@atbash/sdk 0.10.0-dev.0 → 0.10.1-dev.0

package/dist/browser.d.mts

@@ -1049,35 +1049,16 @@ declare function flushTelemetry(): Promise<void>;
 declare function shutdownTelemetry(): Promise<void>;
 
 /**
- * Signs `log_encrypted_tool_call` — the ciphertext-only counterpart of
- * `log_tool_call`. Rust core owns the encrypt + hash + GTX sign flow;
- * this module is a thin wrapper. Browser callers get the pure-TS shim
- * at `src-ts/browser/encrypted-toolcall.ts` (NAPI can't run in-browser).
- */
-/** Plaintext fields of a tool call, sealed into a single ECIES payload. */
-interface ToolCallPlaintext {
-    tool_name: string;
-    action: string;
-    context: string;
-    tool_args_json: string;
-}
-/**
- * Canonical form of an action for the retry-cache hash. Byte-identical to
- * the dashboard's `normalizeActionForHash` — diverging silently breaks
- * YELLOW-hold retry resolution.
+ * Rust core does the work; `browser/encrypted-toolcall.ts` mirrors it for the
+ * browser and must produce the same columns.
  */
+/** Must match `column_aad` in the core — the label binds a ciphertext to its column. */
+declare function columnAad(toolCallId: string, column: string): string;
+/** Byte-identical to the dashboard's copy — diverging breaks hold-retry resolution. */
 declare function normalizeActionForHash(action: string): string;
-/**
- * Signed commitment to the plaintext claims the caller sends alongside the
- * ciphertext. The judge reads plaintext from the request body but holds no
- * org key; this hash lets it verify body-vs-ciphertext without decrypting.
- * Byte-identical to the dashboard's `claimHashHex`.
- */
+/** Lets the judge check the request body against the ciphertext without an org key. */
 declare function claimHashHex(toolName: string, action: string, context: string, toolArgsJson: string): string;
-/**
- * Build + sign a `log_encrypted_tool_call` transaction. Returns hex-encoded
- * signed tx, ready to POST as `signed_log_tool_call`.
- */
+/** @returns hex-encoded signed tx, ready to POST as `signed_log_tool_call`. */
 declare function signEncryptedToolCall(toolCallId: string, action: string, context: string, toolName: string, toolArgsJson: string, orgEncryptionPubKey: string, privkeyHex: string, blockchainRidHex: string): string;
 
 /**
@@ -1126,6 +1107,29 @@ declare function decryptForOrg(payload: Uint8Array, orgPrivKeyHex: string, aad:
  */
 declare function encryptedLength(plaintextByteLength: number): number;
 
+/**
+ *   atb1.<key-fingerprint>.<claim-hash>.<base64 ciphertext>
+ *
+ * Normative spec: `core/src/crypto_envelope.rs`. This mirrors it for the browser.
+ */
+interface Envelope {
+    /** First 8 bytes of the recipient public key, hex. May be empty. */
+    keyFingerprint: string;
+    /** Commitment to the accompanying plaintext claims. May be empty. */
+    claimHash: string;
+    /** Raw ECIES payload. */
+    payload: Uint8Array;
+}
+declare function packEnvelope(payload: Uint8Array, keyFingerprint?: string, claimHash?: string): string;
+/**
+ * Stays true for a truncated envelope that `parseEnvelope` rejects — a severed
+ * ciphertext is not plaintext, so callers must show a placeholder.
+ */
+declare function isEnvelope(value: string): boolean;
+/** Null, not a throw — pre-encryption records are plaintext. */
+declare function parseEnvelope(value: string): Envelope | null;
+declare function keyFingerprintOf(pubKeyHex: string): string;
+
 declare function isValidPrivateKey(hex: string): boolean;
 declare function derivePublicKey(privkey: string): string;
 declare function generateKeypair(): KeyPair;
@@ -1141,4 +1145,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallPlaintext, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, claimHashHex, classifyMemoryRead, classifyMemoryWrite, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveMemory, getActiveMemoryId, getAllAgentMemory, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRollbackHistory, guardMemoryWrite, isValidPrivateKey, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveMemory, getActiveMemoryId, getAllAgentMemory, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -44126,6 +44126,44 @@ function encryptedLength(plaintextByteLength) {
   return HEADER_LEN + plaintextByteLength + GCM_TAG_LEN;
 }
 
+// src-ts/crypto/envelope.ts
+var PREFIX = "atb1";
+var SEPARATOR = ".";
+function toBase64(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+function fromBase64(text) {
+  const binary = atob(text);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function packEnvelope(payload, keyFingerprint = "", claimHash = "") {
+  return [PREFIX, keyFingerprint, claimHash, toBase64(payload)].join(SEPARATOR);
+}
+function fieldWidthOk(value, hexChars) {
+  return value.length === 0 ? true : value.length === hexChars && /^[0-9a-f]+$/.test(value);
+}
+function isEnvelope(value) {
+  if (typeof value !== "string" || !value.startsWith(PREFIX + SEPARATOR)) return false;
+  const parts = value.split(SEPARATOR);
+  return parts.length >= 4 && fieldWidthOk(parts[1], 16) && fieldWidthOk(parts[2], 64);
+}
+function parseEnvelope(value) {
+  if (!isEnvelope(value)) return null;
+  const [, keyFingerprint, claimHash, ...rest] = value.split(SEPARATOR);
+  try {
+    return { keyFingerprint, claimHash, payload: fromBase64(rest.join(SEPARATOR)) };
+  } catch {
+    return null;
+  }
+}
+function keyFingerprintOf(pubKeyHex) {
+  return pubKeyHex.trim().replace(/^0x/i, "").toLowerCase().slice(0, 16);
+}
+
 // src-ts/browser/encrypted-toolcall.ts
 var { Buffer: PolyBuffer, gtx: pcgtx2 } = index;
 var MERKLE_HASH_VERSION2 = 2;
@@ -44138,6 +44176,9 @@ function claimHashHex(toolName, action, context, toolArgsJson) {
   ]);
   return bytesToHex2(sha256(new TextEncoder().encode(canonical)));
 }
+function columnAad(toolCallId, column) {
+  return `${toolCallId}:${column}`;
+}
 function normalizeActionForHash(action) {
   action = action.trim();
   try {
@@ -44183,31 +44224,34 @@ function signOpWithBytes(opName, args, privkeyHex, blockchainRidHex) {
   return pcgtx2.serialize(g).toString("hex");
 }
 function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJson, orgEncryptionPubKey, privkeyHex, blockchainRidHex) {
-  const plaintext = {
-    tool_name: toolName,
-    action,
-    context,
-    tool_args_json: toolArgsJson
-  };
-  const contentCipher = encryptForOrg(
-    JSON.stringify(plaintext),
-    orgEncryptionPubKey,
-    toolCallId,
-    EciesDomain.toolCall
+  const fingerprint = keyFingerprintOf(orgEncryptionPubKey);
+  const seal = (text, column) => text === "" ? "" : packEnvelope(
+    encryptForOrg(
+      text,
+      orgEncryptionPubKey,
+      columnAad(toolCallId, column),
+      EciesDomain.toolCall
+    ),
+    fingerprint
   );
-  const actionHash = bytesToHex2(
-    sha256(new TextEncoder().encode(normalizeActionForHash(action)))
+  const actionColumn = packEnvelope(
+    encryptForOrg(
+      action,
+      orgEncryptionPubKey,
+      columnAad(toolCallId, "action"),
+      EciesDomain.toolCall
+    ),
+    fingerprint,
+    claimHashHex(toolName, action, context, toolArgsJson)
   );
   return signOpWithBytes(
-    "log_encrypted_tool_call",
+    "log_tool_call",
     [
       toolCallId,
+      actionColumn,
+      seal(context, "context"),
       toolName,
-      contentCipher,
-      actionHash,
-      // Empty = "org's current key"; chain resolves it.
-      PolyBuffer.from(new Uint8Array(0)),
-      claimHashHex(toolName, action, context, toolArgsJson)
+      seal(toolArgsJson, "tool_args")
     ],
     privkeyHex,
     blockchainRidHex
@@ -45697,6 +45741,7 @@ export {
   claimHashHex,
   classifyMemoryRead,
   classifyMemoryWrite,
+  columnAad,
   commitMemoryVersion,
   containsEvasionCharacters2 as containsEvasionCharacters,
   containsSecret2 as containsSecret,
@@ -45724,7 +45769,9 @@ export {
   getMemoryHistory,
   getRollbackHistory,
   guardMemoryWrite,
+  isEnvelope,
   isValidPrivateKey2 as isValidPrivateKey,
+  keyFingerprintOf,
   loadAgent2 as loadAgent,
   loadAgentFromFile,
   loadUserConfig,
@@ -45732,6 +45779,8 @@ export {
   normalizeForMatching2 as normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
+  packEnvelope,
+  parseEnvelope,
   pubkeyToHex,
   recordCall,
   recordDuration,