@atbash/sdk 0.13.3-dev.0 → 0.15.0-dev.0

package/dist/index.mjs

@@ -3185,6 +3185,9 @@ function normalizeVerdict(raw2) {
   if (v === "BLOCK" || v === "RED") return "BLOCK";
   return "HOLD";
 }
+function normalizeActionType(raw2) {
+  return typeof raw2 === "string" ? raw2.trim().toLowerCase() : "";
+}
 function normalizeStatus(raw2) {
   const s2 = String(raw2 ?? "").toLowerCase();
   if (s2 === "pending" || s2 === "answered" || s2 === "error") return s2;
@@ -3201,6 +3204,37 @@ function pubkeyToHex(val) {
   return "";
 }
 
+// src-ts/decision.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function allowSignalsPermit(data) {
+  const signals = [];
+  if (Object.hasOwn(data, "allow")) signals.push(data.allow);
+  if (isRecord(data.decision) && Object.hasOwn(data.decision, "allow")) {
+    signals.push(data.decision.allow);
+  }
+  return signals.length === 0 || signals.every((value) => value === true);
+}
+function wireActionType(data) {
+  if (data.action_type !== void 0)
+    return normalizeActionType(data.action_type);
+  return normalizeActionType(data.actionType);
+}
+function isAuditTier(data) {
+  const absentVerdict = data.verdict === null || data.verdict === void 0;
+  return absentVerdict && data.status === "logged";
+}
+function canonicalAllow(data) {
+  if (!allowSignalsPermit(data)) return false;
+  const actionType = wireActionType(data);
+  if (actionType && actionType !== "allow") return false;
+  if (isAuditTier(data)) return true;
+  if (typeof data.verdict !== "string") return false;
+  const verdict = data.verdict.trim().toUpperCase();
+  return verdict === "ALLOW" || verdict === "GREEN";
+}
+
 // src-ts/opentel/telemetry.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -3522,7 +3556,10 @@ var Atbash = class _Atbash {
         getAuthHeaders: () => this.authHeaders()
       });
     } catch (err) {
-      this.logger.warn?.("[atbash] telemetry setup failed \u2014 continuing without metrics", { error: String(err) });
+      this.logger.warn?.(
+        "[atbash] telemetry setup failed \u2014 continuing without metrics",
+        { error: String(err) }
+      );
     }
   }
   /**
@@ -3737,7 +3774,10 @@ var Atbash = class _Atbash {
           this._chainCache.set(options.orgName, chain);
           chainOpts = { network: mapNetwork };
         } else if (!chainOpts?.blockchainRid) {
-          const resolved = await this.resolveChainFromMap(options.orgName, null);
+          const resolved = await this.resolveChainFromMap(
+            options.orgName,
+            null
+          );
           chainOpts = { ...chainOpts, network: resolved.network };
         }
       }
@@ -3812,7 +3852,8 @@ var Atbash = class _Atbash {
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
     return {
       verdict: normalizeVerdict(data.verdict),
-      actionType: String(data.action_type ?? ""),
+      allow: canonicalAllow(data),
+      actionType: normalizeActionType(data.action_type),
       reason: String(data.reason ?? ""),
       confidence: Number(data.confidence ?? 0),
       provider: String(data.provider ?? ""),
@@ -3954,19 +3995,31 @@ var Atbash = class _Atbash {
     return { allow: !this.failClosed, verdict: "ERROR", reason, toolCallId };
   }
   /* ── judgment status ───────────────────────────────────────────────────── */
-  async getJudgmentStatus(judgmentId, agentPubkey) {
+  /**
+   * Return the current status of a previously submitted judgment.
+   *
+   * `chainOpts` names which chain the judgment was signed against. The
+   * server's GET /api/v1/judge routes to that chain when the SDK sends
+   * a `brid` query param; without it, the server falls back to public.
+   * Callers on the private chain must pass a `chainOpts` (or configure
+   * the client on the private chain) — otherwise polling a POSTed
+   * judgment on the private chain 404s at the server.
+   */
+  async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
+    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
       const resp = await this.http.get(
         "/api/v1/judge",
-        { tool_call_id: judgmentId, agent_pubkey: pk },
-        this.authHeaders(await this.defaultOrgBrid())
+        { tool_call_id: judgmentId, agent_pubkey: pk, brid },
+        this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
+        allow: canonicalAllow(data),
         reason: String(data.reason ?? ""),
         judgmentId: String(data.judgmentId ?? judgmentId),
         onChain: optBool(data.onChain),
@@ -4026,7 +4079,7 @@ var Atbash = class _Atbash {
         { tool_call_id: toolCallId },
         await this.defaultOrgBrid()
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return toToolCallFull(raw2);
     });
   }
@@ -4038,7 +4091,7 @@ var Atbash = class _Atbash {
         { org: orgName },
         brid
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
         tier: String(raw2.tier ?? ""),
@@ -4115,7 +4168,7 @@ var Atbash = class _Atbash {
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
-      if (isRecord(data.data)) return data.data;
+      if (isRecord2(data.data)) return data.data;
       return data;
     });
   }
@@ -4131,7 +4184,7 @@ var Atbash = class _Atbash {
       if (network) params.network = network;
       const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       const raw2 = await this.riskEngineGet("org-subscription", params, brid);
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
   }
@@ -4337,7 +4390,7 @@ var Atbash = class _Atbash {
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    return isRecord(data) ? data : {};
+    return isRecord2(data) ? data : {};
   }
   async riskEngineRecords(action, params, brid) {
     const raw2 = await this.riskEngineGet(action, params, brid);
@@ -4404,14 +4457,11 @@ var Atbash = class _Atbash {
   transportError(err) {
     if (err instanceof HttpTransportError) {
       if (this.debug) {
-        this.logger.warn?.(
-          `[atbash] transport failed \u2014 kind=${err.kind}`,
-          {
-            kind: err.kind,
-            cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
-            endpoint: this.endpoint
-          }
-        );
+        this.logger.warn?.(`[atbash] transport failed \u2014 kind=${err.kind}`, {
+          kind: err.kind,
+          cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
+          endpoint: this.endpoint
+        });
       }
       return new AtbashAPIError(0, err.message, "", this.endpoint);
     }
@@ -4509,7 +4559,7 @@ function coerceOrgSubscription(raw2, orgName) {
     is_active: Boolean(raw2.is_active)
   };
 }
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function optString(v) {
@@ -4648,7 +4698,7 @@ async function scanMemory(entry, auth, opts) {
     );
   }
   const KNOWN_ACTIONS = ["allow", "block", "hold_for_user_confirm"];
-  const action = result.actionType.trim().toLowerCase();
+  const action = result.actionType;
   if (result.verdict !== "No verdict" && action !== "" && !KNOWN_ACTIONS.includes(action)) {
     throw new Error(
       `memory scan: unrecognized action_type from judge (${result.actionType})`
@@ -43650,6 +43700,7 @@ export {
   SignatureVerificationError,
   bootSyncFailureLine,
   buildAllowedJudgeHosts,
+  canonicalAllow,
   chainForNetwork,
   chooseKeyPath,
   claimHashHex,
@@ -43691,6 +43742,7 @@ export {
   loadAgentFromFile,
   loadUserConfig,
   normalizeActionForHash,
+  normalizeActionType,
   normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,