@crawlcheck/sdk 1.8.0 → 1.9.0

package/README.md

@@ -18,6 +18,8 @@ const { proceed, receipt } = await cc.guard("example.com", "read", { agent: "MyA
 
 Every verification returns `integrity_valid`, `issuer_trusted` and `accepted`. Act on `accepted`: it needs the signing key to be one CrawlCheck publishes, so a document someone signed with their own key is `verified` offline but never `accepted`. The client methods (`verifyDocument`, `verifyOffline`, `verifyReceiptOffline`, `guard`) check the published key directory for you.
 
+Since 1.9.0 `logCheck` reads the chain of signed heads 200 per request (`/api/v1/log/sths`) instead of one per batch, so a first check on a client holding no heads takes one or two requests; an older server is still walked one head per request.
+
 Since 1.8.0 an MCP connect decision names the server and, with a lockfile, its approved `tools_sha256` (`preflight(domain, "connect", { mcp: { url, tools_sha256 } })`; `withPreflight` sends it for you). CrawlCheck reads the live tools from its own network: a changed tool list comes back as `block`, and the signed receipt's `assessed` block says exactly which endpoint and tool state it covered.
 
 Since 1.8.0 they also apply the signing policy (https://crawlcheck.io/keys#policy): which key purpose may sign which object at which time (decision receipts move to the decision key at 2026-11-09 17:00 UTC), retired keys (valid only for documents signed before they stopped) and compromised keys (never valid on their signature alone). The result carries `key_policy_valid`, and `accepted` needs it. Offline, build the same input from copies you saved: `keyPolicyFrom(savedDirectory, savedRotationRecord)`, then `applyKeyPolicy(result, doc, kp)` or `guard(domain, action, { onlineKeys: false, keyPolicy })`. A saved copy cannot know a key retired or compromised after you saved it.

package/dist/log.d.ts

@@ -110,6 +110,7 @@ export function verifyWitnessToken(token: any, sthSha256: any, jwks: any): Promi
  * holds (at most opts.maxWalk batches), observing every link, so any head this client was shown that the witness's
  * chain does not contain surfaces as a fork. Heads newer than the witnessed one are listed as unwitnessed.
  */
+export function walkHeads(get: any, hi: any, lo: any): Promise<any[]>;
 export function logCheck(store: any, get: any, opts?: {}): Promise<{
     consistent: boolean;
     forks: any;

package/dist/log.js

@@ -146,6 +146,32 @@ export async function verifyWitnessToken(token, sthSha256, jwks) {
  * holds (at most opts.maxWalk batches), observing every link, so any head this client was shown that the witness's
  * chain does not contain surfaces as a fork. Heads newer than the witnessed one are listed as unwitnessed.
  */
+// Signed heads for batches hi down to lo, newest first. Since 1.9.0 one request per 200 batches (/api/v1/log/sths);
+// a server without that route is walked one head per request as before.
+export async function walkHeads(get, hi, lo) {
+    const out = [];
+    let k = hi;
+    while (k >= lo) {
+        const n = Math.min(200, k - lo + 1);
+        const d = await get("/api/v1/log/sths?to=" + k + "&n=" + n).catch(() => null);
+        if (!d || !Array.isArray(d.sths))
+            break;
+        const got = {};
+        for (const s of d.sths)
+            if (s && Number.isInteger(s.batch))
+                got[s.batch] = s;
+        for (let b = k; b > k - n; b--)
+            if (got[b])
+                out.push(got[b]);
+        k -= n;
+    }
+    for (; k >= lo; k--) {
+        const d = await get("/api/v1/log/sth/" + k).catch(() => null);
+        if (d && d.sth)
+            out.push(d.sth);
+    }
+    return out;
+}
 export async function logCheck(store, get, opts = {}) {
     const before = store.forks.length, o = { publishedKids: opts.publishedKids };
     const log = await get("/api/v1/log");
@@ -166,11 +192,8 @@ export async function logCheck(store, get, opts = {}) {
             store.witnessed = { batch: w.batch, sha256: sth.sha256, at: witnessed.at, run_id: witnessed.run_id };
         const held = Object.keys(store.heads).map(Number).filter((k) => k < w.batch);
         const lo = held.length ? Math.max(Math.min(...held), w.batch - (opts.maxWalk || 200)) : w.batch;
-        for (let k = w.batch - 1; k >= lo; k--) {
-            const d = await get("/api/v1/log/sth/" + k).catch(() => null);
-            if (d && d.sth)
-                await logObserve(store, d.sth, o);
-        }
+        for (const s of await walkHeads(get, w.batch - 1, lo))
+            await logObserve(store, s, o);
     }
     const wb = store.witnessed ? store.witnessed.batch : -1, now = Date.now(), maxAge = (opts.maxUnwitnessedMinutes || 120) * 60000;
     const unwitnessed = Object.keys(store.heads).map(Number).filter((k) => k > wb).sort((a, b) => a - b).map((k) => ({ batch: k, sha256: store.heads[k].sha256, created_at: store.heads[k].created_at }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",

package/test/split-view.test.js

@@ -2,6 +2,7 @@
 // Worker's own log code in a test harness) must be detected offline, and the live log must check out consistent.
 import test from "node:test"; import assert from "node:assert/strict"; import fs from "node:fs";
 import { CrawlCheck, newLogStore, logObserve, logGossip, logHeads, verifyWitnessToken, verifyDocument } from "../dist/index.js";
+import { walkHeads } from "../src/log.js";
 const F = JSON.parse(fs.readFileSync(new URL("./fixtures/split-view.json", import.meta.url), "utf8"));
 
 test("a forked log is detected by gossip: two signed heads for one batch", async () => {
@@ -26,6 +27,19 @@ test("the witness token binds one head: valid for it, refused for the forked hea
   assert.equal((await verifyWitnessToken(F.witness.token, F.A[2].sha256, F.jwks)).ok, true);
   assert.equal((await verifyWitnessToken(F.witness.token, F.B[2].sha256, F.jwks)).ok, false);
 });
+test("1.9.0: the chain walk reads 200 heads per request, and falls back to one per batch on an older server", async () => {
+  const calls = [];
+  const batched = async (p) => { calls.push(p); const m = /sths\?to=(\d+)&n=(\d+)/.exec(p); if (!m) throw new Error("404");
+    const to = +m[1], n = +m[2]; return { sths: Array.from({ length: n }, (_, i) => ({ kind: "crawlcheck-log-sth", batch: to - i })) }; };
+  let r = await walkHeads(batched, 449, 0);
+  assert.equal(r.length, 450); assert.deepEqual(r.slice(0, 2).map((x) => x.batch), [449, 448]); assert.equal(r[449].batch, 0);
+  assert.deepEqual(calls, ["/api/v1/log/sths?to=449&n=200", "/api/v1/log/sths?to=249&n=200", "/api/v1/log/sths?to=49&n=50"]);
+  calls.length = 0;
+  const old = async (p) => { calls.push(p); const m = /sth\/(\d+)$/.exec(p); if (!m) throw new Error("404"); return { sth: { kind: "crawlcheck-log-sth", batch: +m[1] } }; };
+  r = await walkHeads(old, 4, 2);
+  assert.deepEqual(r.map((x) => x.batch), [4, 3, 2]); assert.equal(calls.length, 4, "one refused batched call, then one per head");
+  assert.deepEqual(await walkHeads(batched, 3, 4), []);
+});
 test("live: the production log is consistent and GitHub's witness co-signature verifies", async () => {
   const c = new CrawlCheck(); await c.resolve("github.com");
   const r = await c.logCheck({ report: false });