@crawlcheck/sdk 1.9.2 → 1.11.0

package/dist/index.d.ts

@@ -1,6 +1,131 @@
 import type { paths, components } from "./gen/openapi.js";
 import * as S from "./staple.js";
 export type { paths, components };
+export interface Acceptance {
+    integrity_valid: boolean;
+    issuer_trusted: boolean | null;
+    key_policy_valid: boolean | null;
+    freshness_valid: boolean;
+    subject_matches: boolean;
+    operation_matches: boolean | null;
+    replay_safe: boolean | null;
+    baseline_matches: boolean | null;
+    assessment_complete: boolean;
+    decision: string | null;
+    policy_source: string | null;
+    evidence_level: "A" | "B" | "C" | null;
+    policy_result: "proceed" | "pause" | "deny";
+    accepted: boolean;
+    why: string[];
+}
+export type ContinuityEffect = "proceed" | "proceed_recorded" | "refresh" | "pause_tool" | "pause" | "deny";
+export interface ContinuityPolicy {
+    v?: 1;
+    id?: string;
+    max_baseline_age_days?: number;
+    effects?: Partial<Record<string, ContinuityEffect>>;
+    allow_integrity_override?: boolean;
+}
+export interface ContinuityException {
+    tool?: string;
+    class: string;
+    until?: string;
+    by?: string;
+    reason?: string;
+}
+export interface ContinuityEvent {
+    class: string;
+    tool: string | null;
+    why: string;
+    policy_effect: ContinuityEffect;
+    effect: ContinuityEffect;
+    exception?: {
+        by: string | null;
+        reason: string | null;
+        until: string | null;
+    };
+    detail?: string;
+}
+export interface ContinuityRecord {
+    kind: "crawlcheck-continuity-record";
+    v: 1;
+    checked_at: string;
+    mode: "observe" | "review" | "enforce";
+    server: string | null;
+    policy: {
+        id: string;
+        sha256: string;
+        integrity_override: boolean;
+    };
+    claims: string;
+    baseline: {
+        tools_sha256: string | null;
+        approved_at: string | null;
+        age_days: number | null;
+        server: string | null;
+        per_part: boolean;
+    } | null;
+    observed: {
+        tools_sha256: string;
+        count: number;
+        complete: boolean;
+    } | null;
+    events: ContinuityEvent[];
+    would: ContinuityEffect;
+    enforced: boolean;
+    outcome: "proceed" | "refresh" | "pause" | "deny";
+    paused_tools: string[];
+    why: string[];
+    record_sha256: string;
+}
+export interface ContinuityOptions {
+    mode?: "observe" | "review" | "enforce";
+    policy?: ContinuityPolicy;
+    exceptions?: ContinuityException[];
+    complete?: boolean;
+    server?: string;
+    serverIdentity?: string;
+    expectPolicySha256?: string;
+    now?: number;
+    detail?: string;
+}
+export declare const CONTINUITY_DEFAULT_POLICY: {
+    v: 1;
+    id: string;
+    max_baseline_age_days: number;
+    effects: Record<string, ContinuityEffect>;
+};
+export declare const CONTINUITY_CHANGE_CLASSES: string[];
+export declare const CONTINUITY_FAILURE_CLASSES: string[];
+/** Compare offered tools with the approved baseline and apply the operator's policy; returns the record to keep. */
+export declare const continuityCheck: (lock: McpLock, tools: unknown, opts?: ContinuityOptions) => Promise<ContinuityRecord>;
+/** The record for a check that could not compare (server, evidence or service failed). */
+export declare const continuityFailure: (cls: string, opts?: ContinuityOptions) => Promise<ContinuityRecord>;
+/** The policy in force (default + yours) and its sha256. */
+export declare const continuityPolicy: (p?: ContinuityPolicy) => Promise<Required<ContinuityPolicy> & {
+    sha256: string;
+}>;
+/** Per-part hashes (description, schema, annotations) so a change can be named. Store lockParts(tools) as lock.parts. */
+export declare const lockToolParts: (t: McpTool) => Promise<{
+    description_sha256: string;
+    schema_sha256: string;
+    annotations_sha256: string;
+}>;
+export declare const lockParts: (tools: McpTool[]) => Promise<Record<string, {
+    description_sha256: string;
+    schema_sha256: string;
+    annotations_sha256: string;
+}>>;
+/** The separate acceptance questions for one decision receipt. Act on policy_result, never on integrity_valid alone. */
+/** Which continuity failure class a refused guard() result is. */
+export declare const continuityClassOf: (g: GuardResult | null) => string;
+export declare const acceptanceOf: (receipt: unknown, verification: unknown, scope: {
+    fields?: unknown;
+} | null, opts?: {
+    allowWarn?: boolean;
+    confirmed?: boolean | null;
+    lock?: unknown;
+}) => Acceptance;
 /** One verifier check. ok: true passed, false FAILED, null could not run (why says why) - never a pass. */
 export interface VerifyCheck {
     id: string;
@@ -180,7 +305,12 @@ export interface McpLock {
     tools: {
         name: string;
         sha256: string;
-    }[];
+    }[]; /** 1.11.0: per-part hashes (lockParts) so continuityCheck can name what changed. */
+    parts?: Record<string, {
+        description_sha256: string;
+        schema_sha256: string;
+        annotations_sha256: string;
+    }>;
     descriptions?: Record<string, string>;
     server?: {
         url?: string | null;
@@ -303,16 +433,31 @@ export interface DecisionWant {
  * time window, per-action lifetime, known decision, resolve binding); the signature and issuer are checked by
  * verifyDocument. guard() runs both. https://crawlcheck.io/spec/guard
  */
+export interface DecisionScopeFields {
+    kind_ok: boolean;
+    domain_matches: boolean;
+    action_matches: boolean;
+    operation_matches?: boolean;
+    nonce_matches?: boolean;
+    times_present: boolean;
+    not_expired: boolean;
+    not_future: boolean;
+    lifetime_ok: boolean;
+    decision_known: boolean;
+    resolve_bound: boolean;
+}
 export declare function checkDecision(receipt: unknown, want: DecisionWant): {
     ok: boolean;
     why: string[];
+    fields: DecisionScopeFields;
 };
 export interface GuardResult {
     proceed: boolean;
     receipt: DecisionReceipt | null;
     verification: (DocumentVerification & Trust) | null;
     header: Record<string, string> | null;
-    why: string[];
+    why: string[]; /** 1.11.0: the separate acceptance questions (integrity, issuer, key policy, freshness, subject, operation, replay, baseline, completeness) and policy_result. Null when no receipt came back. */
+    acceptance: Acceptance | null;
     split_view?: LogFork[]; /** Set when the domain was refused from the held revocation list, with no network call. */
     revoked?: RevokedEntry;
 }
@@ -528,6 +673,10 @@ export interface McpPreflightOptions extends PreflightOptions {
     local?: "allow" | "refuse";
     /** The server URL when the transport does not expose it. */
     serverUrl?: string;
+    /** 1.11.0: tool-interface continuity with lock. mode observe (record only), review (changes go to confirm), enforce (the policy applies). Every check is kept in state.records and passed to onRecord. https://crawlcheck.io/spec/continuity */
+    continuity?: ContinuityOptions & {
+        onRecord?: (record: ContinuityRecord) => unknown;
+    };
     onlineKeys?: boolean;
 }
 export interface McpPreflightState {
@@ -536,8 +685,11 @@ export interface McpPreflightState {
     receipt: DecisionReceipt | null;
     verification: (DocumentVerification & Trust) | null;
     decidedAt: number;
-    lockCheck: McpLockCheck | null;
+    lockCheck: McpLockCheck | ContinuityRecord | null;
     approved: Set<string> | null;
+    continuity: ContinuityRecord | null;
+    records: ContinuityRecord[];
+    pausedTools: Set<string> | null;
 }
 export interface McpPreflightHooks {
     state: McpPreflightState;
@@ -547,7 +699,9 @@ export interface McpPreflightHooks {
         receipt: DecisionReceipt | null;
         verification?: DocumentVerification & Trust;
     }>;
-    afterConnect(tools: McpTool[]): Promise<McpLockCheck | null>;
+    afterConnect(tools: McpTool[] | null, meta?: {
+        nextCursor?: string | null;
+    } | null): Promise<McpLockCheck | ContinuityRecord | null>;
     beforeToolCall(name: string, annotations?: unknown): Promise<{
         receipt: DecisionReceipt | null;
     }>;
@@ -762,4 +916,23 @@ export declare function toolsFor(format: ToolFormat, tools: AgentTool[]): {
     tools: unknown;
     call: (name: string, args: unknown) => Promise<JsonObject>;
 };
+/** Structural view of the Vercel AI SDK module ("ai") - passed in, so this package keeps no dependency. */
+export interface VercelAiModule {
+    tool: (def: any) => any;
+    jsonSchema: (schema: any) => any;
+}
+/** Vercel AI SDK adapter (1.10.0): `import * as ai from "ai"; const tools = vercelTools(cc, ai);` then generateText({ tools, ... }).
+ * Same three tools as agentTools(); they fail closed. The schema is given as both inputSchema (AI SDK 5+) and parameters (AI SDK 4). */
+export declare function vercelTools(cc: CrawlCheck, ai: VercelAiModule, opts?: AgentToolOptions): Record<string, unknown>;
+/** Structural view of "@langchain/core/tools" - passed in, so this package keeps no dependency. */
+export interface LangChainToolsModule {
+    tool: (fn: (input: any) => any, fields: {
+        name: string;
+        description: string;
+        schema: any;
+    }) => any;
+}
+/** LangChain.js adapter (1.10.0): `import * as lc from "@langchain/core/tools"; const tools = langchainTools(cc, lc);`
+ * Same three tools as agentTools(); each returns its result as a JSON string; they fail closed. */
+export declare function langchainTools(cc: CrawlCheck, lc: LangChainToolsModule, opts?: AgentToolOptions): unknown[];
 export default CrawlCheck;

package/dist/index.js

@@ -3,6 +3,23 @@ import * as L from "./log.js";
 import * as S from "./staple.js";
 import * as M from "./mcp.js";
 import * as R from "./revocations.js";
+import * as C from "./continuity.js";
+export const CONTINUITY_DEFAULT_POLICY = C.CONTINUITY_DEFAULT_POLICY;
+export const CONTINUITY_CHANGE_CLASSES = C.CONTINUITY_CHANGE_CLASSES;
+export const CONTINUITY_FAILURE_CLASSES = C.CONTINUITY_FAILURE_CLASSES;
+/** Compare offered tools with the approved baseline and apply the operator's policy; returns the record to keep. */
+export const continuityCheck = C.continuityCheck;
+/** The record for a check that could not compare (server, evidence or service failed). */
+export const continuityFailure = C.continuityFailure;
+/** The policy in force (default + yours) and its sha256. */
+export const continuityPolicy = C.continuityPolicy;
+/** Per-part hashes (description, schema, annotations) so a change can be named. Store lockParts(tools) as lock.parts. */
+export const lockToolParts = C.lockToolParts;
+export const lockParts = C.lockParts;
+/** The separate acceptance questions for one decision receipt. Act on policy_result, never on integrity_valid alone. */
+/** Which continuity failure class a refused guard() result is. */
+export const continuityClassOf = C.continuityClassOf;
+export const acceptanceOf = C.acceptanceOf;
 /** The signing policy as data (https://crawlcheck.io/keys#policy): object purposes, purpose chains, start times. */
 export const KEY_POLICY = V.KEY_POLICY;
 /** Build the policy input from a key directory you hold and, optionally, the rotation record saved with it. */
@@ -84,46 +101,63 @@ export const ACTION_MAX_LIFETIME_S = { read: 86400, cite: 86400, connect: 3600,
 /** The most clock skew a receipt may claim (seconds). */
 export const MAX_CLOCK_SKEW_S = 300;
 const DECISIONS = ["allow", "warn", "require_confirmation", "block", "unsupported"];
-/**
- * Is this receipt about the operation you are about to perform? Checks the scope only (kind, domain, action, nonce,
- * time window, per-action lifetime, known decision, resolve binding); the signature and issuer are checked by
- * verifyDocument. guard() runs both. https://crawlcheck.io/spec/guard
- */
 export function checkDecision(receipt, want) {
     const why = [], r = receipt;
+    const f = { kind_ok: false, domain_matches: false, action_matches: false, times_present: false, not_expired: false, not_future: false, lifetime_ok: false, decision_known: false, resolve_bound: false };
+    if (want.operation)
+        f.operation_matches = false;
+    if (want.nonce)
+        f.nonce_matches = false;
     if (!r || typeof r !== "object" || Array.isArray(r))
-        return { ok: false, why: ["no receipt: CrawlCheck sent " + (r === null || r === undefined ? "nothing" : typeof r)] };
-    if (r.kind !== "crawlcheck-decision" || r.v !== 1)
+        return { ok: false, why: ["no receipt: CrawlCheck sent " + (r === null || r === undefined ? "nothing" : typeof r)], fields: f };
+    f.kind_ok = r.kind === "crawlcheck-decision" && r.v === 1;
+    if (!f.kind_ok)
         why.push("not a v1 decision receipt (kind " + r.kind + ", v " + r.v + ")");
     const wd = normalizeDomain(want.domain);
-    if (!wd || normalizeDomain(r.domain) !== wd)
+    f.domain_matches = !!wd && normalizeDomain(r.domain) === wd;
+    if (!f.domain_matches)
         why.push("the receipt is for " + r.domain + ", not " + want.domain);
-    if (String(r.action) !== String(want.action))
+    f.action_matches = String(r.action) === String(want.action);
+    if (!f.action_matches)
         why.push("the receipt is for action " + r.action + ", not " + want.action);
-    if (want.operation && canon(r.operation ?? null) !== canon(want.operation))
-        why.push(r.operation ? "the receipt is for another operation (" + canon(r.operation).slice(0, 120) + ")" : "the receipt is not scoped to an operation, and this request named one");
-    if (want.nonce && r.nonce !== want.nonce)
-        why.push(r.nonce ? "the receipt carries another request's nonce (replayed)" : "the receipt does not carry the nonce this request sent");
+    if (want.operation) {
+        f.operation_matches = canon(r.operation ?? null) === canon(want.operation);
+        if (!f.operation_matches)
+            why.push(r.operation ? "the receipt is for another operation (" + canon(r.operation).slice(0, 120) + ")" : "the receipt is not scoped to an operation, and this request named one");
+    }
+    if (want.nonce) {
+        f.nonce_matches = r.nonce === want.nonce;
+        if (!f.nonce_matches)
+            why.push(r.nonce ? "the receipt carries another request's nonce (replayed)" : "the receipt does not carry the nonce this request sent");
+    }
     const now = want.now ?? Date.now(), skew = Math.min(Math.max(Number(r.clock_skew_s) || 0, 0), MAX_CLOCK_SKEW_S) * 1000;
     const at = Date.parse(r.decided_at), exp = Date.parse(r.expires_at);
     if (!isFinite(at) || !isFinite(exp))
         why.push("decided_at or expires_at missing");
     else {
-        if (now > exp + skew)
+        f.times_present = true;
+        f.not_expired = !(now > exp + skew);
+        if (!f.not_expired)
             why.push("expired at " + r.expires_at);
-        if (at > now + skew)
+        f.not_future = !(at > now + skew);
+        if (!f.not_future)
             why.push("decided in the future (" + r.decided_at + "): check the clock");
         const max = ACTION_MAX_LIFETIME_S[String(want.action)];
         if (max === undefined)
             why.push("unknown action " + want.action);
-        else if (exp - at > max * 1000 + 1000)
-            why.push("valid for " + Math.round((exp - at) / 1000) + " s; a " + want.action + " receipt may last at most " + max + " s");
+        else {
+            f.lifetime_ok = !(exp - at > max * 1000 + 1000);
+            if (!f.lifetime_ok)
+                why.push("valid for " + Math.round((exp - at) / 1000) + " s; a " + want.action + " receipt may last at most " + max + " s");
+        }
     }
-    if (DECISIONS.indexOf(r.decision) < 0)
+    f.decision_known = DECISIONS.indexOf(r.decision) >= 0;
+    if (!f.decision_known)
         why.push("unknown decision " + r.decision);
-    if (!r.resolve || !/^[0-9a-f]{64}$/.test(String(r.resolve.sha256 || "")))
+    f.resolve_bound = !!(r.resolve && /^[0-9a-f]{64}$/.test(String(r.resolve.sha256 || "")));
+    if (!f.resolve_bound)
         why.push("the receipt names no resolve answer");
-    return { ok: why.length === 0, why };
+    return { ok: why.length === 0, why, fields: f };
 }
 export const LOG_ID = L.LOG_ID;
 /** A new, empty transparency-log store (plain JSON: persist it between runs). */
@@ -347,7 +381,8 @@ export class CrawlCheck {
      */
     async guard(domain, action = "read", opts = {}) {
         const nonce = opts.nonce || randomNonce();
-        const no = (why, receipt = null, verification = null) => ({ proceed: false, receipt, verification, header: null, why });
+        let scope = null;
+        const no = (why, receipt = null, verification = null) => ({ proceed: false, receipt, verification, header: null, why, acceptance: receipt && scope ? acceptanceOf(receipt, verification, scope, { allowWarn: !!opts.allowWarn }) : null });
         const rv = revokedFor(this.revocations, normalizeDomain(domain) || domain, action); // rvd1: refused offline, before any request
         if (rv)
             return Object.assign(no([rv.domain + " is on CrawlCheck's signed revocation list for " + action + " (" + (rv.causes.join(", ") || rv.state || "revoked") + (rv.since ? ", since " + rv.since : "") + "; list of " + this.revocations.generated_at + ")"]), { revoked: rv });
@@ -360,7 +395,7 @@ export class CrawlCheck {
         }
         if (this.log.forks.length)
             return Object.assign(no(["the transparency log has shown this client two histories (split view)"], receipt), { split_view: this.log.forks.slice() });
-        const scope = checkDecision(receipt, { domain, action, nonce, now: opts.now, operation: opts.operation });
+        scope = checkDecision(receipt, { domain, action, nonce, now: opts.now, operation: opts.operation });
         if (!receipt || typeof receipt !== "object")
             return no(scope.why);
         const online = opts.onlineKeys ?? true;
@@ -386,20 +421,21 @@ export class CrawlCheck {
         if (why.length)
             return no(why, receipt, verification);
         const d = receipt.decision;
-        let proceed = d === "allow" || (d === "warn" && !!opts.allowWarn);
+        let proceed = d === "allow" || (d === "warn" && !!opts.allowWarn), confirmed = null;
         if (d === "require_confirmation") {
             if (opts.confirm) {
                 try {
-                    proceed = (await opts.confirm(receipt)) === true;
+                    proceed = confirmed = (await opts.confirm(receipt)) === true;
                 }
                 catch {
-                    proceed = false;
+                    proceed = confirmed = false;
                 }
             }
         }
         if (!proceed)
             why.push(d === "warn" ? "decision is warn and allowWarn is not set" : d === "require_confirmation" ? (opts.confirm ? "a human did not confirm" : "decision is require_confirmation and no confirm() was given") : "decision is " + d);
-        return { proceed, receipt, verification, header: proceed ? receiptHeader(receipt) : null, why };
+        const acceptance = acceptanceOf(receipt, verification, scope, { allowWarn: !!opts.allowWarn, confirmed });
+        return { proceed: proceed && acceptance.accepted, receipt, verification, header: proceed && acceptance.accepted ? receiptHeader(receipt) : null, why, acceptance };
     }
     /**
      * fetch() with the check where the action runs: guard() before the first request, and again before every redirect hop
@@ -692,4 +728,18 @@ export function toolsFor(format, tools) {
         return { tools: tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.parameters, annotations: { readOnlyHint: true, openWorldHint: true } })), call };
     return { tools: Object.fromEntries(tools.map((t) => [t.name, { description: t.description, parameters: t.parameters, execute: t.execute }])), call };
 }
+/** Vercel AI SDK adapter (1.10.0): `import * as ai from "ai"; const tools = vercelTools(cc, ai);` then generateText({ tools, ... }).
+ * Same three tools as agentTools(); they fail closed. The schema is given as both inputSchema (AI SDK 5+) and parameters (AI SDK 4). */
+export function vercelTools(cc, ai, opts = {}) {
+    if (!ai || typeof ai.tool !== "function" || typeof ai.jsonSchema !== "function")
+        throw new Error('vercelTools needs the "ai" module: import * as ai from "ai"');
+    return Object.fromEntries(agentTools(cc, opts).map((t) => { const sc = ai.jsonSchema(t.parameters); return [t.name, ai.tool({ description: t.description, inputSchema: sc, parameters: sc, execute: (args) => t.execute(args) })]; }));
+}
+/** LangChain.js adapter (1.10.0): `import * as lc from "@langchain/core/tools"; const tools = langchainTools(cc, lc);`
+ * Same three tools as agentTools(); each returns its result as a JSON string; they fail closed. */
+export function langchainTools(cc, lc, opts = {}) {
+    if (!lc || typeof lc.tool !== "function")
+        throw new Error('langchainTools needs "@langchain/core/tools": import * as lc from "@langchain/core/tools"');
+    return agentTools(cc, opts).map((t) => lc.tool(async (input) => JSON.stringify(await t.execute(input ?? {})), { name: t.name, description: t.description, schema: t.parameters }));
+}
 export default CrawlCheck;

package/dist/mcp.d.ts

@@ -1,11 +1,19 @@
+export declare class McpPreflightRefused extends Error {
+    stage: any;
+    why: any;
+    receipt: any;
+    lock: any;
+    verification: any;
+    constructor(stage: any, why: any, detail: any);
+}
 /** The server URL a transport will talk to, if it can be read (Streamable HTTP and SSE transports keep it as _url or url). */
-export function transportUrl(transport: any): string | null;
+export declare function transportUrl(transport: any): string | null;
 /**
  * The two hooks. cc is a CrawlCheck client (from this SDK). opts: template (default safe_mcp_tool), policy, agent,
  * confirm(receipt) for require_confirmation, allowWarn, lock (an approved McpLock), confirmDestructive, maxAgeMs for a
  * cached connect receipt (default: until the receipt's expires_at).
  */
-export function mcpPreflight(cc: any, opts?: {}): {
+export declare function mcpPreflight(cc: any, opts?: {}): {
     state: {
         url: null;
         host: null;
@@ -14,6 +22,9 @@ export function mcpPreflight(cc: any, opts?: {}): {
         decidedAt: number;
         lockCheck: null;
         approved: null;
+        continuity: null;
+        records: never[];
+        pausedTools: null;
     };
     /** Before initialize. url: the server URL (a stdio/local server has none and is not decided; pass opts.local = "allow" | "refuse", default allow). */
     beforeConnect(url: any): Promise<{
@@ -28,7 +39,7 @@ export function mcpPreflight(cc: any, opts?: {}): {
         verification: any;
     }>;
     /** After initialize, with the tools the server lists. Refuses (and the wrapper closes the client) when they differ from the approved lockfile. */
-    afterConnect(tools: any): Promise<import("./index.js").McpLockCheck | null>;
+    afterConnect(tools: any, meta: any): Promise<any>;
     /** Before tools/call. */
     beforeToolCall(name: any, annotations: any, tool: any): Promise<{
         receipt: any;
@@ -40,12 +51,4 @@ export function mcpPreflight(cc: any, opts?: {}): {
  * client.preflight (the hooks and their state). Works on @modelcontextprotocol/sdk's Client and on anything with the same
  * two methods; listTools() is used for the lockfile check when present.
  */
-export function withPreflight(client: any, cc: any, opts?: {}): any;
-export class McpPreflightRefused extends Error {
-    constructor(stage: any, why: any, detail: any);
-    stage: any;
-    why: any;
-    receipt: any;
-    lock: any;
-    verification: any;
-}
+export declare function withPreflight(client: any, cc: any, opts?: {}): any;

package/dist/mcp.js

@@ -17,6 +17,7 @@
 // request is never sent.
 import { normalizeDomain } from "./index.js";
 import { checkLock, toolOperation } from "./index.js";
+import { continuityCheck, continuityFailure, continuityClassOf } from "./continuity.js";
 export class McpPreflightRefused extends Error {
     constructor(stage, why, detail) { super("MCP preflight refused " + stage + ": " + why); this.name = "McpPreflightRefused"; this.stage = stage; this.why = why; this.receipt = detail && detail.receipt || null; this.lock = detail && detail.lock || null; this.verification = detail && detail.verification || null; }
 }
@@ -49,7 +50,18 @@ function destructive(ann) { if (!ann || typeof ann !== "object")
  */
 export function mcpPreflight(cc, opts = {}) {
     const template = opts.template || "safe_mcp_tool";
-    const state = { url: null, host: null, receipt: null, verification: null, decidedAt: 0, lockCheck: null, approved: null };
+    const state = { url: null, host: null, receipt: null, verification: null, decidedAt: 0, lockCheck: null, approved: null, continuity: null, records: [], pausedTools: null };
+    // 1.11.0 continuity: opts.continuity = { mode: observe | review | enforce, policy, exceptions, onRecord(record) }. Every check
+    // (connect decision, tool list, failure) leaves a crawlcheck-continuity-record in state.records and is passed to onRecord.
+    const CO = opts.continuity || null;
+    const keep = async function (rec) { state.continuity = rec; state.records.push(rec); if (state.records.length > 50)
+        state.records.shift(); if (CO && typeof CO.onRecord === "function") {
+        try {
+            await CO.onRecord(rec);
+        }
+        catch (e) { }
+    } return rec; };
+    const coOpts = function (extra) { return Object.assign({ mode: CO.mode, policy: CO.policy, exceptions: CO.exceptions, server: state.url }, extra || {}); };
     const fresh = function () {
         if (!state.receipt)
             return false;
@@ -69,6 +81,23 @@ export function mcpPreflight(cc, opts = {}) {
         state.receipt = g.receipt;
         state.verification = g.verification;
         state.decidedAt = Date.now();
+        if (!g.proceed && CO) {
+            const rec = await keep(await continuityFailure(continuityClassOf(g), coOpts({ detail: (g.why || []).join("; ").slice(0, 300) })));
+            if (rec.outcome === "proceed")
+                return g; // observe mode: recorded, not enforced
+            if (rec.outcome === "pause" && opts.confirm) {
+                let ok = false;
+                try {
+                    ok = (await opts.confirm(Object.assign({}, g.receipt || {}, { continuity: rec }))) === true;
+                }
+                catch (e) {
+                    ok = false;
+                }
+                if (ok)
+                    return g;
+            }
+            throw new McpPreflightRefused("connect", rec.why.join("; "), { receipt: g.receipt, verification: g.verification, lock: rec });
+        }
         if (!g.proceed) {
             const d = g.receipt && g.receipt.decision;
             const decisionOnly = (g.why || []).every(function (w) { return /^decision is|a human did not confirm|no confirm\(\) was given|allowWarn is not set/.test(w); });
@@ -97,7 +126,30 @@ export function mcpPreflight(cc, opts = {}) {
             return { local: false, host, receipt: g.receipt, verification: g.verification };
         },
         /** After initialize, with the tools the server lists. Refuses (and the wrapper closes the client) when they differ from the approved lockfile. */
-        async afterConnect(tools) {
+        async afterConnect(tools, meta) {
+            if (CO && opts.lock) { // 1.11.0: classify, apply the operator's policy, keep the record
+                const rec = await keep(await continuityCheck(opts.lock, tools, coOpts({ complete: !(meta && meta.nextCursor) })));
+                state.lockCheck = rec;
+                state.approved = null;
+                state.pausedTools = new Set(rec.paused_tools);
+                if (rec.outcome === "deny")
+                    throw new McpPreflightRefused("connect", rec.why.join("; "), { lock: rec, receipt: state.receipt });
+                if (rec.outcome === "pause" || rec.outcome === "refresh") {
+                    let ok = false;
+                    if (opts.confirm) {
+                        try {
+                            ok = (await opts.confirm(Object.assign({}, state.receipt || {}, { continuity: rec }))) === true;
+                        }
+                        catch (e) {
+                            ok = false;
+                        }
+                    }
+                    if (!ok)
+                        throw new McpPreflightRefused("connect", rec.why.join("; "), { lock: rec, receipt: state.receipt });
+                    state.pausedTools = new Set();
+                }
+                return rec;
+            }
             if (!opts.lock) {
                 state.approved = null;
                 return null;
@@ -113,6 +165,20 @@ export function mcpPreflight(cc, opts = {}) {
         async beforeToolCall(name, annotations, tool) {
             if (state.host && !fresh())
                 await decide(state.host);
+            if (state.pausedTools && state.pausedTools.has(name)) { // 1.11.0: a changed or new tool waits for a person; the others stay usable
+                let ok = false;
+                if (opts.confirm) {
+                    try {
+                        ok = (await opts.confirm(Object.assign({}, state.receipt || {}, { tool: name, continuity: state.continuity }))) === true;
+                    }
+                    catch (e) {
+                        ok = false;
+                    }
+                }
+                if (!ok)
+                    throw new McpPreflightRefused("tools/call", "tool " + name + " changed since it was approved (or is new) and no person re-approved it", { lock: state.continuity, receipt: state.receipt });
+                state.pausedTools.delete(name);
+            }
             if (state.approved && !state.approved.has(name))
                 throw new McpPreflightRefused("tools/call", "tool " + name + " is not in the approved lockfile", { lock: state.lockCheck, receipt: state.receipt });
             if (opts.confirmDestructive && destructive(annotations)) {
@@ -147,18 +213,27 @@ export function withPreflight(client, cc, opts = {}) {
         const r = await connect(transport, ...rest);
         if (opts.lock || opts.confirmDestructive || (opts.toolReceipts || "write") !== "none") {
             let list = [];
+            let meta = null, bad = false;
             try {
                 const t = typeof client.listTools === "function" ? await client.listTools() : null;
                 list = (t && t.tools) || [];
+                meta = t ? { nextCursor: t.nextCursor || null } : null;
+                if (t && !Array.isArray(t.tools))
+                    bad = true;
             }
             catch (e) {
                 list = [];
+                bad = true;
+            }
+            if (!Array.isArray(list)) {
+                list = [];
+                bad = true;
             }
             list.forEach(function (t) { if (t && t.name)
                 tools[t.name] = t; });
             if (opts.lock || opts.confirmDestructive)
                 try {
-                    await pf.afterConnect(list);
+                    await pf.afterConnect(bad && opts.continuity ? null : list, meta);
                 }
                 catch (e) {
                     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crawlcheck/sdk",
-  "version": "1.9.2",
+  "version": "1.11.0",
   "description": "Typed client for the CrawlCheck API (generated from its OpenAPI document) and the zero-dependency offline verifier for evidence bundles and remediation receipts.",
   "type": "module",
   "main": "./dist/index.js",