@atbash/sdk 0.21.0-dev.0 → 0.23.0-dev.0

package/README.md

@@ -68,7 +68,7 @@ Two ways to create an agent:
 
 ## Secret storage
 
-- Load the private key from an environment variable (`ATBASH_AGENT_KEY`) or a secret manager — never hardcode it.
+- Keep the private key in the key file (`~/.config/atbash/guard-client-key`, or a file named by `keyPath`), in `ATBASH_AGENT_KEY`, or in a secret manager — never hardcode it. See [Which key signs](#which-key-signs).
 - Never commit `.env` files containing the key.
 - If a key leaks, stop using it and create a new agent in the dashboard.
 
@@ -84,6 +84,8 @@ Every `judgeAction` call returns one of three verdicts:
 
 > **Gate on `allow`, not on `verdict`.** `allow` is the canonical permission the SDK computes from every signal in the response; `verdict` is one of those signals, and reads as the reason. The two differ when an organisation does not enforce an agent's verdicts — Shadow Mode on an agent, or org-wide Monitor mode — where the action is judged and recorded on chain but deliberately not applied. Branching on `verdict` re-derives a denial the organisation chose not to make.
 
+> **Shadow and Monitor mode.** On a judge host whose replies are signature-checked, `auditToolCall` asks the judge for its true verdict and the organisation's mode, and applies the mode itself. Under a signed `shadow`, `monitor` or `off` mode, a BLOCK or HOLD still runs (`allow: true`, `verdict: "ALLOW"`) and `decision.wouldVerdict` says what would have happened; it is also logged as a warning. A missing, unsigned or unknown mode enforces. Set `enforceLocally: true` to enforce every verdict whatever the mode; the SDK then asks the judge to judge every call before answering, and refuses a reply that does not confirm it, so against a judge without client enforcement every call is refused. `getJudgmentStatus` applies the mode the same way, so a shadow call polled later reports its `wouldVerdict` while `allow` stays true. `judgeAction` does not opt in and returns what the server sends. To poll a HOLD, call `getJudgmentStatus(decision.judgmentId || decision.toolCallId)` (or the same fields of a `judgeAction` result): on the on-chain judge path the verdict is recorded under its own id.
+
 > **NB:** If your org has no active subscription, the judge returns `"No verdict"` — actions are logged on-chain for the audit trail but not evaluated by an AI provider. Assign a plan at [atbash.ai/risk-engine/settings](https://atbash.ai/risk-engine/settings) for active verdicts.
 
 ## API
@@ -127,31 +129,71 @@ Standalone helpers for keypair handling.
 | `isValidPrivateKey(hex)` | Validate a private-key string |
 | `loadAgent(privkey)` | Validate the key + return `{ pubkey, privkey }` |
 
-## Configuration
+## Configuration resolution
 
-Configuration is resolved with priority: **constructor arg > env var > config file** (`~/.config/atbash/config.json`).
+`new Atbash(privkey, options)` takes everything explicitly. `Atbash.fromConfig(options)` fills in what you did not pass from the environment and then from `~/.config/atbash/config.json`, and finds the signing key for you.
 
 ```ts
 import { Atbash } from "@atbash/sdk";
-const atbash = Atbash.fromConfig();   // reads env + config file
+const atbash = Atbash.fromConfig();   // key file + env + config.json
 ```
 
-| Config key | Env var |
-|---|---|
-| `agentKey` | `ATBASH_AGENT_KEY` |
-| `orgName` | `ATBASH_ORG_NAME` |
-| `judgeEndpoint` | `ATBASH_ENDPOINT` |
-| `judgeVerifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` (self-hosted judge response-signing key; selects the self-hosted policy) |
-| `blockchainRid` | `ATBASH_BLOCKCHAIN_RID` |
+### Settings: option, then env, then `config.json`
+
+Each setting is read from the first place that has it: the `fromConfig` option, then the environment variable, then the key in `config.json`.
+
+`judge` is taken whole. Pass it complete, or leave it out and use the environment or `config.json`: a `judge` with only an `endpoint` ignores `ATBASH_JUDGE_VERIFY_PUBKEY`, so a self-hosted host then fails the allowlist.
+
+| `fromConfig` option | Env var | `config.json` key | Notes |
+|---|---|---|---|
+| `judge.endpoint` | `ATBASH_ENDPOINT` | `judgeEndpoint` | Must pass the endpoint rules below. |
+| `judge.verifyPubKey` | `ATBASH_JUDGE_VERIFY_PUBKEY` | `judgeVerifyPubKey` | 66-hex response-signing key of a self-hosted judge. Set through the environment or `config.json` without an endpoint, it throws; passed in `judge` without an endpoint, the default endpoint is used. |
+| `network` | `ATBASH_DEFAULT_CHAIN_NETWORK` | `defaultChainNetwork` | Only `"private"` is accepted; anything else throws. A client that names no chain is pinned to it, even for an org the dashboard places on another chain. |
+| `debug` | `ATBASH_DEBUG` | `debug` | `1`, `true` or `yes` turns diagnostics on. |
+| `orgName` | `ATBASH_ORG_NAME` | `orgName` | `fromConfig` reads the option only. The env var and file key are read by `resolve("orgName")`, which the CLI and plugins use. |
+
+`agentKey` is not in this table on purpose: the signing key is never read from `config.json` (next section).
+
+Helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
+
+### Which key signs
+
+`fromConfig` picks the first of these that is set:
+
+1. `agentKey` option (hex private key in code).
+2. `keyPath` option. A path that does not exist throws; the SDK never falls through to another key when you named one.
+3. `ATBASH_AGENT_KEY` environment variable.
+4. `~/.config/atbash/guard-client-key`.
+5. `~/.config/atbash/atbash-client-key`.
 
-Persistent config helpers: `saveUserConfig(config)`, `loadUserConfig()`, `resolve(key, flagValue?)`, `getConfigPath()`.
+If none exists `fromConfig` throws `atbash key file not found. Looked for: <both default paths>`. The bare constructor never reads a key file.
 
-### Judge endpoint policy
+An `agentKey` inside `config.json` is ignored. A settings file is writable by anything on the machine and is shared by every Atbash integration, so it is not allowed to choose who you sign as. When you pass a `logger`, `fromConfig` warns:
 
-Both `Atbash.fromConfig()` and the direct constructor validate the judge endpoint before any request is made. `new Atbash(privkey, { endpoint })` accepts only an `https://` allowlisted judge host, or a self-hosted judge when `verifyPubKey` is also given (the 66-hex response-signing key, which then verifies every judge response). Plaintext `http://` is accepted only for loopback (`localhost`, `127.0.0.1`, `::1`) local development. Anything else throws at construction, so a misconfigured or injected endpoint can no longer receive the agent's signed actions or return unsigned verdicts. `validateJudgeEndpoint(...)` exposes the same check.
+```
+[atbash] "agentKey" in config.json is ignored — settings do not choose the signing key. It holds <pubkey>; this client signs as the key file or ATBASH_AGENT_KEY instead. ...
+```
+
+and when no key file exists at all, the "not found" error names the pubkey stranded in `config.json` so you know where it went.
+
+A key file is either `key=value` lines or JSON. Both fields must be present; the public key is re-derived from the private key, and a `0x` prefix is accepted.
+
+```
+privkey=<64 hex>
+pubkey=<66 hex>
+```
+
+```json
+{ "privKey": "<64 hex>", "pubKey": "<66 hex>" }
+```
 
-Agent policy and detail reads can resolve the organization's active network, or
-accept an explicit network override:
+For adapters and CI, keep the key in a file and point at it with `keyPath` (or let the default path be found). Passing the key on a command line puts it in shell history and process listings.
+
+### What `orgName` does
+
+`orgName` tells the SDK which chain to sign the call for: the org's network is looked up once through the dashboard, cached per client, and every judge and log call is signed for that chain. The SDK does not check that the name matches the org the agent was registered under; which org's policy judges the action is decided by the agent's registration, not by this string. On a deployment with a single chain a missing or different `orgName` therefore does not change the verdict. Org-scoped reads such as `getOrgTierInfo(orgName)` send the name as given; the dashboard answers an agent-authenticated call for the agent's own org, whatever name was passed.
+
+Agent policy and detail reads can take the org, or an explicit chain:
 
 ```ts
 await atbash.getAgentPolicy(atbash.pubkey, { orgName: "acme" });
@@ -160,6 +202,42 @@ await atbash.getAgentDetail(atbash.pubkey, {
 });
 ```
 
+### Judge endpoint rules
+
+Both `fromConfig` and the constructor validate the endpoint before any request. `validateJudgeEndpoint(...)` exposes the same check.
+
+- With no endpoint configured the SDK talks to the endpoint compiled into the build (`https://atbash.ai` for a release build).
+- An `https://` endpoint is accepted without further setup only on the trusted hosts: `atbash.ai`, `www.atbash.ai` and the build's own default host.
+- On the trusted hosts, every judge response and status poll must carry a valid signature from one of the response-signing keys built into the SDK; an unsigned or forged reply is denied, whatever `failClosed` says. No setup is needed. A `verifyPubKey` set for such a host must be one of those keys, or the constructor throws `not the response-signing key pinned for <host>`. A build with no keys for its host leaves replies unchecked, as before.
+- Any other `https://` endpoint is a self-hosted judge. It needs `policy: "self-hosted"` plus `verifyPubKey` (the judge's 66-hex compressed response-signing key), or `ATBASH_ENDPOINT` plus `ATBASH_JUDGE_VERIFY_PUBKEY`. Every judge response is then signature-checked against that key. Without the key the constructor throws `judge endpoint hostname "<host>" is not in the trusted allowlist`.
+- Plain `http://` is accepted only for loopback (`localhost`, `127.0.0.1`, `::1`), for a dashboard running on the same machine. Any other `http://` endpoint throws.
+- A URL with embedded credentials (`user:pass@host`) throws.
+
+```ts
+const atbash = Atbash.fromConfig({
+  judge: {
+    policy: "self-hosted",
+    endpoint: "https://judge.example.com",
+    verifyPubKey: "02…66 hex…",
+  },
+});
+```
+
+### From a key file to a first ALLOW
+
+1. Download the key file the onboarding wizard offers at its Deploy step (it is in the `key=value` form above) and save it, for example as `./agent.key`.
+2. Build the client from that file and judge an action:
+
+```ts
+import { Atbash } from "@atbash/sdk";
+
+const atbash = Atbash.fromConfig({ keyPath: "./agent.key" });
+const result = await atbash.judgeAction("read file", "list the files in ./src");
+console.log(result.allow, result.enforced, result.reason);
+```
+
+Dropping the same file at `~/.config/atbash/guard-client-key` lets `Atbash.fromConfig()` find it with no options at all.
+
 ## Error handling
 
 The SDK throws standard `Error` objects. Known failure modes are enriched with a pointer to the dashboard page that fixes them:

package/dist/browser.d.mts

@@ -31,6 +31,31 @@ interface ValidatedEndpoint {
  * @internal
  */
 declare function buildAllowedJudgeHosts(): ReadonlySet<string>;
+/**
+ * Pin keys for a loopback judge, so tests can drive the pinned-host path
+ * against a local server.
+ *
+ * Only loopback hosts read this, and their traffic never leaves the machine,
+ * so it cannot loosen the check on a real Atbash host.
+ *
+ * @internal
+ * @param keys - Compressed pubkeys to pin; `[]` clears them.
+ */
+declare function setLoopbackJudgePinsForTests(keys: readonly string[]): void;
+/**
+ * The keys a judge reply must be signed by, for one endpoint.
+ *
+ * An Atbash host's pinned keys always decide: a configured `verifyPubKey` on
+ * such a host must be one of them, or the client refuses to start, because a
+ * key that only had to come from config could be anyone's. A host with no pins
+ * uses the configured key, or none.
+ *
+ * @param endpoint - The validated judge endpoint URL.
+ * @param configuredKey - The `verifyPubKey` the caller configured, if any.
+ * @returns The accepted keys, current first; empty means replies are not checked.
+ * @throws When `configuredKey` is not one of the host's pinned keys.
+ */
+declare function judgeVerifyKeys(endpoint: string, configuredKey?: string): readonly string[];
 declare function validateJudgeEndpoint(judge?: JudgeEndpointConfig): ValidatedEndpoint;
 
 interface ChainConfig {
@@ -195,6 +220,12 @@ interface JudgeResult {
     provider: string;
     latencyMs: number;
     toolCallId: string;
+    /**
+     * The id the judge recorded this verdict under, when it differs from
+     * `toolCallId` (the on-chain judge path). Poll `getJudgmentStatus` with
+     * `judgmentId || toolCallId`. Absent when the reply names none.
+     */
+    judgmentId?: string;
     onChain: boolean;
     /** Severity 1 (poisonous) → 10 (benign). Present on memory-scan responses; absent for regular tool-call judgments. */
     score?: number;
@@ -231,6 +262,12 @@ interface JudgmentStatus {
     onChain?: boolean;
     cached?: boolean;
     responseTimeMs?: number;
+    /**
+     * The verdict the judge reached (`"BLOCK"` or `"HOLD"`) when the
+     * organisation's signed mode (`shadow`, `monitor`, `off`) let the action run
+     * anyway, as {@link Decision.wouldVerdict}. Absent when the status is the verdict.
+     */
+    wouldVerdict?: "BLOCK" | "HOLD";
 }
 interface TierInfo {
     orgName: string;
@@ -398,6 +435,14 @@ interface AtbashOptions {
      * off).
      */
     requireEnforcement?: boolean;
+    /**
+     * When true, `auditToolCall` enforces the judge's verdict whatever
+     * enforcement mode the organisation is in. Default false: on a judge host
+     * whose replies are signature-checked, a signed `shadow`, `monitor` or `off`
+     * mode lets a BLOCK or HOLD run, reported in `Decision.wouldVerdict`. This
+     * can only make the client stricter.
+     */
+    enforceLocally?: boolean;
     /**
      * Verbose diagnostics. Off by default. When on, a failed judge call also
      * logs the response body, which is the difference between "judge API failed"
@@ -422,6 +467,18 @@ interface Decision {
     enforced?: boolean;
     /** Server-reported protection mode (`off`, `monitor`, `enforce`); absent when unknown. */
     enforcementMode?: string;
+    /**
+     * The verdict the judge reached when the organisation's signed mode
+     * (`shadow`, `monitor`, `off`) let the action run anyway: what would have
+     * happened under enforcement. Absent when the decision is the verdict.
+     */
+    wouldVerdict?: "BLOCK" | "HOLD";
+    /**
+     * The id the judge recorded this verdict under, when it differs from
+     * `toolCallId` (the on-chain judge path), as {@link JudgeResult.judgmentId}.
+     * Poll `getJudgmentStatus` with `judgmentId || toolCallId`.
+     */
+    judgmentId?: string;
 }
 /** Input to `auditToolCall`. */
 interface ToolCallInput {
@@ -459,6 +516,8 @@ interface FromConfigOptions {
     failClosed?: boolean;
     /** See {@link AtbashOptions.requireEnforcement}. Default true. */
     requireEnforcement?: boolean;
+    /** See {@link AtbashOptions.enforceLocally}. Default false. */
+    enforceLocally?: boolean;
     /** See {@link AtbashOptions.decisionTimeoutMs}. Default 60 000 ms. */
     decisionTimeoutMs?: number;
     /** See {@link AtbashOptions.debug}. */
@@ -513,12 +572,21 @@ declare class Atbash {
     readonly orgName?: string;
     /** Default judge response-signing pubkey, if configured (see fromConfig). */
     readonly verifyPubKey?: string;
+    /**
+     * The keys every judge reply must be signed by: the host's pinned keys, or
+     * the configured `verifyPubKey` on a host with none. Empty means unchecked.
+     */
+    private readonly verifyKeys;
     /** Default org encryption key — see {@link AtbashOptions.orgEncryptionPubKey}. */
     readonly orgEncryptionPubKey?: string;
     /** When true (default), `auditToolCall` denies on any error. */
     readonly failClosed: boolean;
     /** When true (default), an unenforced (audit-tier) answer is refused. */
     readonly requireEnforcement: boolean;
+    /** When true, a signed non-enforcing mode never relaxes a verdict. */
+    readonly enforceLocally: boolean;
+    /** Results whose enforcement mode came signed and bound to their call. */
+    private readonly modeTrusted;
     /** Overall deadline for one auditToolCall decision, in ms. */
     readonly decisionTimeoutMs: number;
     /** Org key learned from the last agent-exists check, for this agent only. */
@@ -659,12 +727,25 @@ declare class Atbash {
      * response bytes via the Rust core's `verifySignature`.
      */
     judgeAction(action: string, context?: string, options?: JudgeOptions): Promise<JudgeResult>;
+    /**
+     * judgeAction, optionally asking the judge for the true verdict and the
+     * organisation's enforcement mode so this client applies the mode itself.
+     *
+     * Only auditToolCall opts in: judgeAction's callers keep the server-side
+     * downgrade they gate on today.
+     *
+     * @param clientEnforces - Send `X-Atbash-Client-Enforcement` when the reply can be trusted.
+     */
+    private judgeTracked;
     private _judgeAction;
     /**
-     * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
-     * Refuse any other result that lands while the agent is held, or whose
-     * request was already in flight when the block arrived: the server judged it
-     * on pre-jail state.
+     * Start a local hold on an enforced BLOCK that jails: one already on chain,
+     * or one the judge answered before its chain write landed
+     * (`on_chain_status: "pending"`), which jails once it lands. Refuse any other
+     * result that lands while the agent is held, or whose request was already in
+     * flight when the block arrived: the server judged it on pre-jail state.
+     *
+     * @param onChainStatus - The reply's `on_chain_status`; empty when absent.
      */
     private applyJailHold;
     /** The server's jailed refusal, produced locally while the agent is held. */
@@ -677,12 +758,12 @@ declare class Atbash {
      */
     auditToolCall(input: ToolCallInput): Promise<Decision>;
     /**
-     * The verify key for one call (R4, governor tier-2 review). A per-call key
-     * may only narrow what the client accepts: on a client pinned to a judge
-     * key it must be that same key, never a replacement; on an unpinned client
-     * it adds the check.
+     * The verify keys for one call (R4, governor tier-2 review). A per-call key
+     * may only narrow what the client accepts: on a client pinned to judge keys
+     * it must be one of them, never a replacement; on an unpinned client it
+     * adds the check.
      */
-    private effectiveVerifyKey;
+    private effectiveVerifyKeys;
     /**
      * Collapse a judge result into a {@link Decision}. The most restrictive
      * signal wins (security review 2026-09-30, H1): `action_type`, `verdict`
@@ -693,6 +774,15 @@ declare class Atbash {
      * never overrides a refusal.
      */
     private decide;
+    /**
+     * Apply the organisation's enforcement mode to the judge's true verdict.
+     *
+     * Only a mode that arrived signed and bound to this call counts; a missing,
+     * unsigned or unknown mode, or enforceLocally, means enforce. Under
+     * `shadow`, `monitor` or `off` a BLOCK or HOLD runs, reported in
+     * `wouldVerdict`. An ERROR stays an error: it is not a verdict.
+     */
+    private applyMode;
     private decideInner;
     /**
      * One exit for every judge failure.
@@ -1154,11 +1244,18 @@ declare function getRecentAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, fi
  * when you need every active version regardless of age.
  */
 declare function getActiveAgentMemory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+interface MemoryHistoryPage {
+    /** Most versions to return, at most 200. Omit for the full history. */
+    maxCount?: number;
+    /** Return only versions with a lower id: the last id of the previous page. */
+    beforeId?: number;
+}
 /**
  * Full version history — active + inactive, most recent first. Used
- * by rollback UX to choose a target version.
+ * by rollback UX to choose a target version. Pass `page` to read it in
+ * pages; this needs a Dashboard and chain that support paging.
  */
-declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null): Promise<AgentMemoryEntry[]>;
+declare function getMemoryHistory(auth: AgentAuth, chainOpts?: ChainOpts, filePath?: string | null, page?: MemoryHistoryPage): Promise<AgentMemoryEntry[]>;
 /**
  * Fetch a single memory entry by version id, including its current
  * `is_active` state. Version ids are agent-unique on chain (not
@@ -1988,4 +2085,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, JudgeRefusalError, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, type MemoryHistoryPage, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, configureJailHold, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isJailHeld, isValidPrivateKey, judgeVerifyKeys, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, memorySlotOf, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, releaseJailHolds, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setLoopbackJudgePinsForTests, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };