@crawlcheck/sdk 0.0.0-stage → 1.0.1

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "test",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "sideEffects": false,
+  "homepage": "https://crawlcheck.io/sdk",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/emmanuelorta/crawlcheck.git",
+    "directory": "sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/emmanuelorta/crawlcheck/issues"
+  },
+  "keywords": [
+    "crawlcheck",
+    "verification",
+    "evidence",
+    "ai-crawlers",
+    "openapi",
+    "ed25519",
+    "merkle",
+    "opentimestamps"
+  ],
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  }
+}

package/test/sdk.test.js

@@ -0,0 +1,45 @@
+// Runs against the live API. npm test
+import test from "node:test"; import assert from "node:assert/strict";
+import { CrawlCheck, verifyBundle, verifyReceipt, CrawlCheckError } from "../dist/index.js";
+const c = new CrawlCheck();
+
+test("conformance: every published fixture gives its expected output through this package's verifier", async () => {
+  const r = await c.conformance();
+  const bad = r.results.filter((x) => !x.ok);
+  assert.equal(bad.length, 0, bad.map((x) => x.name + ": " + x.diffs.join("; ")).join("\n"));
+  assert.ok(r.results.length >= 19, "fixtures: " + r.results.length);
+});
+
+test("conformance: the one receipt a verifier cannot reject offline is rejected by comparing published key ids", async () => {
+  const ids = await c.publishedKeyIds();
+  const ix = await (await fetch(c.base + "/conformance/index.json")).json();
+  const f = ix.fixtures.find((x) => x.name === "receipt-foreign-key"), good = ix.fixtures.find((x) => x.name === "receipt-valid");
+  const forged = await (await fetch(f.file)).json(), real = await (await fetch(good.file)).json();
+  assert.equal((await verifyReceipt(forged)).verified, true, "offline it verifies");
+  assert.ok(!ids.includes(forged.signature.kid), "and its key id is not published");
+  assert.ok(ids.includes(real.signature.kid), "while the real receipt's key id is");
+});
+
+test("live machine record: typed fields present, evidence links resolve, offline bundle verification agrees", async () => {
+  const mr = await c.machineRecord({ domain: "crawlcheck.io" });
+  assert.equal(mr.kind, "crawlcheck-machine-record");
+  assert.ok(mr.subject && mr.observation && mr.evidence);
+  const id = mr.subject.report_id;
+  const v = await c.verifyOffline(id);
+  assert.ok(v.checks.length >= 11);
+  assert.equal(v.checks.filter((x) => x.ok === false).length, 0, JSON.stringify(v.checks.filter((x) => x.ok === false)));
+  assert.ok(["manifest_hash", "key_id", "signature"].every((k) => v.checks.find((x) => x.id === k).ok === true), "manifest checks pass on a live record");
+});
+
+test("a tampered live bundle fails offline", async () => {
+  const mr = await c.machineRecord({ domain: "crawlcheck.io" });
+  const b = await c.bundle(mr.subject.report_id);
+  b.manifest.body += " ";
+  const v = await verifyBundle(b);
+  assert.equal(v.verified, false);
+  assert.equal(v.checks.find((x) => x.id === "manifest_hash").ok, false);
+});
+
+test("locked data surfaces as a typed error, not a crash", async () => {
+  await assert.rejects(c.impact({ domain: "wikipedia.org" }), (e) => e instanceof CrawlCheckError && e.locked === true && e.status === 403);
+});