@xyz17711/domain-security 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,87 @@
-# Temporary Holding Version
+# @xyz17711/domain-security
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![Publish](https://github.com/17711-services/clients/actions/workflows/publish-node.yml/badge.svg)](https://github.com/17711-services/clients/actions/workflows/publish-node.yml)
+[![npm](https://img.shields.io/npm/v/@xyz17711/domain-security)](https://www.npmjs.com/package/@xyz17711/domain-security)
+[![License](https://img.shields.io/npm/l/@xyz17711/domain-security)](https://github.com/17711-services/clients/blob/main/LICENSE)
+
+Typed TypeScript client for **🛡️ domain-security-service**, part of the
+[17711.xyz](https://api.17711.xyz) microservice fleet -- pay-per-call APIs settled in USDC via
+[x402](https://x402.org), listed on [x402scan](https://www.x402scan.com/server/f1c7b972-3405-4b75-8b4f-d1bfbd6305ff).
+
+## Install
+
+```bash
+npm install @xyz17711/domain-security
+```
+
+## Methods
+
+| Method | Description |
+| --- | --- |
+| `getReport` | Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) |
+
+## Quickstart
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/🛡️ domain-security-service");
+// see the Methods table above for every available call and its request/response type
+```
+
+## Paying past the free quota
+
+Every gated tool allows a small number of free calls per day; beyond that it returns a 402
+challenge. Without a wallet configured, this client throws `PaymentRequiredError` with the price,
+network, and payee address attached:
+
+```typescript
+import { Client, PaymentRequiredError } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/🛡️ domain-security-service");
+try {
+  await client.getReport(/* ... */);
+} catch (e) {
+  if (e instanceof PaymentRequiredError) {
+    console.log(`needs ${e.priceUsdc} USDC on ${e.network}, payable to ${e.payTo}`);
+  }
+}
+```
+
+To pay automatically, configure a wallet on the client -- the private key should come from your
+own environment/secrets manager, never a literal string in source code:
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/🛡️ domain-security-service", {
+  x402PrivateKey: process.env.X402_PRIVATE_KEY,
+  x402ExpectedNetwork: "eip155:8453", // Base mainnet; use eip155:84532 for Base Sepolia testnet
+  x402MaxPaymentUsdc: 0.01,           // refuse any single call above this
+  x402MaxTotalSpendUsdc: 1.0,         // refuse once this WALLET's lifetime spend would exceed it
+});
+```
+
+**Never commit a private key.** Both spend caps are required together with the key -- a wallet
+with real funds and no explicit caps refuses to construct at all (`WalletConfigError`), on
+purpose. The cumulative cap is tracked per wallet address, shared by every `Client` you construct
+with that same key in this process.
+
+## LangChain.js
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+import { DomainSecurityToolkit } from "@xyz17711/domain-security/langchain";
+
+const client = new Client("https://api.17711.xyz/registry/🛡️ domain-security-service", { /* ...wallet options... */ });
+const tools = new DomainSecurityToolkit(client).getTools();
+```
+
+Requires the optional `@langchain/core`+`zod` peer dependencies (`npm install @langchain/core
+zod`) -- importing the base package above never requires them; only `@xyz17711/domain-security/langchain`
+does.
+
+## License
+
+MIT -- see [`LICENSE`](../../LICENSE), shared by every language's client library in the
+`clients` repo this package lives in.

package/dist/index.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Typed HTTP client and request/response interfaces for 🛡️ domain-security-service.
+ */
+import { Client as BaseClient, type ClientOptions } from "@xyz17711/core";
+export interface BlocklistHit {
+    cidr: string;
+    ip: string;
+    source: string;
+}
+export interface DnsSecurity {
+    /** CAA records: the certificate authorities allowed to issue for the domain. */
+    caa: string[];
+    /** Whether the answer for the domain is validated by DNSSEC. */
+    dnssec: boolean;
+    /** Authoritative name servers (at most 8). */
+    name_servers: string[];
+}
+export interface Finding {
+    /** Stable machine-readable code, e.g. `tls.expired`, `mail.dmarc_absent`, `http.hsts_missing`. */
+    code: string;
+    /** What was observed and why it matters, in one sentence. */
+    message: string;
+    /** `critical`, `high`, `medium`, `low` or `info`. */
+    severity: string;
+}
+export interface HttpSecurity {
+    /** Whether the `Server` / `X-Powered-By` headers disclose a software version. */
+    discloses_version: boolean;
+    /** The ones that are missing. */
+    headers_missing: string[];
+    /** Security headers found on the HTTPS response (`strict-transport-security`, `content-security-policy`, `x-content-type-options`, `x-frame-options`, `referrer-policy`, `permissions-policy`). */
+    headers_present: string[];
+    /** `true` when plain HTTP on port 80 redirects to HTTPS, `false` when it serves content or redirects elsewhere, absent when port 80 does not answer. */
+    http_redirects_to_https?: boolean | null;
+    /** Status of `GET https://<domain>/`. */
+    https_status?: number | null;
+}
+export interface MailSecurity {
+    /** DMARC policy: `reject`, `quarantine`, `none` or `absent`. */
+    dmarc?: string | null;
+    /** Whether an MTA-STS policy is published (`_mta-sts` TXT record). */
+    mta_sts: boolean;
+    /** Mail servers (MX) of the website's domain, highest priority first (at most 5). */
+    mx: string[];
+    /** Mail platform deduced from the MX records (`google-workspace`, `microsoft-365`, ...). */
+    provider?: string | null;
+    /** SPF policy: `strict` (-all), `soft` (~all), `neutral` (?all), `open` (+all) or `none`. */
+    spf?: string | null;
+}
+export interface TlsSecurity {
+    /** Days left before expiry (negative once expired). */
+    days_remaining?: number | null;
+    /** Why the handshake or validation failed, when it did. */
+    error?: string | null;
+    /** Certificate end of validity (UTC). */
+    expires_at?: string | null;
+    issuer?: string | null;
+    /** `TLS1.3` or `TLS1.2`. */
+    protocol?: string | null;
+    /** Whether HTTPS answered on port 443. */
+    reachable: boolean;
+    /** Number of host names the certificate covers. */
+    san_count: number;
+    /** Whether the certificate chain validates for this host name. */
+    valid: boolean;
+}
+export interface GetReportResponse {
+    /** How old this report is, in seconds (0 for a fresh assessment). */
+    age_seconds: number;
+    /** Addresses found on a public IP blocklist (IPv4 only). */
+    blocklisted: BlocklistHit[];
+    dns: DnsSecurity;
+    /** The host that was assessed, lowercased, without scheme or path. */
+    domain: string;
+    /** Everything worth acting on, most severe first. */
+    findings: Finding[];
+    /** `true` when this report was served from a stored result. */
+    from_cache: boolean;
+    /** `A` (90+), `B` (80+), `C` (65+), `D` (50+), `F`. */
+    grade: string;
+    http: HttpSecurity;
+    /** Public IPv4/IPv6 addresses of the host (at most 8). */
+    ip_addresses: string[];
+    mail: MailSecurity;
+    /** When the assessment was made (UTC). */
+    retrieved_at: string;
+    /** 0 to 100, higher is better; derived from the findings. */
+    score: number;
+    tls: TlsSecurity;
+}
+export interface GetReportRequest {
+    /** The domain to assess: `stripe.com`, `www.stripe.com` or a full URL (only the host is used). */
+    domain: string;
+    /** The oldest report you accept, in seconds. Omit it for the default (reports up to 1 hour old); `0` forces a fresh assessment. The response always says how old it is. */
+    max_age_seconds?: number | null;
+}
+/** Typed client for 🛡️ domain-security-service, e.g. `client.getReport(...)`. */
+export declare class Client extends BaseClient {
+    /** Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) */
+    getReport(request: GetReportRequest): Promise<GetReportResponse>;
+}
+export { ClientOptions };

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * Typed HTTP client and request/response interfaces for 🛡️ domain-security-service.
+ */
+import { Client as BaseClient } from "@xyz17711/core";
+/** Typed client for 🛡️ domain-security-service, e.g. `client.getReport(...)`. */
+export class Client extends BaseClient {
+    /** Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) */
+    async getReport(request) {
+        return this.post("/v1/domain-security/get_report", request);
+    }
+}

package/dist/langchain.d.ts

@@ -0,0 +1,19 @@
+/**
+ * LangChain.js tools for 🛡️ domain-security-service, grouped in one Toolkit -- one tool per operation, each just an async function (JS has no separate sync form to generate). Requires the `@langchain/core`+`zod` peer dependencies declared in this package's own package.json -- imported from `domain-security/langchain`, never from the package root, so importing the base client never requires them installed.
+ */
+import { z } from "zod";
+import { Client } from "./index.js";
+export declare class DomainSecurityToolkit {
+    private client;
+    constructor(client: Client);
+    getTools(): import("@langchain/core/tools").DynamicStructuredTool<z.ZodObject<{
+        domain: z.ZodString;
+        max_age_seconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>, {
+        domain: string;
+        max_age_seconds?: number | null | undefined;
+    }, {
+        domain: string;
+        max_age_seconds?: number | null | undefined;
+    }, import("./index.js").GetReportResponse, unknown, "getReport">[];
+}

package/dist/langchain.js

@@ -0,0 +1,19 @@
+/**
+ * LangChain.js tools for 🛡️ domain-security-service, grouped in one Toolkit -- one tool per operation, each just an async function (JS has no separate sync form to generate). Requires the `@langchain/core`+`zod` peer dependencies declared in this package's own package.json -- imported from `domain-security/langchain`, never from the package root, so importing the base client never requires them installed.
+ */
+import { tool } from "@langchain/core/tools";
+import { z } from "zod";
+export class DomainSecurityToolkit {
+    constructor(client) {
+        this.client = client;
+    }
+    getTools() {
+        return [
+            tool(async (input) => this.client.getReport(input), {
+                name: "getReport",
+                description: "Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402)",
+                schema: z.object({ domain: z.string(), max_age_seconds: z.number().nullable().optional() }),
+            }),
+        ];
+    }
+}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@xyz17711/domain-security",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Generated typed client for the 🛡️ domain-security-service 17711.xyz microservice.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./langchain": {
+      "types": "./dist/langchain.d.ts",
+      "default": "./dist/langchain.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p .",
+    "test": "npm run build && node --test test/*.test.mjs"
+  },
+  "dependencies": {
+    "@xyz17711/core": "^0.1.0"
+  },
+  "peerDependencies": {
+    "@langchain/core": ">=0.3",
+    "zod": "^3 || ^4"
+  },
+  "peerDependenciesMeta": {
+    "@langchain/core": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "@langchain/core": "^1.2",
+    "zod": "^4"
+  }
+}

package/src/index.ts

@@ -0,0 +1,115 @@
+/**
+ * Typed HTTP client and request/response interfaces for 🛡️ domain-security-service.
+ */
+
+import { Client as BaseClient, type ClientOptions } from "@xyz17711/core";
+
+export interface BlocklistHit {
+  cidr: string;
+  ip: string;
+  source: string;
+}
+
+export interface DnsSecurity {
+  /** CAA records: the certificate authorities allowed to issue for the domain. */
+  caa: string[];
+  /** Whether the answer for the domain is validated by DNSSEC. */
+  dnssec: boolean;
+  /** Authoritative name servers (at most 8). */
+  name_servers: string[];
+}
+
+export interface Finding {
+  /** Stable machine-readable code, e.g. `tls.expired`, `mail.dmarc_absent`, `http.hsts_missing`. */
+  code: string;
+  /** What was observed and why it matters, in one sentence. */
+  message: string;
+  /** `critical`, `high`, `medium`, `low` or `info`. */
+  severity: string;
+}
+
+export interface HttpSecurity {
+  /** Whether the `Server` / `X-Powered-By` headers disclose a software version. */
+  discloses_version: boolean;
+  /** The ones that are missing. */
+  headers_missing: string[];
+  /** Security headers found on the HTTPS response (`strict-transport-security`, `content-security-policy`, `x-content-type-options`, `x-frame-options`, `referrer-policy`, `permissions-policy`). */
+  headers_present: string[];
+  /** `true` when plain HTTP on port 80 redirects to HTTPS, `false` when it serves content or redirects elsewhere, absent when port 80 does not answer. */
+  http_redirects_to_https?: boolean | null;
+  /** Status of `GET https://<domain>/`. */
+  https_status?: number | null;
+}
+
+export interface MailSecurity {
+  /** DMARC policy: `reject`, `quarantine`, `none` or `absent`. */
+  dmarc?: string | null;
+  /** Whether an MTA-STS policy is published (`_mta-sts` TXT record). */
+  mta_sts: boolean;
+  /** Mail servers (MX) of the website's domain, highest priority first (at most 5). */
+  mx: string[];
+  /** Mail platform deduced from the MX records (`google-workspace`, `microsoft-365`, ...). */
+  provider?: string | null;
+  /** SPF policy: `strict` (-all), `soft` (~all), `neutral` (?all), `open` (+all) or `none`. */
+  spf?: string | null;
+}
+
+export interface TlsSecurity {
+  /** Days left before expiry (negative once expired). */
+  days_remaining?: number | null;
+  /** Why the handshake or validation failed, when it did. */
+  error?: string | null;
+  /** Certificate end of validity (UTC). */
+  expires_at?: string | null;
+  issuer?: string | null;
+  /** `TLS1.3` or `TLS1.2`. */
+  protocol?: string | null;
+  /** Whether HTTPS answered on port 443. */
+  reachable: boolean;
+  /** Number of host names the certificate covers. */
+  san_count: number;
+  /** Whether the certificate chain validates for this host name. */
+  valid: boolean;
+}
+
+export interface GetReportResponse {
+  /** How old this report is, in seconds (0 for a fresh assessment). */
+  age_seconds: number;
+  /** Addresses found on a public IP blocklist (IPv4 only). */
+  blocklisted: BlocklistHit[];
+  dns: DnsSecurity;
+  /** The host that was assessed, lowercased, without scheme or path. */
+  domain: string;
+  /** Everything worth acting on, most severe first. */
+  findings: Finding[];
+  /** `true` when this report was served from a stored result. */
+  from_cache: boolean;
+  /** `A` (90+), `B` (80+), `C` (65+), `D` (50+), `F`. */
+  grade: string;
+  http: HttpSecurity;
+  /** Public IPv4/IPv6 addresses of the host (at most 8). */
+  ip_addresses: string[];
+  mail: MailSecurity;
+  /** When the assessment was made (UTC). */
+  retrieved_at: string;
+  /** 0 to 100, higher is better; derived from the findings. */
+  score: number;
+  tls: TlsSecurity;
+}
+
+export interface GetReportRequest {
+  /** The domain to assess: `stripe.com`, `www.stripe.com` or a full URL (only the host is used). */
+  domain: string;
+  /** The oldest report you accept, in seconds. Omit it for the default (reports up to 1 hour old); `0` forces a fresh assessment. The response always says how old it is. */
+  max_age_seconds?: number | null;
+}
+
+/** Typed client for 🛡️ domain-security-service, e.g. `client.getReport(...)`. */
+export class Client extends BaseClient {
+  /** Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) */
+  async getReport(request: GetReportRequest): Promise<GetReportResponse> {
+    return this.post<GetReportResponse>("/v1/domain-security/get_report", request);
+  }
+}
+
+export { ClientOptions };

package/src/langchain.ts

@@ -0,0 +1,28 @@
+/**
+ * LangChain.js tools for 🛡️ domain-security-service, grouped in one Toolkit -- one tool per operation, each just an async function (JS has no separate sync form to generate). Requires the `@langchain/core`+`zod` peer dependencies declared in this package's own package.json -- imported from `domain-security/langchain`, never from the package root, so importing the base client never requires them installed.
+ */
+
+import { tool } from "@langchain/core/tools";
+import { z } from "zod";
+import { Client } from "./index.js";
+
+export class DomainSecurityToolkit {
+  private client: Client;
+
+  constructor(client: Client) {
+    this.client = client;
+  }
+
+  getTools() {
+    return [
+      tool(
+        async (input) => this.client.getReport(input),
+        {
+          name: "getReport",
+          description: "Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402)",
+          schema: z.object({ domain: z.string(), max_age_seconds: z.number().nullable().optional() }),
+        },
+      ),
+    ];
+  }
+}

package/test/index.test.mjs

@@ -0,0 +1,24 @@
+/**
+ * Verifies every domain-security client method sends a request to the expected path/HTTP verb and parses a well-formed response -- one test per operation, real fetch mocked via a plain reassignment of `globalThis.fetch` (no extra test/mocking dependency). Runs against the COMPILED package (`../dist/index.js`) -- build before testing.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Client } from "../dist/index.js";
+
+test("getReport calls the expected path", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async (url, init = {}) => {
+    const parsed = new URL(url);
+    assert.equal((init.method ?? "GET").toUpperCase(), "POST");
+    assert.equal(parsed.pathname, "/v1/domain-security/get_report");
+    return new Response(JSON.stringify({ age_seconds: 0, blocklisted: [], dns: { caa: [], dnssec: false, name_servers: [] }, domain: "test", findings: [], from_cache: false, grade: "test", http: { discloses_version: false, headers_missing: [], headers_present: [], http_redirects_to_https: null, https_status: null }, ip_addresses: [], mail: { dmarc: null, mta_sts: false, mx: [], provider: null, spf: null }, retrieved_at: "test", score: 0, tls: { days_remaining: null, error: null, expires_at: null, issuer: null, protocol: null, reachable: false, san_count: 0, valid: false } }), { status: 200 });
+  };
+  try {
+    const client = new Client("https://example.test");
+    const result = await client.getReport({ domain: "test", max_age_seconds: null });
+    assert.ok(result !== undefined);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});

package/test/langchain.test.mjs

@@ -0,0 +1,16 @@
+/**
+ * Verifies every domain-security LangChain tool through the real StructuredTool (`.invoke()`), not just the underlying client method -- catches schema-shape bugs a plain client-method test would miss. Requires the `langchain`/`zod` dev dependencies.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Client } from "../dist/index.js";
+import { DomainSecurityToolkit } from "../dist/langchain.js";
+
+test("getReport tool invoke", async () => {
+  globalThis.fetch = async () => new Response(JSON.stringify({ age_seconds: 0, blocklisted: [], dns: { caa: [], dnssec: false, name_servers: [] }, domain: "test", findings: [], from_cache: false, grade: "test", http: { discloses_version: false, headers_missing: [], headers_present: [], http_redirects_to_https: null, https_status: null }, ip_addresses: [], mail: { dmarc: null, mta_sts: false, mx: [], provider: null, spf: null }, retrieved_at: "test", score: 0, tls: { days_remaining: null, error: null, expires_at: null, issuer: null, protocol: null, reachable: false, san_count: 0, valid: false } }), { status: 200 });
+  const toolkit = new DomainSecurityToolkit(new Client("https://example.test"));
+  const t = toolkit.getTools().find((x) => x.name === "getReport");
+  const result = await t.invoke({ domain: "test", max_age_seconds: 0 });
+  assert.ok(result !== undefined);
+});

package/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ES2020",
+    "moduleResolution": "bundler",
+    "declaration": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": [
+    "src"
+  ]
+}