@atbash/sdk 0.10.13-dev.0 → 0.12.0-dev.0

package/dist/index.mjs

@@ -3311,6 +3311,8 @@ var ENV_MAP = {
   agentKey: "ATBASH_AGENT_KEY",
   orgName: "ATBASH_ORG_NAME",
   judgeEndpoint: "ATBASH_ENDPOINT",
+  // Same variable name the Hermes plugin already documents.
+  judgeVerifyPubKey: "ATBASH_JUDGE_VERIFY_PUBKEY",
   blockchainRid: "ATBASH_BLOCKCHAIN_RID",
   provider: "ATBASH_PROVIDER",
   providerModel: "ATBASH_PROVIDER_MODEL",
@@ -3409,11 +3411,18 @@ var Atbash = class _Atbash {
   static environmentLogged = false;
   constructor(privkey, options = {}) {
     this.auth = native.loadAgent(privkey);
-    this.endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "") || DEFAULT_ENDPOINT;
+    const validated = validateJudgeEndpoint(
+      options.verifyPubKey ? {
+        policy: "self-hosted",
+        endpoint: options.endpoint ?? DEFAULT_ENDPOINT,
+        verifyPubKey: options.verifyPubKey
+      } : { endpoint: options.endpoint }
+    );
+    this.endpoint = validated.url;
     this.nodeUrls = options.nodeUrls ? [...options.nodeUrls] : DEFAULT_CHROMIA_NODE_URLS;
     this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
     this.orgName = options.orgName;
-    this.verifyPubKey = options.verifyPubKey;
+    this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
     this.debug = options.debug === true;
@@ -3471,8 +3480,19 @@ var Atbash = class _Atbash {
    * self-hosted endpoint's `verifyPubKey` becomes the client default.
    */
   static fromConfig(options = {}) {
+    const configuredEndpoint = resolve("judgeEndpoint") || void 0;
+    const configuredVerifyPubKey = resolve("judgeVerifyPubKey") || void 0;
+    if (!options.judge && configuredVerifyPubKey && !configuredEndpoint) {
+      throw new Error(
+        "judgeVerifyPubKey / ATBASH_JUDGE_VERIFY_PUBKEY is set but no judge endpoint is configured: set judgeEndpoint / ATBASH_ENDPOINT to the self-hosted judge"
+      );
+    }
     const validated = validateJudgeEndpoint(
-      options.judge ?? { endpoint: resolve("judgeEndpoint") || void 0 }
+      options.judge ?? (configuredVerifyPubKey && configuredEndpoint ? {
+        policy: "self-hosted",
+        endpoint: configuredEndpoint,
+        verifyPubKey: configuredVerifyPubKey
+      } : { endpoint: configuredEndpoint })
     );
     const agentKey = resolve("agentKey", options.agentKey);
     const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
@@ -4028,21 +4048,22 @@ var Atbash = class _Atbash {
    * entry (caller falls back to per-chain subscription resolution).
    */
   async getActiveNetworkForOrg(orgName) {
+    let resp;
     try {
-      const resp = await this.http.get(
+      resp = await this.http.get(
         "/api/org-network",
-        { org: orgName },
+        { org: orgName.trim() },
         this.authHeaders()
       );
-      if (resp.status !== 200) return null;
-      const data = await this.json(resp);
-      if (data?.network === "public" || data?.network === "private") {
-        return data.network;
-      }
-      return null;
-    } catch {
-      return null;
+    } catch (err) {
+      throw this.transportError(err);
     }
+    if (resp.status !== 200) throw await this.httpError(resp);
+    const data = await this.json(resp);
+    if (data?.network === "public" || data?.network === "private") {
+      return data.network;
+    }
+    return null;
   }
   /**
    * Resolve which chain an org's actions should run against. Cached
@@ -4054,10 +4075,11 @@ var Atbash = class _Atbash {
    * Defaults to the public chain when nothing else resolves.
    */
   async resolveChainForOrg(orgName) {
-    const cached = this._chainCache.get(orgName);
+    const name2 = orgName.trim();
+    const cached = this._chainCache.get(name2);
     if (cached) return cached;
-    const mapNetwork = await this.getActiveNetworkForOrg(orgName);
-    return this.resolveChainFromMap(orgName, mapNetwork);
+    const mapNetwork = await this.getActiveNetworkForOrg(name2);
+    return this.resolveChainFromMap(name2, mapNetwork);
   }
   /**
    * Resolve a chain given an already-fetched `org_networks` map result.
@@ -4073,29 +4095,38 @@ var Atbash = class _Atbash {
       this._chainCache.set(orgName, chain);
       return chain;
     }
-    try {
-      const [pubSub, privSub] = await Promise.all([
-        this.getOrgSubscription(orgName, "public").catch(() => null),
-        this.getOrgSubscription(orgName, "private").catch(() => null)
-      ]);
-      if (pubSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-      if (pubSub && privSub) {
-        const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-        this._chainCache.set(orgName, chain);
-        return chain;
-      }
-      if (pubSub) {
-        this._chainCache.set(orgName, PUBLIC_CHAIN);
-        return PUBLIC_CHAIN;
-      }
-      if (privSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-    } catch {
+    const [pubRes, privRes] = await Promise.allSettled([
+      this.getOrgSubscription(orgName, "public"),
+      this.getOrgSubscription(orgName, "private")
+    ]);
+    const pubSub = pubRes.status === "fulfilled" ? pubRes.value : null;
+    const privSub = privRes.status === "fulfilled" ? privRes.value : null;
+    const failure = pubRes.status === "rejected" ? pubRes.reason : privRes.status === "rejected" ? privRes.reason : null;
+    if (pubSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (pubSub && privSub) {
+      const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      this._chainCache.set(orgName, chain);
+      return chain;
+    }
+    if (pubSub) {
+      this._chainCache.set(orgName, PUBLIC_CHAIN);
+      return PUBLIC_CHAIN;
+    }
+    if (privSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (failure) {
+      const detail = failure instanceof Error ? failure.message : String(failure);
+      throw new AtbashAPIError(
+        failure instanceof AtbashAPIError ? failure.status : 0,
+        `could not resolve the chain for org "${orgName}": ${detail}`,
+        "",
+        this.endpoint
+      );
     }
     this._chainCache.set(orgName, PUBLIC_CHAIN);
     return PUBLIC_CHAIN;
@@ -42664,6 +42695,7 @@ async function resolveChainOptsForOrg(opts, auth) {
   if (opts?.orgName && !opts.chainOpts?.blockchainRid && auth) {
     const atbash = new Atbash(auth.privkey, {
       endpoint: opts.endpoint,
+      verifyPubKey: opts.verifyPubKey,
       orgName: opts.orgName
     });
     const resolved = await atbash.resolveChainForOrg(opts.orgName);
@@ -42703,13 +42735,15 @@ function buildSigner(auth) {
 }
 async function commitMemoryVersion(plaintext, auth, opts) {
   const score = opts?.score ?? 5;
+  const filePath = opts?.filePath ?? "";
   const key3 = await deriveMemoryKey(auth.privkey);
   const { ciphertext, nonce } = await encryptMemoryContent(plaintext, key3);
   const args = native.buildAddAgentMemoryArgs(
     auth.pubkey,
     ciphertext,
     nonce,
-    score
+    score,
+    filePath
   );
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
@@ -42721,7 +42755,8 @@ async function commitMemoryVersion(plaintext, auth, opts) {
         toGtxBytes(args.agent_pubkey),
         toGtxBytes(args.content_cipher),
         toGtxBytes(args.nonce),
-        args.score
+        args.score,
+        args.file_path
       ]
     },
     sigProvider
@@ -42743,6 +42778,7 @@ async function decryptRow(row, key3) {
   }
   return {
     id: parsed.id,
+    filePath: parsed.file_path,
     content,
     decryptError,
     score: parsed.score,
@@ -42751,39 +42787,52 @@ async function decryptRow(row, key3) {
     updatedAt: parsed.updated_at
   };
 }
-async function getActiveMemoryId(auth, chainOpts) {
+function paramsWithOptionalFilePath(agentPubkeyHex, filePath) {
+  const params = {
+    [native.ARG_AGENT_PUBKEY]: agentPubkeyHex
+  };
+  if (filePath !== null) {
+    params[native.ARG_FILE_PATH] = filePath;
+  }
+  return params;
+}
+async function getActiveMemoryId(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
-  const q = native.buildGetActiveMemoryIdQuery(auth.pubkey);
-  const raw2 = await client.query(native.QUERY_GET_ACTIVE_MEMORY_ID, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetActiveMemoryIdQuery(auth.pubkey, filePath ?? null);
+  const raw2 = await client.query(
+    native.QUERY_GET_ACTIVE_MEMORY_ID,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return native.parseActiveMemoryId(raw2);
 }
-async function getActiveMemory(auth, chainOpts) {
+async function getRecentAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAgentMemoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_AGENT_MEMORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetRecentAgentMemoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_RECENT_AGENT_MEMORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
-async function getAllAgentMemory(auth, chainOpts) {
+async function getActiveAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAllAgentMemoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_ALL_AGENT_MEMORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetActiveAgentMemoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_ACTIVE_AGENT_MEMORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
-async function getMemoryHistory(auth, chainOpts) {
+async function getMemoryHistory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
   const key3 = await deriveMemoryKey(auth.privkey);
-  const q = native.buildGetAgentMemoryHistoryQuery(auth.pubkey);
-  const rows = await client.query(native.QUERY_GET_AGENT_MEMORY_HISTORY, {
-    [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex
-  });
+  const q = native.buildGetAgentMemoryHistoryQuery(auth.pubkey, filePath ?? null);
+  const rows = await client.query(
+    native.QUERY_GET_AGENT_MEMORY_HISTORY,
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
+  );
   return Promise.all((rows ?? []).map((r2) => decryptRow(r2, key3)));
 }
 async function getMemoryById(id, auth, chainOpts) {
@@ -42796,17 +42845,21 @@ async function getMemoryById(id, auth, chainOpts) {
   });
   return decryptRow(row, key3);
 }
-async function getRollbackHistory(auth, chainOpts) {
+async function getRollbackHistory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
-  const q = native.buildGetAgentMemoryRollbackHistoryQuery(auth.pubkey);
+  const q = native.buildGetAgentMemoryRollbackHistoryQuery(
+    auth.pubkey,
+    filePath ?? null
+  );
   const raw2 = await client.query(
     native.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY,
-    { [native.ARG_AGENT_PUBKEY]: q.agent_pubkey_hex }
+    paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
   const parsed = native.parseRollbackRows(raw2 ?? []);
   return parsed.map((r2) => ({
     fromId: r2.from_id,
     toId: r2.to_id,
+    filePath: r2.file_path,
     reason: r2.reason,
     signer: Buffer.from(r2.signer).toString("hex"),
     createdAt: r2.created_at
@@ -42874,8 +42927,7 @@ async function guardMemoryWrite(input) {
     toolNames,
     enforce = true,
     debug: debug2 = false,
-    logger: logger2,
-    memoryFilePath
+    logger: logger2
   } = input;
   const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
@@ -42911,37 +42963,35 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
-  const isManagedMemoryFile = memoryFilePath !== void 0 && path3.resolve(memEntry.key) === path3.resolve(memoryFilePath);
-  if (isManagedMemoryFile) {
-    commitMemoryVersion(memEntry.value, auth, {
-      score: scanResult.score,
-      orgName,
-      endpoint
-    }).catch((err) => {
-      const reason = err instanceof Error ? err.message : String(err);
-      logger2?.warn?.("[atbash] memory commit to chain failed", {
-        path: memEntry.key,
-        reason
-      });
+  const filePath = path3.basename(memEntry.key);
+  commitMemoryVersion(memEntry.value, auth, {
+    score: scanResult.score,
+    filePath,
+    orgName,
+    endpoint,
+    verifyPubKey
+  }).catch((err) => {
+    const reason = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory commit to chain failed", {
+      path: memEntry.key,
+      filePath,
+      reason
     });
-  } else {
-    logger2?.info?.(
-      "[atbash] scanned but not committed \u2014 not the managed memory file",
-      {
-        path: memEntry.key,
-        memoryFilePath: memoryFilePath ?? "(not configured)"
-      }
-    );
-  }
+  });
   logger2?.info?.(
     scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
-    { path: memEntry.key, score: scanResult.score, reason: scanResult.reason }
+    {
+      path: memEntry.key,
+      filePath,
+      score: scanResult.score,
+      reason: scanResult.reason
+    }
   );
   return {
     handled: true,
     decision: { allow: true },
     scanResult,
-    committed: isManagedMemoryFile
+    committed: true
   };
 }
 
@@ -43181,9 +43231,7 @@ var MemoryGuardManager = class {
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
       debug: this.opts.debug,
-      logger: guardLogger,
-      // Only this file may reach the single, path-less chain memory slot.
-      memoryFilePath: this.memoryFilePath
+      logger: guardLogger
     });
     return this.mapGuardResult(guard);
   }
@@ -43483,13 +43531,13 @@ export {
   encryptedLength,
   flushTelemetry,
   generateKeypair,
-  getActiveMemory,
+  getActiveAgentMemory,
   getActiveMemoryId,
-  getAllAgentMemory,
   getConfigDir,
   getConfigPath,
   getMemoryById,
   getMemoryHistory,
+  getRecentAgentMemory,
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,