@xyz17711/domain-security 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,87 @@
-# Temporary Holding Version
+# @xyz17711/domain-security
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![Publish](https://github.com/17711-services/clients/actions/workflows/publish-node.yml/badge.svg)](https://github.com/17711-services/clients/actions/workflows/publish-node.yml)
+[![npm](https://img.shields.io/npm/v/@xyz17711/domain-security)](https://www.npmjs.com/package/@xyz17711/domain-security)
+[![License](https://img.shields.io/npm/l/@xyz17711/domain-security)](https://github.com/17711-services/clients/blob/main/LICENSE)
+
+Typed TypeScript client for **domain-security-service**, part of the
+[17711.xyz](https://api.17711.xyz) microservice fleet -- pay-per-call APIs settled in USDC via
+[x402](https://x402.org), listed on [x402scan](https://www.x402scan.com/server/f1c7b972-3405-4b75-8b4f-d1bfbd6305ff).
+
+## Install
+
+```bash
+npm install @xyz17711/domain-security
+```
+
+## Methods
+
+| Method | Description |
+| --- | --- |
+| `getReport` | Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) |
+
+## Quickstart
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/domain-security-service");
+// see the Methods table above for every available call and its request/response type
+```
+
+## Paying past the free quota
+
+Every gated tool allows a small number of free calls per day; beyond that it returns a 402
+challenge. Without a wallet configured, this client throws `PaymentRequiredError` with the price,
+network, and payee address attached:
+
+```typescript
+import { Client, PaymentRequiredError } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/domain-security-service");
+try {
+  await client.getReport(/* ... */);
+} catch (e) {
+  if (e instanceof PaymentRequiredError) {
+    console.log(`needs ${e.priceUsdc} USDC on ${e.network}, payable to ${e.payTo}`);
+  }
+}
+```
+
+To pay automatically, configure a wallet on the client -- the private key should come from your
+own environment/secrets manager, never a literal string in source code:
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+
+const client = new Client("https://api.17711.xyz/registry/domain-security-service", {
+  x402PrivateKey: process.env.X402_PRIVATE_KEY,
+  x402ExpectedNetwork: "eip155:8453", // Base mainnet; use eip155:84532 for Base Sepolia testnet
+  x402MaxPaymentUsdc: 0.01,           // refuse any single call above this
+  x402MaxTotalSpendUsdc: 1.0,         // refuse once this WALLET's lifetime spend would exceed it
+});
+```
+
+**Never commit a private key.** Both spend caps are required together with the key -- a wallet
+with real funds and no explicit caps refuses to construct at all (`WalletConfigError`), on
+purpose. The cumulative cap is tracked per wallet address, shared by every `Client` you construct
+with that same key in this process.
+
+## LangChain.js
+
+```typescript
+import { Client } from "@xyz17711/domain-security";
+import { DomainSecurityToolkit } from "@xyz17711/domain-security/langchain";
+
+const client = new Client("https://api.17711.xyz/registry/domain-security-service", { /* ...wallet options... */ });
+const tools = new DomainSecurityToolkit(client).getTools();
+```
+
+Requires the optional `@langchain/core`+`zod` peer dependencies (`npm install @langchain/core
+zod`) -- importing the base package above never requires them; only `@xyz17711/domain-security/langchain`
+does.
+
+## License
+
+MIT -- see [`LICENSE`](../../LICENSE), shared by every language's client library in the
+`clients` repo this package lives in.

package/dist/index.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Typed HTTP client and request/response interfaces for domain-security-service.
+ */
+import { Client as BaseClient, type ClientOptions } from "@xyz17711/core";
+export interface BlocklistHit {
+    cidr: string;
+    ip: string;
+    source: string;
+}
+export interface DnsSecurity {
+    /** CAA records: the certificate authorities allowed to issue for the domain. */
+    caa: string[];
+    /** Whether the answer for the domain is validated by DNSSEC. */
+    dnssec: boolean;
+    /** Authoritative name servers (at most 8). */
+    name_servers: string[];
+}
+export interface Finding {
+    /** Stable machine-readable code, e.g. `tls.expired`, `mail.dmarc_absent`, `http.hsts_missing`. */
+    code: string;
+    /** What was observed and why it matters, in one sentence. */
+    message: string;
+    /** `critical`, `high`, `medium`, `low` or `info`. */
+    severity: string;
+}
+export interface HttpSecurity {
+    /** Whether the `Server` / `X-Powered-By` headers disclose a software version. */
+    discloses_version: boolean;
+    /** The ones that are missing. */
+    headers_missing: string[];
+    /** Security headers found on the HTTPS response (`strict-transport-security`, `content-security-policy`, `x-content-type-options`, `x-frame-options`, `referrer-policy`, `permissions-policy`). */
+    headers_present: string[];
+    /** `true` when plain HTTP on port 80 redirects to HTTPS, `false` when it serves content or redirects elsewhere, absent when port 80 does not answer. */
+    http_redirects_to_https?: boolean | null;
+    /** Status of `GET https://<domain>/`. */
+    https_status?: number | null;
+}
+export interface MailSecurity {
+    /** DMARC policy: `reject`, `quarantine`, `none` or `absent`. */
+    dmarc?: string | null;
+    /** Whether an MTA-STS policy is published (`_mta-sts` TXT record). */
+    mta_sts: boolean;
+    /** Mail servers (MX) of the website's domain, highest priority first (at most 5). */
+    mx: string[];
+    /** Mail platform deduced from the MX records (`google-workspace`, `microsoft-365`, ...). */
+    provider?: string | null;
+    /** SPF policy: `strict` (-all), `soft` (~all), `neutral` (?all), `open` (+all) or `none`. */
+    spf?: string | null;
+}
+export interface TlsSecurity {
+    /** Days left before expiry (negative once expired). */
+    days_remaining?: number | null;
+    /** Why the handshake or validation failed, when it did. */
+    error?: string | null;
+    /** Certificate end of validity (UTC). */
+    expires_at?: string | null;
+    issuer?: string | null;
+    /** `TLS1.3` or `TLS1.2`. */
+    protocol?: string | null;
+    /** Whether HTTPS answered on port 443. */
+    reachable: boolean;
+    /** Number of host names the certificate covers. */
+    san_count: number;
+    /** Whether the certificate chain validates for this host name. */
+    valid: boolean;
+}
+export interface GetReportResponse {
+    /** How old this report is, in seconds (0 for a fresh assessment). */
+    age_seconds: number;
+    /** Addresses found on a public IP blocklist (IPv4 only). */
+    blocklisted: BlocklistHit[];
+    dns: DnsSecurity;
+    /** The host that was assessed, lowercased, without scheme or path. */
+    domain: string;
+    /** Everything worth acting on, most severe first. */
+    findings: Finding[];
+    /** `true` when this report was served from a stored result. */
+    from_cache: boolean;
+    /** `A` (90+), `B` (80+), `C` (65+), `D` (50+), `F`. */
+    grade: string;
+    http: HttpSecurity;
+    /** Public IPv4/IPv6 addresses of the host (at most 8). */
+    ip_addresses: string[];
+    mail: MailSecurity;
+    /** When the assessment was made (UTC). */
+    retrieved_at: string;
+    /** 0 to 100, higher is better; derived from the findings. */
+    score: number;
+    tls: TlsSecurity;
+}
+export interface GetReportRequest {
+    /** The domain to assess: `stripe.com`, `www.stripe.com` or a full URL (only the host is used). */
+    domain: string;
+    /** The oldest report you accept, in seconds. Omit it for the default (reports up to 1 hour old); `0` forces a fresh assessment. The response always says how old it is. */
+    max_age_seconds?: number | null;
+}
+/** Typed client for domain-security-service, e.g. `client.getReport(...)`. */
+export declare class Client extends BaseClient {
+    /** Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) */
+    getReport(request: GetReportRequest): Promise<GetReportResponse>;
+}
+export { ClientOptions };

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * Typed HTTP client and request/response interfaces for domain-security-service.
+ */
+import { Client as BaseClient } from "@xyz17711/core";
+/** Typed client for domain-security-service, e.g. `client.getReport(...)`. */
+export class Client extends BaseClient {
+    /** Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402) */
+    async getReport(request) {
+        return this.post("/v1/domain-security/get_report", request);
+    }
+}

package/dist/langchain.d.ts

@@ -0,0 +1,19 @@
+/**
+ * LangChain.js tools for domain-security-service, grouped in one Toolkit -- one tool per operation, each just an async function (JS has no separate sync form to generate). Requires the `@langchain/core`+`zod` peer dependencies declared in this package's own package.json -- imported from `domain-security/langchain`, never from the package root, so importing the base client never requires them installed.
+ */
+import { z } from "zod";
+import { Client } from "./index.js";
+export declare class DomainSecurityToolkit {
+    private client;
+    constructor(client: Client);
+    getTools(): import("@langchain/core/tools").DynamicStructuredTool<z.ZodObject<{
+        domain: z.ZodString;
+        max_age_seconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>, {
+        domain: string;
+        max_age_seconds?: number | null | undefined;
+    }, {
+        domain: string;
+        max_age_seconds?: number | null | undefined;
+    }, import("./index.js").GetReportResponse, unknown, "getReport">[];
+}

package/dist/langchain.js

@@ -0,0 +1,19 @@
+/**
+ * LangChain.js tools for domain-security-service, grouped in one Toolkit -- one tool per operation, each just an async function (JS has no separate sync form to generate). Requires the `@langchain/core`+`zod` peer dependencies declared in this package's own package.json -- imported from `domain-security/langchain`, never from the package root, so importing the base client never requires them installed.
+ */
+import { tool } from "@langchain/core/tools";
+import { z } from "zod";
+export class DomainSecurityToolkit {
+    constructor(client) {
+        this.client = client;
+    }
+    getTools() {
+        return [
+            tool(async (input) => this.client.getReport(input), {
+                name: "getReport",
+                description: "Domain security check: SSL certificate check, DMARC SPF check, DNSSEC, security headers and blocklist status with a score ($0.009, x402)",
+                schema: z.object({ domain: z.string(), max_age_seconds: z.number().nullable().optional() }),
+            }),
+        ];
+    }
+}

package/package.json

@@ -1,6 +1,70 @@
 {
   "name": "@xyz17711/domain-security",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Typed TypeScript client for the 17711.xyz Domain Security API: pay-per-call, settled in USDC via x402.",
+  "license": "MIT",
+  "author": "17711 Services",
+  "homepage": "https://api.17711.xyz",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/17711-services/clients.git",
+    "directory": "node/packages/domain-security"
+  },
+  "bugs": {
+    "url": "https://github.com/17711-services/clients/issues"
+  },
+  "keywords": [
+    "x402",
+    "usdc",
+    "api-client",
+    "pay-per-call",
+    "ai-agents",
+    "mcp",
+    "langchain",
+    "domain-security"
+  ],
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./langchain": {
+      "types": "./dist/langchain.d.ts",
+      "default": "./dist/langchain.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p .",
+    "test": "npm run build && node --test test/*.test.mjs"
+  },
+  "dependencies": {
+    "@xyz17711/core": "^0.1.0"
+  },
+  "peerDependencies": {
+    "@langchain/core": ">=0.3",
+    "zod": "^3 || ^4"
+  },
+  "peerDependenciesMeta": {
+    "@langchain/core": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "@langchain/core": "^1.2",
+    "zod": "^4"
+  }
+}