@agenticprimitives/agent-naming 1.0.0-alpha.4 → 1.0.0-alpha.5

package/AUDIT.md

@@ -1,7 +1,8 @@
 # @agenticprimitives/agent-naming — package audit
 
 **Status:** Phase 1 (SDK skeleton + spec + pure helpers).
-**Last refreshed:** 2026-05-23.
+**Last refreshed:** 2026-06-01 (R9 substrate coverage references + R11.1 fail-hard audit + R11.3 public-surface cleanup)
+**Prior refresh:** 2026-05-23
 **Owner:** [security-auditor](../../docs/agents/security-auditor.md) +
 [technical-architect-auditor](../../docs/agents/technical-architect-auditor.md).
 **System audit cross-ref:** see
@@ -14,7 +15,7 @@ on-chain authority paths, and demo integration land in Phase 3+.
 ## Charter (what's audit-relevant in this package)
 
 - Pure helpers (`normalizeAgentName`, `labelhash`, `namehash`): MUST
-  be deterministic + match the reference ENS algorithm + reject
+  be deterministic + match the standard recursive-namehash algorithm + reject
   malformed input.
 - Record schema (`AgentNameRecords` + `records` subpath): MUST
   refuse unknown keys on encode (fail-loud write) AND drop unknown
@@ -39,9 +40,9 @@ on-chain authority paths, and demo integration land in Phase 3+.
   non-ASCII / oversize labels. Throws `InvalidNameError`. Covered in
   `test/normalize.test.ts`.
 - ✅ `normalize` is idempotent: `normalize(normalize(x)) === normalize(x)`.
-- ✅ `namehash('')` = `ZERO_NODE` (`0x00…00`) per the ENS sentinel
+- ✅ `namehash('')` = `ZERO_NODE` (`0x00…00`) per the root-sentinel
   convention.
-- ✅ `namehash` matches the ENS reference algorithm under an
+- ✅ `namehash` matches the standard recursive-namehash algorithm under an
   in-band independent reimplementation (`test/namehash.test.ts`
   golden-vector table).
 - ✅ `namehash` rejects malformed input by delegating to `normalize`.
@@ -84,3 +85,13 @@ client doesn't yet take an `auditSink`; Phase 2 will add the optional
 | Date | Wave | What changed |
 | --- | --- | --- |
 | 2026-05-23 | NS Phase 1 | Initial audit. AN-1/2/3 open; security invariants verified by unit tests. |
+
+## R9 substrate coverage (2026-06-01)
+
+- Locked by R6.2 + R6.8 contract-side hardening:
+  - `AgentNameRegistry.initializeRoot` cannot be frontrun (immutable initializer + same-tx deploy) — H7-C.4 / CON-NAMING-001.
+  - `PermissionlessSubregistry.register` is `nonReentrant` — R6.2 / CON-SUBREGISTRY-003.
+  - Pause coverage: 7 mutating functions (register, backfillLabel, setOwner, setResolver, setSubregistry, renew, setPrimaryName) are `whenNotPaused` — R6.8.
+  - ADR-0012 / ADR-0013: NO `eth_getLogs` in product read paths; `reverseResolveString` is the canonical single-call.
+- See [`packages/contracts/AUDIT.md` § 3.8](../contracts/AUDIT.md).
+

package/CLAUDE.md

@@ -8,8 +8,8 @@ Names are a **facet registration** pointing AT the canonical Smart Agent ([ADR-0
 - The `.agent` TLD constant (`AGENT_TLD`).
 - Name normalization (`normalizeAgentName`) — NFC + lowercase + label
   validation. Rejects empty / hyphen-prefixed / non-ASCII labels in v0.
-- `labelhash` + `namehash` — ENS-compatible keccak256 hashes for
-  identifier nodes.
+- `labelhash` + `namehash` — recursive keccak256 hashes
+  (`keccak256(parentNode || labelhash)`) for identifier nodes.
 - Record schemas (`AgentNameRecords`) and predicate constants
   (subpath `/records`).
 - `AgentNamingClient` — read API (resolve / reverse-resolve / get
@@ -37,7 +37,7 @@ Names are a **facet registration** pointing AT the canonical Smart Agent ([ADR-0
 `AGENT_TLD`.
 **Disambiguation:**
 
-- **"resolver"** here = on-chain ENS-v2 resolver. Distinct from
+- **"resolver"** here = our on-chain registry + resolver. Distinct from
   any other package.
 - **"registry"** here = `AgentNameRegistry` contract. Distinct from
   the factory deploy-registry in `agent-account`.

package/README.md

@@ -70,7 +70,7 @@ const records = await naming.getRecords('treasury.acme.agent');
   `nativeId`). Owned by `agent-account`, not this package.
 - **AgentName**: a normalized dotted name under `.agent` (a facet label).
 - **Label**: one segment of a name, such as `treasury`.
-- **Node**: ENS-compatible `namehash(name)`.
+- **Node**: the recursive `namehash(name)`.
 - **Registry**: owns name records: owner, resolver, parent, subregistry.
 - **Resolver**: stores typed records for a node.
 - **Primary name**: reverse record for a Smart Agent address.

package/dist/namehash.d.ts

@@ -1,6 +1,7 @@
 import { type Hex } from 'viem';
 /**
- * Compute the namehash of an agent name (ENS-compatible).
+ * Compute the recursive namehash of an agent name
+ * (`keccak256(parentNode || labelhash)` convention).
  *
  *   namehash('')                = 0x00…00
  *   namehash('agent')           = keccak256(namehash('') || labelhash('agent'))
@@ -13,7 +14,7 @@ import { type Hex } from 'viem';
  *
  * Throws `InvalidNameError` (via `normalizeAgentName`) on malformed
  * input. Passing `''` returns `0x00…00` — the canonical "empty / root"
- * sentinel matching the ENS convention.
+ * sentinel matching the recursive-namehash convention.
  */
 export declare function namehash(name: string): Hex;
 /**

package/dist/namehash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namehash.d.ts","sourceRoot":"","sources":["../src/namehash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAGlE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAW1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAE5C;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,EAAE,GAA0E,CAAC"}
+{"version":3,"file":"namehash.d.ts","sourceRoot":"","sources":["../src/namehash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAGlE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAW1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAE5C;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,EAAE,GAA0E,CAAC"}

package/dist/namehash.js

@@ -1,7 +1,8 @@
 import { keccak256, encodePacked, toBytes } from 'viem';
 import { normalizeAgentName } from './normalize';
 /**
- * Compute the namehash of an agent name (ENS-compatible).
+ * Compute the recursive namehash of an agent name
+ * (`keccak256(parentNode || labelhash)` convention).
  *
  *   namehash('')                = 0x00…00
  *   namehash('agent')           = keccak256(namehash('') || labelhash('agent'))
@@ -14,7 +15,7 @@ import { normalizeAgentName } from './normalize';
  *
  * Throws `InvalidNameError` (via `normalizeAgentName`) on malformed
  * input. Passing `''` returns `0x00…00` — the canonical "empty / root"
- * sentinel matching the ENS convention.
+ * sentinel matching the recursive-namehash convention.
  */
 export function namehash(name) {
     if (name === '')
@@ -22,7 +23,7 @@ export function namehash(name) {
     const labels = normalizeAgentName(name).split('.');
     let node = ZERO_NODE;
     // Walk from rightmost (TLD-side) label inward so the root anchors
-    // the recursion — same as ENS reference impl.
+    // the recursion — the standard recursive-namehash algorithm.
     for (let i = labels.length - 1; i >= 0; i--) {
         const lh = labelhash(labels[i]);
         node = keccak256(encodePacked(['bytes32', 'bytes32'], [node, lh]));

package/dist/namehash.js.map

@@ -1 +1 @@
-{"version":3,"file":"namehash.js","sourceRoot":"","sources":["../src/namehash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,IAAI,GAAQ,SAAS,CAAC;IAC1B,kEAAkE;IAClE,8CAA8C;IAC9C,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACjC,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAQ,oEAAoE,CAAC"}
+{"version":3,"file":"namehash.js","sourceRoot":"","sources":["../src/namehash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,IAAI,GAAQ,SAAS,CAAC;IAC1B,kEAAkE;IAClE,6DAA6D;IAC7D,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACjC,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,MAAM,SAAS,GAAQ,oEAAoE,CAAC"}

package/docs/api.md

@@ -7,7 +7,7 @@ This is the human-readable guide to the public exports in
 
 - `AGENT_TLD`: the canonical top-level label, currently `"agent"`.
 - `AgentTld`: type of the canonical top-level label.
-- `ZERO_NODE`: the all-zero ENS root node.
+- `ZERO_NODE`: the all-zero root node.
 
 ## Name Helpers
 
@@ -15,7 +15,7 @@ This is the human-readable guide to the public exports in
   throws `InvalidNameError`.
 - `isValidAgentName(name)`: boolean wrapper around `normalizeAgentName`.
 - `labelhash(label)`: keccak256 hash of a single label.
-- `namehash(name)`: ENS-compatible recursive namehash of a normalized name.
+- `namehash(name)`: recursive namehash (`keccak256(parentNode || labelhash)`) of a normalized name.
 
 ## Client
 

package/docs/concepts.md

@@ -43,7 +43,7 @@ This avoids Unicode spoofing until a full IDN/punycode policy exists.
 
 ## Node And Namehash
 
-A node is the ENS-compatible `bytes32` namehash of a normalized name.
+A node is the recursive `bytes32` namehash (`keccak256(parentNode || labelhash)`) of a normalized name.
 
 ```ts
 namehash('agent');

package/docs/migration.md

@@ -90,4 +90,4 @@ Expected future migration areas:
 - Generated API docs or manifest-doc synchronization.
 - Example typecheck enforcement.
 - Stable deployment address package.
-- Optional compatibility layer for external ENS resolvers.
+- Optional compatibility layer for external on-chain name resolvers.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agenticprimitives/agent-naming",
-  "version": "1.0.0-alpha.4",
-  "description": "Agent Naming Service SDK: ENS-v2-style hierarchical naming for Smart Agents (.agent TLD). Owns name normalization, namehash/labelhash, records schemas, and the AgentNamingClient (resolve / reverse / registry). Speaks naming-domain vocabulary only — no delegation / caveat / custody concepts.",
+  "version": "1.0.0-alpha.5",
+  "description": "Agent Naming Service SDK: hierarchical naming for Smart Agents (.agent TLD). Owns name normalization, namehash/labelhash, records schemas, and the AgentNamingClient (resolve / reverse / registry). Speaks naming-domain vocabulary only — no delegation / caveat / custody concepts.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -43,19 +43,19 @@
     "access": "public"
   },
   "peerDependencies": {
-    "viem": "^2.50.0",
-    "@agenticprimitives/agent-account": "1.0.0-alpha.4",
-    "@agenticprimitives/connect-auth": "1.0.0-alpha.4",
-    "@agenticprimitives/types": "1.0.0-alpha.4"
+    "viem": "^2.52.2",
+    "@agenticprimitives/agent-account": "1.0.0-alpha.5",
+    "@agenticprimitives/connect-auth": "1.0.0-alpha.5",
+    "@agenticprimitives/types": "1.0.0-alpha.5"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",
-    "vitest": "^2.1.0"
+    "vitest": "^4.1.8"
   },
   "keywords": [
     "agent",
     "naming",
-    "ens",
+    "namehash",
     "smart-agent",
     "agentic"
   ],