@atbash/sdk 0.15.1-dev.0 → 0.16.0-dev.0

package/README.md

@@ -144,8 +144,6 @@ const atbash = Atbash.fromConfig();   // reads env + config file
 | `judgeEndpoint` | `ATBASH_ENDPOINT` |
 | `judgeVerifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` (self-hosted judge response-signing key; selects the self-hosted policy) |
 | `blockchainRid` | `ATBASH_BLOCKCHAIN_RID` |
-| `provider` | `ATBASH_PROVIDER` |
-| `providerModel` | `ATBASH_PROVIDER_MODEL` |
 
 Persistent config helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
 

package/dist/browser.d.mts

@@ -408,8 +408,6 @@ interface FromConfigOptions {
 interface JudgeOptions {
     toolName?: string;
     toolArgsJson?: string;
-    provider?: string;
-    model?: string;
     verifyPubKey?: string;
     /** Per-call override of {@link AtbashOptions.orgEncryptionPubKey}. */
     orgEncryptionPubKey?: string;
@@ -807,8 +805,6 @@ interface AtbashUserConfig {
      * at construction instead.
      */
     defaultChainNetwork?: Network;
-    provider?: string;
-    providerModel?: string;
     /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
     debug?: string;
 }
@@ -879,6 +875,22 @@ declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the caus
  */
 declare function bootSyncFailureLine(cause: unknown): string;
 
+/**
+ * Make a chain query result crossable at the NAPI boundary.
+ *
+ * `postchain-client` decodes a Rell `byte_array` into a Node `Buffer`. The
+ * core's `parse*` functions take `serde_json::Value`, and NAPI-RS cannot
+ * convert a `Buffer` into one — it reaches the methods every `Uint8Array`
+ * inherits and fails with "JS functions cannot be represented as a
+ * serde_json::Value", which names functions for what is a plain Buffer.
+ *
+ * The conversion has to happen here because the failure is in the argument
+ * conversion, before any core code runs. Of the shapes the core accepts —
+ * hex string, `[u8]`, `{ data: [...] }` — hex is the cheapest to produce.
+ */
+/** Recursively rewrite byte containers to hex, leaving everything else as-is. */
+declare function gtvToFfiSafe(value: unknown): unknown;
+
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -1320,7 +1332,29 @@ declare class MemoryGuardManager {
     private readonly rollbackMinScore;
     private readonly enforce;
     private readonly agentPubkeyHex;
+    /**
+     * Memoized org→chain resolution. Reads have to hit the SAME chain
+     * writes did, so an org-scoped guard must resolve `orgName` to
+     * network exactly like `commitMemoryVersion` does. Without this
+     * cache the read path would either (a) hit the SDK-default chain
+     * every time — silently returning "no active memory on chain" when
+     * writes landed on the org's actual chain, or (b) hammer
+     * `/api/org-network` on every read. `undefined` means "not yet
+     * resolved"; a resolved `null` means "no org / use raw chainOpts".
+     */
+    private _resolvedChainOpts;
+    private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+     * already does this for writes; without the same call on the read
+     * path, a client on the SDK's baked default chain reads from the wrong
+     * chain and reports "no active memory" for an agent whose writes did
+     * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+     * still wins (caller vouched for it); everything else honors the
+     * dashboard's `org_networks` map.
+     */
+    private resolveChainOpts;
     /**
      * One-shot chain probe at plugin registration. Refreshes MEMORY.md
      * from chain when drifted and score passes threshold. Fire-and-forget
@@ -1509,4 +1543,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, gtvToFfiSafe, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -44656,8 +44656,6 @@ function resolve(_key, flagValue) {
 function forcedChainNetwork(flagValue) {
   return flagValue === "public" || flagValue === "private" ? flagValue : void 0;
 }
-function warnDeprecatedEnvVarsOnce(_log) {
-}
 
 // src-ts/client.ts
 function generateToolCallId() {
@@ -44765,7 +44763,6 @@ var Atbash = class _Atbash {
     this._defaultChain = resolvedChain;
     this._explicitChain = options.chain !== void 0 || options.network !== void 0 || options.blockchainRid !== void 0 && options.nodeUrls !== void 0;
     this._forcedNetwork = forcedChainNetwork();
-    warnDeprecatedEnvVarsOnce((msg) => options.logger?.warn?.(msg));
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
@@ -45023,18 +45020,15 @@ var Atbash = class _Atbash {
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
-    let signedJudgeAction;
-    if (!options.provider) {
-      const judgmentId = generateToolCallId();
-      signedJudgeAction = native.signJudgeAction(
-        judgmentId,
-        action,
-        context || "",
-        "",
-        this.auth.privkey,
-        brid
-      );
-    }
+    const judgmentId = generateToolCallId();
+    const signedJudgeAction = native.signJudgeAction(
+      judgmentId,
+      action,
+      context || "",
+      "",
+      this.auth.privkey,
+      brid
+    );
     const body = {
       tool_call_id: logResult.toolCallId,
       agent_pubkey: this.auth.pubkey,
@@ -45043,10 +45037,8 @@ var Atbash = class _Atbash {
     };
     if (signedJudgeAction) body.signed_judge_action = signedJudgeAction;
     if (context) body.context = context;
-    if (options.provider) body.provider = options.provider;
     if (options.toolName) body.tool_name = options.toolName;
     if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
-    if (options.model) body.model = options.model;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
     let resp;
@@ -45927,6 +45919,22 @@ function bootSyncFailureLine(cause) {
   );
 }
 
+// src-ts/memory/_gtv_bytes.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+function gtvToFfiSafe(value) {
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("hex");
+  if (Array.isArray(value)) return value.map(gtvToFfiSafe);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key3, val] of Object.entries(value)) {
+      out[key3] = gtvToFfiSafe(val);
+    }
+    return out;
+  }
+  return value;
+}
+
 // src-ts/memory/index.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -46394,6 +46402,7 @@ export {
   getMemoryHistory,
   getRecentAgentMemory,
   getRollbackHistory,
+  gtvToFfiSafe,
   guardMemoryWrite,
   isEnvelope,
   isValidPrivateKey2 as isValidPrivateKey,

package/dist/index.d.mts

@@ -408,8 +408,6 @@ interface FromConfigOptions {
 interface JudgeOptions {
     toolName?: string;
     toolArgsJson?: string;
-    provider?: string;
-    model?: string;
     verifyPubKey?: string;
     /** Per-call override of {@link AtbashOptions.orgEncryptionPubKey}. */
     orgEncryptionPubKey?: string;
@@ -807,8 +805,6 @@ interface AtbashUserConfig {
      * at construction instead.
      */
     defaultChainNetwork?: Network;
-    provider?: string;
-    providerModel?: string;
     /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
     debug?: string;
 }
@@ -879,6 +875,22 @@ declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the caus
  */
 declare function bootSyncFailureLine(cause: unknown): string;
 
+/**
+ * Make a chain query result crossable at the NAPI boundary.
+ *
+ * `postchain-client` decodes a Rell `byte_array` into a Node `Buffer`. The
+ * core's `parse*` functions take `serde_json::Value`, and NAPI-RS cannot
+ * convert a `Buffer` into one — it reaches the methods every `Uint8Array`
+ * inherits and fails with "JS functions cannot be represented as a
+ * serde_json::Value", which names functions for what is a plain Buffer.
+ *
+ * The conversion has to happen here because the failure is in the argument
+ * conversion, before any core code runs. Of the shapes the core accepts —
+ * hex string, `[u8]`, `{ data: [...] }` — hex is the cheapest to produce.
+ */
+/** Recursively rewrite byte containers to hex, leaving everything else as-is. */
+declare function gtvToFfiSafe(value: unknown): unknown;
+
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -1320,7 +1332,29 @@ declare class MemoryGuardManager {
     private readonly rollbackMinScore;
     private readonly enforce;
     private readonly agentPubkeyHex;
+    /**
+     * Memoized org→chain resolution. Reads have to hit the SAME chain
+     * writes did, so an org-scoped guard must resolve `orgName` to
+     * network exactly like `commitMemoryVersion` does. Without this
+     * cache the read path would either (a) hit the SDK-default chain
+     * every time — silently returning "no active memory on chain" when
+     * writes landed on the org's actual chain, or (b) hammer
+     * `/api/org-network` on every read. `undefined` means "not yet
+     * resolved"; a resolved `null` means "no org / use raw chainOpts".
+     */
+    private _resolvedChainOpts;
+    private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+     * already does this for writes; without the same call on the read
+     * path, a client on the SDK's baked default chain reads from the wrong
+     * chain and reports "no active memory" for an agent whose writes did
+     * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+     * still wins (caller vouched for it); everything else honors the
+     * dashboard's `org_networks` map.
+     */
+    private resolveChainOpts;
     /**
      * One-shot chain probe at plugin registration. Refreshes MEMORY.md
      * from chain when drifted and score passes threshold. Fire-and-forget
@@ -1509,4 +1543,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, gtvToFfiSafe, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.d.ts

@@ -408,8 +408,6 @@ interface FromConfigOptions {
 interface JudgeOptions {
     toolName?: string;
     toolArgsJson?: string;
-    provider?: string;
-    model?: string;
     verifyPubKey?: string;
     /** Per-call override of {@link AtbashOptions.orgEncryptionPubKey}. */
     orgEncryptionPubKey?: string;
@@ -807,8 +805,6 @@ interface AtbashUserConfig {
      * at construction instead.
      */
     defaultChainNetwork?: Network;
-    provider?: string;
-    providerModel?: string;
     /** "1" / "true" turns on verbose diagnostics. See AtbashOptions.debug. */
     debug?: string;
 }
@@ -879,6 +875,22 @@ declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the caus
  */
 declare function bootSyncFailureLine(cause: unknown): string;
 
+/**
+ * Make a chain query result crossable at the NAPI boundary.
+ *
+ * `postchain-client` decodes a Rell `byte_array` into a Node `Buffer`. The
+ * core's `parse*` functions take `serde_json::Value`, and NAPI-RS cannot
+ * convert a `Buffer` into one — it reaches the methods every `Uint8Array`
+ * inherits and fails with "JS functions cannot be represented as a
+ * serde_json::Value", which names functions for what is a plain Buffer.
+ *
+ * The conversion has to happen here because the failure is in the argument
+ * conversion, before any core code runs. Of the shapes the core accepts —
+ * hex string, `[u8]`, `{ data: [...] }` — hex is the cheapest to produce.
+ */
+/** Recursively rewrite byte containers to hex, leaving everything else as-is. */
+declare function gtvToFfiSafe(value: unknown): unknown;
+
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -1320,7 +1332,29 @@ declare class MemoryGuardManager {
     private readonly rollbackMinScore;
     private readonly enforce;
     private readonly agentPubkeyHex;
+    /**
+     * Memoized org→chain resolution. Reads have to hit the SAME chain
+     * writes did, so an org-scoped guard must resolve `orgName` to
+     * network exactly like `commitMemoryVersion` does. Without this
+     * cache the read path would either (a) hit the SDK-default chain
+     * every time — silently returning "no active memory on chain" when
+     * writes landed on the org's actual chain, or (b) hammer
+     * `/api/org-network` on every read. `undefined` means "not yet
+     * resolved"; a resolved `null` means "no org / use raw chainOpts".
+     */
+    private _resolvedChainOpts;
+    private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+     * already does this for writes; without the same call on the read
+     * path, a client on the SDK's baked default chain reads from the wrong
+     * chain and reports "no active memory" for an agent whose writes did
+     * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+     * still wins (caller vouched for it); everything else honors the
+     * dashboard's `org_networks` map.
+     */
+    private resolveChainOpts;
     /**
      * One-shot chain probe at plugin registration. Refreshes MEMORY.md
      * from chain when drifted and score passes threshold. Fire-and-forget
@@ -1509,4 +1543,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, gtvToFfiSafe, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.js

@@ -2908,6 +2908,7 @@ __export(src_ts_exports, {
   getMemoryHistory: () => getMemoryHistory,
   getRecentAgentMemory: () => getRecentAgentMemory,
   getRollbackHistory: () => getRollbackHistory,
+  gtvToFfiSafe: () => gtvToFfiSafe,
   guardMemoryWrite: () => guardMemoryWrite,
   isEnvelope: () => isEnvelope,
   isValidPrivateKey: () => isValidPrivateKey,
@@ -3434,33 +3435,8 @@ var ENV_MAP = {
   // Same variable name the Hermes plugin already documents.
   judgeVerifyPubKey: "ATBASH_JUDGE_VERIFY_PUBKEY",
   defaultChainNetwork: "ATBASH_DEFAULT_CHAIN_NETWORK",
-  provider: "ATBASH_PROVIDER",
-  providerModel: "ATBASH_PROVIDER_MODEL",
   debug: "ATBASH_DEBUG"
 };
-var DEPRECATED_ENV_VARS = ["ATBASH_BLOCKCHAIN_RID"];
-var DEPRECATED_CONFIG_FIELDS = ["blockchainRid"];
-var deprecatedWarned = false;
-function warnDeprecatedEnvVarsOnce(log = console.warn) {
-  if (deprecatedWarned) return;
-  for (const name2 of DEPRECATED_ENV_VARS) {
-    if (process.env[name2]) {
-      deprecatedWarned = true;
-      log(
-        `[atbash] ${name2} is ignored \u2014 each org's chain is resolved from the dashboard; set ATBASH_DEFAULT_CHAIN_NETWORK=private only to pin everything to private`
-      );
-    }
-  }
-  const fileConfig = loadUserConfig();
-  for (const field of DEPRECATED_CONFIG_FIELDS) {
-    if (fileConfig[field]) {
-      deprecatedWarned = true;
-      log(
-        `[atbash] "${field}" in ${getConfigPath()} is ignored \u2014 pass \`chain\` or \`network\` at construction instead`
-      );
-    }
-  }
-}
 function getConfigDir() {
   const home2 = process.env.HOME || (0, import_node_os3.homedir)() || "";
   return (0, import_node_path3.join)(home2, ".config", "atbash");
@@ -3619,7 +3595,6 @@ var Atbash = class _Atbash {
     this._defaultChain = resolvedChain;
     this._explicitChain = options.chain !== void 0 || options.network !== void 0 || options.blockchainRid !== void 0 && options.nodeUrls !== void 0;
     this._forcedNetwork = forcedChainNetwork();
-    warnDeprecatedEnvVarsOnce((msg) => options.logger?.warn?.(msg));
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
@@ -3877,18 +3852,15 @@ var Atbash = class _Atbash {
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
-    let signedJudgeAction;
-    if (!options.provider) {
-      const judgmentId = generateToolCallId();
-      signedJudgeAction = native.signJudgeAction(
-        judgmentId,
-        action,
-        context || "",
-        "",
-        this.auth.privkey,
-        brid
-      );
-    }
+    const judgmentId = generateToolCallId();
+    const signedJudgeAction = native.signJudgeAction(
+      judgmentId,
+      action,
+      context || "",
+      "",
+      this.auth.privkey,
+      brid
+    );
     const body = {
       tool_call_id: logResult.toolCallId,
       agent_pubkey: this.auth.pubkey,
@@ -3897,10 +3869,8 @@ var Atbash = class _Atbash {
     };
     if (signedJudgeAction) body.signed_judge_action = signedJudgeAction;
     if (context) body.context = context;
-    if (options.provider) body.provider = options.provider;
     if (options.toolName) body.tool_name = options.toolName;
     if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
-    if (options.model) body.model = options.model;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
     let resp;
@@ -4752,6 +4722,20 @@ function bootSyncFailureLine(cause) {
   );
 }
 
+// src-ts/memory/_gtv_bytes.ts
+function gtvToFfiSafe(value) {
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("hex");
+  if (Array.isArray(value)) return value.map(gtvToFfiSafe);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key3, val] of Object.entries(value)) {
+      out[key3] = gtvToFfiSafe(val);
+    }
+    return out;
+  }
+  return value;
+}
+
 // src-ts/memory/crypto.ts
 async function deriveMemoryKey(privkey) {
   return native.deriveMemoryKey(privkey);
@@ -42971,16 +42955,25 @@ async function resolveChainOptsForOrg(opts, auth) {
   return opts?.chainOpts;
 }
 function materializeChain(chainOpts) {
-  if (chainOpts?.blockchainRid && chainOpts.nodeUrls) {
+  const hasNodeUrls = chainOpts?.nodeUrls !== void 0;
+  const hasBrid = chainOpts?.blockchainRid !== void 0;
+  if (hasNodeUrls !== hasBrid) {
+    throw new Error(
+      'chainOpts.nodeUrls and chainOpts.blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `network: "public" | "private"`, or set both.'
+    );
+  }
+  if (hasNodeUrls && hasBrid) {
     return {
       nodeUrls: chainOpts.nodeUrls,
       blockchainRid: chainOpts.blockchainRid
     };
   }
-  const config2 = chainOpts?.network ? chainForNetwork(chainOpts.network) : PUBLIC_CHAIN;
+  const config2 = chainForNetwork(
+    chainOpts?.network ?? forcedChainNetwork() ?? "private"
+  );
   return {
-    nodeUrls: chainOpts?.nodeUrls ?? config2.nodeUrls,
-    blockchainRid: chainOpts?.blockchainRid ?? config2.blockchainRid
+    nodeUrls: config2.nodeUrls,
+    blockchainRid: config2.blockchainRid
   };
 }
 async function buildChainClient(chainOpts) {
@@ -43030,7 +43023,7 @@ async function commitMemoryVersion(plaintext, auth, opts) {
   );
 }
 async function decryptRow(row, key3) {
-  const parsed = native.parseMemoryRow(row);
+  const parsed = native.parseMemoryRow(gtvToFfiSafe(row));
   let content;
   let decryptError;
   try {
@@ -43070,7 +43063,7 @@ async function getActiveMemoryId(auth, chainOpts, filePath) {
     native.QUERY_GET_ACTIVE_MEMORY_ID,
     paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
-  return native.parseActiveMemoryId(raw2);
+  return native.parseActiveMemoryId(gtvToFfiSafe(raw2));
 }
 async function getRecentAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
@@ -43122,7 +43115,7 @@ async function getRollbackHistory(auth, chainOpts, filePath) {
     native.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY,
     paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
-  const parsed = native.parseRollbackRows(raw2 ?? []);
+  const parsed = native.parseRollbackRows(gtvToFfiSafe(raw2 ?? []));
   return parsed.map((r2) => ({
     fromId: r2.from_id,
     toId: r2.to_id,
@@ -43434,6 +43427,66 @@ var MemoryGuardManager = class {
   rollbackMinScore;
   enforce;
   agentPubkeyHex;
+  /**
+   * Memoized org→chain resolution. Reads have to hit the SAME chain
+   * writes did, so an org-scoped guard must resolve `orgName` to
+   * network exactly like `commitMemoryVersion` does. Without this
+   * cache the read path would either (a) hit the SDK-default chain
+   * every time — silently returning "no active memory on chain" when
+   * writes landed on the org's actual chain, or (b) hammer
+   * `/api/org-network` on every read. `undefined` means "not yet
+   * resolved"; a resolved `null` means "no org / use raw chainOpts".
+   */
+  _resolvedChainOpts = void 0;
+  _resolveChainInflight;
+  /**
+   * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+   * already does this for writes; without the same call on the read
+   * path, a client on the SDK's baked default chain reads from the wrong
+   * chain and reports "no active memory" for an agent whose writes did
+   * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+   * still wins (caller vouched for it); everything else honors the
+   * dashboard's `org_networks` map.
+   */
+  async resolveChainOpts() {
+    if (this._resolvedChainOpts !== void 0) {
+      return this._resolvedChainOpts ?? void 0;
+    }
+    if (this._resolveChainInflight) return this._resolveChainInflight;
+    this._resolveChainInflight = (async () => {
+      if (this.opts.chainOpts?.blockchainRid) {
+        this._resolvedChainOpts = this.opts.chainOpts;
+        return this.opts.chainOpts;
+      }
+      if (!this.opts.orgName) {
+        this._resolvedChainOpts = this.opts.chainOpts ?? null;
+        return this.opts.chainOpts;
+      }
+      try {
+        const atbash = new Atbash(this.opts.auth.privkey, {
+          endpoint: this.opts.judgeEndpoint,
+          verifyPubKey: this.opts.judgeVerifyPubKey,
+          orgName: this.opts.orgName
+        });
+        const resolved = await atbash.resolveChainForOrg(this.opts.orgName);
+        const chainOpts = { ...this.opts.chainOpts, network: resolved.network };
+        this._resolvedChainOpts = chainOpts;
+        this.logger.info(
+          `[atbash] resolved org \u2192 chain \u2014 org=${this.opts.orgName} network=${resolved.network}`
+        );
+        return chainOpts;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        this.logger.warn(
+          `[atbash] org \u2192 chain resolution failed (falling back to SDK default): ${msg}`
+        );
+        return this.opts.chainOpts;
+      } finally {
+        this._resolveChainInflight = void 0;
+      }
+    })();
+    return this._resolveChainInflight;
+  }
   /**
    * One-shot chain probe at plugin registration. Refreshes MEMORY.md
    * from chain when drifted and score passes threshold. Fire-and-forget
@@ -43441,11 +43494,12 @@ var MemoryGuardManager = class {
    */
   async runBootProbe() {
     try {
+      const chainOpts = await this.resolveChainOpts();
       const seed = { activeId: null, checkedAt: 0 };
       const result = await syncLocalMemory(this.opts.auth, seed, {
         ttlMs: 0,
         force: true,
-        chainOpts: this.opts.chainOpts
+        chainOpts
       });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
@@ -43584,9 +43638,10 @@ var MemoryGuardManager = class {
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
     try {
+      const chainOpts = await this.resolveChainOpts();
       result = await syncLocalMemory(this.opts.auth, pointer, {
         ttlMs: this.ttlMs,
-        chainOpts: this.opts.chainOpts
+        chainOpts
       });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
@@ -43820,6 +43875,7 @@ function diffMemorySnapshots(before, after) {
   getMemoryHistory,
   getRecentAgentMemory,
   getRollbackHistory,
+  gtvToFfiSafe,
   guardMemoryWrite,
   isEnvelope,
   isValidPrivateKey,

package/dist/index.mjs

@@ -3348,33 +3348,8 @@ var ENV_MAP = {
   // Same variable name the Hermes plugin already documents.
   judgeVerifyPubKey: "ATBASH_JUDGE_VERIFY_PUBKEY",
   defaultChainNetwork: "ATBASH_DEFAULT_CHAIN_NETWORK",
-  provider: "ATBASH_PROVIDER",
-  providerModel: "ATBASH_PROVIDER_MODEL",
   debug: "ATBASH_DEBUG"
 };
-var DEPRECATED_ENV_VARS = ["ATBASH_BLOCKCHAIN_RID"];
-var DEPRECATED_CONFIG_FIELDS = ["blockchainRid"];
-var deprecatedWarned = false;
-function warnDeprecatedEnvVarsOnce(log = console.warn) {
-  if (deprecatedWarned) return;
-  for (const name2 of DEPRECATED_ENV_VARS) {
-    if (process.env[name2]) {
-      deprecatedWarned = true;
-      log(
-        `[atbash] ${name2} is ignored \u2014 each org's chain is resolved from the dashboard; set ATBASH_DEFAULT_CHAIN_NETWORK=private only to pin everything to private`
-      );
-    }
-  }
-  const fileConfig = loadUserConfig();
-  for (const field of DEPRECATED_CONFIG_FIELDS) {
-    if (fileConfig[field]) {
-      deprecatedWarned = true;
-      log(
-        `[atbash] "${field}" in ${getConfigPath()} is ignored \u2014 pass \`chain\` or \`network\` at construction instead`
-      );
-    }
-  }
-}
 function getConfigDir() {
   const home2 = process.env.HOME || homedir3() || "";
   return join3(home2, ".config", "atbash");
@@ -3533,7 +3508,6 @@ var Atbash = class _Atbash {
     this._defaultChain = resolvedChain;
     this._explicitChain = options.chain !== void 0 || options.network !== void 0 || options.blockchainRid !== void 0 && options.nodeUrls !== void 0;
     this._forcedNetwork = forcedChainNetwork();
-    warnDeprecatedEnvVarsOnce((msg) => options.logger?.warn?.(msg));
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
@@ -3791,18 +3765,15 @@ var Atbash = class _Atbash {
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
-    let signedJudgeAction;
-    if (!options.provider) {
-      const judgmentId = generateToolCallId();
-      signedJudgeAction = native.signJudgeAction(
-        judgmentId,
-        action,
-        context || "",
-        "",
-        this.auth.privkey,
-        brid
-      );
-    }
+    const judgmentId = generateToolCallId();
+    const signedJudgeAction = native.signJudgeAction(
+      judgmentId,
+      action,
+      context || "",
+      "",
+      this.auth.privkey,
+      brid
+    );
     const body = {
       tool_call_id: logResult.toolCallId,
       agent_pubkey: this.auth.pubkey,
@@ -3811,10 +3782,8 @@ var Atbash = class _Atbash {
     };
     if (signedJudgeAction) body.signed_judge_action = signedJudgeAction;
     if (context) body.context = context;
-    if (options.provider) body.provider = options.provider;
     if (options.toolName) body.tool_name = options.toolName;
     if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
-    if (options.model) body.model = options.model;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
     let resp;
@@ -4666,6 +4635,20 @@ function bootSyncFailureLine(cause) {
   );
 }
 
+// src-ts/memory/_gtv_bytes.ts
+function gtvToFfiSafe(value) {
+  if (value instanceof Uint8Array) return Buffer.from(value).toString("hex");
+  if (Array.isArray(value)) return value.map(gtvToFfiSafe);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [key3, val] of Object.entries(value)) {
+      out[key3] = gtvToFfiSafe(val);
+    }
+    return out;
+  }
+  return value;
+}
+
 // src-ts/memory/crypto.ts
 async function deriveMemoryKey(privkey) {
   return native.deriveMemoryKey(privkey);
@@ -42885,16 +42868,25 @@ async function resolveChainOptsForOrg(opts, auth) {
   return opts?.chainOpts;
 }
 function materializeChain(chainOpts) {
-  if (chainOpts?.blockchainRid && chainOpts.nodeUrls) {
+  const hasNodeUrls = chainOpts?.nodeUrls !== void 0;
+  const hasBrid = chainOpts?.blockchainRid !== void 0;
+  if (hasNodeUrls !== hasBrid) {
+    throw new Error(
+      'chainOpts.nodeUrls and chainOpts.blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `network: "public" | "private"`, or set both.'
+    );
+  }
+  if (hasNodeUrls && hasBrid) {
     return {
       nodeUrls: chainOpts.nodeUrls,
       blockchainRid: chainOpts.blockchainRid
     };
   }
-  const config2 = chainOpts?.network ? chainForNetwork(chainOpts.network) : PUBLIC_CHAIN;
+  const config2 = chainForNetwork(
+    chainOpts?.network ?? forcedChainNetwork() ?? "private"
+  );
   return {
-    nodeUrls: chainOpts?.nodeUrls ?? config2.nodeUrls,
-    blockchainRid: chainOpts?.blockchainRid ?? config2.blockchainRid
+    nodeUrls: config2.nodeUrls,
+    blockchainRid: config2.blockchainRid
   };
 }
 async function buildChainClient(chainOpts) {
@@ -42944,7 +42936,7 @@ async function commitMemoryVersion(plaintext, auth, opts) {
   );
 }
 async function decryptRow(row, key3) {
-  const parsed = native.parseMemoryRow(row);
+  const parsed = native.parseMemoryRow(gtvToFfiSafe(row));
   let content;
   let decryptError;
   try {
@@ -42984,7 +42976,7 @@ async function getActiveMemoryId(auth, chainOpts, filePath) {
     native.QUERY_GET_ACTIVE_MEMORY_ID,
     paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
-  return native.parseActiveMemoryId(raw2);
+  return native.parseActiveMemoryId(gtvToFfiSafe(raw2));
 }
 async function getRecentAgentMemory(auth, chainOpts, filePath) {
   const client = await buildChainClient(chainOpts);
@@ -43036,7 +43028,7 @@ async function getRollbackHistory(auth, chainOpts, filePath) {
     native.QUERY_GET_AGENT_MEMORY_ROLLBACK_HISTORY,
     paramsWithOptionalFilePath(q.agent_pubkey_hex, q.file_path)
   );
-  const parsed = native.parseRollbackRows(raw2 ?? []);
+  const parsed = native.parseRollbackRows(gtvToFfiSafe(raw2 ?? []));
   return parsed.map((r2) => ({
     fromId: r2.from_id,
     toId: r2.to_id,
@@ -43348,6 +43340,66 @@ var MemoryGuardManager = class {
   rollbackMinScore;
   enforce;
   agentPubkeyHex;
+  /**
+   * Memoized org→chain resolution. Reads have to hit the SAME chain
+   * writes did, so an org-scoped guard must resolve `orgName` to
+   * network exactly like `commitMemoryVersion` does. Without this
+   * cache the read path would either (a) hit the SDK-default chain
+   * every time — silently returning "no active memory on chain" when
+   * writes landed on the org's actual chain, or (b) hammer
+   * `/api/org-network` on every read. `undefined` means "not yet
+   * resolved"; a resolved `null` means "no org / use raw chainOpts".
+   */
+  _resolvedChainOpts = void 0;
+  _resolveChainInflight;
+  /**
+   * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
+   * already does this for writes; without the same call on the read
+   * path, a client on the SDK's baked default chain reads from the wrong
+   * chain and reports "no active memory" for an agent whose writes did
+   * land — on the org's actual chain. An explicit `chainOpts.blockchainRid`
+   * still wins (caller vouched for it); everything else honors the
+   * dashboard's `org_networks` map.
+   */
+  async resolveChainOpts() {
+    if (this._resolvedChainOpts !== void 0) {
+      return this._resolvedChainOpts ?? void 0;
+    }
+    if (this._resolveChainInflight) return this._resolveChainInflight;
+    this._resolveChainInflight = (async () => {
+      if (this.opts.chainOpts?.blockchainRid) {
+        this._resolvedChainOpts = this.opts.chainOpts;
+        return this.opts.chainOpts;
+      }
+      if (!this.opts.orgName) {
+        this._resolvedChainOpts = this.opts.chainOpts ?? null;
+        return this.opts.chainOpts;
+      }
+      try {
+        const atbash = new Atbash(this.opts.auth.privkey, {
+          endpoint: this.opts.judgeEndpoint,
+          verifyPubKey: this.opts.judgeVerifyPubKey,
+          orgName: this.opts.orgName
+        });
+        const resolved = await atbash.resolveChainForOrg(this.opts.orgName);
+        const chainOpts = { ...this.opts.chainOpts, network: resolved.network };
+        this._resolvedChainOpts = chainOpts;
+        this.logger.info(
+          `[atbash] resolved org \u2192 chain \u2014 org=${this.opts.orgName} network=${resolved.network}`
+        );
+        return chainOpts;
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        this.logger.warn(
+          `[atbash] org \u2192 chain resolution failed (falling back to SDK default): ${msg}`
+        );
+        return this.opts.chainOpts;
+      } finally {
+        this._resolveChainInflight = void 0;
+      }
+    })();
+    return this._resolveChainInflight;
+  }
   /**
    * One-shot chain probe at plugin registration. Refreshes MEMORY.md
    * from chain when drifted and score passes threshold. Fire-and-forget
@@ -43355,11 +43407,12 @@ var MemoryGuardManager = class {
    */
   async runBootProbe() {
     try {
+      const chainOpts = await this.resolveChainOpts();
       const seed = { activeId: null, checkedAt: 0 };
       const result = await syncLocalMemory(this.opts.auth, seed, {
         ttlMs: 0,
         force: true,
-        chainOpts: this.opts.chainOpts
+        chainOpts
       });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
@@ -43498,9 +43551,10 @@ var MemoryGuardManager = class {
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
     try {
+      const chainOpts = await this.resolveChainOpts();
       result = await syncLocalMemory(this.opts.auth, pointer, {
         ttlMs: this.ttlMs,
-        chainOpts: this.opts.chainOpts
+        chainOpts
       });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
@@ -43733,6 +43787,7 @@ export {
   getMemoryHistory,
   getRecentAgentMemory,
   getRollbackHistory,
+  gtvToFfiSafe,
   guardMemoryWrite,
   isEnvelope,
   isValidPrivateKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.15.1-dev.0",
+  "version": "0.16.0-dev.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -89,10 +89,10 @@
     "typescript-eslint": "^8.62.1"
   },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.15.1-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.15.1-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.15.1-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.15.1-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.15.1-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.16.0-dev.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.16.0-dev.0",
+    "@atbash/sdk-linux-x64-musl": "0.16.0-dev.0",
+    "@atbash/sdk-darwin-arm64": "0.16.0-dev.0",
+    "@atbash/sdk-win32-x64-msvc": "0.16.0-dev.0"
   }
 }