@crawlcheck/sdk 1.9.1 → 1.9.2

package/dist/gen/openapi.d.ts

@@ -1895,7 +1895,7 @@ export interface paths {
             path?: never;
             cookie?: never;
         };
-        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (R2 archive + seal records), compared byte for byte after canonical serialisation. Public */
+        /** The last reconstruction test: the oldest archived records' evidence paths (record, report node, decision nodes, manifest node, every verifier check) resolved through the 90-day projections and again from the permanent store alone (the sealed archive and seal records), compared byte for byte after canonical serialisation. Public */
         get: operations["reconstructionTest"];
         put?: never;
         post?: never;

package/dist/index.js

@@ -608,7 +608,11 @@ function atDomain(v) { const s = String(v ?? "").trim(); try {
 catch {
     return "";
 } }
-function atAction(v) { return AT_ACTIONS.includes(String(v)) ? String(v) : "read"; }
+// 1.9.2: an action that is GIVEN but not one of the five fails closed (it used to fall back to "read", so a crew asking about
+// "pay" got a read decision). An absent action still means read.
+function atAction(v) { if (v === undefined || v === null || v === "")
+    return "read"; return AT_ACTIONS.includes(String(v)) ? String(v) : null; }
+const atBadAction = (v) => ({ proceed: false, why: ["unknown action: " + String(v) + " (use read, cite, connect, transact or administer)"] });
 export function agentTools(cc, opts = {}) {
     const max = opts.maxChars ?? 20000;
     return [
@@ -620,6 +624,8 @@ export function agentTools(cc, opts = {}) {
                 } },
             execute: async (a) => {
                 const domain = atDomain(a?.site), action = atAction(a?.action);
+                if (!action)
+                    return atBadAction(a?.action);
                 if (!domain)
                     return { proceed: false, why: ["not a public domain name: " + String(a?.site ?? "")] };
                 const g = await cc.guard(domain, action, opts);
@@ -657,6 +663,8 @@ export function agentTools(cc, opts = {}) {
                     action: { type: "string", enum: ["read", "cite"], description: "read (default) or cite, if the text will be quoted back to someone" }
                 } },
             execute: async (a) => {
+                if (a?.action !== undefined && a?.action !== null && a?.action !== "" && a.action !== "read" && a.action !== "cite")
+                    return Object.assign(atBadAction(a.action), { url: String(a?.url ?? "") });
                 const r = await cc.guardedFetch(String(a?.url ?? ""), Object.assign({}, opts, { action: (a?.action === "cite" ? "cite" : "read") }));
                 const hops = r.hops.map((h) => ({ url: h.url, domain: h.domain, decision: h.decision, proceed: h.proceed, status: h.status ?? null }));
                 if (!r.proceed || !r.response)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",

package/test/tools.test.js

@@ -44,3 +44,10 @@ test("live: verify_fact returns a signed verdict that verifies", async () => {
   if (r.ok) { assert.equal(r.kind, "crawlcheck-field-check"); assert.equal(r.verified, true); assert.ok(r.verdict); }
   else assert.ok(r.why.length);
 });
+
+test("1.9.2: an unknown action fails closed (no fallback to read), without calling the API", async () => {
+  const r = await tools[0].execute({ site: "crawlcheck.io", action: "pay" });
+  assert.equal(r.proceed, false); assert.match(r.why[0], /unknown action: pay/);
+  const f = await tools[2].execute({ url: "https://crawlcheck.io/", action: "transact" });
+  assert.equal(f.proceed, false); assert.match(f.why[0], /unknown action/);
+});