@atbash/sdk 0.16.2-dev.0 → 0.16.4-dev.0

package/dist/browser.d.mts

@@ -1079,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1247,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/browser.mjs

@@ -10054,8 +10054,8 @@ Reporter$3.prototype.wrapResult = function wrapResult(result) {
     errors: state2.errors
   };
 };
-function ReporterError$1(path4, msg) {
-  this.path = path4;
+function ReporterError$1(path3, msg) {
+  this.path = path3;
   this.rethrow(msg);
 }
 inherits$v(ReporterError$1, Error);
@@ -12126,7 +12126,7 @@ function requireBuffer_list() {
       }
     }, {
       key: "join",
-      value: function join3(s2) {
+      value: function join2(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -16208,7 +16208,7 @@ function requireBufferList() {
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList2.prototype.join = function join3(s2) {
+      BufferList2.prototype.join = function join2(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -30276,8 +30276,8 @@ Reporter.prototype.wrapResult = function wrapResult2(result) {
     errors: state2.errors
   };
 };
-function ReporterError(path4, msg) {
-  this.path = path4;
+function ReporterError(path3, msg) {
+  this.path = path3;
   this.rethrow(msg);
 }
 inherits(ReporterError, Error);
@@ -30372,7 +30372,7 @@ function requireBuffer() {
     }
   }
   buffer.EncoderBuffer = EncoderBuffer2;
-  EncoderBuffer2.prototype.join = function join3(out, offset) {
+  EncoderBuffer2.prototype.join = function join2(out, offset) {
     if (!out)
       out = new Buffer5(this.length);
     if (!offset)
@@ -33307,8 +33307,8 @@ var parseUtil = {};
   const errors_js_12 = errors$3;
   const en_js_12 = __importDefault2(en);
   const makeIssue = (params) => {
-    const { data, path: path4, errorMaps, issueData } = params;
-    const fullPath = [...path4, ...issueData.path || []];
+    const { data, path: path3, errorMaps, issueData } = params;
+    const fullPath = [...path3, ...issueData.path || []];
     const fullIssue = {
       ...issueData,
       path: fullPath
@@ -33445,11 +33445,11 @@ var errorUtil_js_1 = errorUtil$1;
 var parseUtil_js_1 = parseUtil;
 var util_js_1 = util;
 var ParseInputLazyPath = class {
-  constructor(parent, value, path4, key3) {
+  constructor(parent, value, path3, key3) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path4;
+    this._path = path3;
     this._key = key3;
   }
   get path() {
@@ -40355,21 +40355,21 @@ function createTimeoutController(timeout) {
   const timeoutId = setTimeout(() => controller.abort(timeoutError), timeout);
   return { controller, timeoutId };
 }
-function handleRequest(method, path4, endpoint, timeout, postObject) {
+function handleRequest(method, path3, endpoint, timeout, postObject) {
   return __awaiter$2(this, void 0, void 0, function* () {
     if (method == enums_1$2.Method.GET) {
-      return yield get(path4, endpoint, timeout);
+      return yield get(path3, endpoint, timeout);
     } else {
-      return yield post(path4, endpoint, timeout, postObject);
+      return yield post(path3, endpoint, timeout, postObject);
     }
   });
 }
-function get(path4, endpoint, timeout) {
+function get(path3, endpoint, timeout) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`GET URL ${new URL(path4, endpoint).href}`);
+    logger.debug(`GET URL ${new URL(path3, endpoint).href}`);
     try {
       const { controller, timeoutId } = createTimeoutController(timeout);
-      const response = yield fetch(new URL(path4, endpoint).href, {
+      const response = yield fetch(new URL(path3, endpoint).href, {
         signal: controller === null || controller === void 0 ? void 0 : controller.signal
       });
       if (timeoutId)
@@ -40407,9 +40407,9 @@ function constructBufferResponseBody(response) {
     return responseText ? responseText : response.statusText;
   });
 }
-function post(path4, endpoint, timeout, requestBody) {
+function post(path3, endpoint, timeout, requestBody) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`POST URL ${new URL(path4, endpoint).href}`);
+    logger.debug(`POST URL ${new URL(path3, endpoint).href}`);
     logger.debug(`POST body ${JSON.stringify(requestBody)}`);
     if (buffer_1.Buffer.isBuffer(requestBody)) {
       try {
@@ -40423,7 +40423,7 @@ function post(path4, endpoint, timeout, requestBody) {
           },
           signal: controller === null || controller === void 0 ? void 0 : controller.signal
         };
-        const response = yield fetch(new URL(path4, endpoint).href, requestOptions);
+        const response = yield fetch(new URL(path3, endpoint).href, requestOptions);
         if (timeoutId)
           clearTimeout(timeoutId);
         const transactionTimestamp = response.headers.get("X-Transaction-Timestamp");
@@ -40434,7 +40434,7 @@ function post(path4, endpoint, timeout, requestBody) {
     } else {
       try {
         const { controller, timeoutId } = createTimeoutController(timeout);
-        const response = yield fetch(new URL(path4, endpoint).href, {
+        const response = yield fetch(new URL(path3, endpoint).href, {
           method: "post",
           body: JSON.stringify(requestBody),
           headers: {
@@ -40614,10 +40614,10 @@ function requireFailoverStrategies() {
       }
     }
     function abortOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path4,
+          path: path3,
           config: config2,
           postObject,
           timeoutOverride,
@@ -40628,10 +40628,10 @@ function requireFailoverStrategies() {
       });
     }
     function tryNextOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path4,
+          path: path3,
           config: config2,
           postObject,
           timeoutOverride,
@@ -40647,7 +40647,7 @@ function requireFailoverStrategies() {
       return endpointPoolLength - (endpointPoolLength - 1) / 3;
     }
     function queryMajority(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         var _b;
         const bftMajorityThreshold = calculateBftMajorityThreshold(config2.endpointPool.length);
         const failureThreshold = config2.endpointPool.length - bftMajorityThreshold + 1;
@@ -40658,7 +40658,7 @@ function requireFailoverStrategies() {
         const promises = availableNodes.map((node2) => __awaiter2(this, void 0, void 0, function* () {
           try {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path4, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             const { statusCode } = response;
             if (statusCode && (0, http_utils_1.isSuccessfulStatusCode)(statusCode)) {
               outcomes.push({ type: "SUCCESS", result: response });
@@ -40705,7 +40705,7 @@ function requireFailoverStrategies() {
       });
     }
     function singleEndpoint(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         let statusCode = null;
         let rspBody = null;
         let error4 = null;
@@ -40716,7 +40716,7 @@ function requireFailoverStrategies() {
         }
         for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
           const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-          const response = yield (0, httpUtil_1.handleRequest)(method, path4, endpoint.url, requestTimeout, postObject);
+          const response = yield (0, httpUtil_1.handleRequest)(method, path3, endpoint.url, requestTimeout, postObject);
           if (response) {
             ({ error: error4, statusCode, rspBody, transactionTimestamp } = response);
           }
@@ -40731,7 +40731,7 @@ function requireFailoverStrategies() {
       });
     }
     function retryRequest(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
         var _b, _c, _d;
         let statusCode = null;
         let rspBody = null;
@@ -40742,7 +40742,7 @@ function requireFailoverStrategies() {
         for (const node2 of availableNodes) {
           for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path4, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             error4 = (_b = response === null || response === void 0 ? void 0 : response.error) !== null && _b !== void 0 ? _b : null;
             statusCode = (_c = response === null || response === void 0 ? void 0 : response.statusCode) !== null && _c !== void 0 ? _c : null;
             rspBody = (_d = response === null || response === void 0 ? void 0 : response.rspBody) !== null && _d !== void 0 ? _d : null;
@@ -40885,19 +40885,19 @@ function requireRequestWithFailoverStrategy() {
   const enums_12 = enums;
   const failoverStrategies_1 = requireFailoverStrategies();
   function requestWithFailoverStrategy$1(method_1, path_1, config_1, postObject_1) {
-    return __awaiter2(this, arguments, void 0, function* (method, path4, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
+    return __awaiter2(this, arguments, void 0, function* (method, path3, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
       switch (config2.failoverStrategy) {
         case enums_12.FailoverStrategy.AbortOnError:
-          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.TryNextOnError:
-          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.SingleEndpoint:
-          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.QueryMajority:
           if (forceSingleEndpoint) {
-            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path4, config: config2, postObject, timeoutOverride });
+            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
           }
-          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path3, config: config2, postObject, timeoutOverride });
         default:
           throw new Error(`Unsupported failover strategy: ${config2.failoverStrategy}`);
       }
@@ -42096,7 +42096,7 @@ var networkSettings = {};
     const restNetworkSettingsValidationContext = RestNetworkSettingsSchema.safeParse(networkSettings2);
     if ("error" in restNetworkSettingsValidationContext) {
       const { error: { issues } = {} } = restNetworkSettingsValidationContext;
-      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path4 }) => `${path4[0]}: ${message}`).join(", ");
+      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path3 }) => `${path3[0]}: ${message}`).join(", ");
       if (throwOnError) {
         throw new Error(errorMessage2);
       }
@@ -44420,12 +44420,12 @@ var AtbashAPIError = class extends Error {
    * ran does not carry. The path is the fact that settles it.
    */
   path;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path4) {
-    super(enrich(status, body, statusText, endpoint, path4));
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path3) {
+    super(enrich(status, body, statusText, endpoint, path3));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
-    this.path = path4;
+    this.path = path3;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -44434,9 +44434,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint, path4) {
+function enrich(status, body, statusText, endpoint, path3) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}${path4 ? ` from ${path4}` : ""}: ${body || statusText}`;
+  let msg = `API error ${status}${path3 ? ` from ${path3}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -44467,8 +44467,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path4, query) {
-    const url = new URL(this.baseUrl + path4);
+  buildUrl(path3, query) {
+    const url = new URL(this.baseUrl + path3);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -44478,14 +44478,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path4, query, headers) {
-    return this.fetch(this.buildUrl(path4, query), {
+  async get(path3, query, headers) {
+    return this.fetch(this.buildUrl(path3, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path4, body, headers) {
-    return this.fetch(this.buildUrl(path4), {
+  async post(path3, body, headers) {
+    return this.fetch(this.buildUrl(path3), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -44528,6 +44528,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -44792,7 +44799,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -45619,8 +45625,8 @@ var Atbash = class _Atbash {
   async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      const path4 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path4, body, this.authHeaders(brid));
+      const path3 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path3, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -45860,27 +45866,18 @@ function truncate(text, limit = MAX_ACTION_LEN) {
   return text.slice(0, limit) + "\u2026";
 }
 
-// src-ts/key-path.ts
+// src-ts/browser/key-path.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-import { homedir } from "os";
-import { join as join2 } from "path";
-var KEY_DIR_REL = ".config/atbash";
 var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
-function home() {
-  return process.env.HOME || homedir() || "";
-}
-function expandHome(p) {
-  if (!p.startsWith("~/")) return p;
-  return join2(home(), p.slice(2));
-}
+var unavailable = (name2) => {
+  throw new Error(`${name2} is not available in the browser bundle`);
+};
 function keyPathCandidates() {
-  return KEY_FILENAMES.map((name2) => join2(home(), KEY_DIR_REL, name2));
+  return unavailable("keyPathCandidates");
 }
-function chooseKeyPath(input, exists) {
-  if (input) return expandHome(input);
-  const candidates = keyPathCandidates();
-  return candidates.find(exists) ?? candidates[0];
+function chooseKeyPath(_input, _exists) {
+  return unavailable("chooseKeyPath");
 }
 
 // src-ts/redact.ts
@@ -46100,112 +46097,12 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
   throw new Error(`classifyMemoryWrite ${STUB_MSG4}`);
 }
 
-// src-ts/memory/guard.ts
+// src-ts/browser/memory-guard.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-import path3 from "path";
-function emitDebugProbe(event, ctx, memEntry, logger2) {
-  if (!logger2?.info) return;
-  const ev = event ?? {};
-  const c = ctx ?? {};
-  const argsCandidate = ev.params ?? c.params ?? ev.args ?? c.args ?? ev.arguments ?? c.arguments;
-  const argsObj = argsCandidate && typeof argsCandidate === "object" ? argsCandidate : {};
-  const argsKeys = Object.keys(argsObj).slice(0, 20);
-  const pickedPath = typeof argsObj.file_path === "string" && argsObj.file_path || typeof argsObj.path === "string" && argsObj.path || typeof argsObj.filename === "string" && argsObj.filename || null;
-  const editsArr = Array.isArray(argsObj.edits) ? argsObj.edits : null;
-  const firstEditKeys = editsArr && editsArr[0] && typeof editsArr[0] === "object" ? Object.keys(editsArr[0]).slice(0, 10) : null;
-  const tool = ev.toolName ?? c.tool?.name ?? c.toolName ?? c.name ?? "(none)";
-  logger2.info("[atbash][probe] before_tool_call", {
-    toolName: tool,
-    eventKeys: Object.keys(ev).slice(0, 20),
-    ctxKeys: Object.keys(c).slice(0, 20),
-    argsKeys,
-    pickedPath,
-    firstEditKeys,
-    editsCount: editsArr?.length,
-    memoryWrite: !!memEntry,
-    memoryPath: memEntry?.key
-  });
-}
-async function guardMemoryWrite(input) {
-  const {
-    event,
-    ctx,
-    auth,
-    endpoint,
-    verifyPubKey,
-    orgName,
-    threshold,
-    patterns,
-    toolNames,
-    enforce = true,
-    debug: debug2 = false,
-    logger: logger2
-  } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
-  if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
-  if (!memEntry) return { handled: false };
-  let scanResult;
-  try {
-    scanResult = await scanMemory(memEntry, auth, {
-      endpoint,
-      verifyPubKey,
-      orgName,
-      threshold
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory scan failed", {
-      path: memEntry.key,
-      reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason } : { allow: true }
-    };
-  }
-  if (scanResult.verdict === "red") {
-    logger2?.warn?.("[atbash] memory BLOCK", {
-      path: memEntry.key,
-      reason: scanResult.reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason: scanResult.reason } : { allow: true },
-      scanResult,
-      committed: false
-    };
-  }
-  const filePath = path3.basename(memEntry.key);
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    filePath,
-    orgName,
-    endpoint,
-    verifyPubKey
-  }).catch((err) => {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory commit to chain failed", {
-      path: memEntry.key,
-      filePath,
-      reason
-    });
-  });
-  logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
-    {
-      path: memEntry.key,
-      filePath,
-      score: scanResult.score,
-      reason: scanResult.reason
-    }
-  );
-  return {
-    handled: true,
-    decision: { allow: true },
-    scanResult,
-    committed: true
-  };
+var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 guard memory writes agent-side";
+async function guardMemoryWrite(_input) {
+  throw new Error(`guardMemoryWrite ${STUB_MSG5}`);
 }
 
 // src-ts/memory/sync.ts
@@ -46245,7 +46142,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 // src-ts/browser/memory-pointer-store.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable = (name2) => {
+var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var PointerStore = class {
@@ -46259,38 +46156,38 @@ var PointerStore = class {
   }
 };
 function defaultPointerPath(_workspaceDir) {
-  return unavailable("defaultPointerPath");
+  return unavailable2("defaultPointerPath");
 }
 
 // src-ts/browser/memory-file-logger.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable2 = (name2) => {
+var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 function createFileLogger(_logFilePath, _hostLogger) {
-  return unavailable2("createFileLogger");
+  return unavailable3("createFileLogger");
 }
 function defaultPluginLogPath(_workspaceDir) {
-  return unavailable2("defaultPluginLogPath");
+  return unavailable3("defaultPluginLogPath");
 }
 
 // src-ts/browser/memory-read-classifier.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
+var STUB_MSG6 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
   "memory_search",
   "memory_get"
 ];
 function classifyMemoryRead(_event, _ctx, _opts = {}) {
-  throw new Error(`classifyMemoryRead ${STUB_MSG5}`);
+  throw new Error(`classifyMemoryRead ${STUB_MSG6}`);
 }
 
 // src-ts/browser/memory-guard-manager.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable3 = (name2) => {
+var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var MemoryGuardManager = class {
@@ -46310,7 +46207,7 @@ var MemoryGuardManager = class {
   }
 };
 function createMemoryGuardManager(_opts) {
-  return unavailable3("createMemoryGuardManager");
+  return unavailable4("createMemoryGuardManager");
 }
 
 // src-ts/index.ts

package/dist/index.d.mts

@@ -1079,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1247,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/index.d.ts

@@ -1079,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1247,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/index.js

@@ -3190,6 +3190,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -3354,6 +3361,7 @@ var meterProvider = null;
 var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
+var sourceExplicitlySet = false;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3377,11 +3385,14 @@ function autoInit() {
 }
 function setupTelemetry(config2) {
   if (!config2.enabled) return;
-  if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (config2.source && !sourceExplicitlySet) {
+    defaultSource = config2.source;
+    sourceExplicitlySet = true;
+  }
+  if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
   if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
-  defaultSource = config2.source ?? "sdk";
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new import_exporter_metrics_otlp_http.OTLPMetricExporter({
@@ -3434,6 +3445,8 @@ async function shutdownTelemetry() {
   meterProvider = null;
   callCounter = null;
   durationHistogram = null;
+  defaultSource = "sdk";
+  sourceExplicitlySet = false;
 }
 
 // src-ts/userConfig.ts
@@ -3624,7 +3637,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -35320,9 +35332,9 @@ var ZodUnion = class extends ZodType {
   }
 };
 types.ZodUnion = ZodUnion;
-ZodUnion.create = (types2, params) => {
+ZodUnion.create = (types3, params) => {
   return new ZodUnion({
-    options: types2,
+    options: types3,
     typeName: ZodFirstPartyTypeKind.ZodUnion,
     ...processCreateParams(params)
   });
@@ -38779,9 +38791,9 @@ _nodeUtil.exports;
   var freeProcess = moduleExports && freeGlobal2.process;
   var nodeUtil2 = (function() {
     try {
-      var types2 = freeModule && freeModule.require && freeModule.require("util").types;
-      if (types2) {
-        return types2;
+      var types3 = freeModule && freeModule.require && freeModule.require("util").types;
+      if (types3) {
+        return types3;
       }
       return freeProcess && freeProcess.binding && freeProcess.binding("util");
     } catch (e) {
@@ -43161,12 +43173,96 @@ async function rollbackMemory(toId, reason, auth, opts) {
 }
 
 // src-ts/memory/_json_safe.ts
+var import_node_util = require("util");
+var replacementKeys = [
+  "newText",
+  "new_string",
+  "new_str",
+  "newStr",
+  "replacement"
+];
+var argumentKeys = [
+  "file_path",
+  "path",
+  "filename",
+  "target",
+  "file",
+  "filePath",
+  "content",
+  ...replacementKeys,
+  "value",
+  "text"
+];
+var maxPrototypeDepth = 32;
+var maxEditSlots = 65536;
+var maxTextUnits = 16 * 1024 * 1024;
+function invalid() {
+  throw new TypeError("Unreadable or unsupported memory classifier input");
+}
+function dataProperty(value, key3) {
+  let current = value;
+  for (let depth = 0; current !== null; depth++) {
+    if (depth >= maxPrototypeDepth || import_node_util.types.isProxy(current)) invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(current, key3);
+    if (descriptor) {
+      if (!("value" in descriptor)) invalid();
+      return descriptor.value;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return void 0;
+}
 function toJsonSafe(value) {
-  try {
-    return JSON.parse(JSON.stringify(value ?? null));
-  } catch {
-    return null;
+  let textUnits = 0;
+  function scalar(input) {
+    if (input == null) return null;
+    if (typeof input === "string") {
+      textUnits += input.length;
+      if (textUnits > maxTextUnits) invalid();
+      return input;
+    }
+    if (typeof input === "boolean") return input;
+    if (typeof input === "number" && Number.isFinite(input)) return input;
+    return invalid();
+  }
+  function project(input, shape) {
+    if (input == null || typeof input !== "object") return scalar(input);
+    if (import_node_util.types.isProxy(input) || Array.isArray(input)) invalid();
+    const output = /* @__PURE__ */ Object.create(null);
+    const keys2 = shape === "envelope" ? ["toolName", "name"] : shape === "tool" ? ["name"] : shape === "args" ? argumentKeys : replacementKeys;
+    for (const key3 of keys2) {
+      const field = dataProperty(input, key3);
+      if (field !== void 0) output[key3] = scalar(field);
+    }
+    if (shape === "envelope") {
+      for (const key3 of ["params", "args", "arguments", "tool"]) {
+        const field = dataProperty(input, key3);
+        if (field !== void 0)
+          output[key3] = project(field, key3 === "tool" ? "tool" : "args");
+      }
+    }
+    if (shape === "args") {
+      const edits = dataProperty(input, "edits");
+      if (edits !== void 0) {
+        if (edits !== null && typeof edits === "object" && import_node_util.types.isProxy(edits))
+          invalid();
+        if (Array.isArray(edits)) {
+          const length = dataProperty(edits, "length");
+          if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > maxEditSlots)
+            invalid();
+          const entries = [];
+          for (let index2 = 0; index2 < length; index2++) {
+            entries.push(project(dataProperty(edits, String(index2)), "edit"));
+          }
+          output.edits = entries;
+        } else {
+          output.edits = scalar(edits);
+        }
+      }
+    }
+    return output;
   }
+  return project(value, "envelope");
 }
 
 // src-ts/memory/classifier.ts
@@ -43219,7 +43315,22 @@ async function guardMemoryWrite(input) {
     debug: debug2 = false,
     logger: logger2
   } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  let memEntry;
+  try {
+    memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory classifier refused this tool call's input", { reason: why });
+    if (!enforce) return { handled: false };
+    return {
+      handled: true,
+      decision: {
+        allow: false,
+        block: true,
+        reason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`
+      }
+    };
+  }
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
   if (!memEntry) return { handled: false };
   let scanResult;
@@ -43563,7 +43674,21 @@ var MemoryGuardManager = class {
    * that allows is a call the host still needs to judge.
    */
   async handleBeforeToolCall(event, ctx) {
-    if (classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier)) {
+    let isMemoryRead;
+    try {
+      isMemoryRead = classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier);
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] memory classifier refused this tool call's input", { reason: why });
+      if (!this.enforce) return null;
+      return {
+        allow: false,
+        block: true,
+        blockReason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`,
+        audited: true
+      };
+    }
+    if (isMemoryRead) {
       this.logger.info("[atbash] memory read intercepted \u2014 running sync check");
       return await this.handleMemoryRead(event, ctx);
     }

package/dist/index.mjs

@@ -3094,6 +3094,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -3261,6 +3268,7 @@ var meterProvider = null;
 var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
+var sourceExplicitlySet = false;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3284,11 +3292,14 @@ function autoInit() {
 }
 function setupTelemetry(config2) {
   if (!config2.enabled) return;
-  if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (config2.source && !sourceExplicitlySet) {
+    defaultSource = config2.source;
+    sourceExplicitlySet = true;
+  }
+  if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
   if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
-  defaultSource = config2.source ?? "sdk";
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new OTLPMetricExporter({
@@ -3341,6 +3352,8 @@ async function shutdownTelemetry() {
   meterProvider = null;
   callCounter = null;
   durationHistogram = null;
+  defaultSource = "sdk";
+  sourceExplicitlySet = false;
 }
 
 // src-ts/userConfig.ts
@@ -3537,7 +3550,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -35233,9 +35245,9 @@ var ZodUnion = class extends ZodType {
   }
 };
 types.ZodUnion = ZodUnion;
-ZodUnion.create = (types2, params) => {
+ZodUnion.create = (types3, params) => {
   return new ZodUnion({
-    options: types2,
+    options: types3,
     typeName: ZodFirstPartyTypeKind.ZodUnion,
     ...processCreateParams(params)
   });
@@ -38692,9 +38704,9 @@ _nodeUtil.exports;
   var freeProcess = moduleExports && freeGlobal2.process;
   var nodeUtil2 = (function() {
     try {
-      var types2 = freeModule && freeModule.require && freeModule.require("util").types;
-      if (types2) {
-        return types2;
+      var types3 = freeModule && freeModule.require && freeModule.require("util").types;
+      if (types3) {
+        return types3;
       }
       return freeProcess && freeProcess.binding && freeProcess.binding("util");
     } catch (e) {
@@ -43074,12 +43086,96 @@ async function rollbackMemory(toId, reason, auth, opts) {
 }
 
 // src-ts/memory/_json_safe.ts
+import { types as types2 } from "util";
+var replacementKeys = [
+  "newText",
+  "new_string",
+  "new_str",
+  "newStr",
+  "replacement"
+];
+var argumentKeys = [
+  "file_path",
+  "path",
+  "filename",
+  "target",
+  "file",
+  "filePath",
+  "content",
+  ...replacementKeys,
+  "value",
+  "text"
+];
+var maxPrototypeDepth = 32;
+var maxEditSlots = 65536;
+var maxTextUnits = 16 * 1024 * 1024;
+function invalid() {
+  throw new TypeError("Unreadable or unsupported memory classifier input");
+}
+function dataProperty(value, key3) {
+  let current = value;
+  for (let depth = 0; current !== null; depth++) {
+    if (depth >= maxPrototypeDepth || types2.isProxy(current)) invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(current, key3);
+    if (descriptor) {
+      if (!("value" in descriptor)) invalid();
+      return descriptor.value;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return void 0;
+}
 function toJsonSafe(value) {
-  try {
-    return JSON.parse(JSON.stringify(value ?? null));
-  } catch {
-    return null;
+  let textUnits = 0;
+  function scalar(input) {
+    if (input == null) return null;
+    if (typeof input === "string") {
+      textUnits += input.length;
+      if (textUnits > maxTextUnits) invalid();
+      return input;
+    }
+    if (typeof input === "boolean") return input;
+    if (typeof input === "number" && Number.isFinite(input)) return input;
+    return invalid();
+  }
+  function project(input, shape) {
+    if (input == null || typeof input !== "object") return scalar(input);
+    if (types2.isProxy(input) || Array.isArray(input)) invalid();
+    const output = /* @__PURE__ */ Object.create(null);
+    const keys2 = shape === "envelope" ? ["toolName", "name"] : shape === "tool" ? ["name"] : shape === "args" ? argumentKeys : replacementKeys;
+    for (const key3 of keys2) {
+      const field = dataProperty(input, key3);
+      if (field !== void 0) output[key3] = scalar(field);
+    }
+    if (shape === "envelope") {
+      for (const key3 of ["params", "args", "arguments", "tool"]) {
+        const field = dataProperty(input, key3);
+        if (field !== void 0)
+          output[key3] = project(field, key3 === "tool" ? "tool" : "args");
+      }
+    }
+    if (shape === "args") {
+      const edits = dataProperty(input, "edits");
+      if (edits !== void 0) {
+        if (edits !== null && typeof edits === "object" && types2.isProxy(edits))
+          invalid();
+        if (Array.isArray(edits)) {
+          const length = dataProperty(edits, "length");
+          if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > maxEditSlots)
+            invalid();
+          const entries = [];
+          for (let index2 = 0; index2 < length; index2++) {
+            entries.push(project(dataProperty(edits, String(index2)), "edit"));
+          }
+          output.edits = entries;
+        } else {
+          output.edits = scalar(edits);
+        }
+      }
+    }
+    return output;
   }
+  return project(value, "envelope");
 }
 
 // src-ts/memory/classifier.ts
@@ -43132,7 +43228,22 @@ async function guardMemoryWrite(input) {
     debug: debug2 = false,
     logger: logger2
   } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  let memEntry;
+  try {
+    memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory classifier refused this tool call's input", { reason: why });
+    if (!enforce) return { handled: false };
+    return {
+      handled: true,
+      decision: {
+        allow: false,
+        block: true,
+        reason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`
+      }
+    };
+  }
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
   if (!memEntry) return { handled: false };
   let scanResult;
@@ -43476,7 +43587,21 @@ var MemoryGuardManager = class {
    * that allows is a call the host still needs to judge.
    */
   async handleBeforeToolCall(event, ctx) {
-    if (classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier)) {
+    let isMemoryRead;
+    try {
+      isMemoryRead = classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier);
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] memory classifier refused this tool call's input", { reason: why });
+      if (!this.enforce) return null;
+      return {
+        allow: false,
+        block: true,
+        blockReason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`,
+        audited: true
+      };
+    }
+    if (isMemoryRead) {
       this.logger.info("[atbash] memory read intercepted \u2014 running sync check");
       return await this.handleMemoryRead(event, ctx);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.16.2-dev.0",
+  "version": "0.16.4-dev.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -54,7 +54,7 @@
     "build:native": "napi build --platform --release",
     "build:native:debug": "napi build --platform",
     "gen:http": "openapi-typescript ../../spec/openapi.yaml -o src-ts/http/schema.ts",
-    "build:ts": "tsup",
+    "build:ts": "tsup && node scripts/assert-browser-bundle-clean.mjs",
     "build": "npm run build:native && npm run build:ts",
     "test:native": "node --test __test__/vector_parity.test.mjs",
     "test:sdk": "node --test __test__/*.sdk.test.mjs",
@@ -89,10 +89,10 @@
     "typescript-eslint": "^8.62.1"
   },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.16.2-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.16.2-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.16.2-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.16.2-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.16.2-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.16.4-dev.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.16.4-dev.0",
+    "@atbash/sdk-linux-x64-musl": "0.16.4-dev.0",
+    "@atbash/sdk-darwin-arm64": "0.16.4-dev.0",
+    "@atbash/sdk-win32-x64-msvc": "0.16.4-dev.0"
   }
 }