@atbash/sdk 0.10.0-dev.0 → 0.10.0

package/dist/browser.mjs

@@ -10,6 +10,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod2) => function __require2() {
   return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
 };
@@ -30,10 +33,28 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
   mod2
 ));
 
+// <define:__ATBASH_CHROMIA_NODE_URLS__>
+var define_ATBASH_CHROMIA_NODE_URLS_default;
+var init_define_ATBASH_CHROMIA_NODE_URLS = __esm({
+  "<define:__ATBASH_CHROMIA_NODE_URLS__>"() {
+    define_ATBASH_CHROMIA_NODE_URLS_default = ["https://node0.testnet.chromia.com:7740", "https://node1.testnet.chromia.com:7740"];
+  }
+});
+
+// <define:__ATBASH_PRIVATE_NODE_URLS__>
+var define_ATBASH_PRIVATE_NODE_URLS_default;
+var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
+  "<define:__ATBASH_PRIVATE_NODE_URLS__>"() {
+    define_ATBASH_PRIVATE_NODE_URLS_default = ["https://node0-pvn-testnet.dynamic.chromia.dev:7740", "https://node1-pvn-testnet.dynamic.chromia.dev:7740", "https://node2-pvn-testnet.dynamic.chromia.dev:7740"];
+  }
+});
+
 // (disabled):node_modules/buffer/index.js
 var require_buffer = __commonJS({
   "(disabled):node_modules/buffer/index.js"() {
     "use strict";
+    init_define_ATBASH_CHROMIA_NODE_URLS();
+    init_define_ATBASH_PRIVATE_NODE_URLS();
   }
 });
 
@@ -41,6 +62,8 @@ var require_buffer = __commonJS({
 var require_bn = __commonJS({
   "node_modules/bn.js/lib/bn.js"(exports, module) {
     "use strict";
+    init_define_ATBASH_CHROMIA_NODE_URLS();
+    init_define_ATBASH_PRIVATE_NODE_URLS();
     (function(module2, exports2) {
       "use strict";
       function assert2(val, msg) {
@@ -2858,7 +2881,29 @@ var require_bn = __commonJS({
   }
 });
 
+// src-ts/index.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// src-ts/browser/native.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/curves/secp256k1.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/hashes/sha2.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/hashes/_md.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/hashes/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -3279,7 +3324,13 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
+// node_modules/@noble/curves/abstract/curve.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/curves/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
 var bytesToHex2 = bytesToHex;
@@ -3432,6 +3483,8 @@ function validateObject(object, fields = {}, optFields = {}) {
 }
 
 // node_modules/@noble/curves/abstract/modular.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -4079,7 +4132,13 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
+// node_modules/@noble/curves/abstract/weierstrass.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/hashes/hmac.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var _HMAC = class {
   oHash;
   iHash;
@@ -5111,6 +5170,8 @@ var Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
 var secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);
 
 // node_modules/postchain-client/built/esm/index.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var import_bn = __toESM(require_bn(), 1);
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
 function getDefaultExportFromCjs(x) {
@@ -40524,7 +40585,7 @@ function requireFailoverStrategies() {
     exports.createTimeoutPromise = createTimeoutPromise;
     const utils_12 = requireUtils$1();
     const httpUtil_1 = httpUtil;
-    const logger2 = __importStar2(logger$3);
+    const logger3 = __importStar2(logger$3);
     const http_utils_1 = httpUtils;
     function getUnreachableDuration(statusCode, error4) {
       if ((0, http_utils_1.isNetworkError)(error4)) {
@@ -40625,7 +40686,7 @@ function requireFailoverStrategies() {
         while (true) {
           if (groupedSuccessfulResponses.maxNumberOfEqualResponses() >= bftMajorityThreshold) {
             if (groupedSuccessfulResponses.numberOfDistinctResponses() > 1) {
-              logger2.warning(`Got disagreeing responses, but could still reach BFT majority`);
+              logger3.warning(`Got disagreeing responses, but could still reach BFT majority`);
             }
             return groupedSuccessfulResponses.majorityResponse();
           }
@@ -40663,7 +40724,7 @@ function requireFailoverStrategies() {
           if (!isError4 && !error4) {
             return { error: error4, statusCode, rspBody, transactionTimestamp };
           }
-          logger2.info(`${method} request failed on ${endpoint.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
+          logger3.info(`${method} request failed on ${endpoint.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
           yield (0, utils_12.sleep)(config2.attemptInterval);
         }
         return { error: error4, statusCode, rspBody, transactionTimestamp };
@@ -40699,7 +40760,7 @@ function requireFailoverStrategies() {
             if (isServerError) {
               const duration = getUnreachableDuration(statusCode !== null && statusCode !== void 0 ? statusCode : void 0, response.error);
               nodeManager2.makeNodeUnavailable(node2.url, duration);
-              logger2.info(`request failed with server error on ${node2.url} trying next node`);
+              logger3.info(`request failed with server error on ${node2.url} trying next node`);
               break;
             }
             if (isClientError) {
@@ -40707,11 +40768,11 @@ function requireFailoverStrategies() {
                 return { error: error4, statusCode, rspBody, transactionTimestamp };
               }
               if (!nodeManager2.useStickyNode) {
-                logger2.info(`request failed client error on ${node2.url} trying next node`);
+                logger3.info(`request failed client error on ${node2.url} trying next node`);
                 break;
               }
             }
-            logger2.info(`${method} request failed on ${node2.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
+            logger3.info(`${method} request failed on ${node2.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
             if (config2.attemptInterval > 0) {
               yield (0, utils_12.sleep)(config2.attemptInterval);
             }
@@ -40940,7 +41001,7 @@ function requireUtils$1() {
     exports.getBlockchainRidFromIid = getBlockchainRidFromIid;
     exports.convertToPrintable = convertToPrintable;
     const buffer_12 = buffer$3;
-    const logger2 = __importStar2(logger$3);
+    const logger3 = __importStar2(logger$3);
     const errors_12 = errors;
     const gtxTool = __importStar2(gtx$1);
     const errors_2 = errors;
@@ -41023,7 +41084,7 @@ function requireUtils$1() {
     function validTxRid(txRID) {
       if (txRID.length != 32) {
         const error4 = new errors_12.InvalidTxRidException(txRID);
-        logger2.error(error4.toString());
+        logger3.error(error4.toString());
         return false;
       }
       return true;
@@ -41426,7 +41487,7 @@ function requireUtils$1() {
     function handleGetResponse(error4, statusCode, responseObject, callback) {
       try {
         const responseObjectPrintable = convertToPrintable(responseObject);
-        logger2.debug(`error: ${error4}, status code: ${statusCode}, response body: ${responseObjectPrintable}`);
+        logger3.debug(`error: ${error4}, status code: ${statusCode}, response body: ${responseObjectPrintable}`);
         if (error4) {
           return callback(error4, null);
         }
@@ -41436,16 +41497,16 @@ function requireUtils$1() {
         return callback(null, responseObject);
       } catch (error5) {
         callback(error5, null);
-        logger2.error(`client.handleGetResponse(): Failed to call the callback function. ${error5}`);
+        logger3.error(`client.handleGetResponse(): Failed to call the callback function. ${error5}`);
       }
     }
     function handlePostResponse(error4, statusCode, responseObject, callback) {
       var _a2;
       const responseObjectPrintable = convertToPrintable(responseObject);
-      logger2.debug(`error: ${error4}, status code: ${statusCode}, response body: ${responseObjectPrintable}`);
+      logger3.debug(`error: ${error4}, status code: ${statusCode}, response body: ${responseObjectPrintable}`);
       try {
         if (error4) {
-          logger2.error(`In client post(). ${error4}`);
+          logger3.error(`In client post(). ${error4}`);
           callback(error4, null);
         } else if (!statusCode || !(0, http_utils_1.isSuccessfulStatusCode)(statusCode)) {
           let errorMessage2 = `Unexpected status code from server. Code: ${statusCode}.`;
@@ -41453,14 +41514,14 @@ function requireUtils$1() {
           if (responseObjectPrintable) {
             errorMessage2 += ` Message: ${responseObjectPrintable}.`;
           }
-          logger2.error(errorMessage2);
+          logger3.error(errorMessage2);
           callback(new errors_12.UnexpectedStatusError(statusCode !== null && statusCode !== void 0 ? statusCode : 400, errorMessageInResponseBody || responseObjectPrintable), responseObject);
         } else {
-          logger2.info(`Calling responseCallback with responseObject: ${responseObjectPrintable}`);
+          logger3.info(`Calling responseCallback with responseObject: ${responseObjectPrintable}`);
           callback(null, responseObject);
         }
       } catch (error5) {
-        logger2.error(`client.handlePostResponse(): Failed to call callback function ${error5}`);
+        logger3.error(`client.handlePostResponse(): Failed to call callback function ${error5}`);
       }
     }
     function getBlockchainRidFromIid(_a2) {
@@ -42198,7 +42259,7 @@ function requireBlockchainClient() {
   const crypto_12 = requireCryptoBrowserify();
   const cloneDeep_1$1 = __importDefault2(cloneDeep_1);
   const IccfProofTxMaterialBuilder_1 = requireIccfProofTxMaterialBuilder();
-  const logger2 = __importStar2(logger$3);
+  const logger3 = __importStar2(logger$3);
   const formatter_12 = formatter;
   const serialization_12 = serialization$2;
   const gtxTool = __importStar2(gtx$1);
@@ -42240,7 +42301,7 @@ function requireBlockchainClient() {
         },
         signTransaction(transaction, signMethod2, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            logger2.debug(`Signing transaction with ${!(0, utils_12.isKeyPair)(signMethod2) ? "signature provider containing " : ""}pubKey: ${(0, formatter_12.toString)(signMethod2.pubKey)}`);
+            logger3.debug(`Signing transaction with ${!(0, utils_12.isKeyPair)(signMethod2) ? "signature provider containing " : ""}pubKey: ${(0, formatter_12.toString)(signMethod2.pubKey)}`);
             const gtx2 = (0, utils_12.getGTXFromBufferOrTransactionOrOperation)(transaction, config2.blockchainRid);
             try {
               const signedTx = yield (0, utils_12.isKeyPair)(signMethod2) ? gtxTool.sign(gtx2, signMethod2.privKey, config2.merkleHashVersion, signMethod2.pubKey) : gtxTool.sign(gtx2, signMethod2, config2.merkleHashVersion);
@@ -42265,7 +42326,7 @@ function requireBlockchainClient() {
           const promiEvent = new promiEvents_12.Web3PromiEvent((resolve2, reject) => __awaiter2(this, void 0, void 0, function* () {
             let error4 = null;
             for (let i = 0; i < config2.retryTransactionPolling.count; i++) {
-              logger2.info(`sendTransactionWithRetries attempt ${i + 1} of ${config2.retryTransactionPolling.count}`);
+              logger3.info(`sendTransactionWithRetries attempt ${i + 1} of ${config2.retryTransactionPolling.count}`);
               const tmpPromiEvent = sendOnce().on(enums_12.TransactionEvent.ClusterAnchoringConfirmation, (receipt) => {
                 promiEvent.emit(enums_12.TransactionEvent.ClusterAnchoringConfirmation, receipt);
               }).on(enums_12.TransactionEvent.SystemAnchoringConfirmation, (receipt) => {
@@ -42277,7 +42338,7 @@ function requireBlockchainClient() {
               }).on(enums_12.TransactionEvent.DappConfirmed, (receipt) => {
                 promiEvent.emit(enums_12.TransactionEvent.DappConfirmed, receipt);
               }).catch((tmpError) => {
-                logger2.warning(`sendTransactionWithRetries error on attempt ${i + 1} of ${config2.retryTransactionPolling.count}: ${tmpError}`);
+                logger3.warning(`sendTransactionWithRetries error on attempt ${i + 1} of ${config2.retryTransactionPolling.count}: ${tmpError}`);
                 promiEvent.emit(enums_12.TransactionEvent.Rejected, tmpError);
                 error4 = tmpError;
               });
@@ -43012,11 +43073,11 @@ function requireDecodeTransactionToGtx() {
   Object.defineProperty(decodeTransactionToGtx, "__esModule", { value: true });
   decodeTransactionToGtx.decodeTransactionToGtx = decodeTransactionToGtx$1;
   const gtxTool = __importStar2(gtx$1);
-  const logger2 = __importStar2(logger$3);
+  const logger3 = __importStar2(logger$3);
   const dump_1 = requireDump();
   function decodeTransactionToGtx$1(encodedTransaction) {
     const gtx2 = gtxTool.deserialize(encodedTransaction);
-    logger2.debug(`Output from deserializing a raw transaction: ${(0, dump_1.dumpGtv)(gtx2)}`);
+    logger3.debug(`Output from deserializing a raw transaction: ${(0, dump_1.dumpGtv)(gtx2)}`);
     return gtx2;
   }
   return decodeTransactionToGtx;
@@ -43233,17 +43294,11 @@ var index = /* @__PURE__ */ getDefaultExportFromCjs(builtExports);
 
 // src-ts/browser/native.ts
 var { Buffer: Buffer3, gtx: pcgtx } = index;
-var DEV_ENDPOINT = "https://chromia-verified-ai-dev-two.vercel.app";
-var DEV_BLOCKCHAIN_RID = "02668C5218871F69A93CC0F7032DCFFE06EF0D35EF2F0B07A92A3D83A3F23A7D";
-var DEV_PRIVATE_BLOCKCHAIN_RID = "2603569AE8DC3F254323F719C8D4347BBA964E874E781291F8474236BE8B6493";
-var DEFAULT_CHROMIA_NODE_URLS_ARR = [
-  "https://node0.testnet.chromia.com:7740",
-  "https://node1.testnet.chromia.com:7740",
-  "https://node3.testnet.chromia.com:7740"
-];
-var DEFAULT_PRIVATE_NODE_URLS_ARR = [
-  "https://node0-pvn-testnet.dynamic.chromia.dev"
-];
+var ATBASH_ENDPOINT = "https://atbash.ai";
+var ATBASH_BLOCKCHAIN_RID = "0163241D9AF137638E63E48EFCDE15510F38C2426F7AD5DC726AF60351BF4DFE";
+var ATBASH_PRIVATE_BLOCKCHAIN_RID = "39FFD3557D0296CB2C57FDC6A3B8C024E95639CF4964DA08141AC20C6344D408";
+var DEFAULT_CHROMIA_NODE_URLS_ARR = define_ATBASH_CHROMIA_NODE_URLS_default;
+var DEFAULT_PRIVATE_NODE_URLS_ARR = define_ATBASH_PRIVATE_NODE_URLS_default;
 var MERKLE_HASH_VERSION = 2;
 function stripHex(s2) {
   return s2.trim().replace(/^0x/i, "").toLowerCase();
@@ -43394,15 +43449,23 @@ var native = {
   deriveMemoryKey,
   encryptMemoryContent,
   decryptMemoryContent,
-  DEFAULT_BLOCKCHAIN_RID: DEV_BLOCKCHAIN_RID,
-  DEFAULT_PRIVATE_BLOCKCHAIN_RID: DEV_PRIVATE_BLOCKCHAIN_RID,
-  DEFAULT_ENDPOINT: DEV_ENDPOINT,
-  // Browser has no NAPI channel to Rust's HONEYCOMB_KEY — telemetry
-  // silently no-ops. `HONEYCOMB_API_KEY` env var still overrides at runtime.
-  HONEYCOMB_KEY: "",
+  DEFAULT_BLOCKCHAIN_RID: ATBASH_BLOCKCHAIN_RID,
+  DEFAULT_PRIVATE_BLOCKCHAIN_RID: ATBASH_PRIVATE_BLOCKCHAIN_RID,
+  DEFAULT_ENDPOINT: ATBASH_ENDPOINT,
   defaultChromiaNodeUrls: () => [...DEFAULT_CHROMIA_NODE_URLS_ARR],
   defaultPrivateNodeUrls: () => [...DEFAULT_PRIVATE_NODE_URLS_ARR],
   // Server-only surfaces — throw at runtime, keep types satisfied.
+  // The memory signers are here and not with the other signing shims because
+  // their args are encrypted by `encryptMemoryContent`, which this build does
+  // not have: a browser could sign the transaction but never produce one worth
+  // sending.
+  signAddAgentMemory: stub("signAddAgentMemory"),
+  signRollbackAgentMemory: stub("signRollbackAgentMemory"),
+  extractMemoryEdits: stub("extractMemoryEdits"),
+  applyMemoryEdits: stub("applyMemoryEdits"),
+  memorySlotForPath: stub("memorySlotForPath"),
+  isSafeMemorySlot: stub("isSafeMemorySlot"),
+  defaultAgentHomeDirs: stub("defaultAgentHomeDirs"),
   classifyMemoryWrite: stub("classifyMemoryWrite"),
   classifyMemoryRead: stub("classifyMemoryRead"),
   defaultMemoryWriteToolNames: stub("defaultMemoryWriteToolNames"),
@@ -43426,9 +43489,10 @@ var native = {
   validateMemoryId: stub("validateMemoryId"),
   validateRollbackReason: stub("validateRollbackReason"),
   validateMemoryNonce: stub("validateMemoryNonce"),
+  validateFilePath: stub("validateFilePath"),
   buildGetActiveMemoryIdQuery: stub("buildGetActiveMemoryIdQuery"),
-  buildGetAgentMemoryQuery: stub("buildGetAgentMemoryQuery"),
-  buildGetAllAgentMemoryQuery: stub("buildGetAllAgentMemoryQuery"),
+  buildGetRecentAgentMemoryQuery: stub("buildGetRecentAgentMemoryQuery"),
+  buildGetActiveAgentMemoryQuery: stub("buildGetActiveAgentMemoryQuery"),
   buildGetAgentMemoryHistoryQuery: stub("buildGetAgentMemoryHistoryQuery"),
   buildGetAgentMemoryRollbackHistoryQuery: stub("buildGetAgentMemoryRollbackHistoryQuery"),
   buildGetAgentMemoryByIdQuery: stub("buildGetAgentMemoryByIdQuery"),
@@ -43447,16 +43511,23 @@ var native = {
   OP_ROLLBACK_AGENT_MEMORY: "rollback_agent_memory",
   OP_LOG_ENCRYPTED_TOOL_CALL: "log_encrypted_tool_call",
   QUERY_GET_ACTIVE_MEMORY_ID: "get_active_memory_id",
-  QUERY_GET_AGENT_MEMORY: "get_agent_memory",
-  QUERY_GET_ALL_AGENT_MEMORY: "get_all_agent_memory",
+  QUERY_GET_RECENT_AGENT_MEMORY: "get_recent_agent_memory",
+  QUERY_GET_ACTIVE_AGENT_MEMORY: "get_active_agent_memory",
   QUERY_GET_AGENT_MEMORY_HISTORY: "get_agent_memory_history",
   QUERY_GET_AGENT_MEMORY_BY_ID: "get_agent_memory_by_id",
   QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY: "get_agent_memory_rollback_history",
   ARG_AGENT_PUBKEY: "agent_pubkey",
-  ARG_ID: "id"
+  ARG_ID: "id",
+  ARG_FILE_PATH: "file_path"
 };
 
+// src-ts/client.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/random.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function randomBytes4(size) {
   const buf = new Uint8Array(size);
   globalThis.crypto.getRandomValues(buf);
@@ -43471,7 +43542,39 @@ function randomHex(size) {
   return hex;
 }
 
+// src-ts/auth-bearer.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var BEARER_TTL_MS = 4 * 60 * 1e3;
+var bearers = /* @__PURE__ */ new Map();
+function agentAuthBearer(auth, blockchainRid) {
+  const key3 = `${auth.pubkey}:${blockchainRid}`;
+  const now = Date.now();
+  const cached = bearers.get(key3);
+  if (cached && now - cached.issuedAt < BEARER_TTL_MS) return cached.hex;
+  const hex = native.signLogToolCall(
+    `auth-${now.toString(36)}-${randomHex(4)}`,
+    `auth:${now}`,
+    "",
+    "auth-bearer",
+    "",
+    auth.privkey,
+    blockchainRid
+  );
+  bearers.set(key3, { hex, issuedAt: now });
+  return hex;
+}
+function agentAuthHeaders(auth, blockchainRid) {
+  return { Authorization: `Bearer ${agentAuthBearer(auth, blockchainRid)}` };
+}
+
+// src-ts/chain-config.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/constants.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
 var DEFAULT_CHROMIA_NODE_URLS = Object.freeze(
   native.defaultChromiaNodeUrls()
@@ -43493,8 +43596,21 @@ var PRIVATE_CHAIN = {
   blockchainRid: DEFAULT_PRIVATE_BLOCKCHAIN_RID,
   nodeUrls: DEFAULT_PRIVATE_NODE_URLS
 };
+function chainForNetwork(network) {
+  return network === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+}
+
+// src-ts/browser/encrypted-toolcall.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// src-ts/browser/crypto-ecies.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/hkdf.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function extract(hash3, ikm, salt) {
   ahash(hash3);
   if (salt === void 0)
@@ -43534,7 +43650,17 @@ function expand2(hash3, prk, info2, length = 32) {
 }
 var hkdf = (hash3, ikm, salt, info2, length) => expand2(hash3, extract(hash3, ikm, salt), info2, length);
 
+// node_modules/@noble/ciphers/aes.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/ciphers/_polyval.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/ciphers/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -44126,6 +44252,46 @@ function encryptedLength(plaintextByteLength) {
   return HEADER_LEN + plaintextByteLength + GCM_TAG_LEN;
 }
 
+// src-ts/crypto/envelope.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var PREFIX = "atb1";
+var SEPARATOR = ".";
+function toBase64(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary);
+}
+function fromBase64(text) {
+  const binary = atob(text);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+function packEnvelope(payload, keyFingerprint = "", claimHash = "") {
+  return [PREFIX, keyFingerprint, claimHash, toBase64(payload)].join(SEPARATOR);
+}
+function fieldWidthOk(value, hexChars) {
+  return value.length === 0 ? true : value.length === hexChars && /^[0-9a-f]+$/.test(value);
+}
+function isEnvelope(value) {
+  if (typeof value !== "string" || !value.startsWith(PREFIX + SEPARATOR)) return false;
+  const parts = value.split(SEPARATOR);
+  return parts.length >= 4 && fieldWidthOk(parts[1], 16) && fieldWidthOk(parts[2], 64);
+}
+function parseEnvelope(value) {
+  if (!isEnvelope(value)) return null;
+  const [, keyFingerprint, claimHash, ...rest] = value.split(SEPARATOR);
+  try {
+    return { keyFingerprint, claimHash, payload: fromBase64(rest.join(SEPARATOR)) };
+  } catch {
+    return null;
+  }
+}
+function keyFingerprintOf(pubKeyHex) {
+  return pubKeyHex.trim().replace(/^0x/i, "").toLowerCase().slice(0, 16);
+}
+
 // src-ts/browser/encrypted-toolcall.ts
 var { Buffer: PolyBuffer, gtx: pcgtx2 } = index;
 var MERKLE_HASH_VERSION2 = 2;
@@ -44138,6 +44304,9 @@ function claimHashHex(toolName, action, context, toolArgsJson) {
   ]);
   return bytesToHex2(sha256(new TextEncoder().encode(canonical)));
 }
+function columnAad(toolCallId, column) {
+  return `${toolCallId}:${column}`;
+}
 function normalizeActionForHash(action) {
   action = action.trim();
   try {
@@ -44183,31 +44352,34 @@ function signOpWithBytes(opName, args, privkeyHex, blockchainRidHex) {
   return pcgtx2.serialize(g).toString("hex");
 }
 function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJson, orgEncryptionPubKey, privkeyHex, blockchainRidHex) {
-  const plaintext = {
-    tool_name: toolName,
-    action,
-    context,
-    tool_args_json: toolArgsJson
-  };
-  const contentCipher = encryptForOrg(
-    JSON.stringify(plaintext),
-    orgEncryptionPubKey,
-    toolCallId,
-    EciesDomain.toolCall
+  const fingerprint = keyFingerprintOf(orgEncryptionPubKey);
+  const seal = (text, column) => text === "" ? "" : packEnvelope(
+    encryptForOrg(
+      text,
+      orgEncryptionPubKey,
+      columnAad(toolCallId, column),
+      EciesDomain.toolCall
+    ),
+    fingerprint
   );
-  const actionHash = bytesToHex2(
-    sha256(new TextEncoder().encode(normalizeActionForHash(action)))
+  const actionColumn = packEnvelope(
+    encryptForOrg(
+      action,
+      orgEncryptionPubKey,
+      columnAad(toolCallId, "action"),
+      EciesDomain.toolCall
+    ),
+    fingerprint,
+    claimHashHex(toolName, action, context, toolArgsJson)
   );
   return signOpWithBytes(
-    "log_encrypted_tool_call",
+    "log_tool_call",
     [
       toolCallId,
+      actionColumn,
+      seal(context, "context"),
       toolName,
-      contentCipher,
-      actionHash,
-      // Empty = "org's current key"; chain resolves it.
-      PolyBuffer.from(new Uint8Array(0)),
-      claimHashHex(toolName, action, context, toolArgsJson)
+      seal(toolArgsJson, "tool_args")
     ],
     privkeyHex,
     blockchainRidHex
@@ -44215,11 +44387,23 @@ function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJs
 }
 
 // src-ts/endpoint.ts
-var ALLOWED_JUDGE_HOSTS = /* @__PURE__ */ new Set([
-  "atbash.ai",
-  "www.atbash.ai",
-  "chromia-verified-ai-dev-two.vercel.app"
-]);
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+function buildAllowedJudgeHosts() {
+  return /* @__PURE__ */ new Set([
+    "atbash.ai",
+    "www.atbash.ai",
+    new URL(DEFAULT_ENDPOINT).hostname.toLowerCase()
+  ]);
+}
+var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -44262,16 +44446,30 @@ function validateJudgeEndpoint(judge) {
 }
 
 // src-ts/errors.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var AtbashAPIError = class extends Error {
   /** HTTP status code (or 0 if the request never completed). */
   status;
   /** Raw response body text (may be empty). */
   body;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
-    super(enrich(status, body, statusText, endpoint));
+  /**
+   * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+   * request never reached a response (transport failures carry status 0).
+   *
+   * A status alone does not say what failed. Several routes answer one call, and
+   * more than one of them can 404: a caller reading only `404` cannot tell "this
+   * agent is not registered" from "the chain-routing lookup did not resolve", and
+   * has to guess from the body's prose — which a 404 raised before any handler
+   * ran does not carry. The path is the fact that settles it.
+   */
+  path;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path3) {
+    super(enrich(status, body, statusText, endpoint, path3));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
+    this.path = path3;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -44280,9 +44478,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint) {
+function enrich(status, body, statusText, endpoint, path3) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}: ${body || statusText}`;
+  let msg = `API error ${status}${path3 ? ` from ${path3}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -44304,6 +44502,8 @@ function enrich(status, body, statusText, endpoint) {
 }
 
 // src-ts/http/client.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var HttpClient = class {
   baseUrl;
   timeoutMs;
@@ -44336,11 +44536,80 @@ var HttpClient = class {
     });
   }
   async fetch(url, init4) {
-    return fetch(url, { ...init4, signal: AbortSignal.timeout(this.timeoutMs) });
+    try {
+      return await fetch(url, {
+        ...init4,
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (err) {
+      throw classifyTransportError(err, url, init4.method ?? "GET", this.timeoutMs);
+    }
+  }
+};
+var HttpTransportError = class extends Error {
+  kind;
+  constructor(kind, message, options) {
+    super(message, options);
+    this.name = "HttpTransportError";
+    this.kind = kind;
   }
 };
+function classifyTransportError(err, url, method, timeoutMs) {
+  const name2 = err instanceof Error ? err.name : "";
+  const cause = err instanceof Error ? err.cause : void 0;
+  const code2 = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : "";
+  if (name2 === "TimeoutError") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} did not respond within ${timeoutMs} ms \u2014 the judge may be slow to boot or the LLM is under load; retry in a moment`,
+      { cause: err }
+    );
+  }
+  if (name2 === "AbortError") {
+    return new HttpTransportError(
+      "aborted",
+      `${method} ${url} was cancelled by the caller`,
+      { cause: err }
+    );
+  }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
+    return new HttpTransportError(
+      "dns",
+      `could not resolve the judge hostname (${url}) \u2014 check the endpoint and DNS`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ECONNREFUSED") {
+    return new HttpTransportError(
+      "connect_refused",
+      `judge refused the connection (${url}) \u2014 the service may be down or restarting`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ECONNRESET" || code2 === "EPIPE") {
+    return new HttpTransportError(
+      "connection_reset",
+      `judge dropped the connection mid-request (${url}) \u2014 retry once`,
+      { cause: err }
+    );
+  }
+  return new HttpTransportError(
+    "unknown",
+    `${method} ${url} failed: ${err instanceof Error ? err.message : String(err)}`,
+    { cause: err }
+  );
+}
 
 // src-ts/browser/keyLoader.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE = "keyLoader is not available in the browser bundle \u2014 pass `agentKey` explicitly to Atbash.fromConfig or use `new Atbash(privkey, opts)`.";
 function resolveKeyPath(_input) {
   throw new Error(NOT_AVAILABLE);
@@ -44349,17 +44618,36 @@ function loadAgentFromFile(_keyPath) {
   throw new Error(NOT_AVAILABLE);
 }
 
+// src-ts/decision.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/normalize.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+function wireText(raw2, fallback = "") {
+  if (raw2 === null || raw2 === void 0) return fallback;
+  if (typeof raw2 === "object" || typeof raw2 === "function") return fallback;
+  return String(raw2);
+}
+function wireNumber(raw2, fallback = 0) {
+  if (raw2 === null || raw2 === void 0) return fallback;
+  if (typeof raw2 === "object" || typeof raw2 === "function") return fallback;
+  return Number(raw2);
+}
 function normalizeVerdict(raw2) {
   if (raw2 === null || raw2 === void 0) return "No verdict";
-  const v = String(raw2).toUpperCase();
+  const v = wireText(raw2).trim().toUpperCase();
   if (v === "ALLOW" || v === "GREEN") return "ALLOW";
   if (v === "HOLD" || v === "YELLOW") return "HOLD";
   if (v === "BLOCK" || v === "RED") return "BLOCK";
   return "HOLD";
 }
+function normalizeActionType(raw2) {
+  return typeof raw2 === "string" ? raw2.trim().toLowerCase() : "";
+}
 function normalizeStatus(raw2) {
-  const s2 = String(raw2 ?? "").toLowerCase();
+  const s2 = wireText(raw2).toLowerCase();
   if (s2 === "pending" || s2 === "answered" || s2 === "error") return s2;
   return "error";
 }
@@ -44374,7 +44662,137 @@ function pubkeyToHex(val) {
   return "";
 }
 
+// src-ts/decision.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function allowSignalsPermit(data) {
+  const signals = [];
+  if (Object.hasOwn(data, "allow")) signals.push(data.allow);
+  if (isRecord(data.decision) && Object.hasOwn(data.decision, "allow")) {
+    signals.push(data.decision.allow);
+  }
+  return signals.length === 0 || signals.every((value) => value === true);
+}
+function explicitRefusal(data) {
+  let hold = false;
+  for (const source of decisionSources(data)) {
+    const verdict = verdictOf(source);
+    if (verdict === "BLOCK" || verdict === "RED") return "BLOCK";
+    if (verdict === "HOLD" || verdict === "YELLOW") hold = true;
+    const actionType = actionTypeOf(source);
+    if (actionType === "block") return "BLOCK";
+    if (actionType === "hold_for_user_confirm") hold = true;
+  }
+  if (!allowSignalsPermit(data)) return "BLOCK";
+  return hold ? "HOLD" : "";
+}
+function decisionSources(data) {
+  return [data, isRecord(data.decision) ? data.decision : {}];
+}
+function verdictOf(source) {
+  return typeof source.verdict === "string" ? source.verdict.trim().toUpperCase() : "";
+}
+function actionTypeRank(actionType) {
+  if (actionType === "block") return 4;
+  if (actionType === "hold_for_user_confirm") return 3;
+  if (actionType === "") return 1;
+  if (actionType === "allow") return 0;
+  return 2;
+}
+function actionTypeOf(source) {
+  let winner = "";
+  for (const key3 of ["action_type", "actionType"]) {
+    const raw2 = source[key3];
+    if (raw2 === void 0 || raw2 === null) continue;
+    const actionType = normalizeActionType(raw2);
+    if (actionTypeRank(actionType) > actionTypeRank(winner)) winner = actionType;
+  }
+  return winner;
+}
+function wireActionType(data) {
+  for (const source of decisionSources(data)) {
+    const actionType = actionTypeOf(source);
+    if (actionType !== "") return actionType;
+  }
+  return "";
+}
+function isAuditTier(data) {
+  const absentVerdict = data.verdict === null || data.verdict === void 0;
+  return absentVerdict && data.status === "logged";
+}
+function isAuditTierBody(data) {
+  return isAuditTier(data);
+}
+function canonicalAllow(data) {
+  if (explicitRefusal(data) !== "") return false;
+  const actionType = wireActionType(data);
+  if (actionType && actionType !== "allow") return false;
+  if (isAuditTier(data)) return true;
+  if (typeof data.verdict !== "string") return false;
+  const verdict = data.verdict.trim().toUpperCase();
+  return verdict === "ALLOW" || verdict === "GREEN";
+}
+
+// src-ts/opentel/events.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var SLOW_MS = 1500;
+var SUCCESS_SAMPLE_RATE = 10;
+var logger2 = null;
+var eventsEnabled = false;
+var sdkVersion = "";
+var eventSource = "sdk";
+var hashAgentKey = null;
+function eventsOptedOut() {
+  const flag = process.env.ATBASH_TELEMETRY_EVENTS_DISABLED?.trim().toLowerCase();
+  return Boolean(flag && ["1", "true", "yes", "on"].includes(flag));
+}
+var SOURCE_SHAPE = /^(?:sdk|cli|plugin:[a-z0-9][a-z0-9._-]{0,31})$/;
+function configureEvents(next, opts = {}) {
+  logger2 = next;
+  eventsEnabled = next !== null && !eventsOptedOut();
+  if (opts.version) sdkVersion = opts.version;
+  if (opts.source && SOURCE_SHAPE.test(opts.source)) eventSource = opts.source;
+  hashAgentKey = opts.hashAgentKey ?? null;
+}
+function eventsAreOn() {
+  return eventsEnabled && logger2 !== null;
+}
+function sampleRateFor(e) {
+  if (e.status === "error") return 1;
+  if (e.durationMs >= SLOW_MS) return 1;
+  return Math.random() < 1 / SUCCESS_SAMPLE_RATE ? SUCCESS_SAMPLE_RATE : 0;
+}
+function recordEvent(e) {
+  if (!eventsAreOn()) return;
+  const sampleRate = sampleRateFor(e);
+  if (sampleRate === 0) return;
+  try {
+    const attributes = {
+      "function.name": e.functionName,
+      "duration_ms": Math.round(e.durationMs),
+      status: e.status,
+      source: eventSource,
+      // Honeycomb reweights counts and percentiles by this. It is per-event
+      // because the sampling is biased by outcome and latency.
+      sampleRate
+    };
+    if (sdkVersion) attributes["sdk.version"] = sdkVersion;
+    if (e.agentPubkey && hashAgentKey) attributes["agent.hash"] = hashAgentKey(e.agentPubkey);
+    if (e.chain) attributes["chain"] = e.chain;
+    if (e.errorClass) attributes["error.class"] = e.errorClass;
+    if (e.errorStatus !== void 0) attributes["error.status"] = e.errorStatus;
+    if (e.errorPath) attributes["error.path"] = e.errorPath;
+    if (e.outcome) attributes["outcome"] = e.outcome;
+    logger2.emit({ body: e.functionName, attributes });
+  } catch {
+  }
+}
+
 // src-ts/browser/opentel/telemetry.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function setupTelemetry(_config) {
 }
 function recordCall(_functionName, _source, _agentPubkey) {
@@ -44387,6 +44805,8 @@ async function shutdownTelemetry() {
 }
 
 // src-ts/browser/userConfig.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE2 = "userConfig file I/O is not available in the browser bundle.";
 function getConfigDir() {
   throw new Error(NOT_AVAILABLE2);
@@ -44403,11 +44823,47 @@ function saveUserConfig(_) {
 function resolve(_key, flagValue) {
   return flagValue ?? "";
 }
+function forcedChainNetwork(flagValue) {
+  return flagValue === "public" || flagValue === "private" ? flagValue : void 0;
+}
+function agentKeyFromEnv() {
+  return "";
+}
+function strandedAgentKey() {
+  return "";
+}
 
 // src-ts/client.ts
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
+function resolveConstructorChain(options) {
+  if (options.chain) return options.chain;
+  const hasNodeUrls = options.nodeUrls !== void 0;
+  const hasBrid = options.blockchainRid !== void 0;
+  if (hasNodeUrls !== hasBrid) {
+    throw new Error(
+      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PUBLIC_CHAIN | PRIVATE_CHAIN` or `network: "public" | "private"`.'
+    );
+  }
+  if (hasNodeUrls && hasBrid) {
+    const brid = options.blockchainRid;
+    const derivedNetwork = options.network ?? (brid === PUBLIC_CHAIN.blockchainRid ? "public" : brid === PRIVATE_CHAIN.blockchainRid ? "private" : "private");
+    return {
+      network: derivedNetwork,
+      blockchainRid: brid,
+      nodeUrls: options.nodeUrls
+    };
+  }
+  return chainForNetwork(options.network ?? forcedChainNetwork() ?? "private");
+}
+function errorDetail(err) {
+  if (!(err instanceof AtbashAPIError)) return {};
+  return {
+    errorStatus: err.status,
+    ...err.path ? { errorPath: err.path } : {}
+  };
+}
 var Atbash = class _Atbash {
   auth;
   endpoint;
@@ -44421,6 +44877,13 @@ var Atbash = class _Atbash {
   orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
+  /** When true (default), an unenforced (audit-tier) answer is refused. */
+  requireEnforcement;
+  /** Overall deadline for one auditToolCall decision, in ms. */
+  decisionTimeoutMs;
+  /** Org key learned from the last agent-exists check, for this agent only. */
+  _orgKeyFromChain = null;
+  debug;
   logger;
   http;
   /**
@@ -44429,28 +44892,114 @@ var Atbash = class _Atbash {
    */
   _chainCache = /* @__PURE__ */ new Map();
   /**
-   * Cached bearer token for risk-engine / insurance read calls. Built
-   * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
-   * server-side replay protection windows never expire it mid-session.
+   * The chain the constructor settled on. Used only where a lookup returns no
+   * answer — see {@link resolveChainFromMap}.
+   */
+  _defaultChain;
+  /**
+   * True when the caller named a chain outright — `chain`, `network`, or the
+   * paired `blockchainRid` + `nodeUrls`.
+   *
+   * Such a client is never re-pointed: not by the migration switch, and not by
+   * where an org turns out to live. Naming a chain is the caller saying "talk
+   * to this one", and silently routing elsewhere would make the argument a
+   * suggestion. A client that names nothing is the one that follows the org.
    */
-  _authBearer = null;
+  _explicitChain;
+  /**
+   * The fleet-wide chain switch, read once at construction. `resolve()` hits
+   * the config file on disk, so re-reading it per call would put a file read
+   * on every judge.
+   */
+  _forcedNetwork;
+  /**
+   * Short-TTL cache for `/api/ai/exists`. The `registered` field is
+   * monotonic (once true, stays true), so most calls in a burst re-fetch
+   * data that hasn't changed. The `org_encryption_pubkey` field CAN change
+   * — an org toggling encryption mid-session — so the TTL is deliberately
+   * short (see `AGENT_EXISTS_TTL_MS`). Keyed by (pubkey, network) so
+   * cross-agent / cross-network calls don't collide.
+   */
+  _agentExistsCache = null;
+  static AGENT_EXISTS_TTL_MS = 5e3;
+  /** Guards `logEnvironmentOnce` — hosts construct several clients. */
+  static environmentLogged = false;
   constructor(privkey, options = {}) {
     this.auth = native.loadAgent(privkey);
-    this.endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-    this.nodeUrls = options.nodeUrls ? [...options.nodeUrls] : DEFAULT_CHROMIA_NODE_URLS;
-    this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
+    const validated = validateJudgeEndpoint(
+      options.verifyPubKey ? {
+        policy: "self-hosted",
+        endpoint: options.endpoint ?? DEFAULT_ENDPOINT,
+        verifyPubKey: options.verifyPubKey
+      } : { endpoint: options.endpoint }
+    );
+    this.endpoint = validated.url;
+    const resolvedChain = resolveConstructorChain(options);
+    this.nodeUrls = [...resolvedChain.nodeUrls];
+    this.blockchainRid = resolvedChain.blockchainRid;
+    this._defaultChain = resolvedChain;
+    this._explicitChain = options.chain !== void 0 || options.network !== void 0 || options.blockchainRid !== void 0 && options.nodeUrls !== void 0;
+    this._forcedNetwork = forcedChainNetwork();
     this.orgName = options.orgName;
-    this.verifyPubKey = options.verifyPubKey;
+    this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
+    this.requireEnforcement = options.requireEnforcement !== false;
+    this.decisionTimeoutMs = options.decisionTimeoutMs ?? DEFAULT_DECISION_TIMEOUT_MS;
+    this.debug = options.debug === true;
     this.logger = options.logger ?? {};
-    this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 3e4);
+    this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 12e4);
+    this.logEnvironmentOnce();
     if (this.endpoint !== DEFAULT_ENDPOINT) {
       this.logger.warn?.("[atbash] running on non-default judge endpoint", {
         endpoint: this.endpoint,
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
+      );
+    }
+  }
+  /**
+   * Say which environment this build talks to, once per process.
+   *
+   * The endpoint and both chain RIDs are compiled in, chosen by the npm tag,
+   * and no configuration repoints a released build. So installing the build
+   * for the wrong environment is invisible: the plugin loads, the hook fires,
+   * and every judge call fails because the agent does not exist on the chain
+   * this build targets. Organisation names are not unique across environments
+   * either, so an org resolving is not evidence the build is right.
+   */
+  logEnvironmentOnce() {
+    if (_Atbash.environmentLogged) return;
+    _Atbash.environmentLogged = true;
+    const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
+    this.logger.info?.(
+      `[atbash] environment \u2014 judge=${this.endpoint} publicChain=${brief(native.DEFAULT_BLOCKCHAIN_RID)} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      {
+        judgeEndpoint: this.endpoint,
+        publicBlockchainRid: native.DEFAULT_BLOCKCHAIN_RID,
+        privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
+        activeBlockchainRid: this.blockchainRid,
+        responseSignatureCheck: Boolean(this.verifyPubKey)
+      }
+    );
   }
   /**
    * Construct from resolved config: explicit overrides → env vars → the
@@ -44460,21 +45009,116 @@ var Atbash = class _Atbash {
    * validated against the trusted allowlist / self-hosted policy; a
    * self-hosted endpoint's `verifyPubKey` becomes the client default.
    */
+  /**
+   * Decide which key this client signs as.
+   *
+   * Most specific wins: a key passed in code, then a key file the host named,
+   * then the environment, then the default key file. `config.json` is absent
+   * from that list on purpose — it is a settings file, writable by anything
+   * that can write the user's home and read by every Atbash integration on the
+   * machine, so letting it name the key meant one stray value silently
+   * re-pointed who each of them signed as.
+   *
+   * A named `keyPath` that does not exist throws rather than falling through.
+   * The caller said which file holds its identity; quietly signing as a
+   * different one is the outcome worth refusing.
+   *
+   * @param options - The `fromConfig` options, read for `agentKey` and `keyPath`.
+   * @returns The resolved agent identity.
+   * @throws When a named key file is missing, or no identity can be found.
+   */
+  static resolveIdentity(options) {
+    if (options.agentKey) return native.loadAgent(options.agentKey);
+    if (options.keyPath) return loadAgentFromFile(options.keyPath);
+    const fromEnv = agentKeyFromEnv();
+    if (fromEnv) return native.loadAgent(fromEnv);
+    try {
+      return loadAgentFromFile();
+    } catch (err) {
+      throw _Atbash.explainStrandedKey(err);
+    }
+  }
+  /**
+   * Add the one thing a machine with no key file needs to hear.
+   *
+   * This is the only path where the operator cannot see what happened: no key
+   * file, and the key they are looking for sits in `config.json`, which no
+   * longer selects the identity. A bare "key file not found" sends them hunting
+   * for a key they already have. Only this branch gets the hint — a caller who
+   * named a `keyPath` is told about that path, where a stranded key is noise.
+   *
+   * @param err - The "key file not found" error from the default lookup.
+   * @returns The same error, or one that also names the key in config.json.
+   */
+  static explainStrandedKey(err) {
+    const stranded = strandedAgentKey();
+    if (!stranded) return err;
+    let identity;
+    try {
+      identity = native.derivePublicKey(stranded);
+    } catch {
+      identity = "(unreadable)";
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return new Error(
+      `${message}
+config.json still holds an "agentKey" (${identity}), but a settings file no longer chooses the signing key. Move it into one of the key files above, or set ATBASH_AGENT_KEY.`
+    );
+  }
+  /**
+   * Say so when `config.json` still holds an agent key.
+   *
+   * Nothing signs with it any more, and silence would leave an operator
+   * believing one identity is in force while another is. The pubkey is named,
+   * not the key, so the line is safe in a log.
+   *
+   * @param logger - The host logger, when one was supplied.
+   */
+  static warnOnStrandedKey(logger3) {
+    const stranded = strandedAgentKey();
+    if (!stranded) return;
+    let identity;
+    try {
+      identity = native.derivePublicKey(stranded);
+    } catch {
+      identity = "(unreadable)";
+    }
+    logger3?.warn?.(
+      `[atbash] "agentKey" in config.json is ignored \u2014 settings do not choose the signing key. It holds ${identity}; this client signs as the key file or ATBASH_AGENT_KEY instead. Move it into the key file, or delete the field, to silence this.`
+    );
+  }
   static fromConfig(options = {}) {
+    const configuredEndpoint = resolve("judgeEndpoint") || void 0;
+    const configuredVerifyPubKey = resolve("judgeVerifyPubKey") || void 0;
+    if (!options.judge && configuredVerifyPubKey && !configuredEndpoint) {
+      throw new Error(
+        "judgeVerifyPubKey / ATBASH_JUDGE_VERIFY_PUBKEY is set but no judge endpoint is configured: set judgeEndpoint / ATBASH_ENDPOINT to the self-hosted judge"
+      );
+    }
     const validated = validateJudgeEndpoint(
-      options.judge ?? { endpoint: resolve("judgeEndpoint") || void 0 }
+      options.judge ?? (configuredVerifyPubKey && configuredEndpoint ? {
+        policy: "self-hosted",
+        endpoint: configuredEndpoint,
+        verifyPubKey: configuredVerifyPubKey
+      } : { endpoint: configuredEndpoint })
     );
-    const agentKey = resolve("agentKey", options.agentKey);
-    const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
-    const blockchainRid = resolve("blockchainRid", options.blockchainRid) || void 0;
+    const auth = _Atbash.resolveIdentity(options);
+    _Atbash.warnOnStrandedKey(options.logger);
     return new _Atbash(auth.privkey, {
       endpoint: validated.url,
-      blockchainRid,
+      chain: options.chain,
+      network: options.network,
+      blockchainRid: options.blockchainRid,
       timeoutMs: options.timeoutMs,
       nodeUrls: options.nodeUrls,
       orgName: options.orgName,
       verifyPubKey: validated.verifyPubKey ?? void 0,
       failClosed: options.failClosed,
+      requireEnforcement: options.requireEnforcement,
+      decisionTimeoutMs: options.decisionTimeoutMs,
+      // ATBASH_DEBUG lets an operator turn diagnostics on without editing a
+      // host's plugin config, which is usually the harder half.
+      debug: options.debug ?? /^(1|true|yes)$/i.test(resolve("debug")),
       logger: options.logger
     });
   }
@@ -44495,17 +45139,41 @@ var Atbash = class _Atbash {
    */
   async checkAgentExists(pubkey, opts) {
     const pk = pubkey ?? this.auth.pubkey;
+    const network = opts?.network;
+    const now = Date.now();
+    const cached = this._agentExistsCache;
+    if (cached && cached.pubkey === pk && cached.network === network && cached.expiresAt > now) {
+      if (pk === this.auth.pubkey) {
+        this._orgKeyFromChain = cached.orgKey;
+      }
+      return cached.registered;
+    }
     return this.track("checkAgentExists", pk, async () => {
       const query = { pubkey: pk };
-      if (opts?.network) query.network = opts.network;
+      if (network) query.network = network;
+      const brid = network ? this.bridFromChainOpts({ network }) : await this.defaultOrgBrid();
       const resp = await this.http.get(
         "/api/ai/exists",
         query,
-        this.authHeaders()
+        this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp);
-      return Boolean(data?.registered);
+      const registered = Boolean(data?.registered);
+      const orgKey = typeof data?.org_encryption_pubkey === "string" && data.org_encryption_pubkey ? data.org_encryption_pubkey : null;
+      if (registered) {
+        this._agentExistsCache = {
+          pubkey: pk,
+          network,
+          expiresAt: Date.now() + _Atbash.AGENT_EXISTS_TTL_MS,
+          registered,
+          orgKey
+        };
+      }
+      if (pk === this.auth.pubkey) {
+        this._orgKeyFromChain = orgKey;
+      }
+      return registered;
     });
   }
   /* ── log_tool_call (sign-only) ─────────────────────────────────────────── */
@@ -44534,8 +45202,8 @@ var Atbash = class _Atbash {
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = this.bridFromChainOpts(options.chainOpts);
-    const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey;
+    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
+    const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
         toolCallId,
@@ -44570,24 +45238,42 @@ var Atbash = class _Atbash {
    * response bytes via the Rust core's `verifySignature`.
    */
   async judgeAction(action, context = "", options = {}) {
-    return this.track(
-      "judgeAction",
-      this.auth.pubkey,
-      () => this._judgeAction(action, context, options)
-    );
+    return this.track("judgeAction", this.auth.pubkey, async () => {
+      try {
+        return await this._judgeAction(action, context, options);
+      } catch (err) {
+        if (!isEncryptionStateMismatch(err)) throw err;
+        this._orgKeyFromChain = null;
+        return await this._judgeAction(action, context, options);
+      }
+    });
   }
   async _judgeAction(action, context, options) {
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
     let chainOpts = options.chainOpts;
-    if (options.orgName) {
-      const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
-      if (mapNetwork) {
-        chainOpts = { network: mapNetwork };
-      } else if (!chainOpts?.blockchainRid) {
-        const resolved = await this.resolveChainFromMap(options.orgName, null);
-        chainOpts = { ...chainOpts, network: resolved.network };
+    if (options.orgName && this._explicitChain) {
+      chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
+    } else if (options.orgName && this.forcedNetwork()) {
+      chainOpts = { network: this.forcedNetwork() };
+    } else if (options.orgName) {
+      const cached = this._chainCache.get(options.orgName);
+      if (cached) {
+        chainOpts = { network: cached.network };
+      } else {
+        const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
+        if (mapNetwork) {
+          const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+          this._chainCache.set(options.orgName, chain);
+          chainOpts = { network: mapNetwork };
+        } else if (!chainOpts?.blockchainRid) {
+          const resolved = await this.resolveChainFromMap(
+            options.orgName,
+            null
+          );
+          chainOpts = { ...chainOpts, network: resolved.network };
+        }
       }
     }
     const brid = this.bridFromChainOpts(chainOpts);
@@ -44599,18 +45285,15 @@ var Atbash = class _Atbash {
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
-    let signedJudgeAction;
-    if (!options.provider) {
-      const judgmentId = generateToolCallId();
-      signedJudgeAction = native.signJudgeAction(
-        judgmentId,
-        action,
-        context || "",
-        "",
-        this.auth.privkey,
-        brid
-      );
-    }
+    const judgmentId = generateToolCallId();
+    const signedJudgeAction = native.signJudgeAction(
+      judgmentId,
+      action,
+      context || "",
+      "",
+      this.auth.privkey,
+      brid
+    );
     const body = {
       tool_call_id: logResult.toolCallId,
       agent_pubkey: this.auth.pubkey,
@@ -44619,9 +45302,8 @@ var Atbash = class _Atbash {
     };
     if (signedJudgeAction) body.signed_judge_action = signedJudgeAction;
     if (context) body.context = context;
-    if (options.provider) body.provider = options.provider;
     if (options.toolName) body.tool_name = options.toolName;
-    if (options.model) body.model = options.model;
+    if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
     let resp;
@@ -44632,44 +45314,28 @@ var Atbash = class _Atbash {
     }
     if (!resp.ok) throw await this.httpError(resp);
     const bodyBytes = Buffer.from(await resp.arrayBuffer());
-    const verifyPubKey = options.verifyPubKey ?? this.verifyPubKey;
+    const verifyPubKey = this.effectiveVerifyKey(options.verifyPubKey);
     if (verifyPubKey !== void 0) {
-      const sig = resp.headers.get("X-Atbash-Signature");
-      if (!sig) {
-        throw new SignatureVerificationError(
-          "missing X-Atbash-Signature header"
-        );
-      }
-      let ok;
-      try {
-        ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
-      } catch (err) {
-        throw new SignatureVerificationError(
-          `signature verification threw: ${errorMessage(err)}`
-        );
-      }
-      if (!ok) {
-        throw new SignatureVerificationError(
-          "signature does not verify against configured verifyPubKey"
-        );
-      }
+      verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
     const data = parseJson(bodyBytes);
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
     return {
       verdict: normalizeVerdict(data.verdict),
-      actionType: String(data.action_type ?? ""),
-      reason: String(data.reason ?? ""),
-      confidence: Number(data.confidence ?? 0),
-      provider: String(data.provider ?? ""),
-      latencyMs: Number(data.latency_ms ?? 0),
-      toolCallId: String(data.tool_call_id ?? logResult.toolCallId),
+      allow: this.executable(data),
+      actionType: normalizeActionType(data.action_type),
+      reason: wireText(data.reason),
+      confidence: wireNumber(data.confidence),
+      provider: wireText(data.provider),
+      latencyMs: wireNumber(data.latency_ms),
+      toolCallId: wireText(data.tool_call_id, logResult.toolCallId),
       onChain: Boolean(data.on_chain),
       enforced: Boolean(data.enforced),
-      enforcementMode: String(data.enforcement_mode ?? ""),
-      status: String(data.status ?? ""),
-      score
+      enforcementMode: wireText(data.enforcement_mode),
+      status: wireText(data.status),
+      score,
+      refusal: explicitRefusal(data)
     };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
@@ -44702,97 +45368,197 @@ var Atbash = class _Atbash {
     }
     try {
       this.logger.info?.("[atbash] judge API called", { tool: toolName });
-      const result = await this.judgeAction(actionText, contextText, {
-        toolName,
-        toolArgsJson: argsJson,
-        orgName: this.orgName,
-        // Passed through unredacted — caller vouches for the contents.
-        resolved: input.resolved
-      });
-      if (result.verdict === "No verdict") {
-        if (result.status !== "logged") {
-          return this.fail(
-            `judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`,
-            result.toolCallId
-          );
-        }
-        return {
-          allow: true,
-          verdict: "ALLOW",
-          reason: result.reason || "audit tier \u2014 request logged on-chain, no AI enforcement",
-          toolCallId: result.toolCallId
-        };
-      }
-      const action = result.actionType;
-      if (action === "block") {
+      const result = await withDeadline(
+        this.judgeAction(actionText, contextText, {
+          toolName,
+          toolArgsJson: argsJson,
+          orgName: this.orgName,
+          // Passed through unredacted — caller vouches for the contents.
+          resolved: input.resolved
+        }),
+        this.decisionTimeoutMs
+      );
+      return this.decide(result);
+    } catch (err) {
+      if (err instanceof SignatureVerificationError) {
+        this.failJudge(errorMessage(err), err);
         return {
           allow: false,
-          verdict: "BLOCK",
-          reason: result.reason,
-          toolCallId: result.toolCallId
+          verdict: "ERROR",
+          reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
-      if (action === "hold_for_user_confirm") {
-        return {
-          allow: false,
-          verdict: "HOLD",
-          reason: result.reason || "held for human confirmation",
-          toolCallId: result.toolCallId
-        };
+      return this.failJudge(errorMessage(err), err);
+    }
+  }
+  /**
+   * The verify key for one call (R4, governor tier-2 review). A per-call key
+   * may only narrow what the client accepts: on a client pinned to a judge
+   * key it must be that same key, never a replacement; on an unpinned client
+   * it adds the check.
+   */
+  effectiveVerifyKey(perCall) {
+    if (perCall === void 0) return this.verifyPubKey;
+    const key3 = perCall.trim().toLowerCase();
+    if (this.verifyPubKey !== void 0 && key3 !== this.verifyPubKey) {
+      throw new SignatureVerificationError(
+        "a per-call verifyPubKey cannot replace the judge key this client is pinned to"
+      );
+    }
+    return key3;
+  }
+  /**
+   * Collapse a judge result into a {@link Decision}. The most restrictive
+   * signal wins (security review 2026-09-30, H1): `action_type`, `verdict`
+   * and the canonical `allow` are each able to deny, and only a result where
+   * all three agree may execute. A present `allow` / `decision.allow` that is
+   * not exactly `true` is the judge declining to grant permission, so it
+   * denies even under `failClosed: false` — that option relaxes *errors*, it
+   * never overrides a refusal.
+   */
+  decide(result) {
+    const toolCallId = result.toolCallId;
+    const deny = (verdict, reason) => ({
+      allow: false,
+      verdict,
+      reason,
+      toolCallId
+    });
+    const notGranted = "the judge response did not grant permission";
+    const held = deny("HOLD", result.reason || "held for human confirmation");
+    const blocked = deny("BLOCK", result.reason || notGranted);
+    if (result.refusal === "BLOCK") return blocked;
+    if (result.verdict === "No verdict") {
+      if (result.actionType === "block") {
+        return blocked;
+      }
+      if (result.actionType === "hold_for_user_confirm") {
+        return held;
+      }
+      if (result.refusal === "HOLD") return held;
+      if (result.status !== "logged") {
+        return this.failJudge(
+          `judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`,
+          void 0,
+          toolCallId
+        );
       }
-      if (action === "allow") {
-        if (result.verdict === "HOLD") {
-          return {
-            allow: false,
-            verdict: "HOLD",
-            reason: result.reason,
-            toolCallId: result.toolCallId
-          };
-        }
-        if (result.verdict === "BLOCK") {
-          return {
-            allow: false,
-            verdict: "BLOCK",
-            reason: result.reason,
-            toolCallId: result.toolCallId
-          };
-        }
+      if (this.requireEnforcement) {
+        this.logger.warn?.(
+          "[atbash] judge did not enforce this action (audit tier) and requireEnforcement is on: denied",
+          { toolCallId }
+        );
         return {
-          allow: true,
-          verdict: "ALLOW",
-          reason: result.reason,
-          toolCallId: result.toolCallId
+          allow: false,
+          verdict: "ERROR",
+          reason: "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
+          toolCallId
         };
       }
-      return this.fail(
-        "unrecognized action_type from judge",
-        result.toolCallId
-      );
-    } catch (err) {
-      const message = errorMessage(err);
-      this.logger.warn?.("[atbash] judge API failed", { reason: message });
-      return this.fail(message);
+      if (result.allow !== true) return deny("BLOCK", notGranted);
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: result.reason || "audit tier \u2014 request logged on-chain, no AI enforcement",
+        toolCallId
+      };
+    }
+    const action = result.actionType;
+    if (action === "block") {
+      return deny("BLOCK", result.reason || "Blocked by your organisation's Atbash policy.");
     }
+    if (action === "hold_for_user_confirm") {
+      return held;
+    }
+    if (result.refusal === "HOLD") return held;
+    if (action === "allow") {
+      if (result.verdict === "HOLD") return held;
+      if (result.verdict === "BLOCK") return blocked;
+      if (result.allow !== true) return deny("BLOCK", notGranted);
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: result.reason,
+        toolCallId
+      };
+    }
+    return this.failJudge(
+      "unrecognized action_type from judge",
+      void 0,
+      toolCallId
+    );
+  }
+  /**
+   * One exit for every judge failure.
+   *
+   * Status and reason go in the *message*, not only in the meta object: hosts
+   * print the message and drop the meta, which is why this read as a bare
+   * "judge API failed" while the judge was answering with a precise reason.
+   * The response body follows only under `debug`, since it can echo the action.
+   */
+  failJudge(reason, cause, toolCallId) {
+    const api2 = cause instanceof AtbashAPIError ? cause : null;
+    const userReason = userFacingReason(reason, api2);
+    const status = api2 ? ` status=${api2.status || "no-response"}` : "";
+    const detail = this.debug ? ` detail=${truncate(reason, 500)}` : "";
+    const body = this.debug && api2?.body ? ` body=${truncate(api2.body, 500)}` : "";
+    this.logger.warn?.(
+      `[atbash] judge API failed \u2014${status} reason=${truncate(userReason, 300)}${detail}${body}`,
+      {
+        reason: userReason,
+        ...api2 ? { status: api2.status } : {},
+        ...this.debug && api2 ? { body: api2.body, detail: reason } : {},
+        endpoint: this.endpoint,
+        ...toolCallId ? { toolCallId } : {}
+      }
+    );
+    return this.fail(userReason, toolCallId);
+  }
+  /**
+   * The canonical permission for a response body under this client's
+   * settings: {@link canonicalAllow}, minus the audit tier when
+   * `requireEnforcement` is on. Never more permissive than `auditToolCall`.
+   */
+  executable(data) {
+    if (!canonicalAllow(data)) return false;
+    return !(this.requireEnforcement && isAuditTierBody(data));
   }
   fail(reason, toolCallId) {
     return { allow: !this.failClosed, verdict: "ERROR", reason, toolCallId };
   }
   /* ── judgment status ───────────────────────────────────────────────────── */
-  async getJudgmentStatus(judgmentId, agentPubkey) {
+  /**
+   * Return the current status of a previously submitted judgment.
+   *
+   * `chainOpts` names which chain the judgment was signed against. The
+   * server's GET /api/v1/judge routes to that chain when the SDK sends
+   * a `brid` query param; without it, the server falls back to public.
+   * Callers on the private chain must pass a `chainOpts` (or configure
+   * the client on the private chain) — otherwise polling a POSTed
+   * judgment on the private chain 404s at the server.
+   */
+  async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
+    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
       const resp = await this.http.get(
         "/api/v1/judge",
-        { tool_call_id: judgmentId, agent_pubkey: pk },
-        this.authHeaders()
+        { tool_call_id: judgmentId, agent_pubkey: pk, brid },
+        this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
-      const data = await this.json(resp) ?? {};
+      const bytes = Buffer.from(await resp.arrayBuffer());
+      if (this.verifyPubKey !== void 0) {
+        verifyResponseSignature(bytes, resp, this.verifyPubKey);
+      }
+      const parsed = tryParseJson(bytes.toString("utf-8"));
+      const data = isRecord2(parsed) ? parsed : {};
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
-        reason: String(data.reason ?? ""),
-        judgmentId: String(data.judgmentId ?? judgmentId),
+        allow: this.executable(data),
+        reason: wireText(data.reason),
+        judgmentId: wireText(data.judgmentId, judgmentId),
         onChain: optBool(data.onChain),
         cached: optBool(data.cached),
         responseTimeMs: optNumber(data.responseTimeMs)
@@ -44804,49 +45570,65 @@ var Atbash = class _Atbash {
     return this.track(
       "getToolCalls",
       void 0,
-      () => this.riskEngineRecords("tool-calls", { limit: maxCount })
+      async () => this.riskEngineRecords(
+        "tool-calls",
+        { limit: maxCount },
+        await this.defaultOrgBrid()
+      )
     );
   }
-  getOrgToolCalls(orgName, maxCount) {
-    return this.track(
-      "getOrgToolCalls",
-      void 0,
-      () => this.riskEngineRecords("org-tool-calls", {
-        org: orgName,
-        limit: maxCount
-      })
-    );
+  async getOrgToolCalls(orgName, maxCount) {
+    return this.track("getOrgToolCalls", void 0, async () => {
+      const brid = await this.bridForOrg(orgName);
+      return this.riskEngineRecords(
+        "org-tool-calls",
+        { org: orgName, limit: maxCount },
+        brid
+      );
+    });
   }
   getAgentToolCalls(agentPubkey, maxCount) {
     return this.track(
       "getAgentToolCalls",
       agentPubkey,
-      () => this.riskEngineRecords("agent-tool-calls", {
-        agent: agentPubkey,
-        limit: maxCount
-      })
+      async () => this.riskEngineRecords(
+        "agent-tool-calls",
+        { agent: agentPubkey, limit: maxCount },
+        await this.defaultOrgBrid()
+      )
     );
   }
   async getToolCallCount() {
     return this.track("getToolCallCount", void 0, async () => {
-      const raw2 = await this.riskEngineGet("tool-call-count", {});
+      const raw2 = await this.riskEngineGet(
+        "tool-call-count",
+        {},
+        await this.defaultOrgBrid()
+      );
       const n = Number(raw2);
       return Number.isFinite(n) ? n : 0;
     });
   }
   async getToolCallFull(toolCallId) {
     return this.track("getToolCallFull", void 0, async () => {
-      const raw2 = await this.riskEngineGet("tool-call-full", {
-        tool_call_id: toolCallId
-      });
-      if (!isRecord(raw2)) return null;
+      const raw2 = await this.riskEngineGet(
+        "tool-call-full",
+        { tool_call_id: toolCallId },
+        await this.defaultOrgBrid()
+      );
+      if (!isRecord2(raw2)) return null;
       return toToolCallFull(raw2);
     });
   }
   async getOrgTierInfo(orgName) {
     return this.track("getOrgTierInfo", void 0, async () => {
-      const raw2 = await this.riskEngineGet("org-tier-info", { org: orgName });
-      if (!isRecord(raw2)) return null;
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "org-tier-info",
+        { org: orgName },
+        brid
+      );
+      if (!isRecord2(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
         tier: String(raw2.tier ?? ""),
@@ -44857,20 +45639,24 @@ var Atbash = class _Atbash {
   }
   async getPendingHeldActions(orgName, maxCount) {
     return this.track("getPendingHeldActions", void 0, async () => {
-      const raw2 = await this.riskEngineGet("pending-held-actions", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "pending-held-actions",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map((item) => toHeldAction(item));
     });
   }
   async getHeldActionReviews(orgName, maxCount) {
     return this.track("getHeldActionReviews", void 0, async () => {
-      const raw2 = await this.riskEngineGet("held-action-reviews", {
-        org: orgName,
-        limit: maxCount
-      });
+      const brid = await this.bridForOrg(orgName);
+      const raw2 = await this.riskEngineGet(
+        "held-action-reviews",
+        { org: orgName, limit: maxCount },
+        brid
+      );
       if (!Array.isArray(raw2)) return [];
       return raw2.map(
         (item) => toHeldActionReview(item)
@@ -44878,19 +45664,29 @@ var Atbash = class _Atbash {
     });
   }
   /* ── risk-engine batched (action-dispatched POST) ──────────────────────── */
-  getAgentDetail(agentPubkey) {
-    return this.track(
-      "getAgentDetail",
-      agentPubkey,
-      () => this.riskEnginePost({ action: "agent-detail-batch", agent: agentPubkey })
-    );
+  async getAgentDetail(agentPubkey, options = {}) {
+    return this.track("getAgentDetail", agentPubkey, async () => {
+      const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
+      return this.riskEnginePost(
+        { action: "agent-detail-batch", agent: agentPubkey },
+        network,
+        brid
+      );
+    });
   }
-  async getAgentPolicy(agentPubkey) {
+  async getAgentPolicy(agentPubkey, options = {}) {
     return this.track("getAgentPolicy", agentPubkey, async () => {
-      const raw2 = await this.riskEnginePost({
-        action: "agent-policy-batch",
-        agent: agentPubkey
-      });
+      const network = await this.resolveAgentLookupNetwork(options);
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
+      const raw2 = await this.riskEnginePost(
+        {
+          action: "agent-policy-batch",
+          agent: agentPubkey
+        },
+        network,
+        brid
+      );
       return {
         policy: String(raw2.policy ?? ""),
         isJailed: Boolean(raw2.is_jailed),
@@ -44905,11 +45701,11 @@ var Atbash = class _Atbash {
       const resp = await this.http.get(
         "/api/insurance",
         { action: "safety-stats" },
-        this.authHeaders()
+        this.authHeaders(await this.defaultOrgBrid())
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
-      if (isRecord(data.data)) return data.data;
+      if (isRecord2(data.data)) return data.data;
       return data;
     });
   }
@@ -44923,8 +45719,9 @@ var Atbash = class _Atbash {
     return this.track("getOrgSubscription", void 0, async () => {
       const params = { org: orgName };
       if (network) params.network = network;
-      const raw2 = await this.riskEngineGet("org-subscription", params);
-      if (!isRecord(raw2)) return null;
+      const brid = network ? this.bridFromChainOpts({ network }) : void 0;
+      const raw2 = await this.riskEngineGet("org-subscription", params, brid);
+      if (!isRecord2(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
   }
@@ -44936,21 +45733,22 @@ var Atbash = class _Atbash {
    * entry (caller falls back to per-chain subscription resolution).
    */
   async getActiveNetworkForOrg(orgName) {
+    let resp;
     try {
-      const resp = await this.http.get(
+      resp = await this.http.get(
         "/api/org-network",
-        { org: orgName },
+        { org: orgName.trim() },
         this.authHeaders()
       );
-      if (resp.status !== 200) return null;
-      const data = await this.json(resp);
-      if (data?.network === "public" || data?.network === "private") {
-        return data.network;
-      }
-      return null;
-    } catch {
-      return null;
+    } catch (err) {
+      throw this.transportError(err);
     }
+    if (resp.status !== 200) throw await this.httpError(resp);
+    const data = await this.json(resp);
+    if (data?.network === "public" || data?.network === "private") {
+      return data.network;
+    }
+    return null;
   }
   /**
    * Resolve which chain an org's actions should run against. Cached
@@ -44959,13 +45757,19 @@ var Atbash = class _Atbash {
    *   2. Per-chain subscription fallback — public + private records
    *      are fetched in parallel, with `is_private_blockchain` and
    *      `assigned_at` reconciling mixed states.
-   * Defaults to the public chain when nothing else resolves.
+   * A lookup that names exactly one chain wins outright. Where it names
+   * neither (a brand-new org) or cannot choose between them, the client's
+   * configured default decides.
    */
   async resolveChainForOrg(orgName) {
-    const cached = this._chainCache.get(orgName);
+    const name2 = orgName.trim();
+    if (this._explicitChain) return this._defaultChain;
+    const forced = this.forcedNetwork();
+    if (forced) return chainForNetwork(forced);
+    const cached = this._chainCache.get(name2);
     if (cached) return cached;
-    const mapNetwork = await this.getActiveNetworkForOrg(orgName);
-    return this.resolveChainFromMap(orgName, mapNetwork);
+    const mapNetwork = await this.getActiveNetworkForOrg(name2);
+    return this.resolveChainFromMap(name2, mapNetwork);
   }
   /**
    * Resolve a chain given an already-fetched `org_networks` map result.
@@ -44981,37 +45785,50 @@ var Atbash = class _Atbash {
       this._chainCache.set(orgName, chain);
       return chain;
     }
-    try {
-      const [pubSub, privSub] = await Promise.all([
-        this.getOrgSubscription(orgName, "public").catch(() => null),
-        this.getOrgSubscription(orgName, "private").catch(() => null)
-      ]);
-      if (pubSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-      if (pubSub && privSub) {
-        const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-        this._chainCache.set(orgName, chain);
-        return chain;
-      }
-      if (pubSub) {
-        this._chainCache.set(orgName, PUBLIC_CHAIN);
-        return PUBLIC_CHAIN;
-      }
-      if (privSub?.is_private_blockchain) {
-        this._chainCache.set(orgName, PRIVATE_CHAIN);
-        return PRIVATE_CHAIN;
-      }
-    } catch {
+    const [pubRes, privRes] = await Promise.allSettled([
+      this.getOrgSubscription(orgName, "public"),
+      this.getOrgSubscription(orgName, "private")
+    ]);
+    const pubSub = pubRes.status === "fulfilled" ? pubRes.value : null;
+    const privSub = privRes.status === "fulfilled" ? privRes.value : null;
+    const failure = pubRes.status === "rejected" ? pubRes.reason : privRes.status === "rejected" ? privRes.reason : null;
+    if (pubSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (pubSub && privSub) {
+      const chain = privSub.assigned_at === pubSub.assigned_at ? this._defaultChain : privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      this._chainCache.set(orgName, chain);
+      return chain;
+    }
+    if (pubSub) {
+      this._chainCache.set(orgName, PUBLIC_CHAIN);
+      return PUBLIC_CHAIN;
     }
-    this._chainCache.set(orgName, PUBLIC_CHAIN);
-    return PUBLIC_CHAIN;
+    if (privSub?.is_private_blockchain) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
+    if (failure) {
+      const detail = failure instanceof Error ? failure.message : String(failure);
+      throw new AtbashAPIError(
+        failure instanceof AtbashAPIError ? failure.status : 0,
+        `could not resolve the chain for org "${orgName}": ${detail}`,
+        "",
+        this.endpoint
+      );
+    }
+    this._chainCache.set(orgName, this._defaultChain);
+    return this._defaultChain;
   }
   /** Drop any cached chain resolutions. Useful in tests. */
   clearChainCache() {
     this._chainCache.clear();
   }
+  /** Drop the short-TTL `/api/ai/exists` cache. Useful in tests. */
+  clearAgentExistsCache() {
+    this._agentExistsCache = null;
+  }
   /* ── internals ─────────────────────────────────────────────────────────── */
   /**
    * Wrap an SDK method body in telemetry — records the call at start
@@ -45025,10 +45842,28 @@ var Atbash = class _Atbash {
     recordCall(name2, void 0, agentPubkey);
     try {
       const result = await fn();
-      recordDuration(name2, performance.now() - start, "success");
+      const durationMs = performance.now() - start;
+      recordDuration(name2, durationMs, "success");
+      recordEvent({
+        functionName: name2,
+        durationMs,
+        status: "success",
+        agentPubkey,
+        chain: this.blockchainRid
+      });
       return result;
     } catch (err) {
-      recordDuration(name2, performance.now() - start, "error");
+      const durationMs = performance.now() - start;
+      recordDuration(name2, durationMs, "error");
+      recordEvent({
+        functionName: name2,
+        durationMs,
+        status: "error",
+        agentPubkey,
+        chain: this.blockchainRid,
+        errorClass: err instanceof Error ? err.constructor.name : typeof err,
+        ...errorDetail(err)
+      });
       throw err;
     }
   }
@@ -45043,6 +45878,21 @@ var Atbash = class _Atbash {
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * Resolve the dashboard chain used by agent metadata/policy reads.
+   * Explicit per-call network overrides win; otherwise use the supplied org
+   * or the client's configured default org. A custom BRID is intentionally
+   * left untouched because it cannot be represented by the dashboard's
+   * public/private query selector.
+   */
+  async resolveAgentLookupNetwork(options) {
+    if (options.chainOpts?.network) return options.chainOpts.network;
+    if (options.chainOpts?.blockchainRid) return void 0;
+    if (this._explicitChain) return this._defaultChain.network;
+    const orgName = options.orgName ?? this.orgName;
+    if (!orgName) return void 0;
+    return (await this.resolveChainForOrg(orgName)).network;
+  }
   /**
    * Get-or-create a Bearer token for dashboard reads. The token is a
    * signed `log_tool_call` op (locally signed, never submitted) — the
@@ -45050,34 +45900,19 @@ var Atbash = class _Atbash {
    * for 4 minutes; refreshed after that so a long-lived client never
    * trips the server's replay window.
    */
-  getAuthBearer() {
-    const now = Date.now();
-    if (this._authBearer && now - this._authBearer.issuedAt < 4 * 60 * 1e3) {
-      return this._authBearer.hex;
-    }
-    const nonce = `auth-${now.toString(36)}-${randomHex(4)}`;
-    const hex = native.signLogToolCall(
-      nonce,
-      `auth:${now}`,
-      "",
-      "auth-bearer",
-      "",
-      this.auth.privkey,
-      this.blockchainRid
-    );
-    this._authBearer = { hex, issuedAt: now };
-    return hex;
+  getAuthBearer(brid) {
+    return agentAuthBearer(this.auth, brid ?? this.blockchainRid);
   }
-  authHeaders() {
-    return { Authorization: `Bearer ${this.getAuthBearer()}` };
+  authHeaders(brid) {
+    return agentAuthHeaders(this.auth, brid ?? this.blockchainRid);
   }
-  async riskEngineGet(action, params) {
+  async riskEngineGet(action, params, brid) {
     let resp;
     try {
       resp = await this.http.get(
         "/api/risk-engine",
         { action, ...params },
-        this.authHeaders()
+        this.authHeaders(brid)
       );
     } catch (err) {
       throw this.transportError(err);
@@ -45085,22 +45920,60 @@ var Atbash = class _Atbash {
     if (resp.status !== 200) throw await this.httpError(resp);
     return this.json(resp);
   }
-  async riskEnginePost(body) {
+  async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      resp = await this.http.post("/api/risk-engine", body, this.authHeaders());
+      const path3 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path3, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    return isRecord(data) ? data : {};
+    return isRecord2(data) ? data : {};
   }
-  async riskEngineRecords(action, params) {
-    const raw2 = await this.riskEngineGet(action, params);
+  async riskEngineRecords(action, params, brid) {
+    const raw2 = await this.riskEngineGet(action, params, brid);
     if (!Array.isArray(raw2)) return [];
     return raw2.map((item) => toToolCallRecord(item));
   }
+  /**
+   * BRID for an org — one round-trip to the map, honoring the client's chain
+   * cache. A "brand-new org" (nothing anywhere names its chain) is not an
+   * error — `resolveChainForOrg` returns the client default for that case and
+   * this helper returns its BRID. A transport failure or non-200 from
+   * `/api/org-network` IS an error and propagates: the caller cannot fall
+   * back to the default chain on outage, because with multi-chain live that
+   * silently reads from the wrong chain. Matches the Python binding's
+   * `_brid_for_org` semantics.
+   */
+  async bridForOrg(orgName) {
+    return (await this.resolveChainForOrg(orgName)).blockchainRid;
+  }
+  /**
+   * BRID for the client's configured default org, if it has one.
+   *
+   * Calls that carry no `orgName` argument are not chain-less: they still
+   * belong to `this.orgName`, and that org lives on exactly one chain. Routing
+   * them by the constructor's chain instead means a client configured
+   * `network: "private"` reads the private chain for an org that lives on
+   * public, and gets an empty answer rather than an error. So where an org is
+   * known the org decides the chain, and the constructor's chain is what is
+   * left when no org is known at all — the order `resolveAgentLookupNetwork`
+   * already applies to agent metadata reads, and the order the dashboard
+   * applies in `resolveChainForWallet`.
+   *
+   * Undefined when there is no default org, so callers keep falling back to
+   * the client default.
+   */
+  /** The switch's chain, unless this client named one of its own. */
+  forcedNetwork() {
+    return this._explicitChain ? void 0 : this._forcedNetwork;
+  }
+  async defaultOrgBrid() {
+    if (this._explicitChain || !this.orgName) return void 0;
+    return this.bridForOrg(this.orgName);
+  }
   async raiseIfError(resp) {
     if (resp.ok) return;
     throw await this.httpError(resp);
@@ -45111,11 +45984,28 @@ var Atbash = class _Atbash {
       resp.status,
       await safeText(resp),
       resp.statusText,
-      this.endpoint
+      this.endpoint,
+      requestPath(resp.url)
     );
   }
-  /** Wrap a *transport* failure (fetch threw, no response) as an AtbashAPIError. */
+  /**
+   * Wrap a transport failure (fetch threw, no response) as an AtbashAPIError.
+   *
+   * `HttpTransportError.kind` names the cause; the message is already
+   * human-readable. `debug` echoes the original exception so operators can
+   * cross-reference with node / undici logs when a class doesn't match.
+   */
   transportError(err) {
+    if (err instanceof HttpTransportError) {
+      if (this.debug) {
+        this.logger.warn?.(`[atbash] transport failed \u2014 kind=${err.kind}`, {
+          kind: err.kind,
+          cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
+          endpoint: this.endpoint
+        });
+      }
+      return new AtbashAPIError(0, err.message, "", this.endpoint);
+    }
     return new AtbashAPIError(0, errorMessage(err), "", this.endpoint);
   }
   async json(resp) {
@@ -45144,6 +46034,66 @@ var Atbash = class _Atbash {
     return native.containsEvasionCharacters(text);
   }
 };
+function userFacingReason(reason, api2) {
+  if (api2 && api2.status > 0) {
+    const where = ` (HTTP ${api2.status}${api2.path ? ` from ${api2.path}` : ""})`;
+    const b = api2.body.toLowerCase();
+    if (b.includes("agent not registered")) {
+      return `Agent not registered with Atbash: onboard it in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("jailed")) {
+      return `This agent is jailed; unjail it in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("agent has no policy") || b.includes("no policy configured")) {
+      return `This agent has no policy; attach one in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("audit tier") || b.includes("verdict disabled") || b.includes("verdict not supported")) {
+      return `The organisation's plan does not include checked decisions${where}.`;
+    }
+    return `The Atbash judge answered with an error${where}, so the action was not approved.`;
+  }
+  const text = api2 ? api2.body || reason : reason;
+  return truncate(text.replace(/https?:\/\/[^\s)]+/g, "the judge"), 300);
+}
+var DEFAULT_DECISION_TIMEOUT_MS = 6e4;
+async function withDeadline(p, ms) {
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(
+        new Error(
+          `The judge did not give a decision within ${Math.round(ms / 1e3)} s, so the action was not approved. Check the network, or raise decisionTimeoutMs.`
+        )
+      ),
+      ms
+    );
+  });
+  p.catch(() => void 0);
+  try {
+    return await Promise.race([p, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function verifyResponseSignature(bodyBytes, resp, verifyPubKey) {
+  const sig = resp.headers.get("X-Atbash-Signature");
+  if (!sig) {
+    throw new SignatureVerificationError("missing X-Atbash-Signature header");
+  }
+  let ok;
+  try {
+    ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
+  } catch (err) {
+    throw new SignatureVerificationError(
+      `signature verification threw: ${errorMessage(err)}`
+    );
+  }
+  if (!ok) {
+    throw new SignatureVerificationError(
+      "signature does not verify against configured verifyPubKey"
+    );
+  }
+}
 function baseToolCall(raw2) {
   return {
     toolCallId: String(raw2.tool_call_id ?? ""),
@@ -45210,15 +46160,17 @@ function coerceOrgSubscription(raw2, orgName) {
     is_active: Boolean(raw2.is_active)
   };
 }
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function optString(v) {
   if (v === null || v === void 0) return void 0;
+  if (typeof v === "object" || typeof v === "function") return void 0;
   return typeof v === "string" ? v : String(v);
 }
 function optNumber(v) {
   if (v === null || v === void 0) return void 0;
+  if (typeof v === "object" || typeof v === "function") return void 0;
   const n = Number(v);
   return Number.isFinite(n) ? n : void 0;
 }
@@ -45237,6 +46189,14 @@ function parseJson(bytes) {
   const parsed = tryParseJson(bytes.toString("utf-8"));
   return parsed === void 0 ? {} : parsed;
 }
+function requestPath(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).pathname || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -45247,6 +46207,10 @@ async function safeText(resp) {
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function isEncryptionStateMismatch(err) {
+  const msg = errorMessage(err);
+  return msg.includes("must be a valid encryption envelope") || msg.includes("must be plaintext");
+}
 function stringifyArgs(args) {
   if (args === null || args === void 0) return "";
   if (typeof args === "string") return args;
@@ -45257,12 +46221,28 @@ function stringifyArgs(args) {
   }
 }
 var MAX_ACTION_LEN = 4e3;
-function truncate(text) {
-  if (text.length <= MAX_ACTION_LEN) return text;
-  return text.slice(0, MAX_ACTION_LEN) + "\u2026";
+function truncate(text, limit = MAX_ACTION_LEN) {
+  if (text.length <= limit) return text;
+  return text.slice(0, limit) + "\u2026";
+}
+
+// src-ts/browser/key-path.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
+var unavailable = (name2) => {
+  throw new Error(`${name2} is not available in the browser bundle`);
+};
+function keyPathCandidates() {
+  return unavailable("keyPathCandidates");
+}
+function chooseKeyPath(_input, _exists) {
+  return unavailable("chooseKeyPath");
 }
 
 // src-ts/redact.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function redactJsonStrings(value) {
   if (typeof value === "string") {
     return native.redactSecrets(value).redacted;
@@ -45281,6 +46261,8 @@ function redactJsonStrings(value) {
 }
 
 // src-ts/signature.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   if (!signatureHex) {
     return { ok: false, reason: "missing X-Atbash-Signature header" };
@@ -45302,7 +46284,26 @@ function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   };
 }
 
+// src-ts/memory/boot-sync-message.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var BOOT_SYNC_HINT = "check the chain endpoint and orgName if the cause above does not explain it";
+function bootSyncFailureLine(cause) {
+  const reason = cause instanceof Error ? cause.message : String(cause);
+  const trimmed = reason.trim();
+  return trimmed ? `[atbash] boot memory sync failed: ${trimmed}` : (
+    // No cause to show: fall back to the advice rather than a bare colon.
+    `[atbash] boot memory sync failed \u2014 ${BOOT_SYNC_HINT}`
+  );
+}
+
+// src-ts/memory/index.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/browser/memory-crypto.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var { Buffer: Buffer4 } = index;
 var HKDF_INFO = new TextEncoder().encode("atbash:memory-encryption");
 var KEY_LEN = 32;
@@ -45377,6 +46378,8 @@ async function decryptMemoryContent2(ciphertext, nonce, key3) {
 }
 
 // src-ts/browser/memory-scan.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG2 = "not available in @atbash/sdk browser bundle \u2014 scan memory server-side";
 async function scanMemory(_entry, _auth, _opts) {
   throw new Error(`scanMemory ${STUB_MSG2}`);
@@ -45386,6 +46389,8 @@ async function scanMemoryBatch(_entries, _auth, _opts) {
 }
 
 // src-ts/browser/memory-chain.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG3 = "not available in @atbash/sdk browser bundle \u2014 commit/rollback memory server-side";
 async function commitMemoryVersion(_plaintext, _auth, _opts) {
   throw new Error(`commitMemoryVersion ${STUB_MSG3}`);
@@ -45393,11 +46398,11 @@ async function commitMemoryVersion(_plaintext, _auth, _opts) {
 async function getActiveMemoryId(_auth, _chainOpts) {
   throw new Error(`getActiveMemoryId ${STUB_MSG3}`);
 }
-async function getActiveMemory(_auth, _chainOpts) {
-  throw new Error(`getActiveMemory ${STUB_MSG3}`);
+async function getRecentAgentMemory(_auth, _chainOpts) {
+  throw new Error(`getRecentAgentMemory ${STUB_MSG3}`);
 }
-async function getAllAgentMemory(_auth, _chainOpts) {
-  throw new Error(`getAllAgentMemory ${STUB_MSG3}`);
+async function getActiveAgentMemory(_auth, _chainOpts) {
+  throw new Error(`getActiveAgentMemory ${STUB_MSG3}`);
 }
 async function getMemoryHistory(_auth, _chainOpts) {
   throw new Error(`getMemoryHistory ${STUB_MSG3}`);
@@ -45413,6 +46418,8 @@ async function rollbackMemory(_toId, _reason, _auth, _opts) {
 }
 
 // src-ts/browser/memory-classifier.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG4 = "not available in @atbash/sdk browser bundle \u2014 classify memory writes server-side";
 var DEFAULT_MEMORY_WRITE_TOOL_NAMES = [
   "write",
@@ -45434,103 +46441,17 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
   throw new Error(`classifyMemoryWrite ${STUB_MSG4}`);
 }
 
-// src-ts/memory/guard.ts
-function emitDebugProbe(event, ctx, memEntry, logger2) {
-  if (!logger2?.info) return;
-  const ev = event ?? {};
-  const c = ctx ?? {};
-  const argsCandidate = ev.params ?? c.params ?? ev.args ?? c.args ?? ev.arguments ?? c.arguments;
-  const argsObj = argsCandidate && typeof argsCandidate === "object" ? argsCandidate : {};
-  const argsKeys = Object.keys(argsObj).slice(0, 20);
-  const pickedPath = typeof argsObj.file_path === "string" && argsObj.file_path || typeof argsObj.path === "string" && argsObj.path || typeof argsObj.filename === "string" && argsObj.filename || null;
-  const editsArr = Array.isArray(argsObj.edits) ? argsObj.edits : null;
-  const firstEditKeys = editsArr && editsArr[0] && typeof editsArr[0] === "object" ? Object.keys(editsArr[0]).slice(0, 10) : null;
-  const tool = ev.toolName ?? c.tool?.name ?? c.toolName ?? c.name ?? "(none)";
-  logger2.info("[atbash][probe] before_tool_call", {
-    toolName: tool,
-    eventKeys: Object.keys(ev).slice(0, 20),
-    ctxKeys: Object.keys(c).slice(0, 20),
-    argsKeys,
-    pickedPath,
-    firstEditKeys,
-    editsCount: editsArr?.length,
-    memoryWrite: !!memEntry,
-    memoryPath: memEntry?.key
-  });
-}
-async function guardMemoryWrite(input) {
-  const {
-    event,
-    ctx,
-    auth,
-    endpoint,
-    verifyPubKey,
-    orgName,
-    threshold,
-    patterns,
-    toolNames,
-    enforce = true,
-    debug: debug2 = false,
-    logger: logger2
-  } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
-  if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
-  if (!memEntry) return { handled: false };
-  let scanResult;
-  try {
-    scanResult = await scanMemory(memEntry, auth, {
-      endpoint,
-      verifyPubKey,
-      orgName,
-      threshold
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory scan failed", {
-      path: memEntry.key,
-      reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason } : { allow: true }
-    };
-  }
-  if (scanResult.verdict === "red") {
-    logger2?.warn?.("[atbash] memory BLOCK", {
-      path: memEntry.key,
-      reason: scanResult.reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason: scanResult.reason } : { allow: true },
-      scanResult,
-      committed: false
-    };
-  }
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    orgName,
-    endpoint
-  }).catch((err) => {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory commit to chain failed", {
-      path: memEntry.key,
-      reason
-    });
-  });
-  logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
-    { path: memEntry.key, score: scanResult.score, reason: scanResult.reason }
-  );
-  return {
-    handled: true,
-    decision: { allow: true },
-    scanResult,
-    committed: true
-  };
+// src-ts/browser/memory-guard.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 guard memory writes agent-side";
+async function guardMemoryWrite(_input) {
+  throw new Error(`guardMemoryWrite ${STUB_MSG5}`);
 }
 
 // src-ts/memory/sync.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var MemoryIntegrityError = class extends Error {
   constructor(id, reason) {
     super(`memory integrity check failed on id ${id}: ${reason}`);
@@ -45545,25 +46466,27 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   const now = Date.now();
   const withinTtl = !opts.force && now - pointer.checkedAt < ttl;
   if (withinTtl) {
-    return { drifted: false, pointer };
+    return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
-    return { drifted: false, pointer: nextPointer };
+    return { drifted: false, checked: true, pointer: nextPointer };
   }
   if (currentId === null) {
-    return { drifted: true, current: null, pointer: nextPointer };
+    return { drifted: true, checked: true, current: null, pointer: nextPointer };
   }
   const row = await getMemoryById(currentId, auth, opts.chainOpts);
   if (row.decryptError) {
     throw new MemoryIntegrityError(currentId, row.decryptError);
   }
-  return { drifted: true, current: row, pointer: nextPointer };
+  return { drifted: true, checked: true, current: row, pointer: nextPointer };
 }
 
 // src-ts/browser/memory-pointer-store.ts
-var unavailable = (name2) => {
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var PointerStore = class {
@@ -45577,32 +46500,38 @@ var PointerStore = class {
   }
 };
 function defaultPointerPath(_workspaceDir) {
-  return unavailable("defaultPointerPath");
+  return unavailable2("defaultPointerPath");
 }
 
 // src-ts/browser/memory-file-logger.ts
-var unavailable2 = (name2) => {
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 function createFileLogger(_logFilePath, _hostLogger) {
-  return unavailable2("createFileLogger");
+  return unavailable3("createFileLogger");
 }
 function defaultPluginLogPath(_workspaceDir) {
-  return unavailable2("defaultPluginLogPath");
+  return unavailable3("defaultPluginLogPath");
 }
 
 // src-ts/browser/memory-read-classifier.ts
-var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var STUB_MSG6 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
   "memory_search",
   "memory_get"
 ];
 function classifyMemoryRead(_event, _ctx, _opts = {}) {
-  throw new Error(`classifyMemoryRead ${STUB_MSG5}`);
+  throw new Error(`classifyMemoryRead ${STUB_MSG6}`);
 }
 
 // src-ts/browser/memory-guard-manager.ts
-var unavailable3 = (name2) => {
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var MemoryGuardManager = class {
@@ -45622,7 +46551,7 @@ var MemoryGuardManager = class {
   }
 };
 function createMemoryGuardManager(_opts) {
-  return unavailable3("createMemoryGuardManager");
+  return unavailable4("createMemoryGuardManager");
 }
 
 // src-ts/index.ts
@@ -45683,6 +46612,7 @@ function diffMemorySnapshots2(before, after) {
 export {
   Atbash,
   AtbashAPIError,
+  BOOT_SYNC_HINT,
   DEFAULT_BLOCKCHAIN_RID,
   DEFAULT_CHROMIA_NODE_URLS,
   DEFAULT_ENDPOINT,
@@ -45690,14 +46620,26 @@ export {
   DEFAULT_MEMORY_READ_TOOL_NAMES,
   DEFAULT_MEMORY_WRITE_TOOL_NAMES,
   EciesDomain,
+  HttpClient,
+  HttpTransportError,
+  KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
+  PRIVATE_CHAIN,
+  PUBLIC_CHAIN,
   PointerStore,
   SignatureVerificationError,
+  bootSyncFailureLine,
+  buildAllowedJudgeHosts,
+  canonicalAllow,
+  chainForNetwork,
+  chooseKeyPath,
   claimHashHex,
   classifyMemoryRead,
   classifyMemoryWrite,
+  columnAad,
   commitMemoryVersion,
+  configureEvents,
   containsEvasionCharacters2 as containsEvasionCharacters,
   containsSecret2 as containsSecret,
   createFileLogger,
@@ -45713,28 +46655,36 @@ export {
   encryptForOrg,
   encryptMemoryContent2 as encryptMemoryContent,
   encryptedLength,
+  eventsAreOn,
   flushTelemetry,
   generateKeypair2 as generateKeypair,
-  getActiveMemory,
+  getActiveAgentMemory,
   getActiveMemoryId,
-  getAllAgentMemory,
   getConfigDir,
   getConfigPath,
   getMemoryById,
   getMemoryHistory,
+  getRecentAgentMemory,
   getRollbackHistory,
   guardMemoryWrite,
+  isEnvelope,
   isValidPrivateKey2 as isValidPrivateKey,
+  keyFingerprintOf,
+  keyPathCandidates,
   loadAgent2 as loadAgent,
   loadAgentFromFile,
   loadUserConfig,
   normalizeActionForHash,
+  normalizeActionType,
   normalizeForMatching2 as normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
+  packEnvelope,
+  parseEnvelope,
   pubkeyToHex,
   recordCall,
   recordDuration,
+  recordEvent,
   redactJsonStrings,
   redactSecrets2 as redactSecrets,
   resolve,
@@ -45775,4 +46725,3 @@ postchain-client/built/esm/index.js:
 @noble/ciphers/utils.js:
   (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=browser.mjs.map