@atbash/sdk 0.10.0-dev.0 → 0.10.0

package/dist/browser.d.mts

@@ -1,3 +1,5 @@
+import { Logger } from '@opentelemetry/api-logs';
+
 type JudgeEndpointConfig = {
     policy?: "default";
     endpoint?: string;
@@ -11,8 +13,34 @@ interface ValidatedEndpoint {
     policy: "default" | "self-hosted";
     verifyPubKey: string | null;
 }
+/**
+ * Builds the trusted judge host set.
+ *
+ * The compiled-in default is always trusted: a `prod` build resolves it to
+ * atbash.ai, a dev build to whatever DEV_ENDPOINT was set at build time. No
+ * dev host is spelled out in source, and dev builds still validate their own
+ * default.
+ *
+ * Exported for tests only. The set is a build-time value and is deliberately
+ * never read from the process environment — an env var would let anyone widen
+ * the allowlist of an already-shipped artifact, which is the silent-redirection
+ * attack the allowlist exists to prevent (F-003). Asserting that requires
+ * calling this with the environment set, so it cannot stay module-private.
+ *
+ * @internal
+ */
+declare function buildAllowedJudgeHosts(): ReadonlySet<string>;
 declare function validateJudgeEndpoint(judge?: JudgeEndpointConfig): ValidatedEndpoint;
 
+interface ChainConfig {
+    readonly network: Network;
+    readonly blockchainRid: string;
+    readonly nodeUrls: readonly string[];
+}
+declare const PUBLIC_CHAIN: ChainConfig;
+declare const PRIVATE_CHAIN: ChainConfig;
+declare function chainForNetwork(network: Network): ChainConfig;
+
 /**
  * User-facing types. Two groups:
  *  - Core types — the exact shapes the Rust core emits across the NAPI
@@ -110,14 +138,24 @@ interface MemoryScanOptions {
 type Network = "public" | "private";
 /**
  * Per-call chain overrides. Pass exactly what you need to override —
- * `network` selects between the SDK's known chains, `blockchainRid` /
- * `nodeUrls` pin a fully custom chain. Pass none of these to fall back
- * to the SDK's defaults (or to org-resolved chain when `orgName` is set).
+ * `network` selects between the SDK's known chains, `blockchainRid` pins a
+ * custom one, and `endpoint` names the Dashboard the calls travel over. Pass
+ * none of these to fall back to the SDK's defaults (or to the org-resolved
+ * chain when `orgName` is set).
  */
 interface ChainOpts {
     network?: Network;
     blockchainRid?: string;
+    /**
+     * No longer dialled: memory reaches the chain through the Dashboard. Kept
+     * because callers and the other bindings still carry it as chain config.
+     */
     nodeUrls?: readonly string[];
+    /**
+     * Dashboard base URL. Memory reaches the chain through it, so this is where
+     * those requests go; defaults to the endpoint compiled into the core.
+     */
+    endpoint?: string;
 }
 /** Canonical verdict after normalization. */
 type Verdict = "ALLOW" | "HOLD" | "BLOCK" | "No verdict";
@@ -143,6 +181,11 @@ interface LogToolCallResult {
 }
 interface JudgeResult {
     verdict: Verdict;
+    /**
+     * Canonical executable permission, computed by `canonicalAllow` — see that
+     * function for the rule. Never more permissive than `auditToolCall`.
+     */
+    allow: boolean;
     actionType: string;
     reason: string;
     confidence: number;
@@ -167,10 +210,17 @@ interface JudgeResult {
      * missing" — never infer the former from a null verdict alone.
      */
     status: string;
+    /**
+     * The judge's explicit refusal in the raw body (`explicitRefusal`): "BLOCK",
+     * "HOLD", or "" when it neither refused nor is a known refusal shape.
+     */
+    refusal?: "" | "BLOCK" | "HOLD";
 }
 interface JudgmentStatus {
     status: JudgmentState;
     verdict: Verdict;
+    /** Same canonical executable permission as {@link JudgeResult.allow}. */
+    allow: boolean;
     reason: string;
     judgmentId: string;
     onChain?: boolean;
@@ -257,6 +307,13 @@ interface AgentPolicy {
     isCustom: boolean;
     defaultPolicy: string;
 }
+/** Options for agent metadata and policy lookups. */
+interface AgentLookupOptions {
+    /** Resolve the agent's network from this organization's active network. */
+    orgName?: string;
+    /** Explicit per-call chain override. `network` selects the dashboard chain. */
+    chainOpts?: ChainOpts;
+}
 /** Optional structured logger. */
 interface AtbashLogger {
     info?(...args: unknown[]): void;
@@ -265,8 +322,32 @@ interface AtbashLogger {
 /** Options accepted by the `Atbash` constructor. */
 interface AtbashOptions {
     endpoint?: string;
+    /**
+     * Overall deadline for one `auditToolCall` decision, across every request
+     * it makes (org lookup, exists check, judge). Default 60 000 ms. When it
+     * passes the decision is an ERROR (denied unless `failClosed` is false).
+     * `timeoutMs` still bounds each single request.
+     */
+    decisionTimeoutMs?: number;
     timeoutMs?: number;
+    /**
+     * Full chain override — BRID + nodeUrls in one object. Wins over every
+     * other chain selector. Prefer this over paired `nodeUrls`/`blockchainRid`
+     * for anything but backwards compatibility.
+     */
+    chain?: ChainConfig;
+    /**
+     * Preset chain selector — `"public"` or `"private"`. Resolves to the
+     * matching `ChainConfig` via `chainForNetwork()`. Overridden by `chain`,
+     * overrides env `ATBASH_DEFAULT_CHAIN_NETWORK` and the config file.
+     */
+    network?: Network;
+    /**
+     * Explicit node URLs. Must be paired with `blockchainRid`. Passing one
+     * without the other throws — a BRID/nodes mismatch 404s every request.
+     */
     nodeUrls?: readonly string[];
+    /** Explicit BRID. Must be paired with `nodeUrls`. See {@link nodeUrls}. */
     blockchainRid?: string;
     /**
      * Default org name. When set, `judgeAction` / `auditToolCall` resolve
@@ -293,6 +374,22 @@ interface AtbashOptions {
     orgEncryptionPubKey?: string;
     /** When true (default), `auditToolCall` denies on any error. */
     failClosed?: boolean;
+    /**
+     * When true (the default), an answer that carries no enforcement decision
+     * (the audit tier's `{status:"logged"}` with no verdict) is refused:
+     * `auditToolCall` returns `{allow:false, verdict:"ERROR"}` whatever
+     * `failClosed` says, and `judgeAction().allow` / `getJudgmentStatus().allow`
+     * are false. Set it to `false` only to run deliberately in log-only mode
+     * (security review 2026-09-30, H6: an unsigned marker switched enforcement
+     * off).
+     */
+    requireEnforcement?: boolean;
+    /**
+     * Verbose diagnostics. Off by default. When on, a failed judge call also
+     * logs the response body, which is the difference between "judge API failed"
+     * and knowing why it failed. Opt-in because that body can echo the action.
+     */
+    debug?: boolean;
     logger?: AtbashLogger;
 }
 /** Canonical decision returned by `auditToolCall`. */
@@ -327,20 +424,28 @@ interface FromConfigOptions {
     keyPath?: string;
     /** Judge endpoint config — validated against the allowlist / self-hosted policy. */
     judge?: JudgeEndpointConfig;
+    /** See {@link AtbashOptions.chain}. */
+    chain?: ChainConfig;
+    /** See {@link AtbashOptions.network}. */
+    network?: Network;
     blockchainRid?: string;
     timeoutMs?: number;
     nodeUrls?: readonly string[];
     /** Default org name — see {@link AtbashOptions.orgName}. */
     orgName?: string;
     failClosed?: boolean;
+    /** See {@link AtbashOptions.requireEnforcement}. Default true. */
+    requireEnforcement?: boolean;
+    /** See {@link AtbashOptions.decisionTimeoutMs}. Default 60 000 ms. */
+    decisionTimeoutMs?: number;
+    /** See {@link AtbashOptions.debug}. */
+    debug?: boolean;
     logger?: AtbashLogger;
 }
 /** Options accepted by `judgeAction`. */
 interface JudgeOptions {
     toolName?: string;
     toolArgsJson?: string;
-    provider?: string;
-    model?: string;
     verifyPubKey?: string;
     /** Per-call override of {@link AtbashOptions.orgEncryptionPubKey}. */
     orgEncryptionPubKey?: string;
@@ -376,12 +481,6 @@ interface LogToolCallOptions {
     orgEncryptionPubKey?: string;
 }
 
-interface ChainConfig {
-    readonly network: Network;
-    readonly blockchainRid: string;
-    readonly nodeUrls: readonly string[];
-}
-
 declare class Atbash {
     readonly auth: AgentAuth;
     readonly endpoint: string;
@@ -395,6 +494,13 @@ declare class Atbash {
     readonly orgEncryptionPubKey?: string;
     /** When true (default), `auditToolCall` denies on any error. */
     readonly failClosed: boolean;
+    /** When true (default), an unenforced (audit-tier) answer is refused. */
+    readonly requireEnforcement: boolean;
+    /** Overall deadline for one auditToolCall decision, in ms. */
+    readonly decisionTimeoutMs: number;
+    /** Org key learned from the last agent-exists check, for this agent only. */
+    private _orgKeyFromChain;
+    private readonly debug;
     private readonly logger;
     private readonly http;
     /**
@@ -403,12 +509,50 @@ declare class Atbash {
      */
     private readonly _chainCache;
     /**
-     * Cached bearer token for risk-engine / insurance read calls. Built
-     * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
-     * server-side replay protection windows never expire it mid-session.
+     * The chain the constructor settled on. Used only where a lookup returns no
+     * answer — see {@link resolveChainFromMap}.
      */
-    private _authBearer;
+    private readonly _defaultChain;
+    /**
+     * True when the caller named a chain outright — `chain`, `network`, or the
+     * paired `blockchainRid` + `nodeUrls`.
+     *
+     * Such a client is never re-pointed: not by the migration switch, and not by
+     * where an org turns out to live. Naming a chain is the caller saying "talk
+     * to this one", and silently routing elsewhere would make the argument a
+     * suggestion. A client that names nothing is the one that follows the org.
+     */
+    private readonly _explicitChain;
+    /**
+     * The fleet-wide chain switch, read once at construction. `resolve()` hits
+     * the config file on disk, so re-reading it per call would put a file read
+     * on every judge.
+     */
+    private readonly _forcedNetwork;
+    /**
+     * Short-TTL cache for `/api/ai/exists`. The `registered` field is
+     * monotonic (once true, stays true), so most calls in a burst re-fetch
+     * data that hasn't changed. The `org_encryption_pubkey` field CAN change
+     * — an org toggling encryption mid-session — so the TTL is deliberately
+     * short (see `AGENT_EXISTS_TTL_MS`). Keyed by (pubkey, network) so
+     * cross-agent / cross-network calls don't collide.
+     */
+    private _agentExistsCache;
+    private static readonly AGENT_EXISTS_TTL_MS;
+    /** Guards `logEnvironmentOnce` — hosts construct several clients. */
+    private static environmentLogged;
     constructor(privkey: string, options?: AtbashOptions);
+    /**
+     * Say which environment this build talks to, once per process.
+     *
+     * The endpoint and both chain RIDs are compiled in, chosen by the npm tag,
+     * and no configuration repoints a released build. So installing the build
+     * for the wrong environment is invisible: the plugin loads, the hook fires,
+     * and every judge call fails because the agent does not exist on the chain
+     * this build targets. Organisation names are not unique across environments
+     * either, so an org resolving is not evidence the build is right.
+     */
+    private logEnvironmentOnce;
     /**
      * Construct from resolved config: explicit overrides → env vars → the
      * `~/.config/atbash/config.json` file (see userConfig.resolve). The private
@@ -417,6 +561,48 @@ declare class Atbash {
      * validated against the trusted allowlist / self-hosted policy; a
      * self-hosted endpoint's `verifyPubKey` becomes the client default.
      */
+    /**
+     * Decide which key this client signs as.
+     *
+     * Most specific wins: a key passed in code, then a key file the host named,
+     * then the environment, then the default key file. `config.json` is absent
+     * from that list on purpose — it is a settings file, writable by anything
+     * that can write the user's home and read by every Atbash integration on the
+     * machine, so letting it name the key meant one stray value silently
+     * re-pointed who each of them signed as.
+     *
+     * A named `keyPath` that does not exist throws rather than falling through.
+     * The caller said which file holds its identity; quietly signing as a
+     * different one is the outcome worth refusing.
+     *
+     * @param options - The `fromConfig` options, read for `agentKey` and `keyPath`.
+     * @returns The resolved agent identity.
+     * @throws When a named key file is missing, or no identity can be found.
+     */
+    private static resolveIdentity;
+    /**
+     * Add the one thing a machine with no key file needs to hear.
+     *
+     * This is the only path where the operator cannot see what happened: no key
+     * file, and the key they are looking for sits in `config.json`, which no
+     * longer selects the identity. A bare "key file not found" sends them hunting
+     * for a key they already have. Only this branch gets the hint — a caller who
+     * named a `keyPath` is told about that path, where a stranded key is noise.
+     *
+     * @param err - The "key file not found" error from the default lookup.
+     * @returns The same error, or one that also names the key in config.json.
+     */
+    private static explainStrandedKey;
+    /**
+     * Say so when `config.json` still holds an agent key.
+     *
+     * Nothing signs with it any more, and silence would leave an operator
+     * believing one identity is in force while another is. The pubkey is named,
+     * not the key, so the line is safe in a log.
+     *
+     * @param logger - The host logger, when one was supplied.
+     */
+    private static warnOnStrandedKey;
     static fromConfig(options?: FromConfigOptions): Atbash;
     get pubkey(): string;
     get privkey(): string;
@@ -451,8 +637,50 @@ declare class Atbash {
      * explicitly false.
      */
     auditToolCall(input: ToolCallInput): Promise<Decision>;
+    /**
+     * The verify key for one call (R4, governor tier-2 review). A per-call key
+     * may only narrow what the client accepts: on a client pinned to a judge
+     * key it must be that same key, never a replacement; on an unpinned client
+     * it adds the check.
+     */
+    private effectiveVerifyKey;
+    /**
+     * Collapse a judge result into a {@link Decision}. The most restrictive
+     * signal wins (security review 2026-09-30, H1): `action_type`, `verdict`
+     * and the canonical `allow` are each able to deny, and only a result where
+     * all three agree may execute. A present `allow` / `decision.allow` that is
+     * not exactly `true` is the judge declining to grant permission, so it
+     * denies even under `failClosed: false` — that option relaxes *errors*, it
+     * never overrides a refusal.
+     */
+    private decide;
+    /**
+     * One exit for every judge failure.
+     *
+     * Status and reason go in the *message*, not only in the meta object: hosts
+     * print the message and drop the meta, which is why this read as a bare
+     * "judge API failed" while the judge was answering with a precise reason.
+     * The response body follows only under `debug`, since it can echo the action.
+     */
+    private failJudge;
+    /**
+     * The canonical permission for a response body under this client's
+     * settings: {@link canonicalAllow}, minus the audit tier when
+     * `requireEnforcement` is on. Never more permissive than `auditToolCall`.
+     */
+    private executable;
     private fail;
-    getJudgmentStatus(judgmentId: string, agentPubkey?: string): Promise<JudgmentStatus>;
+    /**
+     * Return the current status of a previously submitted judgment.
+     *
+     * `chainOpts` names which chain the judgment was signed against. The
+     * server's GET /api/v1/judge routes to that chain when the SDK sends
+     * a `brid` query param; without it, the server falls back to public.
+     * Callers on the private chain must pass a `chainOpts` (or configure
+     * the client on the private chain) — otherwise polling a POSTed
+     * judgment on the private chain 404s at the server.
+     */
+    getJudgmentStatus(judgmentId: string, agentPubkey?: string, chainOpts?: ChainOpts): Promise<JudgmentStatus>;
     getToolCalls(maxCount: number): Promise<ToolCallRecord[]>;
     getOrgToolCalls(orgName: string, maxCount: number): Promise<ToolCallRecord[]>;
     getAgentToolCalls(agentPubkey: string, maxCount: number): Promise<ToolCallRecord[]>;
@@ -461,8 +689,8 @@ declare class Atbash {
     getOrgTierInfo(orgName: string): Promise<TierInfo | null>;
     getPendingHeldActions(orgName: string, maxCount: number): Promise<HeldAction[]>;
     getHeldActionReviews(orgName: string, maxCount: number): Promise<HeldActionReview[]>;
-    getAgentDetail(agentPubkey: string): Promise<Record<string, unknown>>;
-    getAgentPolicy(agentPubkey: string): Promise<AgentPolicy>;
+    getAgentDetail(agentPubkey: string, options?: AgentLookupOptions): Promise<Record<string, unknown>>;
+    getAgentPolicy(agentPubkey: string, options?: AgentLookupOptions): Promise<AgentPolicy>;
     getSafetyStats(): Promise<Record<string, unknown>>;
     /**
      * Org's subscription on a specific chain. The `network` arg selects
@@ -485,7 +713,9 @@ declare class Atbash {
      *   2. Per-chain subscription fallback — public + private records
      *      are fetched in parallel, with `is_private_blockchain` and
      *      `assigned_at` reconciling mixed states.
-     * Defaults to the public chain when nothing else resolves.
+     * A lookup that names exactly one chain wins outright. Where it names
+     * neither (a brand-new org) or cannot choose between them, the client's
+     * configured default decides.
      */
     resolveChainForOrg(orgName: string): Promise<ChainConfig>;
     /**
@@ -497,6 +727,8 @@ declare class Atbash {
     private resolveChainFromMap;
     /** Drop any cached chain resolutions. Useful in tests. */
     clearChainCache(): void;
+    /** Drop the short-TTL `/api/ai/exists` cache. Useful in tests. */
+    clearAgentExistsCache(): void;
     /**
      * Wrap an SDK method body in telemetry — records the call at start
      * and a success/error duration at end. Re-throws on failure so the
@@ -511,6 +743,14 @@ declare class Atbash {
      * chains; otherwise the client's default.
      */
     private bridFromChainOpts;
+    /**
+     * Resolve the dashboard chain used by agent metadata/policy reads.
+     * Explicit per-call network overrides win; otherwise use the supplied org
+     * or the client's configured default org. A custom BRID is intentionally
+     * left untouched because it cannot be represented by the dashboard's
+     * public/private query selector.
+     */
+    private resolveAgentLookupNetwork;
     /**
      * Get-or-create a Bearer token for dashboard reads. The token is a
      * signed `log_tool_call` op (locally signed, never submitted) — the
@@ -523,10 +763,46 @@ declare class Atbash {
     private riskEngineGet;
     private riskEnginePost;
     private riskEngineRecords;
+    /**
+     * BRID for an org — one round-trip to the map, honoring the client's chain
+     * cache. A "brand-new org" (nothing anywhere names its chain) is not an
+     * error — `resolveChainForOrg` returns the client default for that case and
+     * this helper returns its BRID. A transport failure or non-200 from
+     * `/api/org-network` IS an error and propagates: the caller cannot fall
+     * back to the default chain on outage, because with multi-chain live that
+     * silently reads from the wrong chain. Matches the Python binding's
+     * `_brid_for_org` semantics.
+     */
+    private bridForOrg;
+    /**
+     * BRID for the client's configured default org, if it has one.
+     *
+     * Calls that carry no `orgName` argument are not chain-less: they still
+     * belong to `this.orgName`, and that org lives on exactly one chain. Routing
+     * them by the constructor's chain instead means a client configured
+     * `network: "private"` reads the private chain for an org that lives on
+     * public, and gets an empty answer rather than an error. So where an org is
+     * known the org decides the chain, and the constructor's chain is what is
+     * left when no org is known at all — the order `resolveAgentLookupNetwork`
+     * already applies to agent metadata reads, and the order the dashboard
+     * applies in `resolveChainForWallet`.
+     *
+     * Undefined when there is no default org, so callers keep falling back to
+     * the client default.
+     */
+    /** The switch's chain, unless this client named one of its own. */
+    private forcedNetwork;
+    private defaultOrgBrid;
     private raiseIfError;
     /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
     private httpError;
-    /** Wrap a *transport* failure (fetch threw, no response) as an AtbashAPIError. */
+    /**
+     * Wrap a transport failure (fetch threw, no response) as an AtbashAPIError.
+     *
+     * `HttpTransportError.kind` names the cause; the message is already
+     * human-readable. `debug` echoes the original exception so operators can
+     * cross-reference with node / undici logs when a class doesn't match.
+     */
     private transportError;
     private json;
     static generateKeypair(): KeyPair;
@@ -546,15 +822,79 @@ declare class AtbashAPIError extends Error {
     readonly status: number;
     /** Raw response body text (may be empty). */
     readonly body: string;
-    constructor(status: number, body: string, statusText?: string, endpoint?: string);
+    /**
+     * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+     * request never reached a response (transport failures carry status 0).
+     *
+     * A status alone does not say what failed. Several routes answer one call, and
+     * more than one of them can 404: a caller reading only `404` cannot tell "this
+     * agent is not registered" from "the chain-routing lookup did not resolve", and
+     * has to guess from the body's prose — which a 404 raised before any handler
+     * ran does not carry. The path is the fact that settles it.
+     */
+    readonly path?: string;
+    constructor(status: number, body: string, statusText?: string, endpoint?: string, path?: string);
 }
 declare class SignatureVerificationError extends Error {
     constructor(message: string);
 }
 
+/**
+ * Thin typed fetch wrapper.
+ *
+ * openapi-typescript emits types only (no runtime client), so this is the
+ * single hand-written transport — generic `get`/`post` over global `fetch`
+ * with a per-request timeout. The endpoint-specific request/response *shapes*
+ * are pulled from the generated `schema.ts` at the call sites in client.ts, so
+ * the wire contract still lives in spec/openapi.yaml. Methods return the raw
+ * `Response` so the caller can read the exact bytes the server signed before
+ * any decode (judge signature verification) — mirroring the Python surface's
+ * use of raw httpx (DECISIONS 2026-05-22).
+ */
+type QueryValue = string | number | boolean | undefined | null;
+declare class HttpClient {
+    readonly baseUrl: string;
+    readonly timeoutMs: number;
+    constructor(baseUrl: string, timeoutMs: number);
+    buildUrl(path: string, query?: Record<string, QueryValue>): string;
+    get(path: string, query?: Record<string, QueryValue>, headers?: Record<string, string>): Promise<Response>;
+    post(path: string, body: unknown, headers?: Record<string, string>): Promise<Response>;
+    private fetch;
+}
+/**
+ * A transport failure the SDK can act on. Every real cause the platform surfaces
+ * lands as one of these — the message names the cause in plain language so a
+ * plugin can show it to a user without decoding httpx / fetch internals.
+ *
+ * `cause` preserves the original error for debug logging; consumers that want
+ * the raw exception (e.g. tests) read it there.
+ */
+declare class HttpTransportError extends Error {
+    readonly kind: "timeout" | "aborted" | "dns" | "connect_refused" | "connection_reset" | "unknown";
+    constructor(kind: HttpTransportError["kind"], message: string, options?: {
+        cause?: unknown;
+    });
+}
+
+declare function canonicalAllow(data: Record<string, unknown>): boolean;
+
 /** Normalize wire shapes (verdict casing, status, pubkey) to canonical forms. */
 
 declare function normalizeVerdict(raw: unknown): Verdict;
+/**
+ * Canonicalize `action_type` at the wire boundary, the way
+ * {@link normalizeVerdict} already canonicalizes `verdict`.
+ *
+ * `verdict` has been normalized here since the beginning and has never
+ * drifted between consumers. `action_type` was passed through raw, so every
+ * reader invented its own folding policy — `auditToolCall` compared exactly
+ * while `memory/scan.ts` trimmed and case-folded, and the same `" ALLOW "`
+ * was therefore an error on one path and permission on the other.
+ *
+ * Trim and case-fold only. Zero-width and homoglyph variants survive
+ * untouched, stay outside the known set, and still fail closed.
+ */
+declare function normalizeActionType(raw: unknown): string;
 declare function normalizeStatus(raw: unknown): JudgmentState;
 /** Wire pubkey may be a hex string, a Buffer/Uint8Array, or `{ data: [...] }`. */
 declare function pubkeyToHex(val: unknown): string;
@@ -563,9 +903,22 @@ interface AtbashUserConfig {
     agentKey?: string;
     orgName?: string;
     judgeEndpoint?: string;
-    blockchainRid?: string;
-    provider?: string;
-    providerModel?: string;
+    /**
+     * Response-signing pubkey of a self-hosted judge (66 hex). Setting it makes
+     * `fromConfig` use the self-hosted policy for `judgeEndpoint`, which is the
+     * only way a non-allowlisted judge host is accepted.
+     */
+    judgeVerifyPubKey?: string;
+    /**
+     * `"private"` pins every org to the private chain regardless of where the
+     * dashboard says it lives — the migration switch. Leave it unset for the
+     * normal mode, where each org's own chain decides. There is no `"public"`
+     * value; a caller that wants one specific chain passes `chain` or `network`
+     * at construction instead.
+     */
+    defaultChainNetwork?: Network;
+    /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
+    debug?: string;
 }
 declare function getConfigDir(): string;
 declare function getConfigPath(): string;
@@ -576,6 +929,26 @@ declare function resolve(key: keyof AtbashUserConfig, flagValue?: string): strin
 declare function resolveKeyPath(input?: string): string;
 declare function loadAgentFromFile(keyPath?: string): AgentAuth;
 
+/**
+ * Accepted key filenames, in precedence order.
+ *
+ * `guard-client-key` stays first: it is the name every existing install
+ * already has, and changing which file wins would silently switch agent
+ * identity for anyone holding both. `atbash-client-key` is accepted because
+ * it is the name people actually create — the old one carries retired
+ * branding — and hitting ENOENT on a key you just wrote, from a plugin that
+ * still reports itself installed, is a miserable first run.
+ */
+declare const KEY_FILENAMES: readonly ["guard-client-key", "atbash-client-key"];
+/** Every path checked when no explicit key path is given, in order. */
+declare function keyPathCandidates(): string[];
+/**
+ * Pick the key path: an explicit input wins untouched; otherwise the first
+ * accepted filename that exists, falling back to the preferred name so the
+ * error names something recognisable when nothing is there.
+ */
+declare function chooseKeyPath(input: string | undefined, exists: (p: string) => boolean): string;
+
 /**
  * Canonical secret kinds reported by the Rust core in `SecretMatch.kind`.
  * Wire is permissive (modelled as a free string in {@link SecretMatch})
@@ -594,6 +967,26 @@ declare function verifyJudgeResponseSignature(bodyBytes: Uint8Array, signatureHe
     reason?: string;
 };
 
+/**
+ * The boot memory-sync failure line.
+ *
+ * Split out of `guard-manager.ts` so it can be asserted without constructing a
+ * guard manager, which needs the native addon. The message is the whole point
+ * of AT-304: hosts print the message and drop the structured meta, so a cause
+ * that lives only in meta never reaches the operator.
+ */
+/** Advice, not a diagnosis — appended only when the cause is unhelpful. */
+declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the cause above does not explain it";
+/**
+ * Lead with the real cause.
+ *
+ * The previous wording named the chain endpoint and orgName as the things to
+ * check, which sent operators to verify configuration that was already correct
+ * while the actual cause (a node answering `404 Can't find blockchain with
+ * blockchainRID: …` for a chain it does not host) stayed hidden.
+ */
+declare function bootSyncFailureLine(cause: unknown): string;
+
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -623,15 +1016,27 @@ declare function scanMemoryBatch(entries: MemoryEntry[], auth: AgentAuth, opts?:
 interface CommitMemoryOptions {
     /** Score in [1, 10]. Defaults to 5 (matches the Rell entity default). */
     score?: number;
+    /**
+     * Which memory file this commit targets. Defaults to `""` — the
+     * un-pathed slot, matching Rell's `file_path: text = ""` default.
+     * Pass an explicit filename (e.g. `"AGENTS.md"`) to keep files
+     * versioned independently on chain.
+     */
+    filePath?: string;
     /** Org name — when set, the SDK resolves which chain the agent lives on. */
     orgName?: string;
-    /** Atbash service endpoint for org→chain lookup. */
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
+    /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
+    verifyPubKey?: string;
     chainOpts?: ChainOpts;
 }
 interface RollbackMemoryOptions {
     orgName?: string;
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
+    /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
+    verifyPubKey?: string;
     chainOpts?: ChainOpts;
 }
 /**
@@ -653,6 +1058,7 @@ declare function commitMemoryVersion(plaintext: string, auth: AgentAuth, opts?:
  */
 interface AgentMemoryEntry {
     id: number;
+    filePath: string;
     content: string;
     decryptError?: string;
     score: number;
@@ -664,6 +1070,7 @@ interface AgentMemoryEntry {
 interface MemoryRollbackEvent {
     fromId: number;
     toId: number;
+    filePath: string;
     reason: string;
     signer: string;
     createdAt: number;
@@ -674,36 +1081,39 @@ interface MemoryRollbackEvent {
  * response is a single integer, so this is safe to call on every
  * memory-read hot path.
  */
-declare function getActiveMemoryId(auth: AgentAuth, chainOpts?: ChainOpts): Promise<number | null>;
+declare function getActiveMemoryId(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<number | null>;
 /**
  * Recent active memory entries — subset of active versions filtered
  * by the chain's `MEMORY_RECENT_WINDOW_MS`. For a time-unbounded view
- * of every currently active version, use `getAllAgentMemory`.
+ * of every currently active version, use `getActiveAgentMemory`.
  */
-declare function getActiveMemory(auth: AgentAuth, chainOpts?: ChainOpts): Promise<AgentMemoryEntry[]>;
+declare function getRecentAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
 /**
  * All currently-active memory entries with no time cutoff. Use this
  * when you need every active version regardless of age.
  */
-declare function getAllAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts): Promise<AgentMemoryEntry[]>;
+declare function getActiveAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
 /**
  * Full version history — active + inactive, most recent first. Used
  * by rollback UX to choose a target version.
  */
-declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts): Promise<AgentMemoryEntry[]>;
+declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
 /**
  * Fetch a single memory entry by version id, including its current
- * `is_active` state.
+ * `is_active` state. Version ids are agent-unique on chain (not
+ * per-file), so `id` alone resolves the target row.
  */
 declare function getMemoryById(id: number, auth: AgentAuth, chainOpts?: ChainOpts): Promise<AgentMemoryEntry>;
 /**
  * Audit trail of rollback events for this agent, most recent first.
+ * Scope by file with `filePath`; omit for a cross-file view.
  */
-declare function getRollbackHistory(auth: AgentAuth, chainOpts?: ChainOpts): Promise<MemoryRollbackEvent[]>;
+declare function getRollbackHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<MemoryRollbackEvent[]>;
 /**
  * Roll back to a previously-committed memory version. The target
- * `toId` must exist and be currently inactive. `reason` is required
- * and is recorded on-chain in `memory_rollback_log`.
+ * `toId` must exist and be currently inactive. The chain resolves the
+ * target row's `file_path` from `toId` — no file path is passed in.
+ * `reason` is required and is recorded on-chain in `memory_rollback_log`.
  */
 declare function rollbackMemory(toId: number, reason: string, auth: AgentAuth, opts?: RollbackMemoryOptions): Promise<void>;
 
@@ -755,21 +1165,15 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
- */
-declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
-
-/**
- * Plugin-agnostic memory-write guard.
- *
- * A single call that replaces the plugin's usual memory-write branch:
- *   classify → scan (Layer 1 regex + Layer 2 LLM) → gate on verdict →
- *   persist to chain (fire-and-forget when allowed) → return decision.
  *
- * Plugins call this from their `before_tool_call` hook. When it returns
- * `{ handled: false }` the call wasn't a memory write and the plugin
- * should fall through to its regular tool-call audit. When
- * `{ handled: true }` the plugin returns `decision` directly.
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
+declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
 /**
  * Minimal logger accepted by `guardMemoryWrite`. Plugins pass their
@@ -793,6 +1197,8 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     verifyPubKey?: string;
     /** Org name for chain resolution (public vs org-private chain). */
     orgName?: string;
+    /** Explicit chain target when the host already resolved and verified it. */
+    chainOpts?: ChainOpts;
     /** LLM confidence threshold for yellow escalation. Default 0.6. */
     threshold?: number;
     /** When false, red verdicts log but don't block. Default true. */
@@ -801,6 +1207,17 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     debug?: boolean;
     /** Optional logger for debug probe + persist-failure warnings. */
     logger?: GuardLogger;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
+    /**
+     * Root the caller keeps memory under, when it is not an agent home.
+     *
+     * Only pass a value the host stated outright. A root defaulted from the
+     * process working directory would make whichever directory the host happened
+     * to start in look like a memory store — which is how a stray MEMORY.md once
+     * ended up inside a plugin checkout.
+     */
+    memoryRoot?: string;
 }
 /** Plugin-facing decision. Shape mirrors what plugins return from `before_tool_call`. */
 interface GuardMemoryDecision {
@@ -815,22 +1232,21 @@ interface GuardMemoryWriteResult {
     decision?: GuardMemoryDecision;
     /** Present when handled and scan ran. Absent when scan threw. */
     scanResult?: MemoryScanResult;
-    /** Present when handled. True when a chain-commit was dispatched (fire-and-forget). */
+    /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
 /**
- * Guarded memory-write flow. Returns `{ handled: false }` when the tool
- * call isn't a memory write, otherwise returns a `decision` the plugin
- * should return from its hook.
+ * Guard a memory write, and record what was decided.
+ *
+ * Wraps the decision rather than threading telemetry through its eight exits,
+ * so a later return added inside cannot quietly stop being counted.
  *
- * Verdict handling:
- * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with LLM score; decision allows
- * - `green`  → persisted with LLM score; decision allows
+ * Only a call this guard actually handled is recorded. A tool call that was
+ * never a memory write is not a memory operation, and counting it would put
+ * every unrelated edit into the number a memory migration reads.
  *
- * Chain commit is fire-and-forget: network errors are logged via
- * `logger.warn` but never surfaced to the caller. This mirrors the
- * existing plugin behaviour — chain is for audit/recovery, not gating.
+ * @param input - The tool call and the agent to judge it for.
+ * @returns What the guard decided; unchanged by the recording.
  */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
@@ -860,17 +1276,26 @@ interface SyncMemoryOptions {
     /** Skip the TTL gate and force a chain check this call. Default false. */
     force?: boolean;
     chainOpts?: ChainOpts;
+    /** Exact chain slot for the managed file; omission keeps the cross-file API behavior. */
+    filePath?: string;
 }
 /**
  * `drifted: false` — pointer is still valid; caller can keep serving the local copy.
  * `drifted: true`  — active id changed on chain; `current` is the fresh decrypted row
  *                    (or `null` if active memory was removed entirely).
+ *
+ * `checked` — whether this call actually queried chain. `false` means the TTL
+ * window was still open and the pointer was trusted without contacting chain, so
+ * `drifted: false` carries no evidence about the current state. Callers that
+ * vouch for content to a third party must not treat an unchecked result as proof.
  */
 type SyncMemoryResult = {
     drifted: false;
+    checked: boolean;
     pointer: MemoryPointer;
 } | {
     drifted: true;
+    checked: true;
     current: AgentMemoryEntry | null;
     pointer: MemoryPointer;
 };
@@ -886,10 +1311,19 @@ declare class PointerStore {
     private cache;
     private loading;
     constructor(filePath: string);
-    /** Resolves the pointer for `agentPubkeyHex`, or a zero-pointer that will force a sync on first use. */
-    get(agentPubkeyHex: string): Promise<MemoryPointer>;
-    /** Persists an updated pointer. Failures are swallowed to a logger callback (if provided) so sync never blocks the caller. */
-    set(agentPubkeyHex: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
+    /**
+     * The pointer for one agent's file, or a zero-pointer forcing a sync.
+     *
+     * @param filePath - The file's chain slot, i.e. its basename.
+     */
+    get(agentPubkeyHex: string, filePath: string): Promise<MemoryPointer>;
+    /**
+     * Persist one file's pointer, leaving the agent's other files alone.
+     *
+     * Write failures are reported to `onError` rather than thrown: a cache that
+     * cannot be written must not take down the read it was speeding up.
+     */
+    set(agentPubkeyHex: string, filePath: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
     private ensureLoaded;
     private loadOnce;
     private persist;
@@ -901,6 +1335,8 @@ declare function defaultPointerPath(workspaceDir?: string): string;
 interface WrappedLogger {
     info(message: string, meta?: Record<string, unknown>): void;
     warn(message: string, meta?: Record<string, unknown>): void;
+    /** Wait for queued writes and surface any lost log entry. */
+    flush(): Promise<void>;
 }
 interface UpstreamLogger {
     info: (...args: unknown[]) => void;
@@ -929,15 +1365,52 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 
-/** Decision the manager returns to the plugin's `before_tool_call` handler. */
+/**
+ * Decision the manager returns to the plugin's `before_tool_call` handler.
+ *
+ * `allow: true` alone is NOT evidence that anything was checked. Read `audited`
+ * to tell the two apart, and route un-audited calls to your own judge — see the
+ * field docs below.
+ */
 interface HookDecision {
     allow?: boolean;
     block?: boolean;
     blockReason?: string;
     reason?: string;
+    /**
+     * Whether the guard reached an enforcement decision about *this* call.
+     *
+     * Note this describes whether the guard **decided**, not whether it allowed.
+     * Every `block` is `audited: true` — a blocked call is the most thoroughly
+     * checked outcome the guard produces (a red scan, a ciphertext integrity
+     * failure, a rolled-back version), and a host must never re-judge its way past
+     * one.
+     *
+   * Absent or false means the guard reached no decision — for example, the scan
+   * never ran or this manager does not own the requested file. In enforce mode,
+   * failed chain verification of the managed file is a block, never an unaudited
+   * allow. In observe mode unverified calls remain unaudited.
+     *
+     * So the host rule is:
+     *   `if (d.block) deny;  else if (d.audited) allow;  else judge it yourself;`
+     *
+     * Treating a bare `allow: true` as a completed audit is what this field exists
+     * to prevent. A host that ignores it and returns the decision verbatim will
+     * execute unaudited tool calls.
+     */
+    audited?: boolean;
+    /** Scan verdict when one was produced (`green` | `yellow` | `red`). Absent when no scan ran. */
+    verdict?: string;
 }
 interface MemoryGuardManagerOptions {
     auth: AgentAuth;
@@ -945,6 +1418,17 @@ interface MemoryGuardManagerOptions {
     workspaceDir: string;
     /** Absolute MEMORY.md path. Default `<workspaceDir>/MEMORY.md`. */
     memoryFilePath?: string;
+    /**
+     * Root this host keeps memory under, when it is not an agent home.
+     *
+     * Only set this from a value the host stated outright — never from
+     * `process.cwd()`. A guessed root makes whichever directory the host started
+     * in look like a memory store, which is how a stray MEMORY.md once ended up
+     * inside a plugin checkout.
+     */
+    memoryRoot?: string;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
     /** Persistent pointer file. Default `<workspaceDir>/.atbash/memory-pointer.json`. */
     pointerFilePath?: string;
     /** File-backed log. Default `<workspaceDir>/.atbash/plugin.log`. */
@@ -960,6 +1444,13 @@ interface MemoryGuardManagerOptions {
     rollbackMinScore?: number;
     /** True → return `{block:true}` on defense triggers. False → log and return `null` (audit-only). Default true. */
     enforce?: boolean;
+    /**
+     * Chain targeting for the pointer sync (network, blockchainRid, nodeUrls).
+     * Defaults to the SDK's configured chain. Without this the manager could only
+     * ever talk to the default chain, which left the whole memory-read path
+     * untestable — `syncLocalMemory` already accepted these options.
+     */
+    chainOpts?: ChainOpts;
     /** Host-specific tuning of what counts as a memory read. */
     memoryReadClassifier?: ClassifyMemoryReadOptions;
     /** Passed through to `guardMemoryWrite`. Host memory-write tool names override. */
@@ -984,11 +1475,45 @@ declare class MemoryGuardManager {
     private readonly pointerStore;
     private readonly logger;
     private readonly memoryFilePath;
+    /** Base for resolving the relative paths a host sends. */
+    private readonly workspaceDir;
+    /** Set by `verifyOneFile` when the file it checked was actually on chain. */
+    private lastVerified;
     private readonly ttlMs;
     private readonly rollbackMinScore;
     private readonly enforce;
     private readonly agentPubkeyHex;
+    /**
+     * Memoized org→chain resolution. Reads have to hit the SAME chain
+     * writes did, so an org-scoped guard must resolve `orgName` to
+     * network exactly like `commitMemoryVersion` does. Without this
+     * cache the read path would either (a) hit the SDK-default chain
+     * every time — silently returning "no active memory on chain" when
+     * writes landed on the org's actual chain, or (b) hammer
+     * `/api/org-network` on every read. `undefined` means "not yet
+     * resolved"; a resolved `null` means "no org / use raw chainOpts".
+     */
+    private _resolvedChainOpts;
+    private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Carry this manager's host into `chainOpts`.
+     *
+     * Memory reads reach the chain through that host, and they are handed only
+     * `chainOpts` — without this a self-hosted deployment would read from the
+     * compiled-in default host while writing to its own.
+     */
+    private withEndpoint;
+    /**
+     * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+     * already does this for writes; without the same call on the read
+     * path, a client on the SDK's baked default chain reads from the wrong
+     * chain and reports "no active memory" for an agent whose writes did
+     * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+     * still wins (caller vouched for it); everything else honors the
+     * dashboard's `org_networks` map.
+     */
+    private resolveChainOpts;
     /**
      * One-shot chain probe at plugin registration. Refreshes MEMORY.md
      * from chain when drifted and score passes threshold. Fire-and-forget
@@ -996,27 +1521,125 @@ declare class MemoryGuardManager {
      */
     runBootProbe(): Promise<void>;
     /**
-     * Returns a `HookDecision` when the event is a memory read or write
-     * (host returns it verbatim to its runtime). Returns `null` when the
-     * event isn't memory-related — host falls through to its own audit.
+     * Bring one chain file into step with its local counterpart.
+     *
+     * Only a file that already exists locally is touched. Restoring one that is
+     * absent would mean choosing where to create it, and the root is a guess the
+     * moment more than one could apply — the same guess that once wrote a
+     * MEMORY.md into a plugin checkout.
+     *
+     * @returns What happened, for the single summary line the caller logs.
+     */
+    private syncOneAtBoot;
+    /**
+     * Where a chain slot's file lives locally, or null when we do not have it.
+     *
+     * A stated root is tried first, then each agent home that actually exists in
+     * the user's home directory — the same rule that produced the slot, run
+     * backwards. Only an existing file is returned: creating one would mean
+     * picking a root, and picking is guessing.
      */
+    private locate;
+    /** Roots a chain slot may be joined to, most specific first. */
+    private memoryRoots;
     handleBeforeToolCall(event: unknown, ctx: unknown): Promise<HookDecision | null>;
     private mapGuardResult;
+    /**
+     * Whether the pointer state this manager tracks actually describes the file
+     * this call is about to read.
+     *
+     * The classifier fires on nine patterns — including the bare tokens
+     * `"memory/"`, `"CLAUDE.md"` and `"AGENTS.md"` — but the sync path only ever
+     * reads, refreshes, or vouches for `this.memoryFilePath`. Without this check a
+     * read of `/repo/CLAUDE.md` (or any path merely containing `memory/`) would
+     * receive an `audited: true` for a file the guard never opened.
+     *
+     * Conservative on purpose: every path-shaped value found must resolve to the
+     * managed file. If none is found, or any one differs, the answer is no. That
+     * also covers events carrying two different path keys, where the classifier
+     * and the host could otherwise disagree about which one is authoritative.
+     */
+    /**
+     * The memory files this tool call reads, as absolute paths.
+     *
+     * Relative paths resolve against the workspace, not `process.cwd()`. The host
+     * sends paths relative to the agent's workspace; resolving them against the
+     * process's own directory made the guard protect whichever directory the host
+     * happened to start in, which on one machine was a plugin checkout.
+     *
+     * @returns Every named target, de-duplicated; empty when the call names none.
+     */
+    private readTargets;
+    /**
+     * Say what the read classifier saw and what it concluded.
+     *
+     * The write path has `emitDebugProbe`; this is its counterpart, so a tool
+     * call can be followed across the fork instead of only after it. `false` here
+     * is the normal answer for a write — it means the call goes to the write
+     * classifier next, not that it was ignored.
+     *
+     * @param isMemoryRead - What `classifyMemoryRead` returned.
+     */
+    private emitReadProbe;
+    /**
+     * The chain slot for a path, or null when the file gets no chain record.
+     *
+     * One helper so the boot probe and every read agree: taking a basename in one
+     * place and a relative path in the other would verify a file against a record
+     * that is not its own.
+     */
+    private slotFor;
+    /**
+     * Verify every memory file this call reads, each against its own chain slot.
+     *
+     * A call naming several files is only cleared when all of them are, so one
+     * unverifiable file cannot ride along with a verified one.
+     *
+     * @returns A block for the first file that fails, an audited allow when all
+     *   were verified, or null when none of them is on chain.
+     */
     private handleMemoryRead;
+    /**
+     * Check one memory file against the chain slot of the same name.
+     *
+     * A file with no chain version is passed through rather than blocked: there
+     * is no claim to protect, so refusing would only stop an agent reading memory
+     * it has never committed. A file that IS on chain must match, or the read is
+     * refused — that is the whole guarantee.
+     *
+     * @returns A decision when the read must not proceed, else null.
+     */
+    private verifyOneFile;
+    /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+    flushLogs(): Promise<void>;
+    /**
+     * A read this guard could not verify.
+     *
+     * Enforcing, that is a block. Observing, the host audits it as usual — but
+     * the reason is said out loud either way, or an unverified read looks
+     * identical to a clean one in the log.
+     */
+    private unverifiedRead;
     private writeMemoryAtomic;
+    /** Replace `target` in one step, so a reader never sees a half-written file. */
+    private writeFileAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;
 
 /**
  * Atbash SDK Telemetry — OpenTelemetry metrics for usage tracking.
  *
- * Tracks: function call counts, latency, source (CLI/plugin/SDK),
- * and agent identity. ON by default.
+ * Metrics are POSTed to the Atbash-owned `/api/telemetry` proxy, which
+ * verifies the bearer, injects the Honeycomb ingest key server-side, and
+ * forwards to Honeycomb. The ingest credential never enters the SDK.
+ *
+ * Environment opt-out (recommended for air-gapped deployments):
+ * ATBASH_TELEMETRY_DISABLED=1
  *
  * Opt-out: create ~/.config/atbash/telemetry.json with { "enabled": false }
  * The file must be readable by the SDK process. If missing, corrupted, or
- * unreadable → telemetry stays ON. Environment variables cannot disable
- * telemetry (prevents agent bypass via env-var injection).
+ * unreadable, telemetry remains eligible to start unless the environment
+ * opt-out is set.
  */
 type ClientSource = "cli" | "sdk" | "plugin:openclaw" | "plugin:langchain" | "plugin:langgraph" | "plugin:hermes" | "plugin:eliza" | "plugin:crewai" | "plugin:mcp" | "plugin:autogen" | "plugin:jeenai" | (string & {});
 interface TelemetryConfig {
@@ -1026,6 +1649,27 @@ interface TelemetryConfig {
     source?: ClientSource;
     /** Flush interval in ms. Default: 60000 */
     exportIntervalMs?: number;
+    /** Atbash endpoint that hosts /api/telemetry. Required to actually export. */
+    endpoint?: string;
+    /**
+     * Called on every export to obtain fresh auth headers (typically
+     * `{ Authorization: "Bearer <hex>" }`). Required to actually export.
+     */
+    getAuthHeaders?: () => Record<string, string>;
+    /**
+     * Hashes the agent key before it is emitted on a wide event.
+     *
+     * Defaults to an unsalted SHA-256, which is de-identification rather than
+     * anonymisation: agent pubkeys are public on chain and can be enumerated, so
+     * the mapping is recoverable by anyone holding that list. Supply a salted
+     * hasher to make it uncorrelatable, at the cost of joining across
+     * deployments.
+     *
+     * Injected rather than imported so the telemetry modules need nothing from
+     * the native addon. Left unset, the agent field is dropped from events
+     * rather than falling back to the raw key.
+     */
+    hashAgentKey?: (pubkeyHex: string) => string;
 }
 declare function setupTelemetry(config: TelemetryConfig): void;
 /**
@@ -1049,35 +1693,121 @@ declare function flushTelemetry(): Promise<void>;
 declare function shutdownTelemetry(): Promise<void>;
 
 /**
- * Signs `log_encrypted_tool_call` — the ciphertext-only counterpart of
- * `log_tool_call`. Rust core owns the encrypt + hash + GTX sign flow;
- * this module is a thin wrapper. Browser callers get the pure-TS shim
- * at `src-ts/browser/encrypted-toolcall.ts` (NAPI can't run in-browser).
+ * Wide events: one row per SDK operation, alongside the counters.
+ *
+ * The counters in `telemetry.ts` are aggregated inside this process before
+ * export, so Honeycomb never receives a per-operation row. That is fine for
+ * "is it up" and useless for everything else: a question nobody attached an
+ * attribute for in advance cannot be answered later, because the data to
+ * answer it never existed. "Which org sees the most failures", "what preceded
+ * a fail-closed", "is the new release slower" are all that shape.
+ *
+ * So each operation also emits one event carrying its whole context. The
+ * counters stay — they are the right tool for health boards and alerts, and
+ * they are not sampled.
+ *
+ * TWO RULES SHAPE THIS MODULE.
+ *
+ * The payload is METADATA ONLY, and the allowlist below is the whole of it:
+ * function name, outcome, latency, error class, error status and path, SDK
+ * version, chain, and a hash of the agent key. Action text, tool arguments, policy text, organisation
+ * names and keys never appear — not as a field that is emptied, but as a field
+ * that does not exist, so there is nothing to forget to strip.
+ *
+ * The agent key is hashed, never sent raw, and the hasher is INJECTED rather
+ * than imported: this module needs nothing from the native addon. With no
+ * hasher supplied the field is DROPPED rather than falling back to the raw
+ * key, so the guarantee does not depend on wiring somebody could forget.
+ *
+ * NOTE on what hashing does and does not buy. Agent pubkeys are public on
+ * chain and can be enumerated, so an UNSALTED hash is reversible by anyone who
+ * can read the chain: it is de-identification, not anonymisation. A salted
+ * hasher makes it uncorrelatable and costs cross-deployment joins. Which one
+ * is wanted is the caller's decision; this module only guarantees the raw key
+ * never leaves.
+ *
+ * And the richer payload has its own switch. Counters carry a function name
+ * and a source. These events carry agent and org identity off a customer's
+ * machine, which is a different proposition for a security product, so
+ * `ATBASH_TELEMETRY_EVENTS_DISABLED=1` turns them off while leaving the health
+ * counters on. Both remain subject to the existing global opt-out.
  */
-/** Plaintext fields of a tool call, sealed into a single ECIES payload. */
-interface ToolCallPlaintext {
-    tool_name: string;
-    action: string;
-    context: string;
-    tool_args_json: string;
+
+/** Attributes an event may carry. Anything not listed here cannot be emitted. */
+interface OperationEvent {
+    /** SDK function, matching the counter's `function.name` so the two join. */
+    functionName: string;
+    durationMs: number;
+    status: "success" | "error";
+    /**
+     * Hex pubkey of the agent the call was made as. Hashed before it is emitted,
+     * and omitted entirely when no hasher is configured.
+     */
+    agentPubkey?: string;
+    /**
+     * Blockchain RID of the chain this call concerned.
+     *
+     * The RID rather than a network label: it is public infrastructure, it is
+     * unambiguous, and it identifies the deployment without naming a customer.
+     */
+    chain?: string;
+    /** Constructor name of the thrown error, e.g. `AtbashAPIError`. */
+    errorClass?: string;
+    /** HTTP status, or 0 when the request never completed. */
+    errorStatus?: number;
+    /**
+     * Request path the status came from, e.g. `/api/v1/judge`.
+     *
+     * The class alone does not say what failed: several routes answer one call
+     * and more than one can 404, so `AtbashAPIError` cannot distinguish "this
+     * agent is not registered" from "the chain-routing lookup did not resolve".
+     * The path settles it.
+     *
+     * Carries no query string — `requestPath` strips it at the point the error
+     * is built, because a query string carries org names, tool call ids and the
+     * agent pubkey. Structured and already sanitised, so this stays inside the
+     * metadata rule where an error message would not.
+     */
+    errorPath?: string;
+    /**
+     * Short categorical result, when "success" is too coarse — e.g. a memory
+     * write that scanned clean but never reached the chain.
+     *
+     * Categorical by contract: a value a caller chooses from a fixed vocabulary,
+     * never free text and never anything derived from user content.
+     */
+    outcome?: string;
 }
+/** Hashes an agent key for emission. Supplied by `setupTelemetry`. */
+type AgentKeyHasher = (pubkeyHex: string) => string;
+declare function configureEvents(next: Logger | null, opts?: {
+    version?: string;
+    source?: string;
+    hashAgentKey?: AgentKeyHasher;
+}): void;
+/** True when an event would actually be emitted. Exported for tests and callers that build context lazily. */
+declare function eventsAreOn(): boolean;
 /**
- * Canonical form of an action for the retry-cache hash. Byte-identical to
- * the dashboard's `normalizeActionForHash` — diverging silently breaks
- * YELLOW-hold retry resolution.
+ * Emit one wide event for a completed operation.
+ *
+ * Never throws and never blocks: telemetry failing must not change what the
+ * caller observes. Does nothing when events are off.
+ *
+ * @param e - The completed operation.
  */
-declare function normalizeActionForHash(action: string): string;
+declare function recordEvent(e: OperationEvent): void;
+
 /**
- * Signed commitment to the plaintext claims the caller sends alongside the
- * ciphertext. The judge reads plaintext from the request body but holds no
- * org key; this hash lets it verify body-vs-ciphertext without decrypting.
- * Byte-identical to the dashboard's `claimHashHex`.
+ * Rust core does the work; `browser/encrypted-toolcall.ts` mirrors it for the
+ * browser and must produce the same columns.
  */
+/** Must match `column_aad` in the core — the label binds a ciphertext to its column. */
+declare function columnAad(toolCallId: string, column: string): string;
+/** Byte-identical to the dashboard's copy — diverging breaks hold-retry resolution. */
+declare function normalizeActionForHash(action: string): string;
+/** Lets the judge check the request body against the ciphertext without an org key. */
 declare function claimHashHex(toolName: string, action: string, context: string, toolArgsJson: string): string;
-/**
- * Build + sign a `log_encrypted_tool_call` transaction. Returns hex-encoded
- * signed tx, ready to POST as `signed_log_tool_call`.
- */
+/** @returns hex-encoded signed tx, ready to POST as `signed_log_tool_call`. */
 declare function signEncryptedToolCall(toolCallId: string, action: string, context: string, toolName: string, toolArgsJson: string, orgEncryptionPubKey: string, privkeyHex: string, blockchainRidHex: string): string;
 
 /**
@@ -1126,6 +1856,29 @@ declare function decryptForOrg(payload: Uint8Array, orgPrivKeyHex: string, aad:
  */
 declare function encryptedLength(plaintextByteLength: number): number;
 
+/**
+ *   atb1.<key-fingerprint>.<claim-hash>.<base64 ciphertext>
+ *
+ * Normative spec: `core/src/crypto_envelope.rs`. This mirrors it for the browser.
+ */
+interface Envelope {
+    /** First 8 bytes of the recipient public key, hex. May be empty. */
+    keyFingerprint: string;
+    /** Commitment to the accompanying plaintext claims. May be empty. */
+    claimHash: string;
+    /** Raw ECIES payload. */
+    payload: Uint8Array;
+}
+declare function packEnvelope(payload: Uint8Array, keyFingerprint?: string, claimHash?: string): string;
+/**
+ * Stays true for a truncated envelope that `parseEnvelope` rejects — a severed
+ * ciphertext is not plaintext, so callers must show a placeholder.
+ */
+declare function isEnvelope(value: string): boolean;
+/** Null, not a throw — pre-encryption records are plaintext. */
+declare function parseEnvelope(value: string): Envelope | null;
+declare function keyFingerprintOf(pubKeyHex: string): string;
+
 declare function isValidPrivateKey(hex: string): boolean;
 declare function derivePublicKey(privkey: string): string;
 declare function generateKeypair(): KeyPair;
@@ -1141,4 +1894,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallPlaintext, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, claimHashHex, classifyMemoryRead, classifyMemoryWrite, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveMemory, getActiveMemoryId, getAllAgentMemory, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRollbackHistory, guardMemoryWrite, isValidPrivateKey, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };