@atbash/sdk 0.14.1-dev.0 → 0.15.1-dev.0

package/dist/browser.d.mts

@@ -169,6 +169,11 @@ interface LogToolCallResult {
 }
 interface JudgeResult {
     verdict: Verdict;
+    /**
+     * Canonical executable permission, computed by `canonicalAllow` — see that
+     * function for the rule. Never more permissive than `auditToolCall`.
+     */
+    allow: boolean;
     actionType: string;
     reason: string;
     confidence: number;
@@ -197,6 +202,8 @@ interface JudgeResult {
 interface JudgmentStatus {
     status: JudgmentState;
     verdict: Verdict;
+    /** Same canonical executable permission as {@link JudgeResult.allow}. */
+    allow: boolean;
     reason: string;
     judgmentId: string;
     onChain?: boolean;
@@ -759,9 +766,25 @@ declare class HttpTransportError extends Error {
     });
 }
 
+declare function canonicalAllow(data: Record<string, unknown>): boolean;
+
 /** Normalize wire shapes (verdict casing, status, pubkey) to canonical forms. */
 
 declare function normalizeVerdict(raw: unknown): Verdict;
+/**
+ * Canonicalize `action_type` at the wire boundary, the way
+ * {@link normalizeVerdict} already canonicalizes `verdict`.
+ *
+ * `verdict` has been normalized here since the beginning and has never
+ * drifted between consumers. `action_type` was passed through raw, so every
+ * reader invented its own folding policy — `auditToolCall` compared exactly
+ * while `memory/scan.ts` trimmed and case-folded, and the same `" ALLOW "`
+ * was therefore an error on one path and permission on the other.
+ *
+ * Trim and case-fold only. Zero-width and homoglyph variants survive
+ * untouched, stay outside the known set, and still fail closed.
+ */
+declare function normalizeActionType(raw: unknown): string;
 declare function normalizeStatus(raw: unknown): JudgmentState;
 /** Wire pubkey may be a hex string, a Buffer/Uint8Array, or `{ data: [...] }`. */
 declare function pubkeyToHex(val: unknown): string;
@@ -1486,4 +1509,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -44555,6 +44555,10 @@ function loadAgentFromFile(_keyPath) {
   throw new Error(NOT_AVAILABLE);
 }
 
+// src-ts/decision.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/normalize.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -44566,6 +44570,9 @@ function normalizeVerdict(raw2) {
   if (v === "BLOCK" || v === "RED") return "BLOCK";
   return "HOLD";
 }
+function normalizeActionType(raw2) {
+  return typeof raw2 === "string" ? raw2.trim().toLowerCase() : "";
+}
 function normalizeStatus(raw2) {
   const s2 = String(raw2 ?? "").toLowerCase();
   if (s2 === "pending" || s2 === "answered" || s2 === "error") return s2;
@@ -44582,6 +44589,37 @@ function pubkeyToHex(val) {
   return "";
 }
 
+// src-ts/decision.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function allowSignalsPermit(data) {
+  const signals = [];
+  if (Object.hasOwn(data, "allow")) signals.push(data.allow);
+  if (isRecord(data.decision) && Object.hasOwn(data.decision, "allow")) {
+    signals.push(data.decision.allow);
+  }
+  return signals.length === 0 || signals.every((value) => value === true);
+}
+function wireActionType(data) {
+  if (data.action_type !== void 0)
+    return normalizeActionType(data.action_type);
+  return normalizeActionType(data.actionType);
+}
+function isAuditTier(data) {
+  const absentVerdict = data.verdict === null || data.verdict === void 0;
+  return absentVerdict && data.status === "logged";
+}
+function canonicalAllow(data) {
+  if (!allowSignalsPermit(data)) return false;
+  const actionType = wireActionType(data);
+  if (actionType && actionType !== "allow") return false;
+  if (isAuditTier(data)) return true;
+  if (typeof data.verdict !== "string") return false;
+  const verdict = data.verdict.trim().toUpperCase();
+  return verdict === "ALLOW" || verdict === "GREEN";
+}
+
 // src-ts/browser/opentel/telemetry.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -44750,7 +44788,10 @@ var Atbash = class _Atbash {
         getAuthHeaders: () => this.authHeaders()
       });
     } catch (err) {
-      this.logger.warn?.("[atbash] telemetry setup failed \u2014 continuing without metrics", { error: String(err) });
+      this.logger.warn?.(
+        "[atbash] telemetry setup failed \u2014 continuing without metrics",
+        { error: String(err) }
+      );
     }
   }
   /**
@@ -44965,7 +45006,10 @@ var Atbash = class _Atbash {
           this._chainCache.set(options.orgName, chain);
           chainOpts = { network: mapNetwork };
         } else if (!chainOpts?.blockchainRid) {
-          const resolved = await this.resolveChainFromMap(options.orgName, null);
+          const resolved = await this.resolveChainFromMap(
+            options.orgName,
+            null
+          );
           chainOpts = { ...chainOpts, network: resolved.network };
         }
       }
@@ -45040,7 +45084,8 @@ var Atbash = class _Atbash {
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
     return {
       verdict: normalizeVerdict(data.verdict),
-      actionType: String(data.action_type ?? ""),
+      allow: canonicalAllow(data),
+      actionType: normalizeActionType(data.action_type),
       reason: String(data.reason ?? ""),
       confidence: Number(data.confidence ?? 0),
       provider: String(data.provider ?? ""),
@@ -45206,6 +45251,7 @@ var Atbash = class _Atbash {
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
+        allow: canonicalAllow(data),
         reason: String(data.reason ?? ""),
         judgmentId: String(data.judgmentId ?? judgmentId),
         onChain: optBool(data.onChain),
@@ -45265,7 +45311,7 @@ var Atbash = class _Atbash {
         { tool_call_id: toolCallId },
         await this.defaultOrgBrid()
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return toToolCallFull(raw2);
     });
   }
@@ -45277,7 +45323,7 @@ var Atbash = class _Atbash {
         { org: orgName },
         brid
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
         tier: String(raw2.tier ?? ""),
@@ -45354,7 +45400,7 @@ var Atbash = class _Atbash {
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
-      if (isRecord(data.data)) return data.data;
+      if (isRecord2(data.data)) return data.data;
       return data;
     });
   }
@@ -45370,7 +45416,7 @@ var Atbash = class _Atbash {
       if (network) params.network = network;
       const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       const raw2 = await this.riskEngineGet("org-subscription", params, brid);
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
   }
@@ -45576,7 +45622,7 @@ var Atbash = class _Atbash {
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    return isRecord(data) ? data : {};
+    return isRecord2(data) ? data : {};
   }
   async riskEngineRecords(action, params, brid) {
     const raw2 = await this.riskEngineGet(action, params, brid);
@@ -45643,14 +45689,11 @@ var Atbash = class _Atbash {
   transportError(err) {
     if (err instanceof HttpTransportError) {
       if (this.debug) {
-        this.logger.warn?.(
-          `[atbash] transport failed \u2014 kind=${err.kind}`,
-          {
-            kind: err.kind,
-            cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
-            endpoint: this.endpoint
-          }
-        );
+        this.logger.warn?.(`[atbash] transport failed \u2014 kind=${err.kind}`, {
+          kind: err.kind,
+          cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
+          endpoint: this.endpoint
+        });
       }
       return new AtbashAPIError(0, err.message, "", this.endpoint);
     }
@@ -45748,7 +45791,7 @@ function coerceOrgSubscription(raw2, orgName) {
     is_active: Boolean(raw2.is_active)
   };
 }
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function optString(v) {
@@ -46318,6 +46361,7 @@ export {
   SignatureVerificationError,
   bootSyncFailureLine,
   buildAllowedJudgeHosts,
+  canonicalAllow,
   chainForNetwork,
   chooseKeyPath,
   claimHashHex,
@@ -46359,6 +46403,7 @@ export {
   loadAgentFromFile,
   loadUserConfig,
   normalizeActionForHash,
+  normalizeActionType,
   normalizeForMatching2 as normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
@@ -46407,4 +46452,3 @@ postchain-client/built/esm/index.js:
 @noble/ciphers/utils.js:
   (*! noble-ciphers - MIT License (c) 2023 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=browser.mjs.map

package/dist/index.d.mts

@@ -169,6 +169,11 @@ interface LogToolCallResult {
 }
 interface JudgeResult {
     verdict: Verdict;
+    /**
+     * Canonical executable permission, computed by `canonicalAllow` — see that
+     * function for the rule. Never more permissive than `auditToolCall`.
+     */
+    allow: boolean;
     actionType: string;
     reason: string;
     confidence: number;
@@ -197,6 +202,8 @@ interface JudgeResult {
 interface JudgmentStatus {
     status: JudgmentState;
     verdict: Verdict;
+    /** Same canonical executable permission as {@link JudgeResult.allow}. */
+    allow: boolean;
     reason: string;
     judgmentId: string;
     onChain?: boolean;
@@ -759,9 +766,25 @@ declare class HttpTransportError extends Error {
     });
 }
 
+declare function canonicalAllow(data: Record<string, unknown>): boolean;
+
 /** Normalize wire shapes (verdict casing, status, pubkey) to canonical forms. */
 
 declare function normalizeVerdict(raw: unknown): Verdict;
+/**
+ * Canonicalize `action_type` at the wire boundary, the way
+ * {@link normalizeVerdict} already canonicalizes `verdict`.
+ *
+ * `verdict` has been normalized here since the beginning and has never
+ * drifted between consumers. `action_type` was passed through raw, so every
+ * reader invented its own folding policy — `auditToolCall` compared exactly
+ * while `memory/scan.ts` trimmed and case-folded, and the same `" ALLOW "`
+ * was therefore an error on one path and permission on the other.
+ *
+ * Trim and case-fold only. Zero-width and homoglyph variants survive
+ * untouched, stay outside the known set, and still fail closed.
+ */
+declare function normalizeActionType(raw: unknown): string;
 declare function normalizeStatus(raw: unknown): JudgmentState;
 /** Wire pubkey may be a hex string, a Buffer/Uint8Array, or `{ data: [...] }`. */
 declare function pubkeyToHex(val: unknown): string;
@@ -1486,4 +1509,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.d.ts

@@ -169,6 +169,11 @@ interface LogToolCallResult {
 }
 interface JudgeResult {
     verdict: Verdict;
+    /**
+     * Canonical executable permission, computed by `canonicalAllow` — see that
+     * function for the rule. Never more permissive than `auditToolCall`.
+     */
+    allow: boolean;
     actionType: string;
     reason: string;
     confidence: number;
@@ -197,6 +202,8 @@ interface JudgeResult {
 interface JudgmentStatus {
     status: JudgmentState;
     verdict: Verdict;
+    /** Same canonical executable permission as {@link JudgeResult.allow}. */
+    allow: boolean;
     reason: string;
     judgmentId: string;
     onChain?: boolean;
@@ -759,9 +766,25 @@ declare class HttpTransportError extends Error {
     });
 }
 
+declare function canonicalAllow(data: Record<string, unknown>): boolean;
+
 /** Normalize wire shapes (verdict casing, status, pubkey) to canonical forms. */
 
 declare function normalizeVerdict(raw: unknown): Verdict;
+/**
+ * Canonicalize `action_type` at the wire boundary, the way
+ * {@link normalizeVerdict} already canonicalizes `verdict`.
+ *
+ * `verdict` has been normalized here since the beginning and has never
+ * drifted between consumers. `action_type` was passed through raw, so every
+ * reader invented its own folding policy — `auditToolCall` compared exactly
+ * while `memory/scan.ts` trimmed and case-folded, and the same `" ALLOW "`
+ * was therefore an error on one path and permission on the other.
+ *
+ * Trim and case-fold only. Zero-width and homoglyph variants survive
+ * untouched, stay outside the known set, and still fail closed.
+ */
+declare function normalizeActionType(raw: unknown): string;
 declare function normalizeStatus(raw: unknown): JudgmentState;
 /** Wire pubkey may be a hex string, a Buffer/Uint8Array, or `{ data: [...] }`. */
 declare function pubkeyToHex(val: unknown): string;
@@ -1486,4 +1509,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.js

@@ -2875,6 +2875,7 @@ __export(src_ts_exports, {
   SignatureVerificationError: () => SignatureVerificationError,
   bootSyncFailureLine: () => bootSyncFailureLine,
   buildAllowedJudgeHosts: () => buildAllowedJudgeHosts,
+  canonicalAllow: () => canonicalAllow,
   chainForNetwork: () => chainForNetwork,
   chooseKeyPath: () => chooseKeyPath,
   claimHashHex: () => claimHashHex,
@@ -2916,6 +2917,7 @@ __export(src_ts_exports, {
   loadAgentFromFile: () => loadAgentFromFile,
   loadUserConfig: () => loadUserConfig,
   normalizeActionForHash: () => normalizeActionForHash,
+  normalizeActionType: () => normalizeActionType,
   normalizeForMatching: () => normalizeForMatching,
   normalizeStatus: () => normalizeStatus,
   normalizeVerdict: () => normalizeVerdict,
@@ -3278,6 +3280,9 @@ function normalizeVerdict(raw2) {
   if (v === "BLOCK" || v === "RED") return "BLOCK";
   return "HOLD";
 }
+function normalizeActionType(raw2) {
+  return typeof raw2 === "string" ? raw2.trim().toLowerCase() : "";
+}
 function normalizeStatus(raw2) {
   const s2 = String(raw2 ?? "").toLowerCase();
   if (s2 === "pending" || s2 === "answered" || s2 === "error") return s2;
@@ -3294,6 +3299,37 @@ function pubkeyToHex(val) {
   return "";
 }
 
+// src-ts/decision.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function allowSignalsPermit(data) {
+  const signals = [];
+  if (Object.hasOwn(data, "allow")) signals.push(data.allow);
+  if (isRecord(data.decision) && Object.hasOwn(data.decision, "allow")) {
+    signals.push(data.decision.allow);
+  }
+  return signals.length === 0 || signals.every((value) => value === true);
+}
+function wireActionType(data) {
+  if (data.action_type !== void 0)
+    return normalizeActionType(data.action_type);
+  return normalizeActionType(data.actionType);
+}
+function isAuditTier(data) {
+  const absentVerdict = data.verdict === null || data.verdict === void 0;
+  return absentVerdict && data.status === "logged";
+}
+function canonicalAllow(data) {
+  if (!allowSignalsPermit(data)) return false;
+  const actionType = wireActionType(data);
+  if (actionType && actionType !== "allow") return false;
+  if (isAuditTier(data)) return true;
+  if (typeof data.verdict !== "string") return false;
+  const verdict = data.verdict.trim().toUpperCase();
+  return verdict === "ALLOW" || verdict === "GREEN";
+}
+
 // src-ts/opentel/telemetry.ts
 var import_node_fs2 = require("fs");
 var import_node_os2 = require("os");
@@ -3606,7 +3642,10 @@ var Atbash = class _Atbash {
         getAuthHeaders: () => this.authHeaders()
       });
     } catch (err) {
-      this.logger.warn?.("[atbash] telemetry setup failed \u2014 continuing without metrics", { error: String(err) });
+      this.logger.warn?.(
+        "[atbash] telemetry setup failed \u2014 continuing without metrics",
+        { error: String(err) }
+      );
     }
   }
   /**
@@ -3821,7 +3860,10 @@ var Atbash = class _Atbash {
           this._chainCache.set(options.orgName, chain);
           chainOpts = { network: mapNetwork };
         } else if (!chainOpts?.blockchainRid) {
-          const resolved = await this.resolveChainFromMap(options.orgName, null);
+          const resolved = await this.resolveChainFromMap(
+            options.orgName,
+            null
+          );
           chainOpts = { ...chainOpts, network: resolved.network };
         }
       }
@@ -3896,7 +3938,8 @@ var Atbash = class _Atbash {
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
     return {
       verdict: normalizeVerdict(data.verdict),
-      actionType: String(data.action_type ?? ""),
+      allow: canonicalAllow(data),
+      actionType: normalizeActionType(data.action_type),
       reason: String(data.reason ?? ""),
       confidence: Number(data.confidence ?? 0),
       provider: String(data.provider ?? ""),
@@ -4062,6 +4105,7 @@ var Atbash = class _Atbash {
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
+        allow: canonicalAllow(data),
         reason: String(data.reason ?? ""),
         judgmentId: String(data.judgmentId ?? judgmentId),
         onChain: optBool(data.onChain),
@@ -4121,7 +4165,7 @@ var Atbash = class _Atbash {
         { tool_call_id: toolCallId },
         await this.defaultOrgBrid()
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return toToolCallFull(raw2);
     });
   }
@@ -4133,7 +4177,7 @@ var Atbash = class _Atbash {
         { org: orgName },
         brid
       );
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return {
         orgName: String(raw2.org_name ?? ""),
         tier: String(raw2.tier ?? ""),
@@ -4210,7 +4254,7 @@ var Atbash = class _Atbash {
       );
       await this.raiseIfError(resp);
       const data = await this.json(resp) ?? {};
-      if (isRecord(data.data)) return data.data;
+      if (isRecord2(data.data)) return data.data;
       return data;
     });
   }
@@ -4226,7 +4270,7 @@ var Atbash = class _Atbash {
       if (network) params.network = network;
       const brid = network ? this.bridFromChainOpts({ network }) : void 0;
       const raw2 = await this.riskEngineGet("org-subscription", params, brid);
-      if (!isRecord(raw2)) return null;
+      if (!isRecord2(raw2)) return null;
       return coerceOrgSubscription(raw2, orgName);
     });
   }
@@ -4432,7 +4476,7 @@ var Atbash = class _Atbash {
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    return isRecord(data) ? data : {};
+    return isRecord2(data) ? data : {};
   }
   async riskEngineRecords(action, params, brid) {
     const raw2 = await this.riskEngineGet(action, params, brid);
@@ -4499,14 +4543,11 @@ var Atbash = class _Atbash {
   transportError(err) {
     if (err instanceof HttpTransportError) {
       if (this.debug) {
-        this.logger.warn?.(
-          `[atbash] transport failed \u2014 kind=${err.kind}`,
-          {
-            kind: err.kind,
-            cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
-            endpoint: this.endpoint
-          }
-        );
+        this.logger.warn?.(`[atbash] transport failed \u2014 kind=${err.kind}`, {
+          kind: err.kind,
+          cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
+          endpoint: this.endpoint
+        });
       }
       return new AtbashAPIError(0, err.message, "", this.endpoint);
     }
@@ -4604,7 +4645,7 @@ function coerceOrgSubscription(raw2, orgName) {
     is_active: Boolean(raw2.is_active)
   };
 }
-function isRecord(v) {
+function isRecord2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function optString(v) {
@@ -4743,7 +4784,7 @@ async function scanMemory(entry, auth, opts) {
     );
   }
   const KNOWN_ACTIONS = ["allow", "block", "hold_for_user_confirm"];
-  const action = result.actionType.trim().toLowerCase();
+  const action = result.actionType;
   if (result.verdict !== "No verdict" && action !== "" && !KNOWN_ACTIONS.includes(action)) {
     throw new Error(
       `memory scan: unrecognized action_type from judge (${result.actionType})`
@@ -43746,6 +43787,7 @@ function diffMemorySnapshots(before, after) {
   SignatureVerificationError,
   bootSyncFailureLine,
   buildAllowedJudgeHosts,
+  canonicalAllow,
   chainForNetwork,
   chooseKeyPath,
   claimHashHex,
@@ -43787,6 +43829,7 @@ function diffMemorySnapshots(before, after) {
   loadAgentFromFile,
   loadUserConfig,
   normalizeActionForHash,
+  normalizeActionType,
   normalizeForMatching,
   normalizeStatus,
   normalizeVerdict,
@@ -43825,4 +43868,3 @@ postchain-client/built/esm/index.js:
    *)
   (*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> *)
 */
-//# sourceMappingURL=index.js.map