@crawlcheck/sdk 1.8.0 → 1.9.1

package/README.md

@@ -18,6 +18,10 @@ const { proceed, receipt } = await cc.guard("example.com", "read", { agent: "MyA
 
 Every verification returns `integrity_valid`, `issuer_trusted` and `accepted`. Act on `accepted`: it needs the signing key to be one CrawlCheck publishes, so a document someone signed with their own key is `verified` offline but never `accepted`. The client methods (`verifyDocument`, `verifyOffline`, `verifyReceiptOffline`, `guard`) check the published key directory for you.
 
+Since 1.9.1 a key the rotation record lists as retired still counts for its own signing window when the expected purpose is worked out: after a decision-key rotation, receipts the old decision key signed inside its window verify, and no other key may sign a decision made while that key was live (key-policy suite cases retired-decision-key-*).
+
+Since 1.9.0 `logCheck` reads the chain of signed heads 200 per request (`/api/v1/log/sths`) instead of one per batch, so a first check on a client holding no heads takes one or two requests; an older server is still walked one head per request.
+
 Since 1.8.0 an MCP connect decision names the server and, with a lockfile, its approved `tools_sha256` (`preflight(domain, "connect", { mcp: { url, tools_sha256 } })`; `withPreflight` sends it for you). CrawlCheck reads the live tools from its own network: a changed tool list comes back as `block`, and the signed receipt's `assessed` block says exactly which endpoint and tool state it covered.
 
 Since 1.8.0 they also apply the signing policy (https://crawlcheck.io/keys#policy): which key purpose may sign which object at which time (decision receipts move to the decision key at 2026-11-09 17:00 UTC), retired keys (valid only for documents signed before they stopped) and compromised keys (never valid on their signature alone). The result carries `key_policy_valid`, and `accepted` needs it. Offline, build the same input from copies you saved: `keyPolicyFrom(savedDirectory, savedRotationRecord)`, then `applyKeyPolicy(result, doc, kp)` or `guard(domain, action, { onlineKeys: false, keyPolicy })`. A saved copy cannot know a key retired or compromised after you saved it.

package/dist/log.d.ts

@@ -110,6 +110,7 @@ export function verifyWitnessToken(token: any, sthSha256: any, jwks: any): Promi
  * holds (at most opts.maxWalk batches), observing every link, so any head this client was shown that the witness's
  * chain does not contain surfaces as a fork. Heads newer than the witnessed one are listed as unwitnessed.
  */
+export function walkHeads(get: any, hi: any, lo: any): Promise<any[]>;
 export function logCheck(store: any, get: any, opts?: {}): Promise<{
     consistent: boolean;
     forks: any;

package/dist/log.js

@@ -146,6 +146,32 @@ export async function verifyWitnessToken(token, sthSha256, jwks) {
  * holds (at most opts.maxWalk batches), observing every link, so any head this client was shown that the witness's
  * chain does not contain surfaces as a fork. Heads newer than the witnessed one are listed as unwitnessed.
  */
+// Signed heads for batches hi down to lo, newest first. Since 1.9.0 one request per 200 batches (/api/v1/log/sths);
+// a server without that route is walked one head per request as before.
+export async function walkHeads(get, hi, lo) {
+    const out = [];
+    let k = hi;
+    while (k >= lo) {
+        const n = Math.min(200, k - lo + 1);
+        const d = await get("/api/v1/log/sths?to=" + k + "&n=" + n).catch(() => null);
+        if (!d || !Array.isArray(d.sths))
+            break;
+        const got = {};
+        for (const s of d.sths)
+            if (s && Number.isInteger(s.batch))
+                got[s.batch] = s;
+        for (let b = k; b > k - n; b--)
+            if (got[b])
+                out.push(got[b]);
+        k -= n;
+    }
+    for (; k >= lo; k--) {
+        const d = await get("/api/v1/log/sth/" + k).catch(() => null);
+        if (d && d.sth)
+            out.push(d.sth);
+    }
+    return out;
+}
 export async function logCheck(store, get, opts = {}) {
     const before = store.forks.length, o = { publishedKids: opts.publishedKids };
     const log = await get("/api/v1/log");
@@ -166,11 +192,8 @@ export async function logCheck(store, get, opts = {}) {
             store.witnessed = { batch: w.batch, sha256: sth.sha256, at: witnessed.at, run_id: witnessed.run_id };
         const held = Object.keys(store.heads).map(Number).filter((k) => k < w.batch);
         const lo = held.length ? Math.max(Math.min(...held), w.batch - (opts.maxWalk || 200)) : w.batch;
-        for (let k = w.batch - 1; k >= lo; k--) {
-            const d = await get("/api/v1/log/sth/" + k).catch(() => null);
-            if (d && d.sth)
-                await logObserve(store, d.sth, o);
-        }
+        for (const s of await walkHeads(get, w.batch - 1, lo))
+            await logObserve(store, s, o);
     }
     const wb = store.witnessed ? store.witnessed.batch : -1, now = Date.now(), maxAge = (opts.maxUnwitnessedMinutes || 120) * 60000;
     const unwitnessed = Object.keys(store.heads).map(Number).filter((k) => k > wb).sort((a, b) => a - b).map((k) => ({ batch: k, sha256: store.heads[k].sha256, created_at: store.heads[k].created_at }));

package/dist/verify.js

@@ -775,7 +775,7 @@ export async function keyPolicyFrom(directory, rotation) {
     }
     for (const r of (rotation && rotation.retired) || [])
         if (r && r.thumbprint)
-            retired[r.thumbprint] = { purpose: kpPurpose(r.purpose), stopped: kpMs(r.stopped_signing_at) ?? kpMs(r.retired_at) };
+            retired[r.thumbprint] = { purpose: kpPurpose(r.purpose), start: kpMs(r.crawlcheck_signs_from) ?? kpMs(r.not_before) ?? kpMs(KEY_POLICY.starts[kpPurpose(r.purpose)]), stopped: kpMs(r.stopped_signing_at) ?? kpMs(r.retired_at) }; // conf3: a retired key keeps its signing window
     for (const c of (rotation && rotation.compromised) || [])
         if (c && c.thumbprint)
             compromised[c.thumbprint] = kpMs(c.compromised_since) ?? 0;
@@ -823,6 +823,9 @@ function kpExpected(objPurpose, t, kp) {
             return p;
         if (Object.keys(kp.keys).some((kid) => kp.keys[kid].purpose === p && kp.compromised[kid] === undefined && (t === null || kp.keys[kid].start === null || kp.keys[kid].start <= t)))
             return p;
+        // conf3: a key retired since still covered its own signing window: a decision made while a decision key was live expects that purpose
+        if (t !== null && Object.keys(kp.retired || {}).some((kid) => { const r = kp.retired[kid]; return r.purpose === p && kp.compromised[kid] === undefined && (r.start === null || r.start === undefined || r.start <= t) && r.stopped !== null && t <= r.stopped; }))
+            return p;
     }
     return "requests";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.8.0",
+  "version": "1.9.1",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",