@atbash/sdk 0.21.0-dev.0 → 0.22.0-dev.0

package/README.md

@@ -68,7 +68,7 @@ Two ways to create an agent:
 
 ## Secret storage
 
-- Load the private key from an environment variable (`ATBASH_AGENT_KEY`) or a secret manager — never hardcode it.
+- Keep the private key in the key file (`~/.config/atbash/guard-client-key`, or a file named by `keyPath`), in `ATBASH_AGENT_KEY`, or in a secret manager — never hardcode it. See [Which key signs](#which-key-signs).
 - Never commit `.env` files containing the key.
 - If a key leaks, stop using it and create a new agent in the dashboard.
 
@@ -127,31 +127,71 @@ Standalone helpers for keypair handling.
 | `isValidPrivateKey(hex)` | Validate a private-key string |
 | `loadAgent(privkey)` | Validate the key + return `{ pubkey, privkey }` |
 
-## Configuration
+## Configuration resolution
 
-Configuration is resolved with priority: **constructor arg > env var > config file** (`~/.config/atbash/config.json`).
+`new Atbash(privkey, options)` takes everything explicitly. `Atbash.fromConfig(options)` fills in what you did not pass from the environment and then from `~/.config/atbash/config.json`, and finds the signing key for you.
 
 ```ts
 import { Atbash } from "@atbash/sdk";
-const atbash = Atbash.fromConfig();   // reads env + config file
+const atbash = Atbash.fromConfig();   // key file + env + config.json
 ```
 
-| Config key | Env var |
-|---|---|
-| `agentKey` | `ATBASH_AGENT_KEY` |
-| `orgName` | `ATBASH_ORG_NAME` |
-| `judgeEndpoint` | `ATBASH_ENDPOINT` |
-| `judgeVerifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` (self-hosted judge response-signing key; selects the self-hosted policy) |
-| `blockchainRid` | `ATBASH_BLOCKCHAIN_RID` |
+### Settings: option, then env, then `config.json`
+
+Each setting is read from the first place that has it: the `fromConfig` option, then the environment variable, then the key in `config.json`.
+
+`judge` is taken whole. Pass it complete, or leave it out and use the environment or `config.json`: a `judge` with only an `endpoint` ignores `ATBASH_JUDGE_VERIFY_PUBKEY`, so a self-hosted host then fails the allowlist.
+
+| `fromConfig` option | Env var | `config.json` key | Notes |
+|---|---|---|---|
+| `judge.endpoint` | `ATBASH_ENDPOINT` | `judgeEndpoint` | Must pass the endpoint rules below. |
+| `judge.verifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` | `judgeVerifyPubKey` | 66-hex response-signing key of a self-hosted judge. Set through the environment or `config.json` without an endpoint, it throws; passed in `judge` without an endpoint, the default endpoint is used. |
+| `network` | `ATBASH_DEFAULT_CHAIN_NETWORK` | `defaultChainNetwork` | Only `"private"` is accepted; anything else throws. A client that names no chain is pinned to it, even for an org the dashboard places on another chain. |
+| `debug` | `ATBASH_DEBUG` | `debug` | `1`, `true` or `yes` turns diagnostics on. |
+| `orgName` | `ATBASH_ORG_NAME` | `orgName` | `fromConfig` reads the option only. The env var and file key are read by `resolve("orgName")`, which the CLI and plugins use. |
+
+`agentKey` is not in this table on purpose: the signing key is never read from `config.json` (next section).
+
+Helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
+
+### Which key signs
+
+`fromConfig` picks the first of these that is set:
+
+1. `agentKey` option (hex private key in code).
+2. `keyPath` option. A path that does not exist throws; the SDK never falls through to another key when you named one.
+3. `ATBASH_AGENT_KEY` environment variable.
+4. `~/.config/atbash/guard-client-key`.
+5. `~/.config/atbash/atbash-client-key`.
+
+If none exists `fromConfig` throws `atbash key file not found. Looked for: <both default paths>`. The bare constructor never reads a key file.
+
+An `agentKey` inside `config.json` is ignored. A settings file is writable by anything on the machine and is shared by every Atbash integration, so it is not allowed to choose who you sign as. When you pass a `logger`, `fromConfig` warns:
+
+```
+[atbash] "agentKey" in config.json is ignored — settings do not choose the signing key. It holds <pubkey>; this client signs as the key file or ATBASH_AGENT_KEY instead. ...
+```
+
+and when no key file exists at all, the "not found" error names the pubkey stranded in `config.json` so you know where it went.
+
+A key file is either `key=value` lines or JSON. Both fields must be present; the public key is re-derived from the private key, and a `0x` prefix is accepted.
+
+```
+privkey=<64 hex>
+pubkey=<66 hex>
+```
+
+```json
+{ "privKey": "<64 hex>", "pubKey": "<66 hex>" }
+```
 
-Persistent config helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
+For adapters and CI, keep the key in a file and point at it with `keyPath` (or let the default path be found). Passing the key on a command line puts it in shell history and process listings.
 
-### Judge endpoint policy
+### What `orgName` does
 
-Both `Atbash.fromConfig()` and the direct constructor validate the judge endpoint before any request is made. `new Atbash(privkey, { endpoint })` accepts only an `https://` allowlisted judge host, or a self-hosted judge when `verifyPubKey` is also given (the 66-hex response-signing key, which then verifies every judge response). Plaintext `http://` is accepted only for loopback (`localhost`, `127.0.0.1`, `::1`) local development. Anything else throws at construction, so a misconfigured or injected endpoint can no longer receive the agent's signed actions or return unsigned verdicts. `validateJudgeEndpoint(...)` exposes the same check.
+`orgName` tells the SDK which chain to sign the call for: the org's network is looked up once through the dashboard, cached per client, and every judge and log call is signed for that chain. The SDK does not check that the name matches the org the agent was registered under; which org's policy judges the action is decided by the agent's registration, not by this string. On a deployment with a single chain a missing or different `orgName` therefore does not change the verdict. Org-scoped reads such as `getOrgTierInfo(orgName)` send the name as given; the dashboard answers an agent-authenticated call for the agent's own org, whatever name was passed.
 
-Agent policy and detail reads can resolve the organization's active network, or
-accept an explicit network override:
+Agent policy and detail reads can take the org, or an explicit chain:
 
 ```ts
 await atbash.getAgentPolicy(atbash.pubkey, { orgName: "acme" });
@@ -160,6 +200,41 @@ await atbash.getAgentDetail(atbash.pubkey, {
 });
 ```
 
+### Judge endpoint rules
+
+Both `fromConfig` and the constructor validate the endpoint before any request. `validateJudgeEndpoint(...)` exposes the same check.
+
+- With no endpoint configured the SDK talks to the endpoint compiled into the build (`https://atbash.ai` for a release build).
+- An `https://` endpoint is accepted without further setup only on the trusted hosts: `atbash.ai`, `www.atbash.ai` and the build's own default host.
+- Any other `https://` endpoint is a self-hosted judge. It needs `policy: "self-hosted"` plus `verifyPubKey` (the judge's 66-hex compressed response-signing key), or `ATBASH_ENDPOINT` plus `ATBASH_JUDGE_VERIFY_PUBKEY`. Every judge response is then signature-checked against that key. Without the key the constructor throws `judge endpoint hostname "<host>" is not in the trusted allowlist`.
+- Plain `http://` is accepted only for loopback (`localhost`, `127.0.0.1`, `::1`), for a dashboard running on the same machine. Any other `http://` endpoint throws.
+- A URL with embedded credentials (`user:pass@host`) throws.
+
+```ts
+const atbash = Atbash.fromConfig({
+  judge: {
+    policy: "self-hosted",
+    endpoint: "https://judge.example.com",
+    verifyPubKey: "02…66 hex…",
+  },
+});
+```
+
+### From a key file to a first ALLOW
+
+1. Download the key file the onboarding wizard offers at its Deploy step (it is in the `key=value` form above) and save it, for example as `./agent.key`.
+2. Build the client from that file and judge an action:
+
+```ts
+import { Atbash } from "@atbash/sdk";
+
+const atbash = Atbash.fromConfig({ keyPath: "./agent.key" });
+const result = await atbash.judgeAction("read file", "list the files in ./src");
+console.log(result.allow, result.enforced, result.reason);
+```
+
+Dropping the same file at `~/.config/atbash/guard-client-key` lets `Atbash.fromConfig()` find it with no options at all.
+
 ## Error handling
 
 The SDK throws standard `Error` objects. Known failure modes are enriched with a pointer to the dashboard page that fixes them:

package/dist/browser.d.mts

@@ -1154,11 +1154,18 @@ declare function getRecentAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, fi
  * when you need every active version regardless of age.
  */
 declare function getActiveAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+interface MemoryHistoryPage {
+    /** Most versions to return, at most 200. Omit for the full history. */
+    maxCount?: number;
+    /** Return only versions with a lower id: the last id of the previous page. */
+    beforeId?: number;
+}
 /**
  * Full version history — active + inactive, most recent first. Used
- * by rollback UX to choose a target version.
+ * by rollback UX to choose a target version. Pass `page` to read it in
+ * pages; this needs a Dashboard and chain that support paging.
  */
-declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null, page?: MemoryHistoryPage): Promise<AgentMemoryEntry[]>;
 /**
  * Fetch a single memory entry by version id, including its current
  * `is_active` state. Version ids are agent-unique on chain (not
@@ -1988,4 +1995,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, type MemoryHistoryPage, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/browser.mjs

@@ -45635,15 +45635,19 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       }
       const parsed = tryParseJson(bytes.toString("utf-8"));
       const data = isRecord2(parsed) ? parsed : {};
+      const rawId = data.tool_call_id ?? data.judgmentId;
+      const statedId = wireText(rawId);
+      const sameCall = rawId === void 0 || rawId === null || statedId === judgmentId;
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
-        allow: this.executable(data),
+        allow: sameCall && this.executable(data),
         reason: wireText(data.reason),
-        judgmentId: wireText(data.judgmentId, judgmentId),
+        judgmentId: statedId || judgmentId,
         onChain: optBool(data.onChain),
         cached: optBool(data.cached),
-        responseTimeMs: optNumber(data.responseTimeMs)
+        // The Dashboard sends response_time_ms; responseTimeMs is the spec name.
+        responseTimeMs: optNumber(data.responseTimeMs ?? data.response_time_ms)
       };
     });
   }
@@ -46463,7 +46467,7 @@ async function getRecentAgentMemory(_auth, _chainOpts) {
 async function getActiveAgentMemory(_auth, _chainOpts) {
   throw new Error(`getActiveAgentMemory ${STUB_MSG3}`);
 }
-async function getMemoryHistory(_auth, _chainOpts) {
+async function getMemoryHistory(_auth, _chainOpts, _filePath, _page) {
   throw new Error(`getMemoryHistory ${STUB_MSG3}`);
 }
 async function getMemoryById(_id, _auth, _chainOpts) {

package/dist/index.d.mts

@@ -1154,11 +1154,18 @@ declare function getRecentAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, fi
  * when you need every active version regardless of age.
  */
 declare function getActiveAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+interface MemoryHistoryPage {
+    /** Most versions to return, at most 200. Omit for the full history. */
+    maxCount?: number;
+    /** Return only versions with a lower id: the last id of the previous page. */
+    beforeId?: number;
+}
 /**
  * Full version history — active + inactive, most recent first. Used
- * by rollback UX to choose a target version.
+ * by rollback UX to choose a target version. Pass `page` to read it in
+ * pages; this needs a Dashboard and chain that support paging.
  */
-declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null, page?: MemoryHistoryPage): Promise<AgentMemoryEntry[]>;
 /**
  * Fetch a single memory entry by version id, including its current
  * `is_active` state. Version ids are agent-unique on chain (not
@@ -1988,4 +1995,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, type MemoryHistoryPage, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.d.ts

@@ -1154,11 +1154,18 @@ declare function getRecentAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, fi
  * when you need every active version regardless of age.
  */
 declare function getActiveAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+interface MemoryHistoryPage {
+    /** Most versions to return, at most 200. Omit for the full history. */
+    maxCount?: number;
+    /** Return only versions with a lower id: the last id of the previous page. */
+    beforeId?: number;
+}
 /**
  * Full version history — active + inactive, most recent first. Used
- * by rollback UX to choose a target version.
+ * by rollback UX to choose a target version. Pass `page` to read it in
+ * pages; this needs a Dashboard and chain that support paging.
  */
-declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null, page?: MemoryHistoryPage): Promise<AgentMemoryEntry[]>;
 /**
  * Fetch a single memory entry by version id, including its current
  * `is_active` state. Version ids are agent-unique on chain (not
@@ -1988,4 +1995,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, type MemoryHistoryPage, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };

package/dist/index.js

@@ -736,7 +736,7 @@ var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
 var import_exporter_logs_otlp_http = require("@opentelemetry/exporter-logs-otlp-http");
 var import_sdk_logs = require("@opentelemetry/sdk-logs");
 var import_node_crypto = require("crypto");
-var SDK_VERSION = true ? "0.21.0-dev.0" : "";
+var SDK_VERSION = true ? "0.22.0-dev.0" : "";
 var SDK_LANGUAGE = "node";
 function sdkResourceAttributes() {
   const attrs = {
@@ -1789,15 +1789,19 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       }
       const parsed = tryParseJson(bytes.toString("utf-8"));
       const data = isRecord2(parsed) ? parsed : {};
+      const rawId = data.tool_call_id ?? data.judgmentId;
+      const statedId = wireText(rawId);
+      const sameCall = rawId === void 0 || rawId === null || statedId === judgmentId;
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
-        allow: this.executable(data),
+        allow: sameCall && this.executable(data),
         reason: wireText(data.reason),
-        judgmentId: wireText(data.judgmentId, judgmentId),
+        judgmentId: statedId || judgmentId,
         onChain: optBool(data.onChain),
         cached: optBool(data.cached),
-        responseTimeMs: optNumber(data.responseTimeMs)
+        // The Dashboard sends response_time_ms; responseTimeMs is the spec name.
+        responseTimeMs: optNumber(data.responseTimeMs ?? data.response_time_ms)
       };
     });
   }
@@ -2733,14 +2737,15 @@ async function decryptRow(row, key) {
     updatedAt: parsed.updated_at
   };
 }
-async function readRows(action, auth, chainOpts, filePath) {
+async function readRows(action, auth, chainOpts, filePath, extra = {}) {
   const key = await deriveMemoryKey(auth.privkey);
   const rows = await memoryQuery(
     action,
     auth,
     resolveBlockchainRid(chainOpts),
     chainOpts,
-    filePath
+    filePath,
+    extra
   );
   return Promise.all((rows ?? []).map((row) => decryptRow(row, key)));
 }
@@ -2760,8 +2765,29 @@ function getRecentAgentMemory(auth, chainOpts, filePath) {
 function getActiveAgentMemory(auth, chainOpts, filePath) {
   return readRows("memory-active", auth, chainOpts, filePath ?? null);
 }
-function getMemoryHistory(auth, chainOpts, filePath) {
-  return readRows("memory-history", auth, chainOpts, filePath ?? null);
+var MEMORY_HISTORY_MAX_COUNT = 200;
+function memoryHistoryPageArgs(page) {
+  const extra = {};
+  for (const [name, value] of [
+    ["max_count", page?.maxCount],
+    ["before_id", page?.beforeId]
+  ]) {
+    if (value === void 0) continue;
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw new Error(`getMemoryHistory: ${name} must be a positive integer`);
+    }
+    if (name === "max_count" && value > MEMORY_HISTORY_MAX_COUNT) {
+      throw new Error(`getMemoryHistory: max_count must be at most ${MEMORY_HISTORY_MAX_COUNT}`);
+    }
+    extra[name] = value;
+  }
+  return extra;
+}
+async function getMemoryHistory(auth, chainOpts, filePath, page) {
+  const rows = await readRows("memory-history", auth, chainOpts, filePath ?? null, memoryHistoryPageArgs(page));
+  const beforeId = page?.beforeId;
+  const older = beforeId === void 0 ? rows : rows.filter((row) => row.id < beforeId);
+  return page?.maxCount === void 0 ? older : older.slice(0, page.maxCount);
 }
 async function getMemoryById(id, auth, chainOpts) {
   native.validateMemoryId(id);

package/dist/index.mjs

@@ -613,7 +613,7 @@ import {
 import { OTLPLogExporter } from "@opentelemetry/exporter-logs-otlp-http";
 import { BatchLogRecordProcessor, LoggerProvider } from "@opentelemetry/sdk-logs";
 import { createHash } from "crypto";
-var SDK_VERSION = true ? "0.21.0-dev.0" : "";
+var SDK_VERSION = true ? "0.22.0-dev.0" : "";
 var SDK_LANGUAGE = "node";
 function sdkResourceAttributes() {
   const attrs = {
@@ -1672,15 +1672,19 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       }
       const parsed = tryParseJson(bytes.toString("utf-8"));
       const data = isRecord2(parsed) ? parsed : {};
+      const rawId = data.tool_call_id ?? data.judgmentId;
+      const statedId = wireText(rawId);
+      const sameCall = rawId === void 0 || rawId === null || statedId === judgmentId;
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
-        allow: this.executable(data),
+        allow: sameCall && this.executable(data),
         reason: wireText(data.reason),
-        judgmentId: wireText(data.judgmentId, judgmentId),
+        judgmentId: statedId || judgmentId,
         onChain: optBool(data.onChain),
         cached: optBool(data.cached),
-        responseTimeMs: optNumber(data.responseTimeMs)
+        // The Dashboard sends response_time_ms; responseTimeMs is the spec name.
+        responseTimeMs: optNumber(data.responseTimeMs ?? data.response_time_ms)
       };
     });
   }
@@ -2616,14 +2620,15 @@ async function decryptRow(row, key) {
     updatedAt: parsed.updated_at
   };
 }
-async function readRows(action, auth, chainOpts, filePath) {
+async function readRows(action, auth, chainOpts, filePath, extra = {}) {
   const key = await deriveMemoryKey(auth.privkey);
   const rows = await memoryQuery(
     action,
     auth,
     resolveBlockchainRid(chainOpts),
     chainOpts,
-    filePath
+    filePath,
+    extra
   );
   return Promise.all((rows ?? []).map((row) => decryptRow(row, key)));
 }
@@ -2643,8 +2648,29 @@ function getRecentAgentMemory(auth, chainOpts, filePath) {
 function getActiveAgentMemory(auth, chainOpts, filePath) {
   return readRows("memory-active", auth, chainOpts, filePath ?? null);
 }
-function getMemoryHistory(auth, chainOpts, filePath) {
-  return readRows("memory-history", auth, chainOpts, filePath ?? null);
+var MEMORY_HISTORY_MAX_COUNT = 200;
+function memoryHistoryPageArgs(page) {
+  const extra = {};
+  for (const [name, value] of [
+    ["max_count", page?.maxCount],
+    ["before_id", page?.beforeId]
+  ]) {
+    if (value === void 0) continue;
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw new Error(`getMemoryHistory: ${name} must be a positive integer`);
+    }
+    if (name === "max_count" && value > MEMORY_HISTORY_MAX_COUNT) {
+      throw new Error(`getMemoryHistory: max_count must be at most ${MEMORY_HISTORY_MAX_COUNT}`);
+    }
+    extra[name] = value;
+  }
+  return extra;
+}
+async function getMemoryHistory(auth, chainOpts, filePath, page) {
+  const rows = await readRows("memory-history", auth, chainOpts, filePath ?? null, memoryHistoryPageArgs(page));
+  const beforeId = page?.beforeId;
+  const older = beforeId === void 0 ? rows : rows.filter((row) => row.id < beforeId);
+  return page?.maxCount === void 0 ? older : older.slice(0, page.maxCount);
 }
 async function getMemoryById(id, auth, chainOpts) {
   native.validateMemoryId(id);

package/index.js

@@ -92,8 +92,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-android-arm64')
         const bindingPackageVersion = require('@atbash/sdk-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -108,8 +108,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-android-arm-eabi')
         const bindingPackageVersion = require('@atbash/sdk-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -129,8 +129,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-win32-x64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-win32-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -145,8 +145,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-win32-x64-msvc')
           const bindingPackageVersion = require('@atbash/sdk-win32-x64-msvc/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -162,8 +162,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-win32-ia32-msvc')
         const bindingPackageVersion = require('@atbash/sdk-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -178,8 +178,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-win32-arm64-msvc')
         const bindingPackageVersion = require('@atbash/sdk-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -197,8 +197,8 @@ function requireNative() {
     try {
       const binding = require('@atbash/sdk-darwin-universal')
       const bindingPackageVersion = require('@atbash/sdk-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -213,8 +213,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-darwin-x64')
         const bindingPackageVersion = require('@atbash/sdk-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -229,8 +229,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-darwin-arm64')
         const bindingPackageVersion = require('@atbash/sdk-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -249,8 +249,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-freebsd-x64')
         const bindingPackageVersion = require('@atbash/sdk-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -265,8 +265,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-freebsd-arm64')
         const bindingPackageVersion = require('@atbash/sdk-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -286,8 +286,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-x64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -302,8 +302,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-x64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -320,8 +320,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -336,8 +336,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -354,8 +354,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm-musleabihf')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -370,8 +370,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@atbash/sdk-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -388,8 +388,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-loong64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -404,8 +404,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-loong64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -422,8 +422,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-riscv64-musl')
           const bindingPackageVersion = require('@atbash/sdk-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -438,8 +438,8 @@ function requireNative() {
         try {
           const binding = require('@atbash/sdk-linux-riscv64-gnu')
           const bindingPackageVersion = require('@atbash/sdk-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -455,8 +455,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-linux-ppc64-gnu')
         const bindingPackageVersion = require('@atbash/sdk-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -471,8 +471,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-linux-s390x-gnu')
         const bindingPackageVersion = require('@atbash/sdk-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -491,8 +491,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-arm64')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -507,8 +507,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-x64')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -523,8 +523,8 @@ function requireNative() {
       try {
         const binding = require('@atbash/sdk-openharmony-arm')
         const bindingPackageVersion = require('@atbash/sdk-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.21.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0-dev.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -664,8 +664,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@atbash/sdk-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '0.21.0-dev.0') {
-            throw new Error(`WASI binding package version mismatch, expected 0.21.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0-dev.0') {
+            throw new Error(`WASI binding package version mismatch, expected 0.22.0-dev.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@atbash/sdk-wasm32-wasi')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.21.0-dev.0",
+  "version": "0.22.0-dev.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -97,10 +97,10 @@
     "typescript-eslint": "^8.62.1"
   },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.21.0-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.21.0-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.21.0-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.21.0-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.21.0-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.22.0-dev.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.22.0-dev.0",
+    "@atbash/sdk-linux-x64-musl": "0.22.0-dev.0",
+    "@atbash/sdk-darwin-arm64": "0.22.0-dev.0",
+    "@atbash/sdk-win32-x64-msvc": "0.22.0-dev.0"
   }
 }