@atbash/sdk 0.20.0-dev.0 → 0.21.0-dev.0

package/dist/browser.d.mts

@@ -38,8 +38,12 @@ interface ChainConfig {
     readonly blockchainRid: string;
     readonly nodeUrls: readonly string[];
 }
-declare const PUBLIC_CHAIN: ChainConfig;
 declare const PRIVATE_CHAIN: ChainConfig;
+/**
+ * The chain a network name selects. Only `"private"` exists; any other value,
+ * including `"public"` from an untyped caller, is refused with the same
+ * message the config switch gives, never routed to private in silence.
+ */
 declare function chainForNetwork(network: Network): ChainConfig;
 
 /**
@@ -130,13 +134,11 @@ interface MemoryScanOptions {
     toolArgsJson?: string;
 }
 /**
- * Which Atbash chain an action runs against. `public` is the shared
- * testnet (Free plan); `private` is reserved for Private / Swarm /
- * Enterprise tier subscribers. The SDK resolves which one to use from
- * the org's subscription via `orgName` — callers normally don't need
- * to pass this manually.
+ * Chain selector. Only `"private"` exists: the public testnet chains are
+ * retired. The SDK resolves an org's chain through the Dashboard via
+ * `orgName` — callers normally don't need to pass this manually.
  */
-type Network = "public" | "private";
+type Network = "private";
 /**
  * Per-call chain overrides. Pass exactly what you need to override —
  * `network` selects between the SDK's known chains, `blockchainRid` pins a
@@ -340,7 +342,7 @@ interface AtbashOptions {
      */
     chain?: ChainConfig;
     /**
-     * Preset chain selector — `"public"` or `"private"`. Resolves to the
+     * Preset chain selector — `"private"` is the only value. Resolves to the
      * matching `ChainConfig` via `chainForNetwork()`. Overridden by `chain`,
      * overrides env `ATBASH_DEFAULT_CHAIN_NETWORK` and the config file.
      */
@@ -748,12 +750,9 @@ declare class Atbash {
      * Resolve which chain an org's actions should run against. Cached
      * per-client by orgName. Resolution order:
      *   1. `org_networks` map (authoritative).
-     *   2. Per-chain subscription fallback — public + private records
-     *      are fetched in parallel, with `is_private_blockchain` and
-     *      `assigned_at` reconciling mixed states.
-     * A lookup that names exactly one chain wins outright. Where it names
-     * neither (a brand-new org) or cannot choose between them, the client's
-     * configured default decides.
+     *   2. Subscription fallback — the org's subscription row on the chain.
+     * A lookup that finds the org wins outright. Where it finds nothing (a
+     * brand-new org), the client's configured default decides.
      */
     resolveChainForOrg(orgName: string): Promise<ChainConfig>;
     /**
@@ -870,8 +869,6 @@ declare function releaseJailHolds(): void;
 declare function configureJailHold(next: Partial<typeof DEFAULTS>): void;
 
 declare const DEFAULT_ENDPOINT: string;
-declare const DEFAULT_CHROMIA_NODE_URLS: readonly string[];
-declare const DEFAULT_BLOCKCHAIN_RID: string;
 
 declare class AtbashAPIError extends Error {
     /** HTTP status code (or 0 if the request never completed). */
@@ -1991,4 +1988,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -33,14 +33,6 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
   mod2
 ));
 
-// <define:__ATBASH_CHROMIA_NODE_URLS__>
-var define_ATBASH_CHROMIA_NODE_URLS_default;
-var init_define_ATBASH_CHROMIA_NODE_URLS = __esm({
-  "<define:__ATBASH_CHROMIA_NODE_URLS__>"() {
-    define_ATBASH_CHROMIA_NODE_URLS_default = ["https://node0.testnet.chromia.com:7740", "https://node1.testnet.chromia.com:7740"];
-  }
-});
-
 // <define:__ATBASH_PRIVATE_NODE_URLS__>
 var define_ATBASH_PRIVATE_NODE_URLS_default;
 var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
@@ -53,7 +45,6 @@ var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
 var require_buffer = __commonJS({
   "(disabled):node_modules/buffer/index.js"() {
     "use strict";
-    init_define_ATBASH_CHROMIA_NODE_URLS();
     init_define_ATBASH_PRIVATE_NODE_URLS();
   }
 });
@@ -62,7 +53,6 @@ var require_buffer = __commonJS({
 var require_bn = __commonJS({
   "node_modules/bn.js/lib/bn.js"(exports, module) {
     "use strict";
-    init_define_ATBASH_CHROMIA_NODE_URLS();
     init_define_ATBASH_PRIVATE_NODE_URLS();
     (function(module2, exports2) {
       "use strict";
@@ -2882,27 +2872,21 @@ var require_bn = __commonJS({
 });
 
 // src-ts/index.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // src-ts/browser/native.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/curves/secp256k1.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/sha2.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/_md.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/utils.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -3325,11 +3309,9 @@ var sha256 = /* @__PURE__ */ createHasher(
 );
 
 // node_modules/@noble/curves/abstract/curve.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/curves/utils.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
@@ -3483,7 +3465,6 @@ function validateObject(object, fields = {}, optFields = {}) {
 }
 
 // node_modules/@noble/curves/abstract/modular.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
@@ -4133,11 +4114,9 @@ function createKeygen(randomSecretKey, getPublicKey) {
 }
 
 // node_modules/@noble/curves/abstract/weierstrass.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/hmac.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var _HMAC = class {
   oHash;
@@ -5170,7 +5149,6 @@ var Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
 var secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);
 
 // node_modules/postchain-client/built/esm/index.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var import_bn = __toESM(require_bn(), 1);
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
@@ -43295,9 +43273,7 @@ var index = /* @__PURE__ */ getDefaultExportFromCjs(builtExports);
 // src-ts/browser/native.ts
 var { Buffer: Buffer3, gtx: pcgtx } = index;
 var ATBASH_ENDPOINT = "https://chromia-verified-ai-dev-two.vercel.app";
-var ATBASH_BLOCKCHAIN_RID = "02668C5218871F69A93CC0F7032DCFFE06EF0D35EF2F0B07A92A3D83A3F23A7D";
 var ATBASH_PRIVATE_BLOCKCHAIN_RID = "2603569AE8DC3F254323F719C8D4347BBA964E874E781291F8474236BE8B6493";
-var DEFAULT_CHROMIA_NODE_URLS_ARR = define_ATBASH_CHROMIA_NODE_URLS_default;
 var DEFAULT_PRIVATE_NODE_URLS_ARR = define_ATBASH_PRIVATE_NODE_URLS_default;
 var MERKLE_HASH_VERSION = 2;
 function stripHex(s2) {
@@ -43449,10 +43425,8 @@ var native = {
   deriveMemoryKey,
   encryptMemoryContent,
   decryptMemoryContent,
-  DEFAULT_BLOCKCHAIN_RID: ATBASH_BLOCKCHAIN_RID,
   DEFAULT_PRIVATE_BLOCKCHAIN_RID: ATBASH_PRIVATE_BLOCKCHAIN_RID,
   DEFAULT_ENDPOINT: ATBASH_ENDPOINT,
-  defaultChromiaNodeUrls: () => [...DEFAULT_CHROMIA_NODE_URLS_ARR],
   defaultPrivateNodeUrls: () => [...DEFAULT_PRIVATE_NODE_URLS_ARR],
   // Server-only surfaces — throw at runtime, keep types satisfied.
   // The memory signers are here and not with the other signing shims because
@@ -43522,11 +43496,9 @@ var native = {
 };
 
 // src-ts/client.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // src-ts/random.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function randomBytes4(size) {
   const buf = new Uint8Array(size);
@@ -43543,7 +43515,6 @@ function randomHex(size) {
 }
 
 // src-ts/auth-bearer.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var BEARER_TTL_MS = 4 * 60 * 1e3;
 var bearers = /* @__PURE__ */ new Map();
@@ -43569,47 +43540,36 @@ function agentAuthHeaders(auth, blockchainRid) {
 }
 
 // src-ts/chain-config.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-
-// src-ts/constants.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
-init_define_ATBASH_PRIVATE_NODE_URLS();
-var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
-var DEFAULT_CHROMIA_NODE_URLS = Object.freeze(
-  native.defaultChromiaNodeUrls()
-);
-var DEFAULT_BLOCKCHAIN_RID = native.DEFAULT_BLOCKCHAIN_RID;
-
-// src-ts/chain-config.ts
 var DEFAULT_PRIVATE_NODE_URLS = Object.freeze(
   native.defaultPrivateNodeUrls()
 );
 var DEFAULT_PRIVATE_BLOCKCHAIN_RID = native.DEFAULT_PRIVATE_BLOCKCHAIN_RID;
-var PUBLIC_CHAIN = {
-  network: "public",
-  blockchainRid: DEFAULT_BLOCKCHAIN_RID,
-  nodeUrls: DEFAULT_CHROMIA_NODE_URLS
-};
 var PRIVATE_CHAIN = {
   network: "private",
   blockchainRid: DEFAULT_PRIVATE_BLOCKCHAIN_RID,
   nodeUrls: DEFAULT_PRIVATE_NODE_URLS
 };
 function chainForNetwork(network) {
-  return network === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+  if (network !== "private") {
+    throw new Error(
+      `network must be "private" (the public chain is retired), got ${JSON.stringify(network)}`
+    );
+  }
+  return PRIVATE_CHAIN;
 }
 
+// src-ts/constants.ts
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
+
 // src-ts/browser/encrypted-toolcall.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // src-ts/browser/crypto-ecies.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/hashes/hkdf.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function extract(hash3, ikm, salt) {
   ahash(hash3);
@@ -43651,15 +43611,12 @@ function expand2(hash3, prk, info2, length = 32) {
 var hkdf = (hash3, ikm, salt, info2, length) => expand2(hash3, extract(hash3, ikm, salt), info2, length);
 
 // node_modules/@noble/ciphers/aes.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/ciphers/_polyval.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // node_modules/@noble/ciphers/utils.js
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
@@ -44253,7 +44210,6 @@ function encryptedLength(plaintextByteLength) {
 }
 
 // src-ts/crypto/envelope.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var PREFIX = "atb1";
 var SEPARATOR = ".";
@@ -44387,7 +44343,6 @@ function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJs
 }
 
 // src-ts/endpoint.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function buildAllowedJudgeHosts() {
   return /* @__PURE__ */ new Set([
@@ -44446,7 +44401,6 @@ function validateJudgeEndpoint(judge) {
 }
 
 // src-ts/errors.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var AtbashAPIError = class extends Error {
   /** HTTP status code (or 0 if the request never completed). */
@@ -44511,7 +44465,6 @@ function enrich(status, body, statusText, endpoint, path3) {
 }
 
 // src-ts/jail-hold.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
 var holds = /* @__PURE__ */ new Map();
@@ -44568,7 +44521,6 @@ function configureJailHold(next) {
 }
 
 // src-ts/http/client.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var HttpClient = class {
   baseUrl;
@@ -44674,7 +44626,6 @@ function classifyTransportError(err, url, method, timeoutMs) {
 }
 
 // src-ts/browser/keyLoader.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE = "keyLoader is not available in the browser bundle \u2014 pass `agentKey` explicitly to Atbash.fromConfig or use `new Atbash(privkey, opts)`.";
 function resolveKeyPath(_input) {
@@ -44685,11 +44636,9 @@ function loadAgentFromFile(_keyPath) {
 }
 
 // src-ts/decision.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // src-ts/normalize.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function wireText(raw2, fallback = "") {
   if (raw2 === null || raw2 === void 0) return fallback;
@@ -44801,7 +44750,6 @@ function canonicalAllow(data) {
 }
 
 // src-ts/opentel/events.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var SLOW_MS = 1500;
 var SUCCESS_SAMPLE_RATE = 10;
@@ -44857,7 +44805,6 @@ function recordEvent(e) {
 }
 
 // src-ts/browser/opentel/telemetry.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function setupTelemetry(_config) {
 }
@@ -44871,7 +44818,6 @@ async function shutdownTelemetry() {
 }
 
 // src-ts/browser/userConfig.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE2 = "userConfig file I/O is not available in the browser bundle.";
 function getConfigDir() {
@@ -44890,7 +44836,7 @@ function resolve(_key, flagValue) {
   return flagValue ?? "";
 }
 function forcedChainNetwork(flagValue) {
-  return flagValue === "public" || flagValue === "private" ? flagValue : void 0;
+  return flagValue === "private" ? flagValue : void 0;
 }
 function agentKeyFromEnv() {
   return "";
@@ -44910,15 +44856,13 @@ function resolveConstructorChain(options) {
   const hasBrid = options.blockchainRid !== void 0;
   if (hasNodeUrls !== hasBrid) {
     throw new Error(
-      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PUBLIC_CHAIN | PRIVATE_CHAIN` or `network: "public" | "private"`.'
+      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PRIVATE_CHAIN` or `network: "private"`.'
     );
   }
   if (hasNodeUrls && hasBrid) {
-    const brid = options.blockchainRid;
-    const derivedNetwork = options.network ?? (brid === PUBLIC_CHAIN.blockchainRid ? "public" : brid === PRIVATE_CHAIN.blockchainRid ? "private" : "private");
     return {
-      network: derivedNetwork,
-      blockchainRid: brid,
+      network: "private",
+      blockchainRid: options.blockchainRid,
       nodeUrls: options.nodeUrls
     };
   }
@@ -45058,10 +45002,9 @@ var Atbash = class _Atbash {
     _Atbash.environmentLogged = true;
     const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
     this.logger.info?.(
-      `[atbash] environment \u2014 judge=${this.endpoint} publicChain=${brief(native.DEFAULT_BLOCKCHAIN_RID)} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
       {
         judgeEndpoint: this.endpoint,
-        publicBlockchainRid: native.DEFAULT_BLOCKCHAIN_RID,
         privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
         activeBlockchainRid: this.blockchainRid,
         responseSignatureCheck: Boolean(this.verifyPubKey)
@@ -45334,7 +45277,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const startedAt = Date.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
-      chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
+      chainOpts = options.chainOpts ?? {
+        blockchainRid: this._defaultChain.blockchainRid
+      };
     } else if (options.orgName && this.forcedNetwork()) {
       chainOpts = { network: this.forcedNetwork() };
     } else if (options.orgName) {
@@ -45344,8 +45289,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       } else {
         const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
         if (mapNetwork) {
-          const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-          this._chainCache.set(options.orgName, chain);
+          this._chainCache.set(options.orgName, chainForNetwork(mapNetwork));
           chainOpts = { network: mapNetwork };
         } else if (!chainOpts?.blockchainRid) {
           const resolved = await this.resolveChainFromMap(
@@ -45883,21 +45827,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    if (data?.network === "public" || data?.network === "private") {
-      return data.network;
-    }
+    if (data?.network === "private") return data.network;
     return null;
   }
   /**
    * Resolve which chain an org's actions should run against. Cached
    * per-client by orgName. Resolution order:
    *   1. `org_networks` map (authoritative).
-   *   2. Per-chain subscription fallback — public + private records
-   *      are fetched in parallel, with `is_private_blockchain` and
-   *      `assigned_at` reconciling mixed states.
-   * A lookup that names exactly one chain wins outright. Where it names
-   * neither (a brand-new org) or cannot choose between them, the client's
-   * configured default decides.
+   *   2. Subscription fallback — the org's subscription row on the chain.
+   * A lookup that finds the org wins outright. Where it finds nothing (a
+   * brand-new org), the client's configured default decides.
    */
   async resolveChainForOrg(orgName) {
     const name2 = orgName.trim();
@@ -45919,35 +45858,14 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const cached = this._chainCache.get(orgName);
     if (cached) return cached;
     if (mapNetwork) {
-      const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-      this._chainCache.set(orgName, chain);
-      return chain;
-    }
-    const [pubRes, privRes] = await Promise.allSettled([
-      this.getOrgSubscription(orgName, "public"),
-      this.getOrgSubscription(orgName, "private")
-    ]);
-    const pubSub = pubRes.status === "fulfilled" ? pubRes.value : null;
-    const privSub = privRes.status === "fulfilled" ? privRes.value : null;
-    const failure = pubRes.status === "rejected" ? pubRes.reason : privRes.status === "rejected" ? privRes.reason : null;
-    if (pubSub?.is_private_blockchain) {
-      this._chainCache.set(orgName, PRIVATE_CHAIN);
-      return PRIVATE_CHAIN;
-    }
-    if (pubSub && privSub) {
-      const chain = privSub.assigned_at === pubSub.assigned_at ? this._defaultChain : privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      const chain = chainForNetwork(mapNetwork);
       this._chainCache.set(orgName, chain);
       return chain;
     }
-    if (pubSub) {
-      this._chainCache.set(orgName, PUBLIC_CHAIN);
-      return PUBLIC_CHAIN;
-    }
-    if (privSub?.is_private_blockchain) {
-      this._chainCache.set(orgName, PRIVATE_CHAIN);
-      return PRIVATE_CHAIN;
-    }
-    if (failure) {
+    let privSub;
+    try {
+      privSub = await this.getOrgSubscription(orgName, "private");
+    } catch (failure) {
       const detail = failure instanceof Error ? failure.message : String(failure);
       throw new AtbashAPIError(
         failure instanceof AtbashAPIError ? failure.status : 0,
@@ -45956,6 +45874,10 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         this.endpoint
       );
     }
+    if (privSub) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
     this._chainCache.set(orgName, this._defaultChain);
     return this._defaultChain;
   }
@@ -46012,8 +45934,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    */
   bridFromChainOpts(chainOpts) {
     if (chainOpts?.blockchainRid) return chainOpts.blockchainRid;
-    if (chainOpts?.network === "private") return PRIVATE_CHAIN.blockchainRid;
-    if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
+    if (chainOpts?.network) return chainForNetwork(chainOpts.network).blockchainRid;
     return this.blockchainRid;
   }
   /**
@@ -46373,7 +46294,6 @@ function truncate(text, limit = MAX_ACTION_LEN) {
 }
 
 // src-ts/browser/key-path.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
 var unavailable = (name2) => {
@@ -46387,7 +46307,6 @@ function chooseKeyPath(_input, _exists) {
 }
 
 // src-ts/redact.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function redactJsonStrings(value) {
   if (typeof value === "string") {
@@ -46407,7 +46326,6 @@ function redactJsonStrings(value) {
 }
 
 // src-ts/signature.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   if (!signatureHex) {
@@ -46431,7 +46349,6 @@ function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
 }
 
 // src-ts/memory/boot-sync-message.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var BOOT_SYNC_HINT = "check the chain endpoint and orgName if the cause above does not explain it";
 function bootSyncFailureLine(cause) {
@@ -46444,11 +46361,9 @@ function bootSyncFailureLine(cause) {
 }
 
 // src-ts/memory/index.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 
 // src-ts/browser/memory-crypto.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var { Buffer: Buffer4 } = index;
 var HKDF_INFO = new TextEncoder().encode("atbash:memory-encryption");
@@ -46524,7 +46439,6 @@ async function decryptMemoryContent2(ciphertext, nonce, key3) {
 }
 
 // src-ts/browser/memory-scan.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG2 = "not available in @atbash/sdk browser bundle \u2014 scan memory server-side";
 async function scanMemory(_entry, _auth, _opts) {
@@ -46535,7 +46449,6 @@ async function scanMemoryBatch(_entries, _auth, _opts) {
 }
 
 // src-ts/browser/memory-chain.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG3 = "not available in @atbash/sdk browser bundle \u2014 commit/rollback memory server-side";
 async function commitMemoryVersion(_plaintext, _auth, _opts) {
@@ -46564,7 +46477,6 @@ async function rollbackMemory(_toId, _reason, _auth, _opts) {
 }
 
 // src-ts/browser/memory-classifier.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG4 = "not available in @atbash/sdk browser bundle \u2014 classify memory writes server-side";
 var DEFAULT_MEMORY_WRITE_TOOL_NAMES = [
@@ -46588,7 +46500,6 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/browser/memory-guard.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 guard memory writes agent-side";
 async function guardMemoryWrite(_input) {
@@ -46596,7 +46507,6 @@ async function guardMemoryWrite(_input) {
 }
 
 // src-ts/browser/memory-slot.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
@@ -46606,7 +46516,6 @@ function memorySlotOf(_target, _home, _root2, _extraHomes, _p) {
 }
 
 // src-ts/memory/sync.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var MemoryIntegrityError = class extends Error {
   constructor(id, reason) {
@@ -46640,7 +46549,6 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 }
 
 // src-ts/browser/memory-pointer-store.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
@@ -46660,7 +46568,6 @@ function defaultPointerPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-file-logger.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
@@ -46673,7 +46580,6 @@ function defaultPluginLogPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-read-classifier.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG6 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
@@ -46685,7 +46591,6 @@ function classifyMemoryRead(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/browser/memory-guard-manager.ts
-init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable5 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
@@ -46769,8 +46674,6 @@ export {
   Atbash,
   AtbashAPIError,
   BOOT_SYNC_HINT,
-  DEFAULT_BLOCKCHAIN_RID,
-  DEFAULT_CHROMIA_NODE_URLS,
   DEFAULT_ENDPOINT,
   DEFAULT_MEMORY_PATH_PATTERNS,
   DEFAULT_MEMORY_READ_TOOL_NAMES,
@@ -46783,7 +46686,6 @@ export {
   MemoryGuardManager,
   MemoryIntegrityError,
   PRIVATE_CHAIN,
-  PUBLIC_CHAIN,
   PointerStore,
   SignatureVerificationError,
   bootSyncFailureLine,