Add humans.txt, llms.txt, security.txt; fix stale MIT license refs to AGPL-3.0

.well-known/security.txt

@@ -0,0 +1,9 @@
+# XSLTDebugX security contact (RFC 9116)
+# See SECURITY.md for full security posture and disclosure policy.
+
+Contact: https://github.com/linusdevx/XSLTDebugX/security/advisories/new
+Expires: 2027-06-25T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://xsltdebugx.pages.dev/.well-known/security.txt
+Policy: https://github.com/linusdevx/XSLTDebugX/blob/main/SECURITY.md
+Acknowledgments: https://github.com/linusdevx/XSLTDebugX/security/advisories

humans.txt

@@ -0,0 +1,20 @@
+/* TEAM */
+Creator: Sunil Pharswan
+Contact: github.com/linusdevx
+LinkedIn: linkedin.com/in/sunilph/
+From: India
+
+/* THANKS */
+Saxon-JS team — Saxonica, for the XSLT 3.0 / XPath 3.1 engine that powers this tool
+Monaco Editor — Microsoft, for the embedded code editor
+Lucide — for the icon set
+SAP Community — for years of CPI knowledge that shaped what this tool needed to do
+
+/* SITE */
+Site: XSLTDebugX
+URL: https://xsltdebugx.pages.dev/
+Last update: 2026-06-25
+Standards: HTML5, CSS3, ES2020, XSLT 3.0, XPath 3.1
+Components: Saxon-JS 2, Monaco Editor 0.44, Lucide Icons, pako
+Software: hand-written vanilla JS, Vite + esbuild build, Cloudflare Pages
+License: AGPL-3.0

index.html

@@ -42,6 +42,8 @@
   <link rel="icon" type="image/svg+xml" href="favicon.svg">
   <link rel="apple-touch-icon" href="favicon-192.png">
   <link rel="manifest" href="site.webmanifest">
+  <link rel="author" href="/humans.txt">
+  <link rel="alternate" type="application/atom+xml" title="XSLTDebugX releases" href="https://github.com/linusdevx/XSLTDebugX/releases.atom">
   <link rel="preconnect" href="https://fonts.googleapis.com">
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link rel="preconnect" href="https://cdn.jsdelivr.net" crossorigin>
@@ -70,9 +72,10 @@
     "url": "https://xsltdebugx.pages.dev/",
     "description": "Free online XSLT 3.0 debugger and XPath 3.1 IDE for SAP Cloud Integration (CPI). Debug and test XSLT transformations with headers, properties, and extension functions — no deployment needed.",
     "applicationCategory": "DeveloperApplication",
-    "applicationSubCategory": "XML/XSLT Development Tool",
-    "operatingSystem": "Any (browser-based)",
-    "browserRequirements": "Requires a modern browser with JavaScript enabled",
+    "applicationSubCategory": "IDE",
+    "operatingSystem": "Any (modern browser)",
+    "browserRequirements": "Requires a modern browser with ES2020 and WebAssembly support (Chrome, Firefox, Safari, Edge).",
+    "softwareRequirements": "Saxon-JS 2 (bundled), Monaco Editor (bundled). No installation required.",
     "softwareVersion": "1.0",
     "datePublished": "2025-01-01",
     "dateModified": "2026-06-03",
@@ -106,7 +109,7 @@
     "keywords": "XSLT debugger, XSLT IDE online, XPath tester, SAP CPI XSLT, SAP Cloud Integration, XSLT 3.0, XPath 3.1, online XSLT editor, XSLT testing tool, XML editor, Saxon-JS, XSLT playground",
     "inLanguage": "en",
     "isAccessibleForFree": true,
-    "license": "https://opensource.org/licenses/MIT",
+    "license": "https://www.gnu.org/licenses/agpl-3.0.html",
     "sameAs": "https://github.com/linusdevx/XSLTDebugX"
   }
   </script>
@@ -130,7 +133,7 @@
         "name": "Is XSLTDebugX free to use?",
         "acceptedAnswer": {
           "@type": "Answer",
-          "text": "Yes. XSLTDebugX is free, open-source (MIT-licensed), and requires no account. It runs entirely in your browser — no XML, XSLT, or message data is sent to any server."
+          "text": "Yes. XSLTDebugX is free, open-source (AGPL-3.0 licensed), and requires no account. It runs entirely in your browser — no XML, XSLT, or message data is sent to any server."
         }
       },
       {

llms.txt

@@ -0,0 +1,26 @@
+# XSLTDebugX
+
+> Browser-based IDE for XSLT 3.0 and XPath 3.1, designed for SAP Cloud
+> Integration (CPI) developers. Simulates the CPI runtime (headers, properties,
+> cpi:setHeader / cpi:setProperty extension functions) so transformations can be
+> tested locally before deploying to an iFlow. Runs entirely client-side using
+> Monaco Editor and Saxon-JS 2. No installation. No account. No data leaves the
+> browser. Free and open source (AGPL-3.0).
+
+## Core
+- [Live app](https://xsltdebugx.pages.dev/): the IDE — XSLT mode and XPath mode share a workspace; press Ctrl+Enter to run.
+- [GitHub repository](https://github.com/linusdevx/XSLTDebugX): source, issues, releases.
+- [README](https://github.com/linusdevx/XSLTDebugX#readme): features, screenshots, quick start.
+
+## Documentation
+- [Architecture](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/ARCHITECTURE.md): module layout, build pipeline, critical constraints.
+- [CPI simulation deep-dive](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/TRANSFORM.md): how the cpi: namespace is rewritten to js: at runtime for Saxon-JS interception.
+- [Features reference](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/reference/features.md): 200+ features with file locations.
+- [Examples catalog](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/reference/examples-data.md): 61 built-in examples across 6 categories.
+- [Development guide](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/DEVELOPMENT.md): local setup, browser debugging.
+- [Testing guide](https://github.com/linusdevx/XSLTDebugX/blob/main/.github/docs/TESTING.md): Playwright E2E patterns.
+
+## Optional
+- [Contributing](https://github.com/linusdevx/XSLTDebugX/blob/main/CONTRIBUTING.md)
+- [Security policy](https://github.com/linusdevx/XSLTDebugX/blob/main/SECURITY.md)
+- [License (AGPL-3.0)](https://github.com/linusdevx/XSLTDebugX/blob/main/LICENSE)

vite.config.js

@@ -128,6 +128,13 @@ export default defineConfig({
         if (existsSync('favicon-192.png')) copyFileSync('favicon-192.png', 'dist/favicon-192.png');
         if (existsSync('site.webmanifest')) copyFileSync('site.webmanifest', 'dist/site.webmanifest');
         if (existsSync('robots.txt')) copyFileSync('robots.txt', 'dist/robots.txt');
+        if (existsSync('llms.txt')) copyFileSync('llms.txt', 'dist/llms.txt');
+        if (existsSync('humans.txt')) copyFileSync('humans.txt', 'dist/humans.txt');
+        // RFC 9116 security.txt — must be served from /.well-known/
+        if (existsSync('.well-known/security.txt')) {
+          mkdirSync('dist/.well-known', { recursive: true });
+          copyFileSync('.well-known/security.txt', 'dist/.well-known/security.txt');
+        }
         if (existsSync('og-image.png')) copyFileSync('og-image.png', 'dist/og-image.png');
         if (existsSync('screenshot.png')) copyFileSync('screenshot.png', 'dist/screenshot.png');