@atbash/sdk 0.14.1-dev.0 → 0.15.0

package/dist/testing.d.mts

@@ -0,0 +1,15 @@
+/**
+ * Helpers for the SDK's own tests, published as `@atbash/sdk/testing` and kept
+ * out of the main entry: fixing the call ids in production would let an old
+ * signed reply pass as the answer to a new call.
+ */
+/**
+ * Fix the ids the client generates, handed out in turn, so a test can serve a
+ * judge reply signed for them. A judge call takes two: its call id, then its
+ * judgment id.
+ *
+ * @param ids - One id or several, used in turn; `undefined` restores random ids.
+ */
+declare function setToolCallIdForTests(ids: string | readonly string[] | undefined): void;
+
+export { setToolCallIdForTests };

package/dist/testing.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Helpers for the SDK's own tests, published as `@atbash/sdk/testing` and kept
+ * out of the main entry: fixing the call ids in production would let an old
+ * signed reply pass as the answer to a new call.
+ */
+/**
+ * Fix the ids the client generates, handed out in turn, so a test can serve a
+ * judge reply signed for them. A judge call takes two: its call id, then its
+ * judgment id.
+ *
+ * @param ids - One id or several, used in turn; `undefined` restores random ids.
+ */
+declare function setToolCallIdForTests(ids: string | readonly string[] | undefined): void;
+
+export { setToolCallIdForTests };

package/dist/testing.js

@@ -0,0 +1,33 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src-ts/testing.ts
+var testing_exports = {};
+__export(testing_exports, {
+  setToolCallIdForTests: () => setToolCallIdForTests
+});
+module.exports = __toCommonJS(testing_exports);
+var TOOL_CALL_IDS_FOR_TESTS = /* @__PURE__ */ Symbol.for("@atbash/sdk.toolCallIdsForTests");
+function setToolCallIdForTests(ids) {
+  globalThis[TOOL_CALL_IDS_FOR_TESTS] = ids === void 0 ? void 0 : { ids: typeof ids === "string" ? [ids] : [...ids], next: 0 };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  setToolCallIdForTests
+});

package/dist/testing.mjs

@@ -0,0 +1,8 @@
+// src-ts/testing.ts
+var TOOL_CALL_IDS_FOR_TESTS = /* @__PURE__ */ Symbol.for("@atbash/sdk.toolCallIdsForTests");
+function setToolCallIdForTests(ids) {
+  globalThis[TOOL_CALL_IDS_FOR_TESTS] = ids === void 0 ? void 0 : { ids: typeof ids === "string" ? [ids] : [...ids], next: 0 };
+}
+export {
+  setToolCallIdForTests
+};

package/index.d.ts

@@ -27,6 +27,8 @@ export interface AgentPubkeyOnlyQueryJs {
   file_path?: string
 }
 
+export declare function applyMemoryEdits(current: string, edits: Array<MemoryEditJs>): string
+
 export declare const ARG_AGENT_PUBKEY: string
 
 export declare const ARG_FILE_PATH: string
@@ -86,13 +88,11 @@ export declare function decryptForOrg(payload: Buffer, orgPrivKeyHex: string, aa
 
 export declare function decryptMemoryContent(ciphertext: Buffer, nonce: Buffer, key: Buffer): string
 
-export declare const DEFAULT_BLOCKCHAIN_RID: string
-
 export declare const DEFAULT_ENDPOINT: string
 
 export declare const DEFAULT_PRIVATE_BLOCKCHAIN_RID: string
 
-export declare function defaultChromiaNodeUrls(): Array<string>
+export declare function defaultAgentHomeDirs(): Array<string>
 
 export declare function defaultMemoryPathPatterns(): Array<string>
 
@@ -132,10 +132,14 @@ export declare function encryptForOrg(plaintext: string, orgPubKeyHex: string, a
 
 export declare function encryptMemoryContent(plaintext: string, key: Buffer): EncryptedMemoryJs
 
+export declare function extractMemoryEdits(event: any, ctx: any): Array<MemoryEditJs>
+
 export declare function formatEntryForScan(entry: MemoryEntryJs, hasEvasion: boolean): string
 
 export declare function generateKeypair(): KeyPairJs
 
+export declare function isSafeMemorySlot(slot: string): boolean
+
 export declare function isValidPrivateKey(s: string): boolean
 
 export interface JudgeSignatureCheckJs {
@@ -176,6 +180,11 @@ export interface MemoryDiffResultJs {
   anomalies: Array<MemoryAnomalyJs>
 }
 
+export interface MemoryEditJs {
+  old_text: string
+  new_text: string
+}
+
 export interface MemoryEntryJs {
   key: string
   value: string
@@ -185,6 +194,8 @@ export interface MemoryEntryJs {
 
 export declare function memoryScanContext(): string
 
+export declare function memorySlotForPath(path: string, userHome: string, root?: string | undefined | null, extraHomes?: Array<string> | undefined | null): string | null
+
 export interface MemorySnapshotJs {
   entries: Array<MemoryEntryJs>
   takenAt: number
@@ -225,6 +236,9 @@ export declare function parseRollbackRows(value: any): Array<RawRollbackRowJs>
 
 export declare function parseScoreFromReason(reason: string): ParsedScoreJs
 
+/** The response-signing pubkeys pinned for a judge host; empty when it has none. */
+export declare function pinnedJudgeVerifyKeys(host: string): Array<string>
+
 export declare const QUERY_GET_ACTIVE_AGENT_MEMORY: string
 
 export declare const QUERY_GET_ACTIVE_MEMORY_ID: string
@@ -282,12 +296,16 @@ export interface SecretMatchJs {
   length: number
 }
 
+export declare function signAddAgentMemory(agentPubkeyHex: string, contentCipher: Buffer, nonce: Buffer, score: number, filePath: string, privkey: string, blockchainRid: string): string
+
 export declare function signEncryptedToolCall(toolCallId: string, action: string, context: string, toolName: string, toolArgsJson: string, orgEncryptionPubKeyHex: string, privkeyHex: string, blockchainRidHex: string): string
 
 export declare function signJudgeAction(judgmentId: string, action: string, context: string, extra: string, privkey: string, blockchainRid: string): string
 
 export declare function signLogToolCall(toolCallId: string, action: string, context: string, toolName: string, toolArgsJson: string, privkey: string, blockchainRid: string): string
 
+export declare function signRollbackAgentMemory(agentPubkeyHex: string, toId: number, reason: string, privkey: string, blockchainRid: string): string
+
 export declare function validateAgentPubkeyHex(pubkeyHex: string): Buffer
 
 export declare function validateFilePath(filePath: string): string

package/index.js

@@ -1,6 +1,9 @@
 /* eslint-disable */
 // @ts-nocheck
 /* auto-generated by NAPI-RS */
+// Every version check below is bumped by release-please (extra-files, generic
+// updater) in the same release PR as package.json; keep them inside this block.
+// x-release-please-start-version
 
 const { readFileSync } = require('fs')
 let nativeBinding = null
@@ -89,8 +92,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-android-arm64')
         const bindingPackageVersion = require('@atbash/sdk-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -105,8 +108,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-android-arm-eabi')
         const bindingPackageVersion = require('@atbash/sdk-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -126,8 +129,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-win32-x64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-win32-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -142,8 +145,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-win32-x64-msvc')
           const bindingPackageVersion = require('@atbash/sdk-win32-x64-msvc/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -159,8 +162,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-win32-ia32-msvc')
         const bindingPackageVersion = require('@atbash/sdk-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -175,8 +178,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-win32-arm64-msvc')
         const bindingPackageVersion = require('@atbash/sdk-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -194,8 +197,8 @@ function requireNative() {
     try {
       const binding = require('@atbash/sdk-darwin-universal')
       const bindingPackageVersion = require('@atbash/sdk-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -210,8 +213,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-darwin-x64')
         const bindingPackageVersion = require('@atbash/sdk-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -226,8 +229,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-darwin-arm64')
         const bindingPackageVersion = require('@atbash/sdk-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -246,8 +249,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-freebsd-x64')
         const bindingPackageVersion = require('@atbash/sdk-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -262,8 +265,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-freebsd-arm64')
         const bindingPackageVersion = require('@atbash/sdk-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -283,8 +286,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-x64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -299,8 +302,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-x64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -317,8 +320,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -333,8 +336,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -351,8 +354,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm-musleabihf')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -367,8 +370,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -385,8 +388,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-loong64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -401,8 +404,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-loong64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -419,8 +422,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-riscv64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -435,8 +438,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-riscv64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -452,8 +455,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-linux-ppc64-gnu')
         const bindingPackageVersion = require('@atbash/sdk-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -468,8 +471,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-linux-s390x-gnu')
         const bindingPackageVersion = require('@atbash/sdk-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -488,8 +491,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-arm64')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -504,8 +507,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-x64')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -520,8 +523,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-arm')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.12.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.15.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -661,8 +664,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@atbash/sdk-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '0.12.0-dev.0') {
-            throw new Error(`WASI binding package version mismatch, expected 0.12.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.15.0') {
+            throw new Error(`WASI binding package version mismatch, expected 0.15.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@atbash/sdk-wasm32-wasi')
@@ -778,6 +781,7 @@ function __napiStampBindingTarget(exportsObject, target) {
 // linked import resolves to `undefined`.
 module.exports.__napiBindingTarget = __napiStampBindingTarget(nativeBinding, __napiLoadedBindingTarget)
 module.exports = nativeBinding
+module.exports.applyMemoryEdits = nativeBinding.applyMemoryEdits
 module.exports.ARG_AGENT_PUBKEY = nativeBinding.ARG_AGENT_PUBKEY
 module.exports.ARG_FILE_PATH = nativeBinding.ARG_FILE_PATH
 module.exports.ARG_ID = nativeBinding.ARG_ID
@@ -800,10 +804,9 @@ module.exports.containsSecret = nativeBinding.containsSecret
 module.exports.createMemorySnapshot = nativeBinding.createMemorySnapshot
 module.exports.decryptForOrg = nativeBinding.decryptForOrg
 module.exports.decryptMemoryContent = nativeBinding.decryptMemoryContent
-module.exports.DEFAULT_BLOCKCHAIN_RID = nativeBinding.DEFAULT_BLOCKCHAIN_RID
 module.exports.DEFAULT_ENDPOINT = nativeBinding.DEFAULT_ENDPOINT
 module.exports.DEFAULT_PRIVATE_BLOCKCHAIN_RID = nativeBinding.DEFAULT_PRIVATE_BLOCKCHAIN_RID
-module.exports.defaultChromiaNodeUrls = nativeBinding.defaultChromiaNodeUrls
+module.exports.defaultAgentHomeDirs = nativeBinding.defaultAgentHomeDirs
 module.exports.defaultMemoryPathPatterns = nativeBinding.defaultMemoryPathPatterns
 module.exports.defaultMemoryReadToolNames = nativeBinding.defaultMemoryReadToolNames
 module.exports.defaultMemoryWriteToolNames = nativeBinding.defaultMemoryWriteToolNames
@@ -816,12 +819,15 @@ module.exports.ECIES_FORMAT_VERSION = nativeBinding.ECIES_FORMAT_VERSION
 module.exports.encryptedLength = nativeBinding.encryptedLength
 module.exports.encryptForOrg = nativeBinding.encryptForOrg
 module.exports.encryptMemoryContent = nativeBinding.encryptMemoryContent
+module.exports.extractMemoryEdits = nativeBinding.extractMemoryEdits
 module.exports.formatEntryForScan = nativeBinding.formatEntryForScan
 module.exports.generateKeypair = nativeBinding.generateKeypair
+module.exports.isSafeMemorySlot = nativeBinding.isSafeMemorySlot
 module.exports.isValidPrivateKey = nativeBinding.isValidPrivateKey
 module.exports.loadAgent = nativeBinding.loadAgent
 module.exports.mapVerdict = nativeBinding.mapVerdict
 module.exports.memoryScanContext = nativeBinding.memoryScanContext
+module.exports.memorySlotForPath = nativeBinding.memorySlotForPath
 module.exports.normalizeActionForHash = nativeBinding.normalizeActionForHash
 module.exports.normalizeForMatching = nativeBinding.normalizeForMatching
 module.exports.OP_ADD_AGENT_MEMORY = nativeBinding.OP_ADD_AGENT_MEMORY
@@ -834,6 +840,7 @@ module.exports.parseMemoryRows = nativeBinding.parseMemoryRows
 module.exports.parseRollbackRow = nativeBinding.parseRollbackRow
 module.exports.parseRollbackRows = nativeBinding.parseRollbackRows
 module.exports.parseScoreFromReason = nativeBinding.parseScoreFromReason
+module.exports.pinnedJudgeVerifyKeys = nativeBinding.pinnedJudgeVerifyKeys
 module.exports.QUERY_GET_ACTIVE_AGENT_MEMORY = nativeBinding.QUERY_GET_ACTIVE_AGENT_MEMORY
 module.exports.QUERY_GET_ACTIVE_MEMORY_ID = nativeBinding.QUERY_GET_ACTIVE_MEMORY_ID
 module.exports.QUERY_GET_AGENT_MEMORY_BY_ID = nativeBinding.QUERY_GET_AGENT_MEMORY_BY_ID
@@ -841,9 +848,11 @@ module.exports.QUERY_GET_AGENT_MEMORY_HISTORY = nativeBinding.QUERY_GET_AGENT_ME
 module.exports.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY = nativeBinding.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY
 module.exports.QUERY_GET_RECENT_AGENT_MEMORY = nativeBinding.QUERY_GET_RECENT_AGENT_MEMORY
 module.exports.redactSecrets = nativeBinding.redactSecrets
+module.exports.signAddAgentMemory = nativeBinding.signAddAgentMemory
 module.exports.signEncryptedToolCall = nativeBinding.signEncryptedToolCall
 module.exports.signJudgeAction = nativeBinding.signJudgeAction
 module.exports.signLogToolCall = nativeBinding.signLogToolCall
+module.exports.signRollbackAgentMemory = nativeBinding.signRollbackAgentMemory
 module.exports.validateAgentPubkeyHex = nativeBinding.validateAgentPubkeyHex
 module.exports.validateFilePath = nativeBinding.validateFilePath
 module.exports.validateMemoryId = nativeBinding.validateMemoryId
@@ -852,3 +861,4 @@ module.exports.validateRollbackReason = nativeBinding.validateRollbackReason
 module.exports.validateScore = nativeBinding.validateScore
 module.exports.verifyJudgeResponseSignature = nativeBinding.verifyJudgeResponseSignature
 module.exports.verifySignature = nativeBinding.verifySignature
+// x-release-please-end

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.14.1-dev.0",
+  "version": "0.15.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -21,9 +21,14 @@
     "./native": {
       "types": "./index.d.ts",
       "default": "./index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.mjs",
+      "require": "./dist/testing.js"
     }
   },
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "Apache-2.0",
   "napi": {
     "binaryName": "atbash",
     "packageName": "@atbash/sdk",
@@ -48,17 +53,22 @@
     "index.d.ts",
     "*.node",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE",
+    "THIRD-PARTY-NOTICES"
   ],
   "scripts": {
     "build:native": "napi build --platform --release",
+    "postbuild:native": "node scripts/sync-loader-version.mjs",
     "build:native:debug": "napi build --platform",
+    "postbuild:native:debug": "node scripts/sync-loader-version.mjs",
     "gen:http": "openapi-typescript ../../spec/openapi.yaml -o src-ts/http/schema.ts",
-    "build:ts": "tsup",
+    "build:ts": "tsup && node scripts/assert-browser-bundle-clean.mjs",
     "build": "npm run build:native && npm run build:ts",
     "test:native": "node --test __test__/vector_parity.test.mjs",
     "test:sdk": "node --test __test__/*.sdk.test.mjs",
     "test:live": "node --test __test__/live_technical_health.test.mjs",
+    "test:memory:live": "node --test __test__/memory_chain_live.test.mjs",
     "test": "node --test __test__/*.test.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -67,13 +77,16 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.219.0",
+    "@opentelemetry/api-logs": "^0.223.0",
+    "@opentelemetry/exporter-logs-otlp-http": "^0.223.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.223.0",
     "@opentelemetry/resources": "^2.7.1",
+    "@opentelemetry/sdk-logs": "^0.223.0",
     "@opentelemetry/sdk-metrics": "^2.7.1"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@napi-rs/cli": "^3.7.2",
+    "@napi-rs/cli": "3.10.9",
     "@noble/ciphers": "^2.2.0",
     "@noble/curves": "2.2.0",
     "@types/node": "^26.0.1",
@@ -88,11 +101,14 @@
     "typescript": "^5.4.0",
     "typescript-eslint": "^8.62.1"
   },
+  "overrides": {
+    "@napi-rs/cross-toolchain": "1.0.3"
+  },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.14.1-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.14.1-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.14.1-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.14.1-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.14.1-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.15.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.15.0",
+    "@atbash/sdk-linux-x64-musl": "0.15.0",
+    "@atbash/sdk-darwin-arm64": "0.15.0",
+    "@atbash/sdk-win32-x64-msvc": "0.15.0"
   }
 }