@atbash/sdk 0.18.0-dev.0 → 0.19.0-dev.0

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+import { Logger } from '@opentelemetry/api-logs';
+
 type JudgeEndpointConfig = {
     policy?: "default";
     endpoint?: string;
@@ -1233,6 +1235,19 @@ interface GuardMemoryWriteResult {
     /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
+/**
+ * Guard a memory write, and record what was decided.
+ *
+ * Wraps the decision rather than threading telemetry through its eight exits,
+ * so a later return added inside cannot quietly stop being counted.
+ *
+ * Only a call this guard actually handled is recorded. A tool call that was
+ * never a memory write is not a memory operation, and counting it would put
+ * every unrelated edit into the number a memory migration reads.
+ *
+ * @param input - The tool call and the agent to judge it for.
+ * @returns What the guard decided; unchanged by the recording.
+ */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
 /**
@@ -1641,6 +1656,20 @@ interface TelemetryConfig {
      * `{ Authorization: "Bearer <hex>" }`). Required to actually export.
      */
     getAuthHeaders?: () => Record<string, string>;
+    /**
+     * Hashes the agent key before it is emitted on a wide event.
+     *
+     * Defaults to an unsalted SHA-256, which is de-identification rather than
+     * anonymisation: agent pubkeys are public on chain and can be enumerated, so
+     * the mapping is recoverable by anyone holding that list. Supply a salted
+     * hasher to make it uncorrelatable, at the cost of joining across
+     * deployments.
+     *
+     * Injected rather than imported so the telemetry modules need nothing from
+     * the native addon. Left unset, the agent field is dropped from events
+     * rather than falling back to the raw key.
+     */
+    hashAgentKey?: (pubkeyHex: string) => string;
 }
 declare function setupTelemetry(config: TelemetryConfig): void;
 /**
@@ -1663,6 +1692,121 @@ declare function flushTelemetry(): Promise<void>;
  */
 declare function shutdownTelemetry(): Promise<void>;
 
+/**
+ * Wide events: one row per SDK operation, alongside the counters.
+ *
+ * The counters in `telemetry.ts` are aggregated inside this process before
+ * export, so Honeycomb never receives a per-operation row. That is fine for
+ * "is it up" and useless for everything else: a question nobody attached an
+ * attribute for in advance cannot be answered later, because the data to
+ * answer it never existed. "Which org sees the most failures", "what preceded
+ * a fail-closed", "is the new release slower" are all that shape.
+ *
+ * So each operation also emits one event carrying its whole context. The
+ * counters stay — they are the right tool for health boards and alerts, and
+ * they are not sampled.
+ *
+ * TWO RULES SHAPE THIS MODULE.
+ *
+ * The payload is METADATA ONLY, and the allowlist below is the whole of it:
+ * function name, outcome, latency, error class, error status and path, SDK
+ * version, chain, and a hash of the agent key. Action text, tool arguments, policy text, organisation
+ * names and keys never appear — not as a field that is emptied, but as a field
+ * that does not exist, so there is nothing to forget to strip.
+ *
+ * The agent key is hashed, never sent raw, and the hasher is INJECTED rather
+ * than imported: this module needs nothing from the native addon. With no
+ * hasher supplied the field is DROPPED rather than falling back to the raw
+ * key, so the guarantee does not depend on wiring somebody could forget.
+ *
+ * NOTE on what hashing does and does not buy. Agent pubkeys are public on
+ * chain and can be enumerated, so an UNSALTED hash is reversible by anyone who
+ * can read the chain: it is de-identification, not anonymisation. A salted
+ * hasher makes it uncorrelatable and costs cross-deployment joins. Which one
+ * is wanted is the caller's decision; this module only guarantees the raw key
+ * never leaves.
+ *
+ * And the richer payload has its own switch. Counters carry a function name
+ * and a source. These events carry agent and org identity off a customer's
+ * machine, which is a different proposition for a security product, so
+ * `ATBASH_TELEMETRY_EVENTS_DISABLED=1` turns them off while leaving the health
+ * counters on. Both remain subject to the existing global opt-out.
+ */
+
+/** Attributes an event may carry. Anything not listed here cannot be emitted. */
+interface OperationEvent {
+    /** SDK function, matching the counter's `function.name` so the two join. */
+    functionName: string;
+    durationMs: number;
+    status: "success" | "error";
+    /**
+     * Hex pubkey of the agent the call was made as. Hashed before it is emitted,
+     * and omitted entirely when no hasher is configured.
+     */
+    agentPubkey?: string;
+    /**
+     * Blockchain RID of the chain this call concerned.
+     *
+     * The RID rather than a network label: it is public infrastructure, it is
+     * unambiguous, and it identifies the deployment without naming a customer.
+     */
+    chain?: string;
+    /** Constructor name of the thrown error, e.g. `AtbashAPIError`. */
+    errorClass?: string;
+    /** HTTP status, or 0 when the request never completed. */
+    errorStatus?: number;
+    /**
+     * Request path the status came from, e.g. `/api/v1/judge`.
+     *
+     * The class alone does not say what failed: several routes answer one call
+     * and more than one can 404, so `AtbashAPIError` cannot distinguish "this
+     * agent is not registered" from "the chain-routing lookup did not resolve".
+     * The path settles it.
+     *
+     * Carries no query string — `requestPath` strips it at the point the error
+     * is built, because a query string carries org names, tool call ids and the
+     * agent pubkey. Structured and already sanitised, so this stays inside the
+     * metadata rule where an error message would not.
+     */
+    errorPath?: string;
+    /**
+     * Short categorical result, when "success" is too coarse — e.g. a memory
+     * write that scanned clean but never reached the chain.
+     *
+     * Categorical by contract: a value a caller chooses from a fixed vocabulary,
+     * never free text and never anything derived from user content.
+     */
+    outcome?: string;
+}
+/** Hashes an agent key for emission. Supplied by `setupTelemetry`. */
+type AgentKeyHasher = (pubkeyHex: string) => string;
+/**
+ * Point this module at a logger, or at nothing.
+ *
+ * Called by `setupTelemetry` once the shared exporter exists, so events and
+ * counters travel the same authenticated route and share one opt-out decision.
+ *
+ * @param next - Logger to emit through, or null to disable.
+ * @param opts - Version and source stamped on every event, and the hasher
+ *   applied to the agent key. Without a hasher, the agent field is dropped.
+ */
+declare function configureEvents(next: Logger | null, opts?: {
+    version?: string;
+    source?: string;
+    hashAgentKey?: AgentKeyHasher;
+}): void;
+/** True when an event would actually be emitted. Exported for tests and callers that build context lazily. */
+declare function eventsAreOn(): boolean;
+/**
+ * Emit one wide event for a completed operation.
+ *
+ * Never throws and never blocks: telemetry failing must not change what the
+ * caller observes. Does nothing when events are off.
+ *
+ * @param e - The completed operation.
+ */
+declare function recordEvent(e: OperationEvent): void;
+
 /**
  * Rust core does the work; `browser/encrypted-toolcall.ts` mirrors it for the
  * browser and must produce the same columns.
@@ -1760,4 +1904,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { Logger } from '@opentelemetry/api-logs';
+
 type JudgeEndpointConfig = {
     policy?: "default";
     endpoint?: string;
@@ -1233,6 +1235,19 @@ interface GuardMemoryWriteResult {
     /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
+/**
+ * Guard a memory write, and record what was decided.
+ *
+ * Wraps the decision rather than threading telemetry through its eight exits,
+ * so a later return added inside cannot quietly stop being counted.
+ *
+ * Only a call this guard actually handled is recorded. A tool call that was
+ * never a memory write is not a memory operation, and counting it would put
+ * every unrelated edit into the number a memory migration reads.
+ *
+ * @param input - The tool call and the agent to judge it for.
+ * @returns What the guard decided; unchanged by the recording.
+ */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
 /**
@@ -1641,6 +1656,20 @@ interface TelemetryConfig {
      * `{ Authorization: "Bearer <hex>" }`). Required to actually export.
      */
     getAuthHeaders?: () => Record<string, string>;
+    /**
+     * Hashes the agent key before it is emitted on a wide event.
+     *
+     * Defaults to an unsalted SHA-256, which is de-identification rather than
+     * anonymisation: agent pubkeys are public on chain and can be enumerated, so
+     * the mapping is recoverable by anyone holding that list. Supply a salted
+     * hasher to make it uncorrelatable, at the cost of joining across
+     * deployments.
+     *
+     * Injected rather than imported so the telemetry modules need nothing from
+     * the native addon. Left unset, the agent field is dropped from events
+     * rather than falling back to the raw key.
+     */
+    hashAgentKey?: (pubkeyHex: string) => string;
 }
 declare function setupTelemetry(config: TelemetryConfig): void;
 /**
@@ -1663,6 +1692,121 @@ declare function flushTelemetry(): Promise<void>;
  */
 declare function shutdownTelemetry(): Promise<void>;
 
+/**
+ * Wide events: one row per SDK operation, alongside the counters.
+ *
+ * The counters in `telemetry.ts` are aggregated inside this process before
+ * export, so Honeycomb never receives a per-operation row. That is fine for
+ * "is it up" and useless for everything else: a question nobody attached an
+ * attribute for in advance cannot be answered later, because the data to
+ * answer it never existed. "Which org sees the most failures", "what preceded
+ * a fail-closed", "is the new release slower" are all that shape.
+ *
+ * So each operation also emits one event carrying its whole context. The
+ * counters stay — they are the right tool for health boards and alerts, and
+ * they are not sampled.
+ *
+ * TWO RULES SHAPE THIS MODULE.
+ *
+ * The payload is METADATA ONLY, and the allowlist below is the whole of it:
+ * function name, outcome, latency, error class, error status and path, SDK
+ * version, chain, and a hash of the agent key. Action text, tool arguments, policy text, organisation
+ * names and keys never appear — not as a field that is emptied, but as a field
+ * that does not exist, so there is nothing to forget to strip.
+ *
+ * The agent key is hashed, never sent raw, and the hasher is INJECTED rather
+ * than imported: this module needs nothing from the native addon. With no
+ * hasher supplied the field is DROPPED rather than falling back to the raw
+ * key, so the guarantee does not depend on wiring somebody could forget.
+ *
+ * NOTE on what hashing does and does not buy. Agent pubkeys are public on
+ * chain and can be enumerated, so an UNSALTED hash is reversible by anyone who
+ * can read the chain: it is de-identification, not anonymisation. A salted
+ * hasher makes it uncorrelatable and costs cross-deployment joins. Which one
+ * is wanted is the caller's decision; this module only guarantees the raw key
+ * never leaves.
+ *
+ * And the richer payload has its own switch. Counters carry a function name
+ * and a source. These events carry agent and org identity off a customer's
+ * machine, which is a different proposition for a security product, so
+ * `ATBASH_TELEMETRY_EVENTS_DISABLED=1` turns them off while leaving the health
+ * counters on. Both remain subject to the existing global opt-out.
+ */
+
+/** Attributes an event may carry. Anything not listed here cannot be emitted. */
+interface OperationEvent {
+    /** SDK function, matching the counter's `function.name` so the two join. */
+    functionName: string;
+    durationMs: number;
+    status: "success" | "error";
+    /**
+     * Hex pubkey of the agent the call was made as. Hashed before it is emitted,
+     * and omitted entirely when no hasher is configured.
+     */
+    agentPubkey?: string;
+    /**
+     * Blockchain RID of the chain this call concerned.
+     *
+     * The RID rather than a network label: it is public infrastructure, it is
+     * unambiguous, and it identifies the deployment without naming a customer.
+     */
+    chain?: string;
+    /** Constructor name of the thrown error, e.g. `AtbashAPIError`. */
+    errorClass?: string;
+    /** HTTP status, or 0 when the request never completed. */
+    errorStatus?: number;
+    /**
+     * Request path the status came from, e.g. `/api/v1/judge`.
+     *
+     * The class alone does not say what failed: several routes answer one call
+     * and more than one can 404, so `AtbashAPIError` cannot distinguish "this
+     * agent is not registered" from "the chain-routing lookup did not resolve".
+     * The path settles it.
+     *
+     * Carries no query string — `requestPath` strips it at the point the error
+     * is built, because a query string carries org names, tool call ids and the
+     * agent pubkey. Structured and already sanitised, so this stays inside the
+     * metadata rule where an error message would not.
+     */
+    errorPath?: string;
+    /**
+     * Short categorical result, when "success" is too coarse — e.g. a memory
+     * write that scanned clean but never reached the chain.
+     *
+     * Categorical by contract: a value a caller chooses from a fixed vocabulary,
+     * never free text and never anything derived from user content.
+     */
+    outcome?: string;
+}
+/** Hashes an agent key for emission. Supplied by `setupTelemetry`. */
+type AgentKeyHasher = (pubkeyHex: string) => string;
+/**
+ * Point this module at a logger, or at nothing.
+ *
+ * Called by `setupTelemetry` once the shared exporter exists, so events and
+ * counters travel the same authenticated route and share one opt-out decision.
+ *
+ * @param next - Logger to emit through, or null to disable.
+ * @param opts - Version and source stamped on every event, and the hasher
+ *   applied to the agent key. Without a hasher, the agent field is dropped.
+ */
+declare function configureEvents(next: Logger | null, opts?: {
+    version?: string;
+    source?: string;
+    hashAgentKey?: AgentKeyHasher;
+}): void;
+/** True when an event would actually be emitted. Exported for tests and callers that build context lazily. */
+declare function eventsAreOn(): boolean;
+/**
+ * Emit one wide event for a completed operation.
+ *
+ * Never throws and never blocks: telemetry failing must not change what the
+ * caller observes. Does nothing when events are off.
+ *
+ * @param e - The completed operation.
+ */
+declare function recordEvent(e: OperationEvent): void;
+
 /**
  * Rust core does the work; `browser/encrypted-toolcall.ts` mirrors it for the
  * browser and must produce the same columns.
@@ -1760,4 +1904,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };