@crawlcheck/sdk 1.9.1 → 1.10.0

package/README.md

@@ -35,16 +35,19 @@ Since 1.8.0 they also apply the signing policy (https://crawlcheck.io/keys#polic
 Three tools your agent can call itself: `crawlcheck_check_site` (the signed, verified decision for an action on a site, including the business facts the site publishes and which AI engines get them wrong), `crawlcheck_verify_fact` (one signed verdict on a phone number, address, hours or service area you hold: does the business publish it, did it once, or whose is it) and `crawlcheck_fetch` (fetches a page only after its domain, and every redirect hop, is allowed). All fail closed.
 
 ```js
-import { CrawlCheck, agentTools, toolsFor } from "@crawlcheck/sdk";
+import { CrawlCheck, agentTools, toolsFor, vercelTools, langchainTools } from "@crawlcheck/sdk";
 const tools = agentTools(new CrawlCheck(), { agent: "MyAgentBot" });
 
 // OpenAI function calling
 const oa = toolsFor("openai", tools);          // oa.tools → tools: [...]; on a tool call: await oa.call(name, argumentsJson)
 // Anthropic tool use
 const an = toolsFor("anthropic", tools);       // an.tools → tools: [...]; on tool_use: await an.call(block.name, block.input)
-// Vercel AI SDK
-import { tool, jsonSchema } from "ai";
-const vt = Object.fromEntries(tools.map((t) => [t.name, tool({ description: t.description, parameters: jsonSchema(t.parameters), execute: t.execute })]));
+// Vercel AI SDK (1.10.0): one call; the "ai" module is passed in, so this package keeps no dependency
+import * as ai from "ai";
+const vt = vercelTools(new CrawlCheck(), ai);  // generateText({ model, tools: vt, ... })
+// LangChain.js (1.10.0)
+import * as lc from "@langchain/core/tools";
+const lt = langchainTools(new CrawlCheck(), lc); // createAgent({ model, tools: lt }) or model.bindTools(lt)
 // An MCP server you run
 const mc = toolsFor("mcp", tools);             // list mc.tools; answer tools/call with mc.call(name, args)
 ```

package/dist/gen/openapi.d.ts

@@ -1895,7 +1895,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (R2 archive + seal records), compared byte for byte after canonical serialisation. Public */
+        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (the sealed archive and seal records), compared byte for byte after canonical serialisation. Public */
         get: operations["reconstructionTest"];
         put?: never;
         post?: never;

package/dist/index.d.ts

@@ -762,4 +762,23 @@ export declare function toolsFor(format: ToolFormat, tools: AgentTool[]): {
     tools: unknown;
     call: (name: string, args: unknown) => Promise<JsonObject>;
 };
+/** Structural view of the Vercel AI SDK module ("ai") - passed in, so this package keeps no dependency. */
+export interface VercelAiModule {
+    tool: (def: any) => any;
+    jsonSchema: (schema: any) => any;
+}
+/** Vercel AI SDK adapter (1.10.0): `import * as ai from "ai"; const tools = vercelTools(cc, ai);` then generateText({ tools, ... }).
+ * Same three tools as agentTools(); they fail closed. The schema is given as both inputSchema (AI SDK 5+) and parameters (AI SDK 4). */
+export declare function vercelTools(cc: CrawlCheck, ai: VercelAiModule, opts?: AgentToolOptions): Record<string, unknown>;
+/** Structural view of "@langchain/core/tools" - passed in, so this package keeps no dependency. */
+export interface LangChainToolsModule {
+    tool: (fn: (input: any) => any, fields: {
+        name: string;
+        description: string;
+        schema: any;
+    }) => any;
+}
+/** LangChain.js adapter (1.10.0): `import * as lc from "@langchain/core/tools"; const tools = langchainTools(cc, lc);`
+ * Same three tools as agentTools(); each returns its result as a JSON string; they fail closed. */
+export declare function langchainTools(cc: CrawlCheck, lc: LangChainToolsModule, opts?: AgentToolOptions): unknown[];
 export default CrawlCheck;

package/dist/index.js

@@ -608,7 +608,11 @@ function atDomain(v) { const s = String(v ?? "").trim(); try {
 catch {
     return "";
 } }
-function atAction(v) { return AT_ACTIONS.includes(String(v)) ? String(v) : "read"; }
+// 1.9.2: an action that is GIVEN but not one of the five fails closed (it used to fall back to "read", so a crew asking about
+// "pay" got a read decision). An absent action still means read.
+function atAction(v) { if (v === undefined || v === null || v === "")
+    return "read"; return AT_ACTIONS.includes(String(v)) ? String(v) : null; }
+const atBadAction = (v) => ({ proceed: false, why: ["unknown action: " + String(v) + " (use read, cite, connect, transact or administer)"] });
 export function agentTools(cc, opts = {}) {
     const max = opts.maxChars ?? 20000;
     return [
@@ -620,6 +624,8 @@ export function agentTools(cc, opts = {}) {
                 } },
             execute: async (a) => {
                 const domain = atDomain(a?.site), action = atAction(a?.action);
+                if (!action)
+                    return atBadAction(a?.action);
                 if (!domain)
                     return { proceed: false, why: ["not a public domain name: " + String(a?.site ?? "")] };
                 const g = await cc.guard(domain, action, opts);
@@ -657,6 +663,8 @@ export function agentTools(cc, opts = {}) {
                     action: { type: "string", enum: ["read", "cite"], description: "read (default) or cite, if the text will be quoted back to someone" }
                 } },
             execute: async (a) => {
+                if (a?.action !== undefined && a?.action !== null && a?.action !== "" && a.action !== "read" && a.action !== "cite")
+                    return Object.assign(atBadAction(a.action), { url: String(a?.url ?? "") });
                 const r = await cc.guardedFetch(String(a?.url ?? ""), Object.assign({}, opts, { action: (a?.action === "cite" ? "cite" : "read") }));
                 const hops = r.hops.map((h) => ({ url: h.url, domain: h.domain, decision: h.decision, proceed: h.proceed, status: h.status ?? null }));
                 if (!r.proceed || !r.response)
@@ -684,4 +692,18 @@ export function toolsFor(format, tools) {
         return { tools: tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.parameters, annotations: { readOnlyHint: true, openWorldHint: true } })), call };
     return { tools: Object.fromEntries(tools.map((t) => [t.name, { description: t.description, parameters: t.parameters, execute: t.execute }])), call };
 }
+/** Vercel AI SDK adapter (1.10.0): `import * as ai from "ai"; const tools = vercelTools(cc, ai);` then generateText({ tools, ... }).
+ * Same three tools as agentTools(); they fail closed. The schema is given as both inputSchema (AI SDK 5+) and parameters (AI SDK 4). */
+export function vercelTools(cc, ai, opts = {}) {
+    if (!ai || typeof ai.tool !== "function" || typeof ai.jsonSchema !== "function")
+        throw new Error('vercelTools needs the "ai" module: import * as ai from "ai"');
+    return Object.fromEntries(agentTools(cc, opts).map((t) => { const sc = ai.jsonSchema(t.parameters); return [t.name, ai.tool({ description: t.description, inputSchema: sc, parameters: sc, execute: (args) => t.execute(args) })]; }));
+}
+/** LangChain.js adapter (1.10.0): `import * as lc from "@langchain/core/tools"; const tools = langchainTools(cc, lc);`
+ * Same three tools as agentTools(); each returns its result as a JSON string; they fail closed. */
+export function langchainTools(cc, lc, opts = {}) {
+    if (!lc || typeof lc.tool !== "function")
+        throw new Error('langchainTools needs "@langchain/core/tools": import * as lc from "@langchain/core/tools"');
+    return agentTools(cc, opts).map((t) => lc.tool(async (input) => JSON.stringify(await t.execute(input ?? {})), { name: t.name, description: t.description, schema: t.parameters }));
+}
 export default CrawlCheck;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",

package/test/tools.test.js

@@ -44,3 +44,10 @@ test("live: verify_fact returns a signed verdict that verifies", async () => {
   if (r.ok) { assert.equal(r.kind, "crawlcheck-field-check"); assert.equal(r.verified, true); assert.ok(r.verdict); }
   else assert.ok(r.why.length);
 });
+
+test("1.9.2: an unknown action fails closed (no fallback to read), without calling the API", async () => {
+  const r = await tools[0].execute({ site: "crawlcheck.io", action: "pay" });
+  assert.equal(r.proceed, false); assert.match(r.why[0], /unknown action: pay/);
+  const f = await tools[2].execute({ url: "https://crawlcheck.io/", action: "transact" });
+  assert.equal(f.proceed, false); assert.match(f.why[0], /unknown action/);
+});