@atbash/sdk 0.10.0-dev.0 → 0.10.4-dev.0

package/dist/index.mjs

@@ -2899,6 +2899,9 @@ function chainForNetwork(network) {
 }
 
 // src-ts/encrypted-toolcall.ts
+function columnAad(toolCallId, column) {
+  return `${toolCallId}:${column}`;
+}
 function normalizeActionForHash(action) {
   return native.normalizeActionForHash(action);
 }
@@ -2919,11 +2922,14 @@ function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJs
 }
 
 // src-ts/endpoint.ts
-var ALLOWED_JUDGE_HOSTS = /* @__PURE__ */ new Set([
-  "atbash.ai",
-  "www.atbash.ai",
-  "chromia-verified-ai-dev-two.vercel.app"
-]);
+function buildAllowedJudgeHosts() {
+  return /* @__PURE__ */ new Set([
+    "atbash.ai",
+    "www.atbash.ai",
+    new URL(DEFAULT_ENDPOINT).hostname.toLowerCase()
+  ]);
+}
+var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -3285,6 +3291,8 @@ var Atbash = class _Atbash {
   orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
+  /** Org key learned from the last agent-exists check, for this agent only. */
+  _orgKeyFromChain = null;
   logger;
   http;
   /**
@@ -3369,6 +3377,10 @@ var Atbash = class _Atbash {
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp);
+      if (pk === this.auth.pubkey) {
+        const key3 = data?.org_encryption_pubkey;
+        this._orgKeyFromChain = typeof key3 === "string" && key3 ? key3 : null;
+      }
       return Boolean(data?.registered);
     });
   }
@@ -3399,7 +3411,7 @@ var Atbash = class _Atbash {
     }
     const toolCallId = generateToolCallId();
     const brid = this.bridFromChainOpts(options.chainOpts);
-    const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey;
+    const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
         toolCallId,
@@ -42940,6 +42952,44 @@ function encryptedLength(plaintextByteLength) {
   return native.encryptedLength(plaintextByteLength);
 }
 
+// src-ts/crypto/envelope.ts
+var PREFIX = "atb1";
+var SEPARATOR = ".";
+function toBase64(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+function fromBase64(text) {
+  const binary = atob(text);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function packEnvelope(payload, keyFingerprint = "", claimHash = "") {
+  return [PREFIX, keyFingerprint, claimHash, toBase64(payload)].join(SEPARATOR);
+}
+function fieldWidthOk(value, hexChars) {
+  return value.length === 0 ? true : value.length === hexChars && /^[0-9a-f]+$/.test(value);
+}
+function isEnvelope(value) {
+  if (typeof value !== "string" || !value.startsWith(PREFIX + SEPARATOR)) return false;
+  const parts = value.split(SEPARATOR);
+  return parts.length >= 4 && fieldWidthOk(parts[1], 16) && fieldWidthOk(parts[2], 64);
+}
+function parseEnvelope(value) {
+  if (!isEnvelope(value)) return null;
+  const [, keyFingerprint, claimHash, ...rest] = value.split(SEPARATOR);
+  try {
+    return { keyFingerprint, claimHash, payload: fromBase64(rest.join(SEPARATOR)) };
+  } catch {
+    return null;
+  }
+}
+function keyFingerprintOf(pubKeyHex) {
+  return pubKeyHex.trim().replace(/^0x/i, "").toLowerCase().slice(0, 16);
+}
+
 // src-ts/index.ts
 function isValidPrivateKey(hex) {
   return native.isValidPrivateKey(hex);
@@ -43009,9 +43059,11 @@ export {
   MemoryIntegrityError,
   PointerStore,
   SignatureVerificationError,
+  buildAllowedJudgeHosts,
   claimHashHex,
   classifyMemoryRead,
   classifyMemoryWrite,
+  columnAad,
   commitMemoryVersion,
   containsEvasionCharacters,
   containsSecret,
@@ -43039,7 +43091,9 @@ export {
   getMemoryHistory,
   getRollbackHistory,
   guardMemoryWrite,
+  isEnvelope,
   isValidPrivateKey,
+  keyFingerprintOf,
   loadAgent,
   loadAgentFromFile,
   loadUserConfig,
@@ -43047,6 +43101,8 @@ export {
   normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
+  packEnvelope,
+  parseEnvelope,
   pubkeyToHex,
   recordCall,
   recordDuration,