@crawlcheck/sdk 1.9.0 → 1.9.2

package/README.md

@@ -18,6 +18,8 @@ const { proceed, receipt } = await cc.guard("example.com", "read", { agent: "MyA
 
 Every verification returns `integrity_valid`, `issuer_trusted` and `accepted`. Act on `accepted`: it needs the signing key to be one CrawlCheck publishes, so a document someone signed with their own key is `verified` offline but never `accepted`. The client methods (`verifyDocument`, `verifyOffline`, `verifyReceiptOffline`, `guard`) check the published key directory for you.
 
+Since 1.9.1 a key the rotation record lists as retired still counts for its own signing window when the expected purpose is worked out: after a decision-key rotation, receipts the old decision key signed inside its window verify, and no other key may sign a decision made while that key was live (key-policy suite cases retired-decision-key-*).
+
 Since 1.9.0 `logCheck` reads the chain of signed heads 200 per request (`/api/v1/log/sths`) instead of one per batch, so a first check on a client holding no heads takes one or two requests; an older server is still walked one head per request.
 
 Since 1.8.0 an MCP connect decision names the server and, with a lockfile, its approved `tools_sha256` (`preflight(domain, "connect", { mcp: { url, tools_sha256 } })`; `withPreflight` sends it for you). CrawlCheck reads the live tools from its own network: a changed tool list comes back as `block`, and the signed receipt's `assessed` block says exactly which endpoint and tool state it covered.

package/dist/gen/openapi.d.ts

@@ -1895,7 +1895,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (R2 archive + seal records), compared byte for byte after canonical serialisation. Public */
+        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (the sealed archive and seal records), compared byte for byte after canonical serialisation. Public */
         get: operations["reconstructionTest"];
         put?: never;
         post?: never;

package/dist/index.js

@@ -608,7 +608,11 @@ function atDomain(v) { const s = String(v ?? "").trim(); try {
 catch {
     return "";
 } }
-function atAction(v) { return AT_ACTIONS.includes(String(v)) ? String(v) : "read"; }
+// 1.9.2: an action that is GIVEN but not one of the five fails closed (it used to fall back to "read", so a crew asking about
+// "pay" got a read decision). An absent action still means read.
+function atAction(v) { if (v === undefined || v === null || v === "")
+    return "read"; return AT_ACTIONS.includes(String(v)) ? String(v) : null; }
+const atBadAction = (v) => ({ proceed: false, why: ["unknown action: " + String(v) + " (use read, cite, connect, transact or administer)"] });
 export function agentTools(cc, opts = {}) {
     const max = opts.maxChars ?? 20000;
     return [
@@ -620,6 +624,8 @@ export function agentTools(cc, opts = {}) {
                 } },
             execute: async (a) => {
                 const domain = atDomain(a?.site), action = atAction(a?.action);
+                if (!action)
+                    return atBadAction(a?.action);
                 if (!domain)
                     return { proceed: false, why: ["not a public domain name: " + String(a?.site ?? "")] };
                 const g = await cc.guard(domain, action, opts);
@@ -657,6 +663,8 @@ export function agentTools(cc, opts = {}) {
                     action: { type: "string", enum: ["read", "cite"], description: "read (default) or cite, if the text will be quoted back to someone" }
                 } },
             execute: async (a) => {
+                if (a?.action !== undefined && a?.action !== null && a?.action !== "" && a.action !== "read" && a.action !== "cite")
+                    return Object.assign(atBadAction(a.action), { url: String(a?.url ?? "") });
                 const r = await cc.guardedFetch(String(a?.url ?? ""), Object.assign({}, opts, { action: (a?.action === "cite" ? "cite" : "read") }));
                 const hops = r.hops.map((h) => ({ url: h.url, domain: h.domain, decision: h.decision, proceed: h.proceed, status: h.status ?? null }));
                 if (!r.proceed || !r.response)

package/dist/verify.js

@@ -775,7 +775,7 @@ export async function keyPolicyFrom(directory, rotation) {
     }
     for (const r of (rotation && rotation.retired) || [])
         if (r && r.thumbprint)
-            retired[r.thumbprint] = { purpose: kpPurpose(r.purpose), stopped: kpMs(r.stopped_signing_at) ?? kpMs(r.retired_at) };
+            retired[r.thumbprint] = { purpose: kpPurpose(r.purpose), start: kpMs(r.crawlcheck_signs_from) ?? kpMs(r.not_before) ?? kpMs(KEY_POLICY.starts[kpPurpose(r.purpose)]), stopped: kpMs(r.stopped_signing_at) ?? kpMs(r.retired_at) }; // conf3: a retired key keeps its signing window
     for (const c of (rotation && rotation.compromised) || [])
         if (c && c.thumbprint)
             compromised[c.thumbprint] = kpMs(c.compromised_since) ?? 0;
@@ -823,6 +823,9 @@ function kpExpected(objPurpose, t, kp) {
             return p;
         if (Object.keys(kp.keys).some((kid) => kp.keys[kid].purpose === p && kp.compromised[kid] === undefined && (t === null || kp.keys[kid].start === null || kp.keys[kid].start <= t)))
             return p;
+        // conf3: a key retired since still covered its own signing window: a decision made while a decision key was live expects that purpose
+        if (t !== null && Object.keys(kp.retired || {}).some((kid) => { const r = kp.retired[kid]; return r.purpose === p && kp.compromised[kid] === undefined && (r.start === null || r.start === undefined || r.start <= t) && r.stopped !== null && t <= r.stopped; }))
+            return p;
     }
     return "requests";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.9.0",
+  "version": "1.9.2",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",