omnigateway 0.13.5 → 0.13.7

package/bin/omni.js

@@ -6582,10 +6582,6 @@ function prepareArtifact(input) {
   const stripped = { ...omitted, error: marker };
   return { artifact: stripped, json: JSON.stringify(stripped) };
 }
-async function sealArtifact(key, json) {
-  const bytes = encoder2.encode(await encrypt(key, json));
-  return { bytes, sha256: await sha256Hex(bytes) };
-}
 var MAX_ENVELOPE_BYTES = 2 * MAX_ARTIFACT_BYTES + 65;
 var BINARY_MAGIC = encoder2.encode("OGBA");
 var LEGACY_PREFIX = encoder2.encode("enc:v1:");
@@ -6603,6 +6599,34 @@ var gunzipAsync = promisify(gunzip);
 function own2(bytes, start, end) {
   return bytes.slice(start, end);
 }
+function plaintextOf(json) {
+  const plain = encoder2.encode(json);
+  if (plain.length < 1 || plain.length > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact plaintext is outside the binary envelope's bounds");
+  }
+  return plain;
+}
+async function sealArtifact(key, json) {
+  const plain = plaintextOf(json);
+  return sealBinary(key, plain.length, CODEC_RAW, plain);
+}
+async function sealBinary(key, claimed, codec, payload) {
+  const bytes = new Uint8Array(BINARY_OVERHEAD + payload.length);
+  bytes.set(BINARY_MAGIC, 0);
+  bytes[4] = BINARY_VERSION;
+  bytes[5] = codec;
+  new DataView(bytes.buffer).setUint32(6, claimed, false);
+  const iv = crypto.getRandomValues(new Uint8Array(BINARY_IV_BYTES));
+  const sealed = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv,
+    additionalData: own2(bytes, 0, BINARY_HEADER_BYTES),
+    tagLength: BINARY_TAG_BYTES * 8
+  }, key, own2(payload, 0));
+  bytes.set(iv, BINARY_HEADER_BYTES);
+  bytes.set(new Uint8Array(sealed), BINARY_HEADER_BYTES + BINARY_IV_BYTES);
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
 async function readArtifact(key, dir, relPath, expectedSha256) {
   const acquired = await acquireArtifact(join(dir, relPath));
   if (!(acquired instanceof Uint8Array))
@@ -19027,6 +19051,7 @@ var KNOWN_EVENTS4 = new Set([
   "response.reasoning_text.done",
   "response.function_call_arguments.delta",
   "response.function_call_arguments.done",
+  "response.metadata",
   "response.completed",
   "response.incomplete",
   "response.failed",
@@ -25263,7 +25288,7 @@ function createServiceDeps(input) {
 }
 
 // apps/cli/src/version.ts
-var VERSION = "0.13.5";
+var VERSION = "0.13.7";
 
 // apps/cli/src/commands/service.ts
 function gatewayArgv(root) {

package/gateway.js

@@ -11884,10 +11884,6 @@ function prepareArtifact(input) {
   const stripped = { ...omitted, error: marker };
   return { artifact: stripped, json: JSON.stringify(stripped) };
 }
-async function sealArtifact(key, json) {
-  const bytes = encoder2.encode(await encrypt(key, json));
-  return { bytes, sha256: await sha256Hex(bytes) };
-}
 var MAX_ENVELOPE_BYTES = 2 * MAX_ARTIFACT_BYTES + 65;
 var BINARY_MAGIC = encoder2.encode("OGBA");
 var LEGACY_PREFIX = encoder2.encode("enc:v1:");
@@ -11905,6 +11901,34 @@ var gunzipAsync = promisify(gunzip);
 function own2(bytes, start, end) {
   return bytes.slice(start, end);
 }
+function plaintextOf(json) {
+  const plain = encoder2.encode(json);
+  if (plain.length < 1 || plain.length > MAX_ARTIFACT_BYTES) {
+    throw new Error("artifact plaintext is outside the binary envelope's bounds");
+  }
+  return plain;
+}
+async function sealArtifact(key, json) {
+  const plain = plaintextOf(json);
+  return sealBinary(key, plain.length, CODEC_RAW, plain);
+}
+async function sealBinary(key, claimed, codec, payload) {
+  const bytes = new Uint8Array(BINARY_OVERHEAD + payload.length);
+  bytes.set(BINARY_MAGIC, 0);
+  bytes[4] = BINARY_VERSION;
+  bytes[5] = codec;
+  new DataView(bytes.buffer).setUint32(6, claimed, false);
+  const iv = crypto.getRandomValues(new Uint8Array(BINARY_IV_BYTES));
+  const sealed = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv,
+    additionalData: own2(bytes, 0, BINARY_HEADER_BYTES),
+    tagLength: BINARY_TAG_BYTES * 8
+  }, key, own2(payload, 0));
+  bytes.set(iv, BINARY_HEADER_BYTES);
+  bytes.set(new Uint8Array(sealed), BINARY_HEADER_BYTES + BINARY_IV_BYTES);
+  return { bytes, sha256: await sha256Hex(bytes) };
+}
 async function readArtifact(key, dir, relPath, expectedSha256) {
   const acquired = await acquireArtifact(join(dir, relPath));
   if (!(acquired instanceof Uint8Array))
@@ -24692,6 +24716,7 @@ var KNOWN_EVENTS4 = new Set([
   "response.reasoning_text.done",
   "response.function_call_arguments.delta",
   "response.function_call_arguments.done",
+  "response.metadata",
   "response.completed",
   "response.incomplete",
   "response.failed",
@@ -49233,7 +49258,7 @@ function createRing(limits = DEFAULT_RING_LIMITS) {
 }
 
 // apps/gateway/src/version.ts
-var VERSION = "0.13.5";
+var VERSION = "0.13.7";
 
 // apps/gateway/src/app.ts
 var ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnigateway",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "description": "Self-hosted AI gateway with Anthropic- and OpenAI-compatible APIs, an admin console, and a CLI",
   "license": "MIT",
   "author": "Harismawan <mail@harismawan.com>",