@atbash/sdk 0.12.0-dev.0 → 0.13.0-dev.0

package/dist/index.d.mts

@@ -30,6 +30,15 @@ interface ValidatedEndpoint {
 declare function buildAllowedJudgeHosts(): ReadonlySet<string>;
 declare function validateJudgeEndpoint(judge?: JudgeEndpointConfig): ValidatedEndpoint;
 
+interface ChainConfig {
+    readonly network: Network;
+    readonly blockchainRid: string;
+    readonly nodeUrls: readonly string[];
+}
+declare const PUBLIC_CHAIN: ChainConfig;
+declare const PRIVATE_CHAIN: ChainConfig;
+declare function chainForNetwork(network: Network): ChainConfig;
+
 /**
  * User-facing types. Two groups:
  *  - Core types — the exact shapes the Rust core emits across the NAPI
@@ -290,7 +299,24 @@ interface AtbashLogger {
 interface AtbashOptions {
     endpoint?: string;
     timeoutMs?: number;
+    /**
+     * Full chain override — BRID + nodeUrls in one object. Wins over every
+     * other chain selector. Prefer this over paired `nodeUrls`/`blockchainRid`
+     * for anything but backwards compatibility.
+     */
+    chain?: ChainConfig;
+    /**
+     * Preset chain selector — `"public"` or `"private"`. Resolves to the
+     * matching `ChainConfig` via `chainForNetwork()`. Overridden by `chain`,
+     * overrides env `ATBASH_DEFAULT_CHAIN_NETWORK` and the config file.
+     */
+    network?: Network;
+    /**
+     * Explicit node URLs. Must be paired with `blockchainRid`. Passing one
+     * without the other throws — a BRID/nodes mismatch 404s every request.
+     */
     nodeUrls?: readonly string[];
+    /** Explicit BRID. Must be paired with `nodeUrls`. See {@link nodeUrls}. */
     blockchainRid?: string;
     /**
      * Default org name. When set, `judgeAction` / `auditToolCall` resolve
@@ -357,6 +383,10 @@ interface FromConfigOptions {
     keyPath?: string;
     /** Judge endpoint config — validated against the allowlist / self-hosted policy. */
     judge?: JudgeEndpointConfig;
+    /** See {@link AtbashOptions.chain}. */
+    chain?: ChainConfig;
+    /** See {@link AtbashOptions.network}. */
+    network?: Network;
     blockchainRid?: string;
     timeoutMs?: number;
     nodeUrls?: readonly string[];
@@ -408,12 +438,6 @@ interface LogToolCallOptions {
     orgEncryptionPubKey?: string;
 }
 
-interface ChainConfig {
-    readonly network: Network;
-    readonly blockchainRid: string;
-    readonly nodeUrls: readonly string[];
-}
-
 declare class Atbash {
     readonly auth: AgentAuth;
     readonly endpoint: string;
@@ -437,6 +461,27 @@ declare class Atbash {
      * calls don't re-hit the dashboard. Cleared by `clearChainCache()`.
      */
     private readonly _chainCache;
+    /**
+     * The chain the constructor settled on. Used only where a lookup returns no
+     * answer — see {@link resolveChainFromMap}.
+     */
+    private readonly _defaultChain;
+    /**
+     * True when the caller named a chain outright — `chain`, `network`, or the
+     * paired `blockchainRid` + `nodeUrls`.
+     *
+     * Such a client is never re-pointed: not by the migration switch, and not by
+     * where an org turns out to live. Naming a chain is the caller saying "talk
+     * to this one", and silently routing elsewhere would make the argument a
+     * suggestion. A client that names nothing is the one that follows the org.
+     */
+    private readonly _explicitChain;
+    /**
+     * The fleet-wide chain switch, read once at construction. `resolve()` hits
+     * the config file on disk, so re-reading it per call would put a file read
+     * on every judge.
+     */
+    private readonly _forcedNetwork;
     /**
      * Short-TTL cache for `/api/ai/exists`. The `registered` field is
      * monotonic (once true, stays true), so most calls in a burst re-fetch
@@ -552,7 +597,9 @@ declare class Atbash {
      *   2. Per-chain subscription fallback — public + private records
      *      are fetched in parallel, with `is_private_blockchain` and
      *      `assigned_at` reconciling mixed states.
-     * Defaults to the public chain when nothing else resolves.
+     * A lookup that names exactly one chain wins outright. Where it names
+     * neither (a brand-new org) or cannot choose between them, the client's
+     * configured default decides.
      */
     resolveChainForOrg(orgName: string): Promise<ChainConfig>;
     /**
@@ -606,6 +653,25 @@ declare class Atbash {
      * back to the client default (best-effort discovery).
      */
     private bridForOrg;
+    /**
+     * BRID for the client's configured default org, if it has one.
+     *
+     * Calls that carry no `orgName` argument are not chain-less: they still
+     * belong to `this.orgName`, and that org lives on exactly one chain. Routing
+     * them by the constructor's chain instead means a client configured
+     * `network: "private"` reads the private chain for an org that lives on
+     * public, and gets an empty answer rather than an error. So where an org is
+     * known the org decides the chain, and the constructor's chain is what is
+     * left when no org is known at all — the order `resolveAgentLookupNetwork`
+     * already applies to agent metadata reads, and the order the dashboard
+     * applies in `resolveChainForWallet`.
+     *
+     * Undefined when there is no default org, so callers keep falling back to
+     * the client default.
+     */
+    /** The switch's chain, unless this client named one of its own. */
+    private forcedNetwork;
+    private defaultOrgBrid;
     private raiseIfError;
     /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
     private httpError;
@@ -695,7 +761,14 @@ interface AtbashUserConfig {
      * only way a non-allowlisted judge host is accepted.
      */
     judgeVerifyPubKey?: string;
-    blockchainRid?: string;
+    /**
+     * `"private"` pins every org to the private chain regardless of where the
+     * dashboard says it lives — the migration switch. Leave it unset for the
+     * normal mode, where each org's own chain decides. There is no `"public"`
+     * value; a caller that wants one specific chain passes `chain` or `network`
+     * at construction instead.
+     */
+    defaultChainNetwork?: Network;
     provider?: string;
     providerModel?: string;
     /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
@@ -1398,4 +1471,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.d.ts

@@ -30,6 +30,15 @@ interface ValidatedEndpoint {
 declare function buildAllowedJudgeHosts(): ReadonlySet<string>;
 declare function validateJudgeEndpoint(judge?: JudgeEndpointConfig): ValidatedEndpoint;
 
+interface ChainConfig {
+    readonly network: Network;
+    readonly blockchainRid: string;
+    readonly nodeUrls: readonly string[];
+}
+declare const PUBLIC_CHAIN: ChainConfig;
+declare const PRIVATE_CHAIN: ChainConfig;
+declare function chainForNetwork(network: Network): ChainConfig;
+
 /**
  * User-facing types. Two groups:
  *  - Core types — the exact shapes the Rust core emits across the NAPI
@@ -290,7 +299,24 @@ interface AtbashLogger {
 interface AtbashOptions {
     endpoint?: string;
     timeoutMs?: number;
+    /**
+     * Full chain override — BRID + nodeUrls in one object. Wins over every
+     * other chain selector. Prefer this over paired `nodeUrls`/`blockchainRid`
+     * for anything but backwards compatibility.
+     */
+    chain?: ChainConfig;
+    /**
+     * Preset chain selector — `"public"` or `"private"`. Resolves to the
+     * matching `ChainConfig` via `chainForNetwork()`. Overridden by `chain`,
+     * overrides env `ATBASH_DEFAULT_CHAIN_NETWORK` and the config file.
+     */
+    network?: Network;
+    /**
+     * Explicit node URLs. Must be paired with `blockchainRid`. Passing one
+     * without the other throws — a BRID/nodes mismatch 404s every request.
+     */
     nodeUrls?: readonly string[];
+    /** Explicit BRID. Must be paired with `nodeUrls`. See {@link nodeUrls}. */
     blockchainRid?: string;
     /**
      * Default org name. When set, `judgeAction` / `auditToolCall` resolve
@@ -357,6 +383,10 @@ interface FromConfigOptions {
     keyPath?: string;
     /** Judge endpoint config — validated against the allowlist / self-hosted policy. */
     judge?: JudgeEndpointConfig;
+    /** See {@link AtbashOptions.chain}. */
+    chain?: ChainConfig;
+    /** See {@link AtbashOptions.network}. */
+    network?: Network;
     blockchainRid?: string;
     timeoutMs?: number;
     nodeUrls?: readonly string[];
@@ -408,12 +438,6 @@ interface LogToolCallOptions {
     orgEncryptionPubKey?: string;
 }
 
-interface ChainConfig {
-    readonly network: Network;
-    readonly blockchainRid: string;
-    readonly nodeUrls: readonly string[];
-}
-
 declare class Atbash {
     readonly auth: AgentAuth;
     readonly endpoint: string;
@@ -437,6 +461,27 @@ declare class Atbash {
      * calls don't re-hit the dashboard. Cleared by `clearChainCache()`.
      */
     private readonly _chainCache;
+    /**
+     * The chain the constructor settled on. Used only where a lookup returns no
+     * answer — see {@link resolveChainFromMap}.
+     */
+    private readonly _defaultChain;
+    /**
+     * True when the caller named a chain outright — `chain`, `network`, or the
+     * paired `blockchainRid` + `nodeUrls`.
+     *
+     * Such a client is never re-pointed: not by the migration switch, and not by
+     * where an org turns out to live. Naming a chain is the caller saying "talk
+     * to this one", and silently routing elsewhere would make the argument a
+     * suggestion. A client that names nothing is the one that follows the org.
+     */
+    private readonly _explicitChain;
+    /**
+     * The fleet-wide chain switch, read once at construction. `resolve()` hits
+     * the config file on disk, so re-reading it per call would put a file read
+     * on every judge.
+     */
+    private readonly _forcedNetwork;
     /**
      * Short-TTL cache for `/api/ai/exists`. The `registered` field is
      * monotonic (once true, stays true), so most calls in a burst re-fetch
@@ -552,7 +597,9 @@ declare class Atbash {
      *   2. Per-chain subscription fallback — public + private records
      *      are fetched in parallel, with `is_private_blockchain` and
      *      `assigned_at` reconciling mixed states.
-     * Defaults to the public chain when nothing else resolves.
+     * A lookup that names exactly one chain wins outright. Where it names
+     * neither (a brand-new org) or cannot choose between them, the client's
+     * configured default decides.
      */
     resolveChainForOrg(orgName: string): Promise<ChainConfig>;
     /**
@@ -606,6 +653,25 @@ declare class Atbash {
      * back to the client default (best-effort discovery).
      */
     private bridForOrg;
+    /**
+     * BRID for the client's configured default org, if it has one.
+     *
+     * Calls that carry no `orgName` argument are not chain-less: they still
+     * belong to `this.orgName`, and that org lives on exactly one chain. Routing
+     * them by the constructor's chain instead means a client configured
+     * `network: "private"` reads the private chain for an org that lives on
+     * public, and gets an empty answer rather than an error. So where an org is
+     * known the org decides the chain, and the constructor's chain is what is
+     * left when no org is known at all — the order `resolveAgentLookupNetwork`
+     * already applies to agent metadata reads, and the order the dashboard
+     * applies in `resolveChainForWallet`.
+     *
+     * Undefined when there is no default org, so callers keep falling back to
+     * the client default.
+     */
+    /** The switch's chain, unless this client named one of its own. */
+    private forcedNetwork;
+    private defaultOrgBrid;
     private raiseIfError;
     /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
     private httpError;
@@ -695,7 +761,14 @@ interface AtbashUserConfig {
      * only way a non-allowlisted judge host is accepted.
      */
     judgeVerifyPubKey?: string;
-    blockchainRid?: string;
+    /**
+     * `"private"` pins every org to the private chain regardless of where the
+     * dashboard says it lives — the migration switch. Leave it unset for the
+     * normal mode, where each org's own chain decides. There is no `"public"`
+     * value; a caller that wants one specific chain passes `chain` or `network`
+     * at construction instead.
+     */
+    defaultChainNetwork?: Network;
     provider?: string;
     providerModel?: string;
     /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
@@ -1398,4 +1471,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.js

@@ -2869,10 +2869,13 @@ __export(src_ts_exports, {
   KEY_FILENAMES: () => KEY_FILENAMES,
   MemoryGuardManager: () => MemoryGuardManager,
   MemoryIntegrityError: () => MemoryIntegrityError,
+  PRIVATE_CHAIN: () => PRIVATE_CHAIN,
+  PUBLIC_CHAIN: () => PUBLIC_CHAIN,
   PointerStore: () => PointerStore,
   SignatureVerificationError: () => SignatureVerificationError,
   bootSyncFailureLine: () => bootSyncFailureLine,
   buildAllowedJudgeHosts: () => buildAllowedJudgeHosts,
+  chainForNetwork: () => chainForNetwork,
   chooseKeyPath: () => chooseKeyPath,
   claimHashHex: () => claimHashHex,
   classifyMemoryRead: () => classifyMemoryRead,
@@ -3394,11 +3397,34 @@ var ENV_MAP = {
   judgeEndpoint: "ATBASH_ENDPOINT",
   // Same variable name the Hermes plugin already documents.
   judgeVerifyPubKey: "ATBASH_JUDGE_VERIFY_PUBKEY",
-  blockchainRid: "ATBASH_BLOCKCHAIN_RID",
+  defaultChainNetwork: "ATBASH_DEFAULT_CHAIN_NETWORK",
   provider: "ATBASH_PROVIDER",
   providerModel: "ATBASH_PROVIDER_MODEL",
   debug: "ATBASH_DEBUG"
 };
+var DEPRECATED_ENV_VARS = ["ATBASH_BLOCKCHAIN_RID"];
+var DEPRECATED_CONFIG_FIELDS = ["blockchainRid"];
+var deprecatedWarned = false;
+function warnDeprecatedEnvVarsOnce(log = console.warn) {
+  if (deprecatedWarned) return;
+  for (const name2 of DEPRECATED_ENV_VARS) {
+    if (process.env[name2]) {
+      deprecatedWarned = true;
+      log(
+        `[atbash] ${name2} is ignored \u2014 each org's chain is resolved from the dashboard; set ATBASH_DEFAULT_CHAIN_NETWORK=private only to pin everything to private`
+      );
+    }
+  }
+  const fileConfig = loadUserConfig();
+  for (const field of DEPRECATED_CONFIG_FIELDS) {
+    if (fileConfig[field]) {
+      deprecatedWarned = true;
+      log(
+        `[atbash] "${field}" in ${getConfigPath()} is ignored \u2014 pass \`chain\` or \`network\` at construction instead`
+      );
+    }
+  }
+}
 function getConfigDir() {
   const home2 = process.env.HOME || (0, import_node_os3.homedir)() || "";
   return (0, import_node_path3.join)(home2, ".config", "atbash");
@@ -3440,11 +3466,41 @@ function resolve(key3, flagValue) {
   if (fileVal != null) return String(fileVal);
   return "";
 }
+function forcedChainNetwork(flagValue) {
+  const raw2 = resolve("defaultChainNetwork", flagValue);
+  if (!raw2) return void 0;
+  if (raw2 !== "public" && raw2 !== "private") {
+    throw new Error(
+      `ATBASH_DEFAULT_CHAIN_NETWORK / defaultChainNetwork must be "public" or "private", got ${JSON.stringify(raw2)} \u2014 unset it to let each org's chain decide.`
+    );
+  }
+  return raw2;
+}
 
 // src-ts/client.ts
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
+function resolveConstructorChain(options) {
+  if (options.chain) return options.chain;
+  const hasNodeUrls = options.nodeUrls !== void 0;
+  const hasBrid = options.blockchainRid !== void 0;
+  if (hasNodeUrls !== hasBrid) {
+    throw new Error(
+      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PUBLIC_CHAIN | PRIVATE_CHAIN` or `network: "public" | "private"`.'
+    );
+  }
+  if (hasNodeUrls && hasBrid) {
+    const brid = options.blockchainRid;
+    const derivedNetwork = options.network ?? (brid === PUBLIC_CHAIN.blockchainRid ? "public" : brid === PRIVATE_CHAIN.blockchainRid ? "private" : "private");
+    return {
+      network: derivedNetwork,
+      blockchainRid: brid,
+      nodeUrls: options.nodeUrls
+    };
+  }
+  return chainForNetwork(options.network ?? forcedChainNetwork() ?? "private");
+}
 var Atbash = class _Atbash {
   auth;
   endpoint;
@@ -3468,6 +3524,27 @@ var Atbash = class _Atbash {
    * calls don't re-hit the dashboard. Cleared by `clearChainCache()`.
    */
   _chainCache = /* @__PURE__ */ new Map();
+  /**
+   * The chain the constructor settled on. Used only where a lookup returns no
+   * answer — see {@link resolveChainFromMap}.
+   */
+  _defaultChain;
+  /**
+   * True when the caller named a chain outright — `chain`, `network`, or the
+   * paired `blockchainRid` + `nodeUrls`.
+   *
+   * Such a client is never re-pointed: not by the migration switch, and not by
+   * where an org turns out to live. Naming a chain is the caller saying "talk
+   * to this one", and silently routing elsewhere would make the argument a
+   * suggestion. A client that names nothing is the one that follows the org.
+   */
+  _explicitChain;
+  /**
+   * The fleet-wide chain switch, read once at construction. `resolve()` hits
+   * the config file on disk, so re-reading it per call would put a file read
+   * on every judge.
+   */
+  _forcedNetwork;
   /**
    * Short-TTL cache for `/api/ai/exists`. The `registered` field is
    * monotonic (once true, stays true), so most calls in a burst re-fetch
@@ -3500,8 +3577,13 @@ var Atbash = class _Atbash {
       } : { endpoint: options.endpoint }
     );
     this.endpoint = validated.url;
-    this.nodeUrls = options.nodeUrls ? [...options.nodeUrls] : DEFAULT_CHROMIA_NODE_URLS;
-    this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
+    const resolvedChain = resolveConstructorChain(options);
+    this.nodeUrls = [...resolvedChain.nodeUrls];
+    this.blockchainRid = resolvedChain.blockchainRid;
+    this._defaultChain = resolvedChain;
+    this._explicitChain = options.chain !== void 0 || options.network !== void 0 || options.blockchainRid !== void 0 && options.nodeUrls !== void 0;
+    this._forcedNetwork = forcedChainNetwork();
+    warnDeprecatedEnvVarsOnce((msg) => options.logger?.warn?.(msg));
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
@@ -3577,10 +3659,11 @@ var Atbash = class _Atbash {
     );
     const agentKey = resolve("agentKey", options.agentKey);
     const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
-    const blockchainRid = resolve("blockchainRid", options.blockchainRid) || void 0;
     return new _Atbash(auth.privkey, {
       endpoint: validated.url,
-      blockchainRid,
+      chain: options.chain,
+      network: options.network,
+      blockchainRid: options.blockchainRid,
       timeoutMs: options.timeoutMs,
       nodeUrls: options.nodeUrls,
       orgName: options.orgName,
@@ -3621,7 +3704,7 @@ var Atbash = class _Atbash {
     return this.track("checkAgentExists", pk, async () => {
       const query = { pubkey: pk };
       if (network) query.network = network;
-      const brid = this.bridFromChainOpts(network ? { network } : void 0);
+      const brid = network ? this.bridFromChainOpts({ network }) : await this.defaultOrgBrid();
       const resp = await this.http.get(
         "/api/ai/exists",
         query,
@@ -3672,7 +3755,7 @@ var Atbash = class _Atbash {
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = this.bridFromChainOpts(options.chainOpts);
+    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
     const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
@@ -3723,7 +3806,11 @@ var Atbash = class _Atbash {
       throw new Error("action is required and cannot be empty.");
     }
     let chainOpts = options.chainOpts;
-    if (options.orgName) {
+    if (options.orgName && this._explicitChain) {
+      chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
+    } else if (options.orgName && this.forcedNetwork()) {
+      chainOpts = { network: this.forcedNetwork() };
+    } else if (options.orgName) {
       const cached = this._chainCache.get(options.orgName);
       if (cached) {
         chainOpts = { network: cached.network };
@@ -3957,7 +4044,7 @@ var Atbash = class _Atbash {
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk },
-        this.authHeaders()
+        this.authHeaders(await this.defaultOrgBrid())
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
@@ -3977,7 +4064,11 @@ var Atbash = class _Atbash {
     return this.track(
       "getToolCalls",
       void 0,
-      () => this.riskEngineRecords("tool-calls", { limit: maxCount })
+      async () => this.riskEngineRecords(
+        "tool-calls",
+        { limit: maxCount },
+        await this.defaultOrgBrid()
+      )
     );
   }
   async getOrgToolCalls(orgName, maxCount) {
@@ -3994,24 +4085,31 @@ var Atbash = class _Atbash {
     return this.track(
       "getAgentToolCalls",
       agentPubkey,
-      () => this.riskEngineRecords("agent-tool-calls", {
-        agent: agentPubkey,
-        limit: maxCount
-      })
+      async () => this.riskEngineRecords(
+        "agent-tool-calls",
+        { agent: agentPubkey, limit: maxCount },
+        await this.defaultOrgBrid()
+      )
     );
   }
   async getToolCallCount() {
     return this.track("getToolCallCount", void 0, async () => {
-      const raw2 = await this.riskEngineGet("tool-call-count", {});
+      const raw2 = await this.riskEngineGet(
+        "tool-call-count",
+        {},
+        await this.defaultOrgBrid()
+      );
       const n = Number(raw2);
       return Number.isFinite(n) ? n : 0;
     });
   }
   async getToolCallFull(toolCallId) {
     return this.track("getToolCallFull", void 0, async () => {
-      const raw2 = await this.riskEngineGet("tool-call-full", {
-        tool_call_id: toolCallId
-      });
+      const raw2 = await this.riskEngineGet(
+        "tool-call-full",
+        { tool_call_id: toolCallId },
+        await this.defaultOrgBrid()
+      );
       if (!isRecord(raw2)) return null;
       return toToolCallFull(raw2);
     });
@@ -4097,7 +4195,7 @@ var Atbash = class _Atbash {
       const resp = await this.http.get(
         "/api/insurance",
         { action: "safety-stats" },
-        this.authHeaders()
+        this.authHeaders(await this.defaultOrgBrid())
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
@@ -4153,10 +4251,15 @@ var Atbash = class _Atbash {
    *   2. Per-chain subscription fallback — public + private records
    *      are fetched in parallel, with `is_private_blockchain` and
    *      `assigned_at` reconciling mixed states.
-   * Defaults to the public chain when nothing else resolves.
+   * A lookup that names exactly one chain wins outright. Where it names
+   * neither (a brand-new org) or cannot choose between them, the client's
+   * configured default decides.
    */
   async resolveChainForOrg(orgName) {
     const name2 = orgName.trim();
+    if (this._explicitChain) return this._defaultChain;
+    const forced = this.forcedNetwork();
+    if (forced) return chainForNetwork(forced);
     const cached = this._chainCache.get(name2);
     if (cached) return cached;
     const mapNetwork = await this.getActiveNetworkForOrg(name2);
@@ -4188,7 +4291,7 @@ var Atbash = class _Atbash {
       return PRIVATE_CHAIN;
     }
     if (pubSub && privSub) {
-      const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      const chain = privSub.assigned_at === pubSub.assigned_at ? this._defaultChain : privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
       this._chainCache.set(orgName, chain);
       return chain;
     }
@@ -4209,8 +4312,8 @@ var Atbash = class _Atbash {
         this.endpoint
       );
     }
-    this._chainCache.set(orgName, PUBLIC_CHAIN);
-    return PUBLIC_CHAIN;
+    this._chainCache.set(orgName, this._defaultChain);
+    return this._defaultChain;
   }
   /** Drop any cached chain resolutions. Useful in tests. */
   clearChainCache() {
@@ -4261,6 +4364,7 @@ var Atbash = class _Atbash {
   async resolveAgentLookupNetwork(options) {
     if (options.chainOpts?.network) return options.chainOpts.network;
     if (options.chainOpts?.blockchainRid) return void 0;
+    if (this._explicitChain) return this._defaultChain.network;
     const orgName = options.orgName ?? this.orgName;
     if (!orgName) return void 0;
     return (await this.resolveChainForOrg(orgName)).network;
@@ -4336,6 +4440,30 @@ var Atbash = class _Atbash {
       return void 0;
     }
   }
+  /**
+   * BRID for the client's configured default org, if it has one.
+   *
+   * Calls that carry no `orgName` argument are not chain-less: they still
+   * belong to `this.orgName`, and that org lives on exactly one chain. Routing
+   * them by the constructor's chain instead means a client configured
+   * `network: "private"` reads the private chain for an org that lives on
+   * public, and gets an empty answer rather than an error. So where an org is
+   * known the org decides the chain, and the constructor's chain is what is
+   * left when no org is known at all — the order `resolveAgentLookupNetwork`
+   * already applies to agent metadata reads, and the order the dashboard
+   * applies in `resolveChainForWallet`.
+   *
+   * Undefined when there is no default org, so callers keep falling back to
+   * the client default.
+   */
+  /** The switch's chain, unless this client named one of its own. */
+  forcedNetwork() {
+    return this._explicitChain ? void 0 : this._forcedNetwork;
+  }
+  async defaultOrgBrid() {
+    if (this._explicitChain || !this.orgName) return void 0;
+    return this.bridForOrg(this.orgName);
+  }
   async raiseIfError(resp) {
     if (resp.ok) return;
     throw await this.httpError(resp);
@@ -43586,10 +43714,13 @@ function diffMemorySnapshots(before, after) {
   KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
+  PRIVATE_CHAIN,
+  PUBLIC_CHAIN,
   PointerStore,
   SignatureVerificationError,
   bootSyncFailureLine,
   buildAllowedJudgeHosts,
+  chainForNetwork,
   chooseKeyPath,
   claimHashHex,
   classifyMemoryRead,