omnigateway 0.13.5 → 0.13.6

package/bin/omni.js

@@ -6582,10 +6582,6 @@ function prepareArtifact(input) {
   const stripped = { ...omitted, error: marker };
   return { artifact: stripped, json: JSON.stringify(stripped) };
 }
-async function sealArtifact(key, json) {
-  const bytes = encoder2.encode(await encrypt(key, json));
-  return { bytes, sha256: await sha256Hex(bytes) };
-}
 var MAX_ENVELOPE_BYTES = 2 * MAX_ARTIFACT_BYTES + 65;
 var BINARY_MAGIC = encoder2.encode("OGBA");
 var LEGACY_PREFIX = encoder2.encode("enc:v1:");
@@ -6603,6 +6599,34 @@ var gunzipAsync = promisify(gunzip);
 function own2(bytes, start, end) {
   return bytes.slice(start, end);
 }
+function plaintextOf(json) {
+  const plain = encoder2.encode(json);
+  if (plain.length < 1 || plain.length > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact plaintext is outside the binary envelope's bounds");
+  }
+  return plain;
+}
+async function sealArtifact(key, json) {
+  const plain = plaintextOf(json);
+  return sealBinary(key, plain.length, CODEC_RAW, plain);
+}
+async function sealBinary(key, claimed, codec, payload) {
+  const bytes = new Uint8Array(BINARY_OVERHEAD + payload.length);
+  bytes.set(BINARY_MAGIC, 0);
+  bytes[4] = BINARY_VERSION;
+  bytes[5] = codec;
+  new DataView(bytes.buffer).setUint32(6, claimed, false);
+  const iv = crypto.getRandomValues(new Uint8Array(BINARY_IV_BYTES));
+  const sealed = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv,
+    additionalData: own2(bytes, 0, BINARY_HEADER_BYTES),
+    tagLength: BINARY_TAG_BYTES * 8
+  }, key, own2(payload, 0));
+  bytes.set(iv, BINARY_HEADER_BYTES);
+  bytes.set(new Uint8Array(sealed), BINARY_HEADER_BYTES + BINARY_IV_BYTES);
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
 async function readArtifact(key, dir, relPath, expectedSha256) {
   const acquired = await acquireArtifact(join(dir, relPath));
   if (!(acquired instanceof Uint8Array))
@@ -25263,7 +25287,7 @@ function createServiceDeps(input) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.13.5";
+var VERSION = "0.13.6";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {

package/gateway.js

@@ -11884,10 +11884,6 @@ function prepareArtifact(input) {
   const stripped = { ...omitted, error: marker };
   return { artifact: stripped, json: JSON.stringify(stripped) };
 }
-async function sealArtifact(key, json) {
-  const bytes = encoder2.encode(await encrypt(key, json));
-  return { bytes, sha256: await sha256Hex(bytes) };
-}
 var MAX_ENVELOPE_BYTES = 2 * MAX_ARTIFACT_BYTES + 65;
 var BINARY_MAGIC = encoder2.encode("OGBA");
 var LEGACY_PREFIX = encoder2.encode("enc:v1:");
@@ -11905,6 +11901,34 @@ var gunzipAsync = promisify(gunzip);
 function own2(bytes, start, end) {
   return bytes.slice(start, end);
 }
+function plaintextOf(json) {
+  const plain = encoder2.encode(json);
+  if (plain.length < 1 || plain.length > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact plaintext is outside the binary envelope's bounds");
+  }
+  return plain;
+}
+async function sealArtifact(key, json) {
+  const plain = plaintextOf(json);
+  return sealBinary(key, plain.length, CODEC_RAW, plain);
+}
+async function sealBinary(key, claimed, codec, payload) {
+  const bytes = new Uint8Array(BINARY_OVERHEAD + payload.length);
+  bytes.set(BINARY_MAGIC, 0);
+  bytes[4] = BINARY_VERSION;
+  bytes[5] = codec;
+  new DataView(bytes.buffer).setUint32(6, claimed, false);
+  const iv = crypto.getRandomValues(new Uint8Array(BINARY_IV_BYTES));
+  const sealed = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv,
+    additionalData: own2(bytes, 0, BINARY_HEADER_BYTES),
+    tagLength: BINARY_TAG_BYTES * 8
+  }, key, own2(payload, 0));
+  bytes.set(iv, BINARY_HEADER_BYTES);
+  bytes.set(new Uint8Array(sealed), BINARY_HEADER_BYTES + BINARY_IV_BYTES);
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
 async function readArtifact(key, dir, relPath, expectedSha256) {
   const acquired = await acquireArtifact(join(dir, relPath));
   if (!(acquired instanceof Uint8Array))
@@ -49233,7 +49257,7 @@ function createRing(limits = DEFAULT_RING_LIMITS) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.13.5";
+var VERSION = "0.13.6";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnigateway",
-  "version": "0.13.5",
+  "version": "0.13.6",
   "description": "Self-hosted AI gateway with Anthropic- and OpenAI-compatible APIs, an admin console, and a CLI",
   "license": "MIT",
   "author": "Harismawan <mail@harismawan.com>",