@atbash/sdk 0.7.2-dev.0 → 0.8.0

package/README.md

@@ -63,8 +63,8 @@ Two ways to create an agent:
 
    ```ts
    import { generateKeypair } from "@atbash/sdk";
-   const { privKey, pubKey } = generateKeypair();
-   console.log("Save this private key somewhere safe:", privKey);
+   const { priv_key, pub_key } = generateKeypair();
+   console.log("Save this private key somewhere safe:", priv_key);
    ```
 
    Paste the public key into the **Onboard agent** form on the dashboard, assign it to an org, and attach a policy pack before calling `judgeAction`.
@@ -111,8 +111,8 @@ Read-only methods that read from the Chromia blockchain and dashboard.
 | `getToolCallCount()` | Total number of tool calls on-chain |
 | `getToolCallFull(toolCallId)` | Full details of a single tool call |
 | `getOrgTierInfo(orgName)` | Check an org's tier and whether verdicts are enabled |
-| `getAgentDetail(pubkey)` | Get agent metadata (org, status, creation date) |
-| `getAgentPolicy(pubkey)` | Check the agent's policy pack and jail status |
+| `getAgentDetail(pubkey, options?)` | Get agent metadata (org, status, creation date) |
+| `getAgentPolicy(pubkey, options?)` | Check the agent's policy pack and jail status |
 | `getPendingHeldActions(orgName, maxCount)` | List actions waiting for operator approval |
 | `getHeldActionReviews(orgName, maxCount)` | List completed operator reviews |
 | `getSafetyStats()` | Chain-wide safety statistics |
@@ -142,12 +142,27 @@ const atbash = Atbash.fromConfig();   // reads env + config file
 | `agentKey` | `ATBASH_AGENT_KEY` |
 | `orgName` | `ATBASH_ORG_NAME` |
 | `judgeEndpoint` | `ATBASH_ENDPOINT` |
+| `judgeVerifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` (self-hosted judge response-signing key; selects the self-hosted policy) |
 | `blockchainRid` | `ATBASH_BLOCKCHAIN_RID` |
 | `provider` | `ATBASH_PROVIDER` |
 | `providerModel` | `ATBASH_PROVIDER_MODEL` |
 
 Persistent config helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
 
+### Judge endpoint policy
+
+Both `Atbash.fromConfig()` and the direct constructor validate the judge endpoint before any request is made. `new Atbash(privkey, { endpoint })` accepts only an `https://` allowlisted judge host, or a self-hosted judge when `verifyPubKey` is also given (the 66-hex response-signing key, which then verifies every judge response). Plaintext `http://` is accepted only for loopback (`localhost`, `127.0.0.1`, `::1`) local development. Anything else throws at construction, so a misconfigured or injected endpoint can no longer receive the agent's signed actions or return unsigned verdicts. `validateJudgeEndpoint(...)` exposes the same check.
+
+Agent policy and detail reads can resolve the organization's active network, or
+accept an explicit network override:
+
+```ts
+await atbash.getAgentPolicy(atbash.pubkey, { orgName: "acme" });
+await atbash.getAgentDetail(atbash.pubkey, {
+  chainOpts: { network: "private" },
+});
+```
+
 ## Error handling
 
 The SDK throws standard `Error` objects. Known failure modes are enriched with a pointer to the dashboard page that fixes them: