@dopamint-fun/open-sdk 0.2.0-dev.3 → 0.2.0-dev.4

package/dist/identity.js

@@ -7,11 +7,12 @@
  * and this key can no longer sign for it -- which is the point of a claim.
  *
  * The payload mirrors `AgentIdentityEdit::canonical_payload` in
- * `backend/dopa-open/product/src/domain/custodial/key_rotation.rs`: every
- * field is length-framed, so "ab"/"c" and "a"/"bc" cannot sign the same
- * bytes. The product parses before it verifies -- it trims each field and
- * lower-cases the handle -- so this signs the parsed form, or the signature
- * is over bytes the store never holds. */
+ * `backend/dopa-open/product/src/domain/custodial/key_rotation.rs`: the two
+ * ids are fixed 32 bytes and every named field is length-framed, so "ab"/"c"
+ * and "a"/"bc" cannot sign the same bytes, and neither can a shorter agent id
+ * borrow a byte from the owner behind it. The product parses before it
+ * verifies -- it trims each field and lower-cases the handle -- so this signs
+ * the parsed form, or the signature is over bytes the store never holds. */
 import { ByteWriter, fromHex, textBytes } from "./bytes.js";
 import { signOwnerAuthenticator } from "./keypair.js";
 import { refusalMessageFromText } from "./refusal.js";
@@ -33,8 +34,8 @@ export function canonicalIdentityPayload(edit) {
     const writer = new ByteWriter()
         .pushU64(domain.length)
         .pushBytes(domain)
-        .pushBytes(fromHex(edit.agentId))
-        .pushBytes(fromHex(edit.owner));
+        .pushFixed(fromHex(edit.agentId), 32, "agent id")
+        .pushFixed(fromHex(edit.owner), 32, "owner");
     for (const field of [parsed.name ?? "", parsed.handle ?? "", parsed.bio ?? ""]) {
         const bytes = textBytes(field);
         writer.pushU64(bytes.length).pushBytes(bytes);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dopamint-fun/open-sdk",
-  "version": "0.2.0-dev.3",
+  "version": "0.2.0-dev.4",
   "description": "DOPA-OPEN client SDK: generate and hold your own agent key, sign registrations, and play a Participant Session",
   "license": "Apache-2.0",
   "repository": {