turva-llms-txt-validator 0.4.0 → 0.4.1

package/README.md

@@ -139,10 +139,10 @@ For vulnerability reporting and supported versions, see [SECURITY.md](https://gi
 GitHub Actions publishes every version from 0.1.3 on with npm trusted publishing, and each one carries a provenance attestation. To check one, install it in an empty directory and ask npm to verify the signatures. Replace the version with the one you want to check.
 
 ```sh
-mkdir verify-llms && cd verify-llms && npm init -y && npm install turva-llms-txt-validator@0.4.0 --ignore-scripts && npm audit signatures
+mkdir verify-llms && cd verify-llms && npm init -y && npm install turva-llms-txt-validator@0.4.1 --ignore-scripts && npm audit signatures
 ```
 
-`npm audit signatures` checks the registry signature and the provenance attestation of each installed package that has one. The attestation of this package names three things to compare with what you expect: the repository `github.com/erekola/llms-txt-validator`, the workflow file `.github/workflows/publish.yml` and the commit that produced the tarball. The npm version page shows them under Provenance. Tag `v0.4.0` must point at that same commit, and `gh api repos/erekola/llms-txt-validator/commits/v0.4.0 --jq .sha` prints it. A mismatch is a reason not to use that version. Provenance proves where a release was built and from which commit. It does not prove that the code is safe, so reading the source and the dependencies stays your job.
+`npm audit signatures` checks the registry signature and the provenance attestation of each installed package that has one. The attestation of this package names three things to compare with what you expect: the repository `github.com/erekola/llms-txt-validator`, the workflow file `.github/workflows/publish.yml` and the commit that produced the tarball. The npm version page shows them under Provenance. Tag `v0.4.1` must point at that same commit, and `gh api repos/erekola/llms-txt-validator/commits/v0.4.1 --jq .sha` prints it. A mismatch is a reason not to use that version. Provenance proves where a release was built and from which commit. It does not prove that the code is safe, so reading the source and the dependencies stays your job.
 
 ## Hosted version and source
 

package/dist/src/index.js

@@ -852,8 +852,10 @@ export function validateLlmsTxt(f) {
     }
     // An accepted redirect is shown masked as well (round 19, K7-2, mirrored from worker.js
     // v3.164.0): a query value or a fragment in a same-host Location used to reach this
-    // detail as sent.
-    add("http-status", "pass", "File exists at /llms.txt", f.redirectedFrom ? "HTTP 200, followed a redirect from " + maskLocation(f.redirectedFrom) + " to " + maskLocation(f.finalUrl) : "HTTP 200");
+    // detail as sent. An input with redirectedFrom and no finalUrl, which fetchLlmsTxt never returns but a
+    // caller of this function can pass, names the address it was redirected from alone instead of ending
+    // in "to undefined" (Tek-668, NULL-2, mirrored from worker.ts).
+    add("http-status", "pass", "File exists at /llms.txt", f.redirectedFrom ? "HTTP 200, followed a redirect from " + maskLocation(f.redirectedFrom) + (f.finalUrl ? " to " + maskLocation(f.finalUrl) : "") : "HTTP 200");
     // A leading byte-order mark is stripped the same way the fetch path already strips it: the
     // TextDecoder used there removes a BOM by default, so the direct API took a different
     // document than the fetched one for the exact same bytes until this was measured (outside
@@ -2189,7 +2191,9 @@ export function findLinkRelations(html, linkHeader) {
         found.headCut = true;
     return found;
 }
-export function validateV2Discovery(found, unreadReason) {
+// A caller that passes null without a reason gets a neutral one instead of an undefined detail (Tek-668,
+// NULL-1, mirrored from worker.ts); validateHost always passes its own.
+export function validateV2Discovery(found, unreadReason = "the home page was not read, so this was not measured") {
     const checks = [];
     const add = (id, status, label, detail) => checks.push({ id, status, label, detail });
     if (!found) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turva-llms-txt-validator",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Validate a site's llms.txt structure: eight checks as pass/warn/fail plus two llms.txt v2 discovery checks that read pass or info and never move the summary, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
   "type": "module",
   "main": "./dist/src/index.js",