@anuma/sdk 6.27.0 → 6.27.2

package/dist/expo/index.mjs

@@ -273,11 +273,32 @@ function clearAllEncryptionState() {
 function clearAllEncryptionKeys() {
   clearAllEncryptionState();
 }
+function hexNibble(code) {
+  if (code >= 48 && code <= 57) return code - 48;
+  if (code >= 65 && code <= 70) return code - 55;
+  if (code >= 97 && code <= 102) return code - 87;
+  return -1;
+}
 function hexToBytes(hex) {
+  if (typeof hex !== "string") {
+    throw new TypeError(
+      "hexToBytes: expected a hex string. Pass raw signature bytes to deriveKeyFromSignatureBytes instead of stringifying them."
+    );
+  }
   const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (cleanHex.length === 0 || cleanHex.length % 2 !== 0) {
+    throw new Error(
+      `hexToBytes: invalid hex string (expected a non-empty even length, got ${cleanHex.length})`
+    );
+  }
   const bytes = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = parseInt(cleanHex.slice(i, i + 2), 16);
+    const hi = hexNibble(cleanHex.charCodeAt(i));
+    const lo = hexNibble(cleanHex.charCodeAt(i + 1));
+    if (hi < 0 || lo < 0) {
+      throw new Error(`hexToBytes: invalid hex string (non-hex character at index ${i})`);
+    }
+    bytes[i / 2] = hi << 4 | lo;
   }
   return bytes;
 }
@@ -289,15 +310,12 @@ var SHARED_TEXT_DECODER = new TextDecoder();
 function isValidWalletAddress(address) {
   return /^0x[a-fA-F0-9]{40}$/.test(address);
 }
-async function deriveKeyFromSignature(signature) {
-  const sigBytes = hexToBytes(signature);
-  const hashBuffer = await crypto.subtle.digest("SHA-256", sigBytes.buffer);
-  const hashBytes = new Uint8Array(hashBuffer);
-  return bytesToHex(hashBytes);
-}
-async function deriveKeyFromSignatureV3(signature) {
-  const sigBytes = hexToBytes(signature);
-  const ikm = await crypto.subtle.digest("SHA-256", sigBytes.buffer);
+var AES_GCM_V3_INFO = "anuma-sdk-aes-gcm-v3";
+var AES_GCM_V4_INFO = "anuma-sdk-aes-gcm-v4";
+var MIN_SIGNATURE_BYTES = 64;
+async function deriveHkdfAesKeyHex(signatureBytes, info) {
+  const sigBytes = new Uint8Array(signatureBytes);
+  const ikm = await crypto.subtle.digest("SHA-256", sigBytes);
   const hkdfKey = await crypto.subtle.importKey("raw", ikm, { name: "HKDF" }, false, [
     "deriveBits"
   ]);
@@ -307,13 +325,32 @@ async function deriveKeyFromSignatureV3(signature) {
       hash: "SHA-256",
       salt: new Uint8Array(32),
       // Zero salt (HKDF spec: uses hash-length zero buffer)
-      info: SHARED_TEXT_ENCODER.encode("anuma-sdk-aes-gcm-v3")
+      info: SHARED_TEXT_ENCODER.encode(info)
     },
     hkdfKey,
     256
   );
   return bytesToHex(new Uint8Array(derivedBits));
 }
+async function deriveKeyFromSignature(signature) {
+  const sigBytes = hexToBytes(signature);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", sigBytes.buffer);
+  return bytesToHex(new Uint8Array(hashBuffer));
+}
+async function deriveKeyFromSignatureV3(signature) {
+  return deriveHkdfAesKeyHex(hexToBytes(signature), AES_GCM_V3_INFO);
+}
+async function deriveKeyFromSignatureBytes(signature) {
+  if (!(signature instanceof Uint8Array)) {
+    throw new TypeError("deriveKeyFromSignatureBytes: expected a Uint8Array signature");
+  }
+  if (signature.byteLength < MIN_SIGNATURE_BYTES) {
+    throw new Error(
+      `deriveKeyFromSignatureBytes: signature must be at least ${MIN_SIGNATURE_BYTES} bytes, got ${signature.byteLength}`
+    );
+  }
+  return deriveHkdfAesKeyHex(signature, AES_GCM_V4_INFO);
+}
 function getStoredKeyPair(address) {
   return keyPairStore.get(address) ?? null;
 }
@@ -331,8 +368,9 @@ async function deriveKeyPairFromSignature(signature, address) {
     {
       name: "HKDF",
       hash: "SHA-256",
+      // EVM addresses are case-insensitive. Base58 is not — this salt stays
+      // behind the EVM address gate in requestKeyPair.
       salt: SHARED_TEXT_ENCODER.encode(address.toLowerCase()),
-      // Wallet address as salt
       info: SHARED_TEXT_ENCODER.encode("ECDH-P256-KeyPair")
       // Context info
     },
@@ -3937,6 +3975,34 @@ function createWebSearchPreProcessor(options = {}) {
   };
 }
 
+// src/lib/storage/mcpImages.ts
+var IMAGE_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "AnumaMediaMCP-anuma_create_image",
+  "anuma_create_image",
+  // Deprecated anuma-image-mcp tools, retained so images in already-stored
+  // conversations still re-materialize on replay.
+  "AnumaImageMCP-generate_cloud_image",
+  "AnumaImageMCP-edit_cloud_image",
+  "generate_cloud_image",
+  "edit_cloud_image"
+]);
+function toolOutputForModel(name, output) {
+  if (!name || !IMAGE_TOOL_NAMES.has(name)) return output;
+  try {
+    const {
+      imageUrl: _imageUrl,
+      url: _url,
+      output_images: _outputImages,
+      ...rest
+    } = JSON.parse(output);
+    return JSON.stringify(rest);
+  } catch {
+    return output;
+  }
+}
+var VIDEO_EXTENSIONS = ["mp4", "webm", "mov"];
+var VIDEO_EXTENSION_RE = new RegExp(`\\.(${VIDEO_EXTENSIONS.join("|")})(?:[?#]|$)`, "i");
+
 // src/lib/chat/runHooks.ts
 function composeHooks(hooks) {
   const handlers = hooks.filter((h) => h !== void 0 && h !== null);
@@ -6067,6 +6133,40 @@ function extractLastUserText(messages) {
 function isToolErrorResult(result) {
   return result !== null && typeof result === "object" && "error" in result && typeof result.error === "string";
 }
+function serverToolCallMessages(events, messages, skipIds) {
+  const seen = new Set(skipIds);
+  for (const m of messages) {
+    if (m.tool_call_id) seen.add(m.tool_call_id);
+    for (const tc of m.tool_calls ?? []) if (tc.id) seen.add(tc.id);
+  }
+  const executed = [];
+  for (const event of events ?? []) {
+    if (!event.id || event.output === void 0 || event.output === null || seen.has(event.id)) {
+      continue;
+    }
+    seen.add(event.id);
+    executed.push(event);
+  }
+  if (executed.length === 0) return [];
+  return [
+    {
+      role: "assistant",
+      content: void 0,
+      tool_calls: executed.map((event) => ({
+        id: event.id,
+        type: "function",
+        function: { name: event.name, arguments: event.arguments }
+      }))
+    },
+    ...executed.map(
+      (event) => ({
+        role: "tool",
+        tool_call_id: event.id,
+        content: [{ type: "text", text: toolOutputForModel(event.name, event.output ?? "") }]
+      })
+    )
+  ];
+}
 function getToolName(tool) {
   const func = tool.function;
   const nestedName = func?.name;
@@ -6836,7 +6936,14 @@ Executing tool: ${toolInfo}
           }
         }))
       };
-      const toolResultMessages = [assistantMessage];
+      const toolResultMessages = [
+        ...serverToolCallMessages(
+          currentAccumulator.toolCallEvents,
+          currentMessages,
+          new Set(toolCallsToExecute.map((tc) => tc.id))
+        ),
+        assistantMessage
+      ];
       for (const execResult of continueResults) {
         const resultContent = execResult.error ? `Error: ${execResult.error}` : safeJsonStringify(execResult.result);
         toolResultMessages.push({
@@ -9019,20 +9126,6 @@ function generateMediaId() {
 // src/lib/db/media/operations.ts
 import { Q as Q3 } from "@nozbe/watermelondb";
 
-// src/lib/storage/mcpImages.ts
-var IMAGE_TOOL_NAMES = /* @__PURE__ */ new Set([
-  "AnumaMediaMCP-anuma_create_image",
-  "anuma_create_image",
-  // Deprecated anuma-image-mcp tools, retained so images in already-stored
-  // conversations still re-materialize on replay.
-  "AnumaImageMCP-generate_cloud_image",
-  "AnumaImageMCP-edit_cloud_image",
-  "generate_cloud_image",
-  "edit_cloud_image"
-]);
-var VIDEO_EXTENSIONS = ["mp4", "webm", "mov"];
-var VIDEO_EXTENSION_RE = new RegExp(`\\.(${VIDEO_EXTENSIONS.join("|")})(?:[?#]|$)`, "i");
-
 // src/lib/storage/opfs.ts
 function isOPFSSupported() {
   return typeof navigator !== "undefined" && "storage" in navigator && "getDirectory" in navigator.storage;
@@ -19522,24 +19615,10 @@ function storedToLlmapiMessage(stored) {
     });
     for (const event of stored.toolCallEvents) {
       if (event.id && event.output !== void 0 && event.output !== null) {
-        let toolOutput = event.output;
-        if (event.name && IMAGE_TOOL_NAMES.has(event.name)) {
-          try {
-            const parsed = JSON.parse(toolOutput);
-            const {
-              imageUrl: _imageUrl,
-              url: _url,
-              output_images: _outputImages,
-              ...rest
-            } = parsed;
-            toolOutput = JSON.stringify(rest);
-          } catch {
-          }
-        }
         messages.push({
           role: "tool",
           tool_call_id: event.id,
-          content: [{ type: "text", text: toolOutput }]
+          content: [{ type: "text", text: toolOutputForModel(event.name, event.output) }]
         });
       }
     }
@@ -23978,6 +24057,7 @@ export {
   deleteVaultFolderOp,
   deleteVaultMemoryOp,
   dequantizeEmbedding,
+  deriveKeyFromSignatureBytes,
   discoverNotionOAuthEndpoints,
   eagerEmbedContent,
   embedAllMessages,

package/dist/index.cjs

@@ -2916,11 +2916,32 @@ function getStoredKeyByVersion(address, version) {
   const value = version === "v2" ? keys.legacy : keys.current;
   return value ?? null;
 }
+function hexNibble(code) {
+  if (code >= 48 && code <= 57) return code - 48;
+  if (code >= 65 && code <= 70) return code - 55;
+  if (code >= 97 && code <= 102) return code - 87;
+  return -1;
+}
 function hexToBytes(hex) {
+  if (typeof hex !== "string") {
+    throw new TypeError(
+      "hexToBytes: expected a hex string. Pass raw signature bytes to deriveKeyFromSignatureBytes instead of stringifying them."
+    );
+  }
   const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (cleanHex.length === 0 || cleanHex.length % 2 !== 0) {
+    throw new Error(
+      `hexToBytes: invalid hex string (expected a non-empty even length, got ${cleanHex.length})`
+    );
+  }
   const bytes = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = parseInt(cleanHex.slice(i, i + 2), 16);
+    const hi = hexNibble(cleanHex.charCodeAt(i));
+    const lo = hexNibble(cleanHex.charCodeAt(i + 1));
+    if (hi < 0 || lo < 0) {
+      throw new Error(`hexToBytes: invalid hex string (non-hex character at index ${i})`);
+    }
+    bytes[i / 2] = hi << 4 | lo;
   }
   return bytes;
 }

package/dist/index.mjs

@@ -2710,11 +2710,32 @@ function getStoredKeyByVersion(address, version) {
   const value = version === "v2" ? keys.legacy : keys.current;
   return value ?? null;
 }
+function hexNibble(code) {
+  if (code >= 48 && code <= 57) return code - 48;
+  if (code >= 65 && code <= 70) return code - 55;
+  if (code >= 97 && code <= 102) return code - 87;
+  return -1;
+}
 function hexToBytes(hex) {
+  if (typeof hex !== "string") {
+    throw new TypeError(
+      "hexToBytes: expected a hex string. Pass raw signature bytes to deriveKeyFromSignatureBytes instead of stringifying them."
+    );
+  }
   const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (cleanHex.length === 0 || cleanHex.length % 2 !== 0) {
+    throw new Error(
+      `hexToBytes: invalid hex string (expected a non-empty even length, got ${cleanHex.length})`
+    );
+  }
   const bytes = new Uint8Array(cleanHex.length / 2);
   for (let i = 0; i < cleanHex.length; i += 2) {
-    bytes[i / 2] = parseInt(cleanHex.slice(i, i + 2), 16);
+    const hi = hexNibble(cleanHex.charCodeAt(i));
+    const lo = hexNibble(cleanHex.charCodeAt(i + 1));
+    if (hi < 0 || lo < 0) {
+      throw new Error(`hexToBytes: invalid hex string (non-hex character at index ${i})`);
+    }
+    bytes[i / 2] = hi << 4 | lo;
   }
   return bytes;
 }

package/dist/memory/context.d.mts

@@ -10,6 +10,11 @@ interface SignMessageOptions {
 /**
  * Type for the signMessage function that client must provide.
  * This is typically from Privy's useSignMessage hook.
+ *
+ * The resolved value must be a hex signature (`0x`-prefixed or bare). A
+ * non-hex string — including `String(uint8Array)` or a base58 signature —
+ * throws from key derivation instead of becoming a zero-filled AES key.
+ * Raw signature bytes go to {@link deriveKeyFromSignatureBytes}.
  */
 type SignMessageFn = (message: string, options?: SignMessageOptions) => Promise<string>;
 /**

package/dist/memory/context.d.ts

@@ -10,6 +10,11 @@ interface SignMessageOptions {
 /**
  * Type for the signMessage function that client must provide.
  * This is typically from Privy's useSignMessage hook.
+ *
+ * The resolved value must be a hex signature (`0x`-prefixed or bare). A
+ * non-hex string — including `String(uint8Array)` or a base58 signature —
+ * throws from key derivation instead of becoming a zero-filled AES key.
+ * Raw signature bytes go to {@link deriveKeyFromSignatureBytes}.
  */
 type SignMessageFn = (message: string, options?: SignMessageOptions) => Promise<string>;
 /**