@atbash/sdk 0.19.1-dev.0 → 0.20.0-dev.0

package/dist/browser.mjs

@@ -21769,23 +21769,23 @@ Splitter$1.prototype.flush = function() {
   return Buffer$9.concat([this.cache, padBuff]);
 };
 function createCipheriv$1(suite, password, iv) {
-  var config2 = MODES$1[suite.toLowerCase()];
-  if (!config2) throw new TypeError("invalid suite type");
+  var config3 = MODES$1[suite.toLowerCase()];
+  if (!config3) throw new TypeError("invalid suite type");
   if (typeof password === "string") password = Buffer$9.from(password);
-  if (password.length !== config2.key / 8) throw new TypeError("invalid key length " + password.length);
+  if (password.length !== config3.key / 8) throw new TypeError("invalid key length " + password.length);
   if (typeof iv === "string") iv = Buffer$9.from(iv);
-  if (config2.mode !== "GCM" && iv.length !== config2.iv) throw new TypeError("invalid iv length " + iv.length);
-  if (config2.type === "stream") {
-    return new StreamCipher$1(config2.module, password, iv);
-  } else if (config2.type === "auth") {
-    return new AuthCipher$1(config2.module, password, iv);
+  if (config3.mode !== "GCM" && iv.length !== config3.iv) throw new TypeError("invalid iv length " + iv.length);
+  if (config3.type === "stream") {
+    return new StreamCipher$1(config3.module, password, iv);
+  } else if (config3.type === "auth") {
+    return new AuthCipher$1(config3.module, password, iv);
   }
-  return new Cipher(config2.module, password, iv);
+  return new Cipher(config3.module, password, iv);
 }
 function createCipher$1(suite, password) {
-  var config2 = MODES$1[suite.toLowerCase()];
-  if (!config2) throw new TypeError("invalid suite type");
-  var keys2 = ebtk$2(password, false, config2.key, config2.iv);
+  var config3 = MODES$1[suite.toLowerCase()];
+  if (!config3) throw new TypeError("invalid suite type");
+  var keys2 = ebtk$2(password, false, config3.key, config3.iv);
   return createCipheriv$1(suite, keys2.key, keys2.iv);
 }
 encrypter.createCipheriv = createCipheriv$1;
@@ -21873,23 +21873,23 @@ function unpad(last) {
   return last.slice(0, 16 - padded);
 }
 function createDecipheriv$1(suite, password, iv) {
-  var config2 = MODES[suite.toLowerCase()];
-  if (!config2) throw new TypeError("invalid suite type");
+  var config3 = MODES[suite.toLowerCase()];
+  if (!config3) throw new TypeError("invalid suite type");
   if (typeof iv === "string") iv = Buffer$8.from(iv);
-  if (config2.mode !== "GCM" && iv.length !== config2.iv) throw new TypeError("invalid iv length " + iv.length);
+  if (config3.mode !== "GCM" && iv.length !== config3.iv) throw new TypeError("invalid iv length " + iv.length);
   if (typeof password === "string") password = Buffer$8.from(password);
-  if (password.length !== config2.key / 8) throw new TypeError("invalid key length " + password.length);
-  if (config2.type === "stream") {
-    return new StreamCipher(config2.module, password, iv, true);
-  } else if (config2.type === "auth") {
-    return new AuthCipher(config2.module, password, iv, true);
+  if (password.length !== config3.key / 8) throw new TypeError("invalid key length " + password.length);
+  if (config3.type === "stream") {
+    return new StreamCipher(config3.module, password, iv, true);
+  } else if (config3.type === "auth") {
+    return new AuthCipher(config3.module, password, iv, true);
   }
-  return new Decipher(config2.module, password, iv);
+  return new Decipher(config3.module, password, iv);
 }
 function createDecipher$1(suite, password) {
-  var config2 = MODES[suite.toLowerCase()];
-  if (!config2) throw new TypeError("invalid suite type");
-  var keys2 = ebtk$1(password, false, config2.key, config2.iv);
+  var config3 = MODES[suite.toLowerCase()];
+  if (!config3) throw new TypeError("invalid suite type");
+  var keys2 = ebtk$1(password, false, config3.key, config3.iv);
   return createDecipheriv$1(suite, keys2.key, keys2.iv);
 }
 decrypter.createDecipher = createDecipher$1;
@@ -40614,29 +40614,29 @@ function requireFailoverStrategies() {
       }
     }
     function abortOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config3, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
           path: path3,
-          config: config2,
+          config: config3,
           postObject,
           timeoutOverride,
           useNextNodeOnError: false,
-          recoveryThreshold: config2.recoveryThreshold
+          recoveryThreshold: config3.recoveryThreshold
           // Use user config or let nodeManager use default
         });
       });
     }
     function tryNextOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config3, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
           path: path3,
-          config: config2,
+          config: config3,
           postObject,
           timeoutOverride,
           useNextNodeOnError: true,
-          recoveryThreshold: config2.recoveryThreshold
+          recoveryThreshold: config3.recoveryThreshold
         });
       });
     }
@@ -40647,17 +40647,17 @@ function requireFailoverStrategies() {
       return endpointPoolLength - (endpointPoolLength - 1) / 3;
     }
     function queryMajority(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config3, postObject, timeoutOverride }) {
         var _b;
-        const bftMajorityThreshold = calculateBftMajorityThreshold(config2.endpointPool.length);
-        const failureThreshold = config2.endpointPool.length - bftMajorityThreshold + 1;
-        const { nodeManager: nodeManager2 } = config2;
+        const bftMajorityThreshold = calculateBftMajorityThreshold(config3.endpointPool.length);
+        const failureThreshold = config3.endpointPool.length - bftMajorityThreshold + 1;
+        const { nodeManager: nodeManager2 } = config3;
         const timeout = 15e3;
-        const availableNodes = nodeManager2.getAvailableNodes((_b = config2.recoveryThreshold) !== null && _b !== void 0 ? _b : bftMajorityThreshold);
+        const availableNodes = nodeManager2.getAvailableNodes((_b = config3.recoveryThreshold) !== null && _b !== void 0 ? _b : bftMajorityThreshold);
         const outcomes = [];
         const promises = availableNodes.map((node2) => __awaiter2(this, void 0, void 0, function* () {
           try {
-            const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
+            const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config3.responseTimeout;
             const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             const { statusCode } = response;
             if (statusCode && (0, http_utils_1.isSuccessfulStatusCode)(statusCode)) {
@@ -40697,7 +40697,7 @@ function requireFailoverStrategies() {
               throw errorOutcomes[0].result;
             }
           }
-          if (outcomes.length >= config2.endpointPool.length) {
+          if (outcomes.length >= config3.endpointPool.length) {
             throw new Error(exports.errorMessages.NO_CONSENSUS);
           }
           remainingPromises = yield racePromisesWithTimeout(remainingPromises, timeout);
@@ -40705,17 +40705,17 @@ function requireFailoverStrategies() {
       });
     }
     function singleEndpoint(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config3, postObject, timeoutOverride }) {
         let statusCode = null;
         let rspBody = null;
         let error4 = null;
         let transactionTimestamp = void 0;
-        const endpoint = config2.nodeManager.getNode();
+        const endpoint = config3.nodeManager.getNode();
         if (!endpoint) {
           throw new Error("No nodes available after recovery attempt. Check node configuration.");
         }
-        for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
-          const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
+        for (let attempt = 0; attempt < config3.attemptsPerEndpoint; attempt++) {
+          const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config3.responseTimeout;
           const response = yield (0, httpUtil_1.handleRequest)(method, path3, endpoint.url, requestTimeout, postObject);
           if (response) {
             ({ error: error4, statusCode, rspBody, transactionTimestamp } = response);
@@ -40724,24 +40724,24 @@ function requireFailoverStrategies() {
           if (!isError4 && !error4) {
             return { error: error4, statusCode, rspBody, transactionTimestamp };
           }
-          logger3.info(`${method} request failed on ${endpoint.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
-          yield (0, utils_12.sleep)(config2.attemptInterval);
+          logger3.info(`${method} request failed on ${endpoint.url}. Attempt: ${attempt + 1} / ${config3.attemptsPerEndpoint}`);
+          yield (0, utils_12.sleep)(config3.attemptInterval);
         }
         return { error: error4, statusCode, rspBody, transactionTimestamp };
       });
     }
     function retryRequest(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config3, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
         var _b, _c, _d;
         let statusCode = null;
         let rspBody = null;
         let error4 = null;
         let transactionTimestamp = void 0;
-        const { nodeManager: nodeManager2 } = config2;
+        const { nodeManager: nodeManager2 } = config3;
         const availableNodes = nodeManager2.getAvailableNodes(recoveryThreshold);
         for (const node2 of availableNodes) {
-          for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
-            const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
+          for (let attempt = 0; attempt < config3.attemptsPerEndpoint; attempt++) {
+            const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config3.responseTimeout;
             const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             error4 = (_b = response === null || response === void 0 ? void 0 : response.error) !== null && _b !== void 0 ? _b : null;
             statusCode = (_c = response === null || response === void 0 ? void 0 : response.statusCode) !== null && _c !== void 0 ? _c : null;
@@ -40772,9 +40772,9 @@ function requireFailoverStrategies() {
                 break;
               }
             }
-            logger3.info(`${method} request failed on ${node2.url}. Attempt: ${attempt + 1} / ${config2.attemptsPerEndpoint}`);
-            if (config2.attemptInterval > 0) {
-              yield (0, utils_12.sleep)(config2.attemptInterval);
+            logger3.info(`${method} request failed on ${node2.url}. Attempt: ${attempt + 1} / ${config3.attemptsPerEndpoint}`);
+            if (config3.attemptInterval > 0) {
+              yield (0, utils_12.sleep)(config3.attemptInterval);
             }
           }
         }
@@ -40885,21 +40885,21 @@ function requireRequestWithFailoverStrategy() {
   const enums_12 = enums;
   const failoverStrategies_1 = requireFailoverStrategies();
   function requestWithFailoverStrategy$1(method_1, path_1, config_1, postObject_1) {
-    return __awaiter2(this, arguments, void 0, function* (method, path3, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
-      switch (config2.failoverStrategy) {
+    return __awaiter2(this, arguments, void 0, function* (method, path3, config3, postObject, forceSingleEndpoint = false, timeoutOverride) {
+      switch (config3.failoverStrategy) {
         case enums_12.FailoverStrategy.AbortOnError:
-          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path3, config: config3, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.TryNextOnError:
-          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path3, config: config3, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.SingleEndpoint:
-          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config3, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.QueryMajority:
           if (forceSingleEndpoint) {
-            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
+            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config3, postObject, timeoutOverride });
           }
-          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path3, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path3, config: config3, postObject, timeoutOverride });
         default:
-          throw new Error(`Unsupported failover strategy: ${config2.failoverStrategy}`);
+          throw new Error(`Unsupported failover strategy: ${config3.failoverStrategy}`);
       }
     });
   }
@@ -41068,11 +41068,11 @@ function requireUtils$1() {
         return Object.assign(Object.assign(Object.assign({ endpointPool, nodeManager: nodeManager2 }, settings.blockedNodeUrlSubstrings !== void 0 ? { blockedNodeUrlSubstrings: settings.blockedNodeUrlSubstrings } : {}), settings.nodeUrlFilter !== void 0 ? { nodeUrlFilter: settings.nodeUrlFilter } : {}), { blockchainRid: blockchainRidToUse, merkleHashVersion: (_e = settings.merkleHashVersion) !== null && _e !== void 0 ? _e : constants_12.MERKLE_HASH_VERSIONS.UNSET, dappStatusPolling: setStatusPolling(settings.dappStatusPolling), clusterAnchoringStatusPolling: setStatusPolling(settings.clusterAnchoringStatusPolling), systemAnchoringStatusPolling: setStatusPolling(settings.systemAnchoringStatusPolling), retryTransactionPolling: setRetryTransactionPolling(settings.retryTransactionPolling), failoverStrategy: ((_f = settings.failOverConfig) === null || _f === void 0 ? void 0 : _f.strategy) || exports.defaultFailoverConfig.strategy, attemptsPerEndpoint: ((_g = settings.failOverConfig) === null || _g === void 0 ? void 0 : _g.attemptsPerEndpoint) || exports.defaultFailoverConfig.attemptsPerEndpoint, attemptInterval: ((_h = settings.failOverConfig) === null || _h === void 0 ? void 0 : _h.attemptInterval) || exports.defaultFailoverConfig.attemptInterval, unreachableDuration: ((_j = settings.failOverConfig) === null || _j === void 0 ? void 0 : _j.unreachableDuration) || exports.defaultFailoverConfig.unreachableDuration, directoryChainRid: settings.directoryChainRid || directoryChainRid, connectTimeout: settings.connectTimeout, responseTimeout: settings.responseTimeout });
       });
     }
-    function getMerkleHashVersionFromDapp(config2) {
+    function getMerkleHashVersionFromDapp(config3) {
       return __awaiter2(this, void 0, void 0, function* () {
         var _a2;
         try {
-          const response = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/config/${config2.blockchainRid}/features`, config2, void 0, false, (_a2 = config2.connectTimeout) !== null && _a2 !== void 0 ? _a2 : config2.responseTimeout);
+          const response = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/config/${config3.blockchainRid}/features`, config3, void 0, false, (_a2 = config3.connectTimeout) !== null && _a2 !== void 0 ? _a2 : config3.responseTimeout);
           const validatedResponse = (0, merkleHash_1.validateMerkleHash)(response.rspBody);
           return validatedResponse.merkle_hash_version;
         } catch (error4) {
@@ -41528,7 +41528,7 @@ function requireUtils$1() {
       return __awaiter2(this, arguments, void 0, function* ({ endpointPool, chainId, failOverConfig = {}, nodeManager: nodeManager2, connectTimeout, responseTimeout }) {
         var _b;
         const mergedFailOverConfig = Object.assign(Object.assign({}, exports.defaultFailoverConfig), failOverConfig);
-        const config2 = {
+        const config3 = {
           endpointPool,
           nodeManager: nodeManager2,
           dappStatusPolling: setStatusPolling(),
@@ -41543,7 +41543,7 @@ function requireUtils$1() {
           connectTimeout,
           responseTimeout
         };
-        const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/brid/iid_${chainId}`, config2, void 0, false, (_b = config2.connectTimeout) !== null && _b !== void 0 ? _b : config2.responseTimeout);
+        const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/brid/iid_${chainId}`, config3, void 0, false, (_b = config3.connectTimeout) !== null && _b !== void 0 ? _b : config3.responseTimeout);
         const blockchainRid = (0, requests_1.isString)(rspBody);
         if (!blockchainRid) {
           throw error4;
@@ -42279,10 +42279,10 @@ function requireBlockchainClient() {
   function createClient(settings) {
     return __awaiter2(this, void 0, void 0, function* () {
       (0, networkSettings_1.isNetworkSettingValid)(settings, { throwOnError: true });
-      const config2 = yield (0, utils_12.getClientConfigFromSettings)(settings);
-      config2.merkleHashVersion = yield getMerkleHashVersion(settings);
+      const config3 = yield (0, utils_12.getClientConfigFromSettings)(settings);
+      config3.merkleHashVersion = yield getMerkleHashVersion(settings);
       return {
-        config: config2,
+        config: config3,
         query(nameOrQueryObject, args, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
             let _name, _args;
@@ -42293,7 +42293,7 @@ function requireBlockchainClient() {
               _name = nameOrQueryObject === null || nameOrQueryObject === void 0 ? void 0 : nameOrQueryObject.name;
               _args = nameOrQueryObject === null || nameOrQueryObject === void 0 ? void 0 : nameOrQueryObject.args;
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.POST, `query_gtv/${config2.blockchainRid}`, config2, (0, serialization_12.encodeValue)((0, formatter_12.toQueryObjectGTV)(_name, _args)));
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.POST, `query_gtv/${config3.blockchainRid}`, config3, (0, serialization_12.encodeValue)((0, formatter_12.toQueryObjectGTV)(_name, _args)));
             return new Promise((resolve2, reject) => {
               (0, utils_12.handlePostResponse)(error4, statusCode, (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
             });
@@ -42302,9 +42302,9 @@ function requireBlockchainClient() {
         signTransaction(transaction, signMethod2, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
             logger3.debug(`Signing transaction with ${!(0, utils_12.isKeyPair)(signMethod2) ? "signature provider containing " : ""}pubKey: ${(0, formatter_12.toString)(signMethod2.pubKey)}`);
-            const gtx2 = (0, utils_12.getGTXFromBufferOrTransactionOrOperation)(transaction, config2.blockchainRid);
+            const gtx2 = (0, utils_12.getGTXFromBufferOrTransactionOrOperation)(transaction, config3.blockchainRid);
             try {
-              const signedTx = yield (0, utils_12.isKeyPair)(signMethod2) ? gtxTool.sign(gtx2, signMethod2.privKey, config2.merkleHashVersion, signMethod2.pubKey) : gtxTool.sign(gtx2, signMethod2, config2.merkleHashVersion);
+              const signedTx = yield (0, utils_12.isKeyPair)(signMethod2) ? gtxTool.sign(gtx2, signMethod2.privKey, config3.merkleHashVersion, signMethod2.pubKey) : gtxTool.sign(gtx2, signMethod2, config3.merkleHashVersion);
               const gtxBytes = (0, utils_12.getSerializedGTX)(signedTx);
               if (typeof callback === "function") {
                 callback(null, gtxBytes);
@@ -42325,8 +42325,8 @@ function requireBlockchainClient() {
           }
           const promiEvent = new promiEvents_12.Web3PromiEvent((resolve2, reject) => __awaiter2(this, void 0, void 0, function* () {
             let error4 = null;
-            for (let i = 0; i < config2.retryTransactionPolling.count; i++) {
-              logger3.info(`sendTransactionWithRetries attempt ${i + 1} of ${config2.retryTransactionPolling.count}`);
+            for (let i = 0; i < config3.retryTransactionPolling.count; i++) {
+              logger3.info(`sendTransactionWithRetries attempt ${i + 1} of ${config3.retryTransactionPolling.count}`);
               const tmpPromiEvent = sendOnce().on(enums_12.TransactionEvent.ClusterAnchoringConfirmation, (receipt) => {
                 promiEvent.emit(enums_12.TransactionEvent.ClusterAnchoringConfirmation, receipt);
               }).on(enums_12.TransactionEvent.SystemAnchoringConfirmation, (receipt) => {
@@ -42338,7 +42338,7 @@ function requireBlockchainClient() {
               }).on(enums_12.TransactionEvent.DappConfirmed, (receipt) => {
                 promiEvent.emit(enums_12.TransactionEvent.DappConfirmed, receipt);
               }).catch((tmpError) => {
-                logger3.warning(`sendTransactionWithRetries error on attempt ${i + 1} of ${config2.retryTransactionPolling.count}: ${tmpError}`);
+                logger3.warning(`sendTransactionWithRetries error on attempt ${i + 1} of ${config3.retryTransactionPolling.count}: ${tmpError}`);
                 promiEvent.emit(enums_12.TransactionEvent.Rejected, tmpError);
                 error4 = tmpError;
               });
@@ -42347,7 +42347,7 @@ function requireBlockchainClient() {
                 resolve2(tmpReceipt);
                 return;
               }
-              yield (0, utils_12.sleep)(config2.retryTransactionPolling.interval);
+              yield (0, utils_12.sleep)(config3.retryTransactionPolling.interval);
             }
             reject(error4);
           }));
@@ -42357,13 +42357,13 @@ function requireBlockchainClient() {
           const promiEvent = new promiEvents_12.Web3PromiEvent((resolve2, reject) => __awaiter2(this, void 0, void 0, function* () {
             var _a2, _b;
             try {
-              const gtx2 = (0, utils_12.getGTXFromBufferOrTransactionOrOperation)(transaction, config2.blockchainRid);
+              const gtx2 = (0, utils_12.getGTXFromBufferOrTransactionOrOperation)(transaction, config3.blockchainRid);
               if (gtx2.signers.length !== ((_a2 = gtx2.signatures) === null || _a2 === void 0 ? void 0 : _a2.length)) {
                 reject(new errors_12.NumberOfSignersAndSignaturesException());
               }
               const gtxBytes = (0, utils_12.getSerializedGTX)(gtx2);
-              const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.POST, `tx/${config2.blockchainRid}`, config2, gtxBytes);
-              const transactionRid = gtxTool.getDigestToSign(gtx2, config2.merkleHashVersion);
+              const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.POST, `tx/${config3.blockchainRid}`, config3, gtxBytes);
+              const transactionRid = gtxTool.getDigestToSign(gtx2, config3.merkleHashVersion);
               try {
                 yield (0, utils_12.handlePostResponsePromisified)(error4, statusCode, (0, requests_1.isRawGtv)(rspBody));
                 if (typeof callback === "function") {
@@ -42371,7 +42371,7 @@ function requireBlockchainClient() {
                     status: enums_12.ResponseStatus.Waiting,
                     statusCode,
                     transactionRid,
-                    node: (_b = config2.nodeManager.lastUsedNode) === null || _b === void 0 ? void 0 : _b.url
+                    node: (_b = config3.nodeManager.lastUsedNode) === null || _b === void 0 ? void 0 : _b.url
                   });
                 }
               } catch (_error) {
@@ -42434,7 +42434,7 @@ function requireBlockchainClient() {
               callback === null || callback === void 0 ? void 0 : callback(error5, null);
               throw error5;
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config2.blockchainRid}/${(0, formatter_12.ensureString)(transactionRid)}`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config3.blockchainRid}/${(0, formatter_12.ensureString)(transactionRid)}`, config3);
             const transaction = (0, requests_1.isTransaction)(rspBody);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, statusCode === 200 && transaction ? (0, formatter_12.toBuffer)(transaction.tx) : (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
@@ -42449,7 +42449,7 @@ function requireBlockchainClient() {
               callback === null || callback === void 0 ? void 0 : callback(error5, null);
               throw error5;
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config2.blockchainRid}/${transactionRid.toString("hex")}/status`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config3.blockchainRid}/${transactionRid.toString("hex")}/status`, config3);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, (result) => resolve2((0, transactionStatusReponse_1.validateTransactionStatusReponse)({
                 statusCode,
@@ -42472,7 +42472,7 @@ function requireBlockchainClient() {
             const beforeTimeQueryParam = beforeTime ? `&before-time=${beforeTime.getTime()}` : "";
             const afterTimeQueryParam = afterTime ? `&after-time=${afterTime.getTime()}` : "";
             const signerQueryParam = signerPubKey ? `&signer=${signerPubKey}` : "";
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config2.blockchainRid}?limit=${limit}${beforeTimeQueryParam}${afterTimeQueryParam}${signerQueryParam}`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config3.blockchainRid}?limit=${limit}${beforeTimeQueryParam}${afterTimeQueryParam}${signerQueryParam}`, config3);
             const transactionsInfoResponseArray = (0, requests_1.isTransactionInfoResponseArray)(rspBody);
             const body = statusCode === 200 && transactionsInfoResponseArray ? transactionsInfoResponseArray.map(utils_12.formatTransactionInfoResponse) : rspBody;
             return new Promise((resolve2, reject) => {
@@ -42488,7 +42488,7 @@ function requireBlockchainClient() {
               callback === null || callback === void 0 ? void 0 : callback(error5, null);
               throw error5;
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config2.blockchainRid}/${(0, formatter_12.ensureString)(transactionRid)}`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config3.blockchainRid}/${(0, formatter_12.ensureString)(transactionRid)}`, config3);
             const transactionInfoResponse = (0, requests_1.isTransactionInfoResponse)(rspBody);
             const body = statusCode === 200 && transactionInfoResponse ? (0, utils_12.formatTransactionInfoResponse)(transactionInfoResponse) : rspBody;
             return new Promise((resolve2, reject) => {
@@ -42500,7 +42500,7 @@ function requireBlockchainClient() {
           return __awaiter2(this, void 0, void 0, function* () {
             const client = this;
             const result = { status: enums_12.AnchoringStatus.NotAnchored };
-            const clusterAnchoredTx = yield (0, utils_2.awaitGetAnchoringTransactionForBlockRid)(anchoringClient, (0, formatter_12.ensureBuffer)(client.config.blockchainRid), (0, formatter_12.ensureBuffer)(blockRid), config2.clusterAnchoringStatusPolling);
+            const clusterAnchoredTx = yield (0, utils_2.awaitGetAnchoringTransactionForBlockRid)(anchoringClient, (0, formatter_12.ensureBuffer)(client.config.blockchainRid), (0, formatter_12.ensureBuffer)(blockRid), config3.clusterAnchoringStatusPolling);
             if (!clusterAnchoredTx) {
               return result;
             }
@@ -42510,7 +42510,7 @@ function requireBlockchainClient() {
             }
             result.status = enums_12.AnchoringStatus.ClusterAnchored;
             result.clusterAnchoredTx = anchoringTransactionValidation.data;
-            const systemAnchoredTransaction = yield (0, utils_12.getSystemAnchoringTransaction)(config2.endpointPool, anchoringTransactionValidation.data.txRid, anchoringClient, systemAnchoringChainRid, config2.systemAnchoringStatusPolling, config2.merkleHashVersion, config2.blockedNodeUrlSubstrings, config2.nodeUrlFilter);
+            const systemAnchoredTransaction = yield (0, utils_12.getSystemAnchoringTransaction)(config3.endpointPool, anchoringTransactionValidation.data.txRid, anchoringClient, systemAnchoringChainRid, config3.systemAnchoringStatusPolling, config3.merkleHashVersion, config3.blockedNodeUrlSubstrings, config3.nodeUrlFilter);
             if (!systemAnchoredTransaction) {
               return result;
             }
@@ -42574,7 +42574,7 @@ function requireBlockchainClient() {
         },
         getTransactionCount(callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config2.blockchainRid}/count`, config2, void 0, true);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `transactions/${config3.blockchainRid}/count`, config3, void 0, true);
             const transactionsCount = (0, requests_1.isTransactionsCount)(rspBody);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, statusCode === 200 ? transactionsCount === null || transactionsCount === void 0 ? void 0 : transactionsCount.transactionsCount : (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
@@ -42585,7 +42585,7 @@ function requireBlockchainClient() {
           return __awaiter2(this, arguments, void 0, function* (blockIdentifier2, txs = false, callback) {
             (0, blockIdentifier_1.isBlockIdentifierValid)(blockIdentifier2, { throwOnError: true });
             const queryString = typeof blockIdentifier2 === "string" ? blockIdentifier2 : `height/${blockIdentifier2}`;
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config2.blockchainRid}/${queryString}?txs=${txs}`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config3.blockchainRid}/${queryString}?txs=${txs}`, config3);
             const blockInfoResponse = (0, requests_1.isBlockInfoResponse)(rspBody);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, statusCode === 200 && blockInfoResponse !== null && blockInfoResponse ? (0, utils_12.formatBlockInfoResponse)(blockInfoResponse) : (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
@@ -42595,7 +42595,7 @@ function requireBlockchainClient() {
         getLatestBlock() {
           return __awaiter2(this, arguments, void 0, function* (txs = false, callback) {
             const shouldIncludeFullTransaction = txs ? `&txs=${txs}` : "";
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config2.blockchainRid}?limit=1${shouldIncludeFullTransaction}`, config2, void 0, true);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config3.blockchainRid}?limit=1${shouldIncludeFullTransaction}`, config3, void 0, true);
             const indexOfLatestBlock = 0;
             const blockInfoResponseArray = (0, requests_1.isBlockInfoResponseArray)(rspBody);
             return new Promise((resolve2, reject) => {
@@ -42620,7 +42620,7 @@ function requireBlockchainClient() {
                 searchParams.append(key3, value.toString());
               }
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config2.blockchainRid}?${searchParams}`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `blocks/${config3.blockchainRid}?${searchParams}`, config3);
             const blockInfoResponseArray = (0, requests_1.isBlockInfoResponseArray)(rspBody);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, statusCode === 200 && blockInfoResponseArray ? blockInfoResponseArray.map(utils_12.formatBlockInfoResponse) : (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
@@ -42628,7 +42628,7 @@ function requireBlockchainClient() {
           });
         },
         getClientNodeUrlPool() {
-          return config2.endpointPool.map((endpoint) => endpoint.url);
+          return config3.endpointPool.map((endpoint) => endpoint.url);
         },
         /**
          * Retrieves a confirmation proof for a transaction with the specified sha256
@@ -42663,7 +42663,7 @@ function requireBlockchainClient() {
               callback === null || callback === void 0 ? void 0 : callback(error5, null);
               throw error5;
             }
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config2.blockchainRid}/${(0, formatter_12.ensureString)(txRid2)}/confirmationProof`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `tx/${config3.blockchainRid}/${(0, formatter_12.ensureString)(txRid2)}/confirmationProof`, config3);
             const confirmationProof = {
               merkleProofTree: "",
               txIndex: 0
@@ -42727,13 +42727,13 @@ function requireBlockchainClient() {
               callback === null || callback === void 0 ? void 0 : callback(error4, null);
               throw error4;
             }
-            const systemAnchoringTransactionTransaction = yield (0, utils_12.getSystemAnchoringTransaction)(config2.endpointPool, anchoredTxRid, anchoringClient, systemAnchoringChainRid, config2.systemAnchoringStatusPolling, config2.merkleHashVersion, config2.blockedNodeUrlSubstrings, config2.nodeUrlFilter);
+            const systemAnchoringTransactionTransaction = yield (0, utils_12.getSystemAnchoringTransaction)(config3.endpointPool, anchoredTxRid, anchoringClient, systemAnchoringChainRid, config3.systemAnchoringStatusPolling, config3.merkleHashVersion, config3.blockedNodeUrlSubstrings, config3.nodeUrlFilter);
             return systemAnchoringTransactionTransaction;
           });
         },
         getWaitingTransactions(blockchainRid, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/waiting`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/waiting`, config3);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
             });
@@ -42741,7 +42741,7 @@ function requireBlockchainClient() {
         },
         getWaitingTransaction(blockchainRid, txRid2, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            const { error: error4, statusCode, rspBody, transactionTimestamp } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/waiting/${(0, formatter_12.ensureString)(txRid2)}`, config2);
+            const { error: error4, statusCode, rspBody, transactionTimestamp } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/waiting/${(0, formatter_12.ensureString)(txRid2)}`, config3);
             const transaction = (0, requests_1.isTransaction)(rspBody);
             const result = transaction ? (0, formatter_12.toBuffer)(transaction.tx) : (0, requests_1.isRawGtv)(rspBody);
             return new Promise((resolve2, reject) => {
@@ -42754,7 +42754,7 @@ function requireBlockchainClient() {
         },
         getRejectedTransactions(blockchainRid, callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/rejected`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/tx/${(0, formatter_12.ensureString)(blockchainRid)}/rejected`, config3);
             const rejectedTransactionsArray = (0, requests_1.isRejectedTransactionResponseArray)(rspBody);
             const validResponseBody = statusCode === 200 && rejectedTransactionsArray ? rejectedTransactionsArray.map((rejectedTransaction) => (0, utils_12.formatRejectedTransactionFromResponse)(rejectedTransaction)) : rspBody;
             return new Promise((resolve2, reject) => {
@@ -42768,7 +42768,7 @@ function requireBlockchainClient() {
          */
         getAppStructure(callback) {
           return __awaiter2(this, void 0, void 0, function* () {
-            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/query/${config2.blockchainRid}?type=rell.get_app_structure`, config2);
+            const { error: error4, statusCode, rspBody } = yield (0, requestWithFailoverStrategy_1.requestWithFailoverStrategy)(enums_12.Method.GET, `/query/${config3.blockchainRid}?type=rell.get_app_structure`, config3);
             return new Promise((resolve2, reject) => {
               (0, utils_12.handleGetResponse)(error4, statusCode, (0, requests_1.isRawGtv)(rspBody), (0, utils_12.callbackPromiseBuilder)(reject, resolve2, callback));
             });
@@ -42781,7 +42781,7 @@ function requireBlockchainClient() {
           if (settings2.merkleHashVersion !== void 0) {
             merkleHashVersion = settings2.merkleHashVersion;
           } else {
-            merkleHashVersion = yield (0, utils_12.getMerkleHashVersionFromDapp)(config2);
+            merkleHashVersion = yield (0, utils_12.getMerkleHashVersionFromDapp)(config3);
           }
           return merkleHashVersion;
         });
@@ -44478,6 +44478,15 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
+var JudgeRefusalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JudgeRefusalError";
+  }
+};
+function isRefusalStatus(status) {
+  return status >= 400 && status < 500 && status !== 408;
+}
 function enrich(status, body, statusText, endpoint, path3) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
   let msg = `API error ${status}${path3 ? ` from ${path3}` : ""}: ${body || statusText}`;
@@ -44501,6 +44510,63 @@ function enrich(status, body, statusText, endpoint, path3) {
   return msg;
 }
 
+// src-ts/jail-hold.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
+var holds = /* @__PURE__ */ new Map();
+var blockedAt = /* @__PURE__ */ new Map();
+var BLOCK_MEMORY_MS = 10 * 6e4;
+var config2 = { ...DEFAULTS };
+function isJailHeld(pubkey) {
+  return holds.has(pubkey);
+}
+function recordBlock(pubkey) {
+  const now = Date.now();
+  for (const [key3, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key3);
+  blockedAt.set(pubkey, now);
+}
+function blockedSince(pubkey, startedAt) {
+  const at = blockedAt.get(pubkey);
+  return at !== void 0 && startedAt <= at;
+}
+function holdJail(pubkey, confirmJailed, onGiveUp) {
+  if (holds.has(pubkey)) return;
+  const hold = { timer: null };
+  holds.set(pubkey, hold);
+  const deadline = Date.now() + config2.ceilingMs;
+  const tick = async () => {
+    if (holds.get(pubkey) !== hold) return;
+    let jailed = false;
+    try {
+      jailed = await confirmJailed();
+    } catch {
+    }
+    if (holds.get(pubkey) !== hold) return;
+    if (jailed) {
+      holds.delete(pubkey);
+      return;
+    }
+    if (Date.now() >= deadline) {
+      holds.delete(pubkey);
+      onGiveUp?.();
+      return;
+    }
+    const timer = setTimeout(() => void tick(), config2.pollMs);
+    timer.unref?.();
+    hold.timer = timer;
+  };
+  void tick();
+}
+function releaseJailHolds() {
+  for (const hold of holds.values()) if (hold.timer) clearTimeout(hold.timer);
+  holds.clear();
+  blockedAt.clear();
+}
+function configureJailHold(next) {
+  config2 = { ...DEFAULTS, ...next };
+}
+
 // src-ts/http/client.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -44748,11 +44814,12 @@ function eventsOptedOut() {
   const flag = process.env.ATBASH_TELEMETRY_EVENTS_DISABLED?.trim().toLowerCase();
   return Boolean(flag && ["1", "true", "yes", "on"].includes(flag));
 }
+var SOURCE_SHAPE = /^(?:sdk|cli|plugin:[a-z0-9][a-z0-9._-]{0,31})$/;
 function configureEvents(next, opts = {}) {
   logger2 = next;
   eventsEnabled = next !== null && !eventsOptedOut();
   if (opts.version) sdkVersion = opts.version;
-  if (opts.source) eventSource = opts.source;
+  if (opts.source && SOURCE_SHAPE.test(opts.source)) eventSource = opts.source;
   hashAgentKey = opts.hashAgentKey ?? null;
 }
 function eventsAreOn() {
@@ -44833,6 +44900,7 @@ function strandedAgentKey() {
 }
 
 // src-ts/client.ts
+var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
@@ -45181,6 +45249,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * return the signed tx hex. The server broadcasts to chain.
    */
   async logToolCall(action, context = "", options = {}) {
+    return this._logToolCall(action, context, options, false);
+  }
+  /**
+   * `raisePreflightErrors` (the judge path, like Python's
+   * `raise_preflight_errors`): a failed registration check throws instead of
+   * becoming `{ success: false }`, so the caller can tell Atbash's "no"
+   * (not registered, or a 4xx) from an outage.
+   */
+  async _logToolCall(action, context, options, raisePreflightErrors) {
     const start = performance.now();
     recordCall("logToolCall", void 0, this.auth.pubkey);
     let exists;
@@ -45190,18 +45267,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       });
     } catch (err) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw err;
       return { success: false, toolCallId: null, error: errorMessage(err) };
     }
     if (!exists) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw new JudgeRefusalError(AGENT_NOT_REGISTERED);
       return {
         success: false,
         toolCallId: null,
-        error: "Agent not registered. Onboard the agent at the dashboard before submitting actions."
+        error: AGENT_NOT_REGISTERED
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
+    const brid = await this.callBrid(options.chainOpts);
     const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
@@ -45251,6 +45330,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
+    if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
+    const startedAt = Date.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
       chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
@@ -45275,12 +45356,13 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         }
       }
     }
-    const brid = this.bridFromChainOpts(chainOpts);
-    const logResult = await this.logToolCall(action, context, {
-      toolName: options.toolName,
-      toolArgsJson: options.toolArgsJson,
-      chainOpts
-    });
+    const brid = await this.callBrid(chainOpts);
+    const logResult = await this._logToolCall(
+      action,
+      context,
+      { toolName: options.toolName, toolArgsJson: options.toolArgsJson, chainOpts },
+      true
+    );
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
@@ -45317,10 +45399,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (verifyPubKey !== void 0) {
       verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
-    const data = parseJson(bodyBytes);
+    const parsed = tryParseJson(bodyBytes.toString("utf-8"));
+    if (!isRecord2(parsed)) {
+      throw new JudgeRefusalError(
+        "The judge's reply could not be read, so the action was not approved."
+      );
+    }
+    const data = parsed;
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
-    return {
+    const result = {
       verdict: normalizeVerdict(data.verdict),
       allow: this.executable(data),
       actionType: normalizeActionType(data.action_type),
@@ -45336,6 +45424,45 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       score,
       refusal: explicitRefusal(data)
     };
+    return this.applyJailHold(result, startedAt);
+  }
+  /**
+   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
+   * Refuse any other result that lands while the agent is held, or whose
+   * request was already in flight when the block arrived: the server judged it
+   * on pre-jail state.
+   */
+  applyJailHold(result, startedAt) {
+    const pubkey = this.auth.pubkey;
+    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+      recordBlock(pubkey);
+      holdJail(
+        pubkey,
+        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+      );
+      return result;
+    }
+    return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
+  }
+  /** The server's jailed refusal, produced locally while the agent is held. */
+  localJailBlock(toolCallId = generateToolCallId()) {
+    return {
+      verdict: "BLOCK",
+      allow: false,
+      actionType: "block",
+      reason: "Agent is jailed. All actions are blocked until the organization owner unjails this agent.",
+      confidence: 1,
+      provider: "policy",
+      latencyMs: 0,
+      toolCallId,
+      onChain: false,
+      enforced: true,
+      enforcementMode: "enforce",
+      status: "",
+      score: void 0,
+      refusal: "BLOCK"
+    };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
   /**
@@ -45387,6 +45514,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
           reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
+      if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
+        return { ...this.failJudge(errorMessage(err), err), allow: false };
+      }
       return this.failJudge(errorMessage(err), err);
     }
   }
@@ -45416,6 +45546,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
+    const inner = this.decideInner(result);
+    if (!result.enforcementMode) return inner;
+    return {
+      ...inner,
+      enforced: result.enforced,
+      enforcementMode: result.enforcementMode
+    };
+  }
+  decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
       allow: false,
@@ -45529,17 +45668,17 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   /**
    * Return the current status of a previously submitted judgment.
    *
-   * `chainOpts` names which chain the judgment was signed against. The
-   * server's GET /api/v1/judge routes to that chain when the SDK sends
-   * a `brid` query param; without it, the server falls back to public.
-   * Callers on the private chain must pass a `chainOpts` (or configure
-   * the client on the private chain) — otherwise polling a POSTed
-   * judgment on the private chain 404s at the server.
+   * `chainOpts` names which chain the judgment was signed against; the SDK
+   * sends it as the `brid` query param the server routes by. Without it the
+   * read uses the same chain `judgeAction` signs for (see `callBrid`): the
+   * client's org chain when it has an `orgName`, else the client default.
+   * A judgment signed with an explicit per-call `chainOpts` (or a per-call
+   * `orgName` on another chain) must be polled with that same `chainOpts`.
    */
   async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
-    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
+      const brid = await this.callBrid(chainOpts);
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
@@ -45877,6 +46016,18 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * The chain one call's transactions are signed for: the per-call override
+   * when given, otherwise the client's org, otherwise the client default.
+   * log_tool_call, judge_action and the judgment-status read all use this, so
+   * a request never pairs transactions signed for two different chains.
+   */
+  async callBrid(chainOpts) {
+    if (chainOpts?.blockchainRid || chainOpts?.network) {
+      return this.bridFromChainOpts(chainOpts);
+    }
+    return await this.defaultOrgBrid() ?? this.blockchainRid;
+  }
   /**
    * Resolve the dashboard chain used by agent metadata/policy reads.
    * Explicit per-call network overrides win; otherwise use the supplied org
@@ -46184,10 +46335,6 @@ function tryParseJson(text) {
     return void 0;
   }
 }
-function parseJson(bytes) {
-  const parsed = tryParseJson(bytes.toString("utf-8"));
-  return parsed === void 0 ? {} : parsed;
-}
 function requestPath(url) {
   if (!url) return void 0;
   try {
@@ -46448,6 +46595,16 @@ async function guardMemoryWrite(_input) {
   throw new Error(`guardMemoryWrite ${STUB_MSG5}`);
 }
 
+// src-ts/browser/memory-slot.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var unavailable2 = (name2) => {
+  throw new Error(`${name2} is not available in the browser bundle`);
+};
+function memorySlotOf(_target, _home, _root2, _extraHomes, _p) {
+  return unavailable2("memorySlotOf");
+}
+
 // src-ts/memory/sync.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
@@ -46485,7 +46642,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 // src-ts/browser/memory-pointer-store.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable2 = (name2) => {
+var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var PointerStore = class {
@@ -46499,20 +46656,20 @@ var PointerStore = class {
   }
 };
 function defaultPointerPath(_workspaceDir) {
-  return unavailable2("defaultPointerPath");
+  return unavailable3("defaultPointerPath");
 }
 
 // src-ts/browser/memory-file-logger.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable3 = (name2) => {
+var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 function createFileLogger(_logFilePath, _hostLogger) {
-  return unavailable3("createFileLogger");
+  return unavailable4("createFileLogger");
 }
 function defaultPluginLogPath(_workspaceDir) {
-  return unavailable3("defaultPluginLogPath");
+  return unavailable4("defaultPluginLogPath");
 }
 
 // src-ts/browser/memory-read-classifier.ts
@@ -46530,7 +46687,7 @@ function classifyMemoryRead(_event, _ctx, _opts = {}) {
 // src-ts/browser/memory-guard-manager.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable4 = (name2) => {
+var unavailable5 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var MemoryGuardManager = class {
@@ -46550,7 +46707,7 @@ var MemoryGuardManager = class {
   }
 };
 function createMemoryGuardManager(_opts) {
-  return unavailable4("createMemoryGuardManager");
+  return unavailable5("createMemoryGuardManager");
 }
 
 // src-ts/index.ts
@@ -46621,6 +46778,7 @@ export {
   EciesDomain,
   HttpClient,
   HttpTransportError,
+  JudgeRefusalError,
   KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
@@ -46639,6 +46797,7 @@ export {
   columnAad,
   commitMemoryVersion,
   configureEvents,
+  configureJailHold,
   containsEvasionCharacters2 as containsEvasionCharacters,
   containsSecret2 as containsSecret,
   createFileLogger,
@@ -46667,12 +46826,14 @@ export {
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,
+  isJailHeld,
   isValidPrivateKey2 as isValidPrivateKey,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent2 as loadAgent,
   loadAgentFromFile,
   loadUserConfig,
+  memorySlotOf,
   normalizeActionForHash,
   normalizeActionType,
   normalizeForMatching2 as normalizeForMatching,
@@ -46686,6 +46847,7 @@ export {
   recordEvent,
   redactJsonStrings,
   redactSecrets2 as redactSecrets,
+  releaseJailHolds,
   resolve,
   resolveKeyPath,
   rollbackMemory,