@atbash/sdk 0.17.0-dev.0 → 0.18.0-dev.0

package/dist/browser.d.mts

@@ -136,14 +136,24 @@ interface MemoryScanOptions {
 type Network = "public" | "private";
 /**
  * Per-call chain overrides. Pass exactly what you need to override —
- * `network` selects between the SDK's known chains, `blockchainRid` /
- * `nodeUrls` pin a fully custom chain. Pass none of these to fall back
- * to the SDK's defaults (or to org-resolved chain when `orgName` is set).
+ * `network` selects between the SDK's known chains, `blockchainRid` pins a
+ * custom one, and `endpoint` names the Dashboard the calls travel over. Pass
+ * none of these to fall back to the SDK's defaults (or to the org-resolved
+ * chain when `orgName` is set).
  */
 interface ChainOpts {
     network?: Network;
     blockchainRid?: string;
+    /**
+     * No longer dialled: memory reaches the chain through the Dashboard. Kept
+     * because callers and the other bindings still carry it as chain config.
+     */
     nodeUrls?: readonly string[];
+    /**
+     * Dashboard base URL. Memory reaches the chain through it, so this is where
+     * those requests go; defaults to the endpoint compiled into the core.
+     */
+    endpoint?: string;
 }
 /** Canonical verdict after normalization. */
 type Verdict = "ALLOW" | "HOLD" | "BLOCK" | "No verdict";
@@ -527,12 +537,6 @@ declare class Atbash {
      */
     private _agentExistsCache;
     private static readonly AGENT_EXISTS_TTL_MS;
-    /**
-     * Cached bearer token for risk-engine / insurance read calls. Built
-     * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
-     * server-side replay protection windows never expire it mid-session.
-     */
-    private _authBearers;
     /** Guards `logEnvironmentOnce` — hosts construct several clients. */
     private static environmentLogged;
     constructor(privkey: string, options?: AtbashOptions);
@@ -555,6 +559,48 @@ declare class Atbash {
      * validated against the trusted allowlist / self-hosted policy; a
      * self-hosted endpoint's `verifyPubKey` becomes the client default.
      */
+    /**
+     * Decide which key this client signs as.
+     *
+     * Most specific wins: a key passed in code, then a key file the host named,
+     * then the environment, then the default key file. `config.json` is absent
+     * from that list on purpose — it is a settings file, writable by anything
+     * that can write the user's home and read by every Atbash integration on the
+     * machine, so letting it name the key meant one stray value silently
+     * re-pointed who each of them signed as.
+     *
+     * A named `keyPath` that does not exist throws rather than falling through.
+     * The caller said which file holds its identity; quietly signing as a
+     * different one is the outcome worth refusing.
+     *
+     * @param options - The `fromConfig` options, read for `agentKey` and `keyPath`.
+     * @returns The resolved agent identity.
+     * @throws When a named key file is missing, or no identity can be found.
+     */
+    private static resolveIdentity;
+    /**
+     * Add the one thing a machine with no key file needs to hear.
+     *
+     * This is the only path where the operator cannot see what happened: no key
+     * file, and the key they are looking for sits in `config.json`, which no
+     * longer selects the identity. A bare "key file not found" sends them hunting
+     * for a key they already have. Only this branch gets the hint — a caller who
+     * named a `keyPath` is told about that path, where a stranded key is noise.
+     *
+     * @param err - The "key file not found" error from the default lookup.
+     * @returns The same error, or one that also names the key in config.json.
+     */
+    private static explainStrandedKey;
+    /**
+     * Say so when `config.json` still holds an agent key.
+     *
+     * Nothing signs with it any more, and silence would leave an operator
+     * believing one identity is in force while another is. The pubkey is named,
+     * not the key, so the line is safe in a log.
+     *
+     * @param logger - The host logger, when one was supplied.
+     */
+    private static warnOnStrandedKey;
     static fromConfig(options?: FromConfigOptions): Atbash;
     get pubkey(): string;
     get privkey(): string;
@@ -939,22 +985,6 @@ declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the caus
  */
 declare function bootSyncFailureLine(cause: unknown): string;
 
-/**
- * Make a chain query result crossable at the NAPI boundary.
- *
- * `postchain-client` decodes a Rell `byte_array` into a Node `Buffer`. The
- * core's `parse*` functions take `serde_json::Value`, and NAPI-RS cannot
- * convert a `Buffer` into one — it reaches the methods every `Uint8Array`
- * inherits and fails with "JS functions cannot be represented as a
- * serde_json::Value", which names functions for what is a plain Buffer.
- *
- * The conversion has to happen here because the failure is in the argument
- * conversion, before any core code runs. Of the shapes the core accepts —
- * hex string, `[u8]`, `{ data: [...] }` — hex is the cheapest to produce.
- */
-/** Recursively rewrite byte containers to hex, leaving everything else as-is. */
-declare function gtvToFfiSafe(value: unknown): unknown;
-
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -993,7 +1023,7 @@ interface CommitMemoryOptions {
     filePath?: string;
     /** Org name — when set, the SDK resolves which chain the agent lives on. */
     orgName?: string;
-    /** Atbash service endpoint for org→chain lookup. */
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
     /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
     verifyPubKey?: string;
@@ -1001,6 +1031,7 @@ interface CommitMemoryOptions {
 }
 interface RollbackMemoryOptions {
     orgName?: string;
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
     /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
     verifyPubKey?: string;
@@ -1174,6 +1205,17 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     debug?: boolean;
     /** Optional logger for debug probe + persist-failure warnings. */
     logger?: GuardLogger;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
+    /**
+     * Root the caller keeps memory under, when it is not an agent home.
+     *
+     * Only pass a value the host stated outright. A root defaulted from the
+     * process working directory would make whichever directory the host happened
+     * to start in look like a memory store — which is how a stray MEMORY.md once
+     * ended up inside a plugin checkout.
+     */
+    memoryRoot?: string;
 }
 /** Plugin-facing decision. Shape mirrors what plugins return from `before_tool_call`. */
 interface GuardMemoryDecision {
@@ -1191,21 +1233,6 @@ interface GuardMemoryWriteResult {
     /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
-/**
- * Guarded memory-write flow. Returns `{ handled: false }` when the tool
- * call isn't a memory write, otherwise returns a `decision` the plugin
- * should return from its hook.
- *
- * Verdict handling:
- * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with its LLM score; decision allows once the chain confirms
- * - `green`  → persisted with its LLM score; decision allows once the chain confirms
- * - anything else → not persisted; decision blocks (unless `enforce: false`)
- *
- * A write is acknowledged only after the chain transaction confirms, for
- * yellow exactly as for green. An unconfirmed write blocks in enforce mode
- * and remains unaudited in observe mode.
- */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
 /**
@@ -1269,10 +1296,19 @@ declare class PointerStore {
     private cache;
     private loading;
     constructor(filePath: string);
-    /** Resolves the pointer for `agentPubkeyHex`, or a zero-pointer that will force a sync on first use. */
-    get(agentPubkeyHex: string): Promise<MemoryPointer>;
-    /** Persists an updated pointer. Failures are swallowed to a logger callback (if provided) so sync never blocks the caller. */
-    set(agentPubkeyHex: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
+    /**
+     * The pointer for one agent's file, or a zero-pointer forcing a sync.
+     *
+     * @param filePath - The file's chain slot, i.e. its basename.
+     */
+    get(agentPubkeyHex: string, filePath: string): Promise<MemoryPointer>;
+    /**
+     * Persist one file's pointer, leaving the agent's other files alone.
+     *
+     * Write failures are reported to `onError` rather than thrown: a cache that
+     * cannot be written must not take down the read it was speeding up.
+     */
+    set(agentPubkeyHex: string, filePath: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
     private ensureLoaded;
     private loadOnce;
     private persist;
@@ -1367,6 +1403,17 @@ interface MemoryGuardManagerOptions {
     workspaceDir: string;
     /** Absolute MEMORY.md path. Default `<workspaceDir>/MEMORY.md`. */
     memoryFilePath?: string;
+    /**
+     * Root this host keeps memory under, when it is not an agent home.
+     *
+     * Only set this from a value the host stated outright — never from
+     * `process.cwd()`. A guessed root makes whichever directory the host started
+     * in look like a memory store, which is how a stray MEMORY.md once ended up
+     * inside a plugin checkout.
+     */
+    memoryRoot?: string;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
     /** Persistent pointer file. Default `<workspaceDir>/.atbash/memory-pointer.json`. */
     pointerFilePath?: string;
     /** File-backed log. Default `<workspaceDir>/.atbash/plugin.log`. */
@@ -1413,6 +1460,10 @@ declare class MemoryGuardManager {
     private readonly pointerStore;
     private readonly logger;
     private readonly memoryFilePath;
+    /** Base for resolving the relative paths a host sends. */
+    private readonly workspaceDir;
+    /** Set by `verifyOneFile` when the file it checked was actually on chain. */
+    private lastVerified;
     private readonly ttlMs;
     private readonly rollbackMinScore;
     private readonly enforce;
@@ -1430,6 +1481,14 @@ declare class MemoryGuardManager {
     private _resolvedChainOpts;
     private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Carry this manager's host into `chainOpts`.
+     *
+     * Memory reads reach the chain through that host, and they are handed only
+     * `chainOpts` — without this a self-hosted deployment would read from the
+     * compiled-in default host while writing to its own.
+     */
+    private withEndpoint;
     /**
      * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
      * already does this for writes; without the same call on the read
@@ -1447,15 +1506,27 @@ declare class MemoryGuardManager {
      */
     runBootProbe(): Promise<void>;
     /**
-     * Returns a `HookDecision` when the guard reached a decision about this event.
-     * Returns `null` for non-memory events, other files this manager does not
-     * own, or unverified observe-mode reads. An enforced read of the managed
-     * file blocks when verification cannot complete.
+     * Bring one chain file into step with its local counterpart.
      *
-     * A returned decision carries `audited` (see `HookDecision`). Only
-     * `{ allow: true, audited: true }` means "checked and cleared"; anything else
-     * that allows is a call the host still needs to judge.
+     * Only a file that already exists locally is touched. Restoring one that is
+     * absent would mean choosing where to create it, and the root is a guess the
+     * moment more than one could apply — the same guess that once wrote a
+     * MEMORY.md into a plugin checkout.
+     *
+     * @returns What happened, for the single summary line the caller logs.
      */
+    private syncOneAtBoot;
+    /**
+     * Where a chain slot's file lives locally, or null when we do not have it.
+     *
+     * A stated root is tried first, then each agent home that actually exists in
+     * the user's home directory — the same rule that produced the slot, run
+     * backwards. Only an existing file is returned: creating one would mean
+     * picking a root, and picking is guessing.
+     */
+    private locate;
+    /** Roots a chain slot may be joined to, most specific first. */
+    private memoryRoots;
     handleBeforeToolCall(event: unknown, ctx: unknown): Promise<HookDecision | null>;
     private mapGuardResult;
     /**
@@ -1473,12 +1544,70 @@ declare class MemoryGuardManager {
      * also covers events carrying two different path keys, where the classifier
      * and the host could otherwise disagree about which one is authoritative.
      */
-    private vouchesForTarget;
+    /**
+     * The memory files this tool call reads, as absolute paths.
+     *
+     * Relative paths resolve against the workspace, not `process.cwd()`. The host
+     * sends paths relative to the agent's workspace; resolving them against the
+     * process's own directory made the guard protect whichever directory the host
+     * happened to start in, which on one machine was a plugin checkout.
+     *
+     * @returns Every named target, de-duplicated; empty when the call names none.
+     */
+    private readTargets;
+    /**
+     * Say what the read classifier saw and what it concluded.
+     *
+     * The write path has `emitDebugProbe`; this is its counterpart, so a tool
+     * call can be followed across the fork instead of only after it. `false` here
+     * is the normal answer for a write — it means the call goes to the write
+     * classifier next, not that it was ignored.
+     *
+     * @param isMemoryRead - What `classifyMemoryRead` returned.
+     */
+    private emitReadProbe;
+    /**
+     * The chain slot for a path, or null when the file gets no chain record.
+     *
+     * One helper so the boot probe and every read agree: taking a basename in one
+     * place and a relative path in the other would verify a file against a record
+     * that is not its own.
+     */
+    private slotFor;
+    /**
+     * Verify every memory file this call reads, each against its own chain slot.
+     *
+     * A call naming several files is only cleared when all of them are, so one
+     * unverifiable file cannot ride along with a verified one.
+     *
+     * @returns A block for the first file that fails, an audited allow when all
+     *   were verified, or null when none of them is on chain.
+     */
     private handleMemoryRead;
+    /**
+     * Check one memory file against the chain slot of the same name.
+     *
+     * A file with no chain version is passed through rather than blocked: there
+     * is no claim to protect, so refusing would only stop an agent reading memory
+     * it has never committed. A file that IS on chain must match, or the read is
+     * refused — that is the whole guarantee.
+     *
+     * @returns A decision when the read must not proceed, else null.
+     */
+    private verifyOneFile;
     /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
     flushLogs(): Promise<void>;
+    /**
+     * A read this guard could not verify.
+     *
+     * Enforcing, that is a block. Observing, the host audits it as usual — but
+     * the reason is said out loud either way, or an unverified read looks
+     * identical to a clean one in the log.
+     */
     private unverifiedRead;
     private writeMemoryAtomic;
+    /** Replace `target` in one step, so a reader never sees a half-written file. */
+    private writeFileAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;
 
@@ -1631,4 +1760,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, gtvToFfiSafe, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -43455,6 +43455,17 @@ var native = {
   defaultChromiaNodeUrls: () => [...DEFAULT_CHROMIA_NODE_URLS_ARR],
   defaultPrivateNodeUrls: () => [...DEFAULT_PRIVATE_NODE_URLS_ARR],
   // Server-only surfaces — throw at runtime, keep types satisfied.
+  // The memory signers are here and not with the other signing shims because
+  // their args are encrypted by `encryptMemoryContent`, which this build does
+  // not have: a browser could sign the transaction but never produce one worth
+  // sending.
+  signAddAgentMemory: stub("signAddAgentMemory"),
+  signRollbackAgentMemory: stub("signRollbackAgentMemory"),
+  extractMemoryEdits: stub("extractMemoryEdits"),
+  applyMemoryEdits: stub("applyMemoryEdits"),
+  memorySlotForPath: stub("memorySlotForPath"),
+  isSafeMemorySlot: stub("isSafeMemorySlot"),
+  defaultAgentHomeDirs: stub("defaultAgentHomeDirs"),
   classifyMemoryWrite: stub("classifyMemoryWrite"),
   classifyMemoryRead: stub("classifyMemoryRead"),
   defaultMemoryWriteToolNames: stub("defaultMemoryWriteToolNames"),
@@ -43531,6 +43542,32 @@ function randomHex(size) {
   return hex;
 }
 
+// src-ts/auth-bearer.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var BEARER_TTL_MS = 4 * 60 * 1e3;
+var bearers = /* @__PURE__ */ new Map();
+function agentAuthBearer(auth, blockchainRid) {
+  const key3 = `${auth.pubkey}:${blockchainRid}`;
+  const now = Date.now();
+  const cached = bearers.get(key3);
+  if (cached && now - cached.issuedAt < BEARER_TTL_MS) return cached.hex;
+  const hex = native.signLogToolCall(
+    `auth-${now.toString(36)}-${randomHex(4)}`,
+    `auth:${now}`,
+    "",
+    "auth-bearer",
+    "",
+    auth.privkey,
+    blockchainRid
+  );
+  bearers.set(key3, { hex, issuedAt: now });
+  return hex;
+}
+function agentAuthHeaders(auth, blockchainRid) {
+  return { Authorization: `Bearer ${agentAuthBearer(auth, blockchainRid)}` };
+}
+
 // src-ts/chain-config.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -44723,6 +44760,12 @@ function resolve(_key, flagValue) {
 function forcedChainNetwork(flagValue) {
   return flagValue === "public" || flagValue === "private" ? flagValue : void 0;
 }
+function agentKeyFromEnv() {
+  return "";
+}
+function strandedAgentKey() {
+  return "";
+}
 
 // src-ts/client.ts
 function generateToolCallId() {
@@ -44806,16 +44849,6 @@ var Atbash = class _Atbash {
    */
   _agentExistsCache = null;
   static AGENT_EXISTS_TTL_MS = 5e3;
-  /**
-   * Cached bearer token for risk-engine / insurance read calls. Built
-   * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
-   * server-side replay protection windows never expire it mid-session.
-   */
-  // Keyed by blockchainRid so bearers for the public and private chains can
-  // coexist. The dashboard derives `authNetwork` from the BRID inside the
-  // signed envelope, so a bearer signed for chain A cannot authenticate a
-  // request routed to chain B — every chain the client talks to needs its own.
-  _authBearers = /* @__PURE__ */ new Map();
   /** Guards `logEnvironmentOnce` — hosts construct several clients. */
   static environmentLogged = false;
   constructor(privkey, options = {}) {
@@ -44903,6 +44936,84 @@ var Atbash = class _Atbash {
    * validated against the trusted allowlist / self-hosted policy; a
    * self-hosted endpoint's `verifyPubKey` becomes the client default.
    */
+  /**
+   * Decide which key this client signs as.
+   *
+   * Most specific wins: a key passed in code, then a key file the host named,
+   * then the environment, then the default key file. `config.json` is absent
+   * from that list on purpose — it is a settings file, writable by anything
+   * that can write the user's home and read by every Atbash integration on the
+   * machine, so letting it name the key meant one stray value silently
+   * re-pointed who each of them signed as.
+   *
+   * A named `keyPath` that does not exist throws rather than falling through.
+   * The caller said which file holds its identity; quietly signing as a
+   * different one is the outcome worth refusing.
+   *
+   * @param options - The `fromConfig` options, read for `agentKey` and `keyPath`.
+   * @returns The resolved agent identity.
+   * @throws When a named key file is missing, or no identity can be found.
+   */
+  static resolveIdentity(options) {
+    if (options.agentKey) return native.loadAgent(options.agentKey);
+    if (options.keyPath) return loadAgentFromFile(options.keyPath);
+    const fromEnv = agentKeyFromEnv();
+    if (fromEnv) return native.loadAgent(fromEnv);
+    try {
+      return loadAgentFromFile();
+    } catch (err) {
+      throw _Atbash.explainStrandedKey(err);
+    }
+  }
+  /**
+   * Add the one thing a machine with no key file needs to hear.
+   *
+   * This is the only path where the operator cannot see what happened: no key
+   * file, and the key they are looking for sits in `config.json`, which no
+   * longer selects the identity. A bare "key file not found" sends them hunting
+   * for a key they already have. Only this branch gets the hint — a caller who
+   * named a `keyPath` is told about that path, where a stranded key is noise.
+   *
+   * @param err - The "key file not found" error from the default lookup.
+   * @returns The same error, or one that also names the key in config.json.
+   */
+  static explainStrandedKey(err) {
+    const stranded = strandedAgentKey();
+    if (!stranded) return err;
+    let identity;
+    try {
+      identity = native.derivePublicKey(stranded);
+    } catch {
+      identity = "(unreadable)";
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return new Error(
+      `${message}
+config.json still holds an "agentKey" (${identity}), but a settings file no longer chooses the signing key. Move it into one of the key files above, or set ATBASH_AGENT_KEY.`
+    );
+  }
+  /**
+   * Say so when `config.json` still holds an agent key.
+   *
+   * Nothing signs with it any more, and silence would leave an operator
+   * believing one identity is in force while another is. The pubkey is named,
+   * not the key, so the line is safe in a log.
+   *
+   * @param logger - The host logger, when one was supplied.
+   */
+  static warnOnStrandedKey(logger2) {
+    const stranded = strandedAgentKey();
+    if (!stranded) return;
+    let identity;
+    try {
+      identity = native.derivePublicKey(stranded);
+    } catch {
+      identity = "(unreadable)";
+    }
+    logger2?.warn?.(
+      `[atbash] "agentKey" in config.json is ignored \u2014 settings do not choose the signing key. It holds ${identity}; this client signs as the key file or ATBASH_AGENT_KEY instead. Move it into the key file, or delete the field, to silence this.`
+    );
+  }
   static fromConfig(options = {}) {
     const configuredEndpoint = resolve("judgeEndpoint") || void 0;
     const configuredVerifyPubKey = resolve("judgeVerifyPubKey") || void 0;
@@ -44918,8 +45029,8 @@ var Atbash = class _Atbash {
         verifyPubKey: configuredVerifyPubKey
       } : { endpoint: configuredEndpoint })
     );
-    const agentKey = resolve("agentKey", options.agentKey);
-    const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
+    const auth = _Atbash.resolveIdentity(options);
+    _Atbash.warnOnStrandedKey(options.logger);
     return new _Atbash(auth.privkey, {
       endpoint: validated.url,
       chain: options.chain,
@@ -45699,25 +45810,10 @@ var Atbash = class _Atbash {
    * trips the server's replay window.
    */
   getAuthBearer(brid) {
-    const chainBrid = brid ?? this.blockchainRid;
-    const now = Date.now();
-    const cached = this._authBearers.get(chainBrid);
-    if (cached && now - cached.issuedAt < 4 * 60 * 1e3) return cached.hex;
-    const nonce = `auth-${now.toString(36)}-${randomHex(4)}`;
-    const hex = native.signLogToolCall(
-      nonce,
-      `auth:${now}`,
-      "",
-      "auth-bearer",
-      "",
-      this.auth.privkey,
-      chainBrid
-    );
-    this._authBearers.set(chainBrid, { hex, issuedAt: now });
-    return hex;
+    return agentAuthBearer(this.auth, brid ?? this.blockchainRid);
   }
   authHeaders(brid) {
-    return { Authorization: `Bearer ${this.getAuthBearer(brid)}` };
+    return agentAuthHeaders(this.auth, brid ?? this.blockchainRid);
   }
   async riskEngineGet(action, params, brid) {
     let resp;
@@ -46108,22 +46204,6 @@ function bootSyncFailureLine(cause) {
   );
 }
 
-// src-ts/memory/_gtv_bytes.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
-init_define_ATBASH_PRIVATE_NODE_URLS();
-function gtvToFfiSafe(value) {
-  if (value instanceof Uint8Array) return Buffer.from(value).toString("hex");
-  if (Array.isArray(value)) return value.map(gtvToFfiSafe);
-  if (value !== null && typeof value === "object") {
-    const out = {};
-    for (const [key3, val] of Object.entries(value)) {
-      out[key3] = gtvToFfiSafe(val);
-    }
-    return out;
-  }
-  return value;
-}
-
 // src-ts/memory/index.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -46491,7 +46571,6 @@ export {
   getMemoryHistory,
   getRecentAgentMemory,
   getRollbackHistory,
-  gtvToFfiSafe,
   guardMemoryWrite,
   isEnvelope,
   isValidPrivateKey2 as isValidPrivateKey,