@atbash/sdk 0.10.12-dev.0 → 0.10.13-dev.0

package/dist/index.d.mts

@@ -452,7 +452,7 @@ declare class Atbash {
      * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
      * server-side replay protection windows never expire it mid-session.
      */
-    private _authBearer;
+    private _authBearers;
     /** Guards `logEnvironmentOnce` — hosts construct several clients. */
     private static environmentLogged;
     constructor(privkey: string, options?: AtbashOptions);
@@ -600,6 +600,12 @@ declare class Atbash {
     private riskEngineGet;
     private riskEnginePost;
     private riskEngineRecords;
+    /**
+     * BRID for an org — one round-trip to the map, honoring the client's chain
+     * cache. Returns undefined when the org is unknown, so the caller falls
+     * back to the client default (best-effort discovery).
+     */
+    private bridForOrg;
     private raiseIfError;
     /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
     private httpError;

package/dist/index.d.ts

@@ -452,7 +452,7 @@ declare class Atbash {
      * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
      * server-side replay protection windows never expire it mid-session.
      */
-    private _authBearer;
+    private _authBearers;
     /** Guards `logEnvironmentOnce` — hosts construct several clients. */
     private static environmentLogged;
     constructor(privkey: string, options?: AtbashOptions);
@@ -600,6 +600,12 @@ declare class Atbash {
     private riskEngineGet;
     private riskEnginePost;
     private riskEngineRecords;
+    /**
+     * BRID for an org — one round-trip to the map, honoring the client's chain
+     * cache. Returns undefined when the org is unknown, so the caller falls
+     * back to the client default (best-effort discovery).
+     */
+    private bridForOrg;
     private raiseIfError;
     /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
     private httpError;

package/dist/index.js

@@ -3481,7 +3481,11 @@ var Atbash = class _Atbash {
    * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
    * server-side replay protection windows never expire it mid-session.
    */
-  _authBearer = null;
+  // Keyed by blockchainRid so bearers for the public and private chains can
+  // coexist. The dashboard derives `authNetwork` from the BRID inside the
+  // signed envelope, so a bearer signed for chain A cannot authenticate a
+  // request routed to chain B — every chain the client talks to needs its own.
+  _authBearers = /* @__PURE__ */ new Map();
   /** Guards `logEnvironmentOnce` — hosts construct several clients. */
   static environmentLogged = false;
   constructor(privkey, options = {}) {
@@ -3597,10 +3601,11 @@ var Atbash = class _Atbash {
     return this.track("checkAgentExists", pk, async () => {
       const query = { pubkey: pk };
       if (network) query.network = network;
+      const brid = this.bridFromChainOpts(network ? { network } : void 0);
       const resp = await this.http.get(
         "/api/ai/exists",
         query,
-        this.authHeaders()
+        this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp);
@@ -3955,15 +3960,15 @@ var Atbash = class _Atbash {
       () => this.riskEngineRecords("tool-calls", { limit: maxCount })
     );
   }
-  getOrgToolCalls(orgName, maxCount) {
-    return this.track(
-      "getOrgToolCalls",
-      void 0,
-      () => this.riskEngineRecords("org-tool-calls", {
-        org: orgName,
-        limit: maxCount
-      })
-    );
+  async getOrgToolCalls(orgName, maxCount) {
+    return this.track("getOrgToolCalls", void 0, async () => {
+      const brid = await this.bridForOrg(orgName);
+      return this.riskEngineRecords(
+        "org-tool-calls",
+        { org: orgName, limit: maxCount },
+        brid
+      );
+    });
   }
   getAgentToolCalls(agentPubkey, maxCount) {
     return this.track(
@@ -3993,7 +3998,12 @@ var Atbash = class _Atbash {
   }
   async getOrgTierInfo(orgName) {
     return this.track("getOrgTierInfo", void 0, async () => {
-      const raw2 = await this.riskEngineGet("org-tier-info", { org: orgName });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "org-tier-info",
+        { org: orgName },
+        brid
+      );
       if (!isRecord(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
@@ -4005,20 +4015,24 @@ var Atbash = class _Atbash {
   }
   async getPendingHeldActions(orgName, maxCount) {
     return this.track("getPendingHeldActions", void 0, async () => {
-      const raw2 = await this.riskEngineGet("pending-held-actions", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "pending-held-actions",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map((item) => toHeldAction(item));
     });
   }
   async getHeldActionReviews(orgName, maxCount) {
     return this.track("getHeldActionReviews", void 0, async () => {
-      const raw2 = await this.riskEngineGet("held-action-reviews", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "held-action-reviews",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map(
         (item) => toHeldActionReview(item)
@@ -4029,21 +4043,25 @@ var Atbash = class _Atbash {
   async getAgentDetail(agentPubkey, options = {}) {
     return this.track("getAgentDetail", agentPubkey, async () => {
       const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       return this.riskEnginePost(
         { action: "agent-detail-batch", agent: agentPubkey },
-        network
+        network,
+        brid
       );
     });
   }
   async getAgentPolicy(agentPubkey, options = {}) {
     return this.track("getAgentPolicy", agentPubkey, async () => {
       const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       const raw2 = await this.riskEnginePost(
         {
           action: "agent-policy-batch",
           agent: agentPubkey
         },
-        network
+        network,
+        brid
       );
       return {
         policy: String(raw2.policy ?? ""),
@@ -4077,7 +4095,8 @@ var Atbash = class _Atbash {
     return this.track("getOrgSubscription", void 0, async () => {
       const params = { org: orgName };
       if (network) params.network = network;
-      const raw2 = await this.riskEngineGet("org-subscription", params);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
+      const raw2 = await this.riskEngineGet("org-subscription", params, brid);
       if (!isRecord(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
@@ -4222,11 +4241,11 @@ var Atbash = class _Atbash {
    * for 4 minutes; refreshed after that so a long-lived client never
    * trips the server's replay window.
    */
-  getAuthBearer() {
+  getAuthBearer(brid) {
+    const chainBrid = brid ?? this.blockchainRid;
     const now = Date.now();
-    if (this._authBearer && now - this._authBearer.issuedAt < 4 * 60 * 1e3) {
-      return this._authBearer.hex;
-    }
+    const cached = this._authBearers.get(chainBrid);
+    if (cached && now - cached.issuedAt < 4 * 60 * 1e3) return cached.hex;
     const nonce = `auth-${now.toString(36)}-${randomHex(4)}`;
     const hex = native.signLogToolCall(
       nonce,
@@ -4235,21 +4254,21 @@ var Atbash = class _Atbash {
       "auth-bearer",
       "",
       this.auth.privkey,
-      this.blockchainRid
+      chainBrid
     );
-    this._authBearer = { hex, issuedAt: now };
+    this._authBearers.set(chainBrid, { hex, issuedAt: now });
     return hex;
   }
-  authHeaders() {
-    return { Authorization: `Bearer ${this.getAuthBearer()}` };
+  authHeaders(brid) {
+    return { Authorization: `Bearer ${this.getAuthBearer(brid)}` };
   }
-  async riskEngineGet(action, params) {
+  async riskEngineGet(action, params, brid) {
     let resp;
     try {
       resp = await this.http.get(
         "/api/risk-engine",
         { action, ...params },
-        this.authHeaders()
+        this.authHeaders(brid)
       );
     } catch (err) {
       throw this.transportError(err);
@@ -4257,11 +4276,11 @@ var Atbash = class _Atbash {
     if (resp.status !== 200) throw await this.httpError(resp);
     return this.json(resp);
   }
-  async riskEnginePost(body, network) {
+  async riskEnginePost(body, network, brid) {
     let resp;
     try {
       const path7 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path7, body, this.authHeaders());
+      resp = await this.http.post(path7, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -4269,11 +4288,23 @@ var Atbash = class _Atbash {
     const data = await this.json(resp);
     return isRecord(data) ? data : {};
   }
-  async riskEngineRecords(action, params) {
-    const raw2 = await this.riskEngineGet(action, params);
+  async riskEngineRecords(action, params, brid) {
+    const raw2 = await this.riskEngineGet(action, params, brid);
     if (!Array.isArray(raw2)) return [];
     return raw2.map((item) => toToolCallRecord(item));
   }
+  /**
+   * BRID for an org — one round-trip to the map, honoring the client's chain
+   * cache. Returns undefined when the org is unknown, so the caller falls
+   * back to the client default (best-effort discovery).
+   */
+  async bridForOrg(orgName) {
+    try {
+      return (await this.resolveChainForOrg(orgName)).blockchainRid;
+    } catch {
+      return void 0;
+    }
+  }
   async raiseIfError(resp) {
     if (resp.ok) return;
     throw await this.httpError(resp);