (outside retest 2026-09-26, mirrored from worker.js
+    // v3.176.0). The status is warn either way, because the format places the summary directly
+    // after the title.
+    const fence = fenceMask(lines);
+    let late = -1;
+    for (let i = firstIdx + 1; i < lines.length; i++) {
+      if (fence[i]) continue;
+      if (/^ {0,3}## /.test(lines[i])) break;
+      if (/^ {0,3}> /.test(lines[i])) { late = i; break; }
+    }
+    add("summary", "warn", "Blockquote summary after the title", late === -1
+      ? "recommended by the format (> one-line summary), not required"
+      : "the blockquote at line " + (late + 1) + " comes after other text, and the format places the summary directly after the title");
   }
   // Headings are read outside fences only, and with the same indentation the H1 check and
   // listItemHasLink have allowed since 2026-08-29. Until 2026-09-10 this one line still
@@ -1270,6 +1298,10 @@ export async function validateHost(input, opts = {}) {
     discovery = validateV2Discovery(null, "the home page could not be read, so this was not measured");
   }
   const checks = validateLlmsTxt(fetched).concat(discovery);
+  // A path in the typed address is not used, and the result says so first (mirrored from worker.js
+  // v3.176.0). Information moves no summary and no exit code.
+  const unusedPath = enteredPath(input);
+  if (unusedPath) checks.unshift({ id: "input-path", status: "info", label: "Path in the address you entered", detail: cut(unusedPath, 120) + " is not used, because the validator always reads /llms.txt at the root of the host" });
   // Text quoted from the fetched file leaves without bidirectional controls (round 19,
   // V6-U1, mirrored from worker.js v3.164.0): a site's own H1 or summary could otherwise
   // read in another order here than in the file itself.