Four packages, published together at one version. Two of them you install on day one; the other two depend on what you are doing.
npm install @rudra-js/core @rudra-js/react @rudra-js/attested zod@^4.5@rudra-js/coreThe contracts and logic that turn one tracking payload into one renderable component specification. This is where the closed vocabulary lives — the reason a model has nowhere to put a price it invented.
Two peer dependencies, for two different reasons. zod is a peer because the public API is zod schemas. @rudra-js/attested is a peer for the opposite reason: none of its types cross the public surface, and it is a peer so there is exactly one denylist in your tree.
@rudra-js/reactRenders a specification as React Server Components, reading every title, price, image and link from your catalog as the page is served. Whatever the model wrote is rendered as escaped text. No client JavaScript, which is why a crawler that never runs JavaScript still reads the block.
@rudra-js/anthropicTalks to the Anthropic API with no vendor SDK and no dependencies. It is the only package that makes a billed call. It is one option rather than the only one — any model can sit behind the same small provider interface.
@rudra-js/attestedReads every word the model wrote in three passes: patterns for prices, discounts, ratings, delivery dates and stock counts; a check that every digit in the sentence came from your own payload; and a list of claims that carry no number to check. Any field that fails a pass is dropped. No dependencies.
Two of the three passes are word lists, so a rewording that sits on neither gets through, and the digit check reads digits, so a number spelled out in words is not a number to it. That is why the structural boundaries are the real defence — the model is never told a price, and the specification has nowhere to put one.