@atbash/sdk 0.3.24 → 0.4.0-dev.0

package/dist/index.mjs

@@ -0,0 +1,1334 @@
+// src-ts/native.ts
+import { createRequire } from "module";
+var anchor = typeof __filename !== "undefined" ? __filename : import.meta.url;
+var require2 = createRequire(anchor);
+var native = require2("../index.js");
+
+// src-ts/client.ts
+import { randomBytes } from "crypto";
+
+// src-ts/constants.ts
+var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
+var DEFAULT_CHROMIA_NODE_URLS = Object.freeze(
+  native.defaultChromiaNodeUrls()
+);
+var DEFAULT_BLOCKCHAIN_RID = native.DEFAULT_BLOCKCHAIN_RID;
+
+// src-ts/chain-config.ts
+var DEFAULT_PRIVATE_NODE_URLS = Object.freeze(
+  native.defaultPrivateNodeUrls()
+);
+var DEFAULT_PRIVATE_BLOCKCHAIN_RID = native.DEFAULT_PRIVATE_BLOCKCHAIN_RID;
+var PUBLIC_CHAIN = {
+  network: "public",
+  blockchainRid: DEFAULT_BLOCKCHAIN_RID,
+  nodeUrls: DEFAULT_CHROMIA_NODE_URLS
+};
+var PRIVATE_CHAIN = {
+  network: "private",
+  blockchainRid: DEFAULT_PRIVATE_BLOCKCHAIN_RID,
+  nodeUrls: DEFAULT_PRIVATE_NODE_URLS
+};
+
+// src-ts/endpoint.ts
+var ALLOWED_JUDGE_HOSTS = /* @__PURE__ */ new Set([
+  "atbash.ai",
+  "www.atbash.ai",
+  "chromia-verified-ai-dev-two.vercel.app"
+]);
+function validateJudgeEndpoint(judge) {
+  const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
+  const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new Error(
+      `[atbash] invalid judge endpoint URL: ${candidate}. Refusing to load \u2014 fix the URL or omit it to use the default (${DEFAULT_ENDPOINT}).`
+    );
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error(
+      `[atbash] judge endpoint must use https:// (got "${parsed.protocol}"). Refusing to load \u2014 plaintext endpoints leak verdicts and enable trivial MITM bypass.`
+    );
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error(
+      `[atbash] judge endpoint must not contain credentials (user:pass@host). Refusing to load \u2014 credentials embedded in URLs leak to logs and process listings.`
+    );
+  }
+  const normalisedUrl = parsed.origin;
+  if (policy === "self-hosted") {
+    const verifyPubKey = judge?.verifyPubKey;
+    const key = verifyPubKey?.trim().toLowerCase();
+    if (!key || !/^[0-9a-f]{66}$/.test(key)) {
+      throw new Error(
+        `[atbash] judge endpoint policy "self-hosted" requires verifyPubKey to be a 66-hex-char compressed secp256k1 pubkey. Refusing to load \u2014 self-hosted judges must produce signed responses so the SDK can detect a malicious or compromised judge.`
+      );
+    }
+    return { url: normalisedUrl, policy, verifyPubKey: key };
+  }
+  if (!ALLOWED_JUDGE_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new Error(
+      `[atbash] judge endpoint hostname "${parsed.hostname}" is not in the trusted allowlist. Allowed: ${[...ALLOWED_JUDGE_HOSTS].join(", ")}. To use a self-hosted judge, set BOTH policy="self-hosted" AND verifyPubKey to the 66-hex pubkey of your judge's response-signing key. Refusing to load \u2014 silent endpoint redirection is a known attack vector (F-003).`
+    );
+  }
+  return { url: normalisedUrl, policy, verifyPubKey: null };
+}
+
+// src-ts/errors.ts
+var AtbashAPIError = class extends Error {
+  /** HTTP status code (or 0 if the request never completed). */
+  status;
+  /** Raw response body text (may be empty). */
+  body;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
+    super(enrich(status, body, statusText, endpoint));
+    this.name = "AtbashAPIError";
+    this.status = status;
+    this.body = body;
+  }
+};
+var SignatureVerificationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SignatureVerificationError";
+  }
+};
+function enrich(status, body, statusText, endpoint) {
+  const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
+  let msg = `API error ${status}: ${body || statusText}`;
+  const lowered = body.toLowerCase();
+  if (lowered.includes("agent not registered")) {
+    msg += `
+  \u2192 Onboard the agent at ${dashboard}/risk-engine/agents`;
+  } else if (lowered.includes("agent has no policy") || lowered.includes("no policy configured")) {
+    msg += `
+  \u2192 Attach a policy at ${dashboard}/risk-engine/agents`;
+  } else if (lowered.includes("agent is jailed") || lowered.includes("jailed")) {
+    msg += `
+  \u2192 Unjail the agent at ${dashboard}/risk-engine/agents`;
+  } else if (lowered.includes("audit tier") || lowered.includes("verdict disabled") || lowered.includes("verdict not supported")) {
+    msg += `
+  \u2192 Upgrade the org tier at ${dashboard}/risk-engine/settings`;
+  } else if (status >= 400 && status < 500) {
+    msg += `
+  \u2192 Dashboard: ${dashboard}/risk-engine/feed`;
+  }
+  return msg;
+}
+
+// src-ts/http/client.ts
+var HttpClient = class {
+  baseUrl;
+  timeoutMs;
+  constructor(baseUrl, timeoutMs) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.timeoutMs = timeoutMs;
+  }
+  buildUrl(path, query) {
+    const url = new URL(this.baseUrl + path);
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== void 0 && v !== null && v !== "") {
+          url.searchParams.set(k, String(v));
+        }
+      }
+    }
+    return url.toString();
+  }
+  async get(path, query, headers) {
+    return this.fetch(this.buildUrl(path, query), {
+      method: "GET",
+      ...headers && { headers }
+    });
+  }
+  async post(path, body, headers) {
+    return this.fetch(this.buildUrl(path), {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...headers },
+      body: JSON.stringify(body)
+    });
+  }
+  async fetch(url, init) {
+    return fetch(url, { ...init, signal: AbortSignal.timeout(this.timeoutMs) });
+  }
+};
+
+// src-ts/keyLoader.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var DEFAULT_KEY_PATH_REL = ".config/atbash/guard-client-key";
+function resolveKeyPath(input) {
+  if (input) return expandHome(input);
+  const home = process.env.HOME || homedir() || "";
+  return join(home, DEFAULT_KEY_PATH_REL);
+}
+function expandHome(p) {
+  if (!p.startsWith("~/")) return p;
+  const home = process.env.HOME || homedir() || "";
+  return join(home, p.slice(2));
+}
+function readKeyFile(keyPath) {
+  const content = String(readFileSync(keyPath, "utf8") || "").trim();
+  let privKey = "";
+  let pubKey = "";
+  if (content.startsWith("{")) {
+    const creds = JSON.parse(content);
+    privKey = String(
+      creds.privKey || creds.privkey || creds.privateKey || ""
+    ).trim();
+    pubKey = String(
+      creds.pubKey || creds.pubkey || creds.publicKey || ""
+    ).trim();
+  } else {
+    for (const line of content.split(/\r?\n/)) {
+      if (line.startsWith("privkey="))
+        privKey = line.slice("privkey=".length).trim();
+      if (line.startsWith("pubkey="))
+        pubKey = line.slice("pubkey=".length).trim();
+    }
+  }
+  if (!privKey || !pubKey) {
+    throw new Error(`atbash key file missing priv/pub key fields: ${keyPath}`);
+  }
+  privKey = privKey.replace(/^0x/, "");
+  return { privKey, pubKey };
+}
+function loadAgentFromFile(keyPath) {
+  const resolved = resolveKeyPath(keyPath);
+  const { privKey } = readKeyFile(resolved);
+  return native.loadAgent(privKey);
+}
+
+// src-ts/normalize.ts
+function normalizeVerdict(raw) {
+  if (raw === null || raw === void 0) return "No verdict";
+  const v = String(raw).toUpperCase();
+  if (v === "ALLOW" || v === "GREEN") return "ALLOW";
+  if (v === "HOLD" || v === "YELLOW") return "HOLD";
+  if (v === "BLOCK" || v === "RED") return "BLOCK";
+  return "HOLD";
+}
+function normalizeStatus(raw) {
+  const s = String(raw ?? "").toLowerCase();
+  if (s === "pending" || s === "answered" || s === "error") return s;
+  return "error";
+}
+function pubkeyToHex(val) {
+  if (!val) return "";
+  if (typeof val === "string") return val;
+  if (val instanceof Uint8Array) return Buffer.from(val).toString("hex");
+  if (typeof val === "object") {
+    const data = val.data;
+    if (Array.isArray(data)) return Buffer.from(data).toString("hex");
+  }
+  return "";
+}
+
+// src-ts/opentel/telemetry.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
+import { resourceFromAttributes } from "@opentelemetry/resources";
+import {
+  MeterProvider,
+  PeriodicExportingMetricReader
+} from "@opentelemetry/sdk-metrics";
+var meterProvider = null;
+var callCounter = null;
+var durationHistogram = null;
+var defaultSource = "sdk";
+function isTelemetryOptedOut() {
+  try {
+    const home = process.env.HOME || homedir2() || "";
+    const filePath = join2(home, ".config", "atbash", "telemetry.json");
+    const raw = readFileSync2(filePath, "utf-8").trim();
+    if (!raw) return false;
+    const config = JSON.parse(raw);
+    return config.enabled === false;
+  } catch {
+    return false;
+  }
+}
+function autoInit() {
+  if (meterProvider) return;
+  if (isTelemetryOptedOut()) return;
+  setupTelemetry({ enabled: true });
+}
+function setupTelemetry(config) {
+  if (!config.enabled) return;
+  if (meterProvider) return;
+  if (isTelemetryOptedOut()) return;
+  defaultSource = config.source ?? "sdk";
+  const ATBASH_HONEYCOMB_KEY = "YOUR_INGEST_KEY_HERE";
+  const apiKey = process.env.HONEYCOMB_API_KEY ?? ATBASH_HONEYCOMB_KEY;
+  const exporter = new OTLPMetricExporter({
+    url: "https://api.honeycomb.io/v1/metrics",
+    headers: {
+      "x-honeycomb-team": apiKey
+    }
+  });
+  const reader = new PeriodicExportingMetricReader({
+    exporter,
+    exportIntervalMillis: config.exportIntervalMs ?? 6e4
+  });
+  meterProvider = new MeterProvider({
+    resource: resourceFromAttributes({
+      "service.name": "atbash-sdk"
+    }),
+    readers: [reader]
+  });
+  const meter = meterProvider.getMeter("atbash-sdk");
+  callCounter = meter.createCounter("atbash.sdk.function.calls", {
+    description: "Number of SDK function calls"
+  });
+  durationHistogram = meter.createHistogram("atbash.sdk.function.duration_ms", {
+    description: "SDK function execution duration",
+    unit: "ms"
+  });
+}
+function recordCall(functionName, source, agentPubkey) {
+  autoInit();
+  if (!callCounter) return;
+  callCounter.add(1, {
+    "function.name": functionName,
+    source: source ?? defaultSource,
+    ...agentPubkey && { "agent.pubkey": agentPubkey }
+  });
+}
+function recordDuration(functionName, durationMs, status, source) {
+  if (!durationHistogram) return;
+  durationHistogram.record(durationMs, {
+    "function.name": functionName,
+    status,
+    source: source ?? defaultSource
+  });
+}
+async function flushTelemetry() {
+  if (!meterProvider) return;
+  await meterProvider.forceFlush();
+}
+async function shutdownTelemetry() {
+  if (!meterProvider) return;
+  await meterProvider.shutdown();
+  meterProvider = null;
+  callCounter = null;
+  durationHistogram = null;
+}
+
+// src-ts/userConfig.ts
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync as readFileSync3,
+  writeFileSync
+} from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var ENV_MAP = {
+  agentKey: "ATBASH_AGENT_KEY",
+  orgName: "ATBASH_ORG_NAME",
+  judgeEndpoint: "ATBASH_ENDPOINT",
+  blockchainRid: "ATBASH_BLOCKCHAIN_RID",
+  provider: "ATBASH_PROVIDER",
+  providerModel: "ATBASH_PROVIDER_MODEL"
+};
+function getConfigDir() {
+  const home = process.env.HOME || homedir3() || "";
+  return join3(home, ".config", "atbash");
+}
+function getConfigPath() {
+  return join3(getConfigDir(), "config.json");
+}
+function loadUserConfig() {
+  try {
+    const p = getConfigPath();
+    if (!existsSync(p)) return {};
+    const raw = readFileSync3(p, "utf-8").trim();
+    if (!raw) return {};
+    return JSON.parse(raw);
+  } catch (err) {
+    console.error("Failed to load config file", err);
+    return {};
+  }
+}
+function saveUserConfig(config) {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  const filePath = getConfigPath();
+  writeFileSync(filePath, JSON.stringify(config, null, 2) + "\n", {
+    mode: 384
+  });
+  chmodSync(filePath, 384);
+}
+function resolve(key, flagValue) {
+  if (flagValue) return flagValue;
+  const envName = ENV_MAP[key];
+  if (envName) {
+    const envVal = process.env[envName];
+    if (envVal) return envVal;
+  }
+  const fileVal = loadUserConfig()[key];
+  if (fileVal != null) return String(fileVal);
+  return "";
+}
+
+// src-ts/client.ts
+function generateToolCallId() {
+  return `tc-${Date.now()}-${randomBytes(4).toString("hex")}`;
+}
+var Atbash = class _Atbash {
+  auth;
+  endpoint;
+  nodeUrls;
+  blockchainRid;
+  /** Default org name used by `auditToolCall` / `judgeAction`. */
+  orgName;
+  /** Default judge response-signing pubkey, if configured (see fromConfig). */
+  verifyPubKey;
+  /** When true (default), `auditToolCall` denies on any error. */
+  failClosed;
+  logger;
+  http;
+  /**
+   * Per-client cache of resolved chains. Keyed by orgName so repeated
+   * calls don't re-hit the dashboard. Cleared by `clearChainCache()`.
+   */
+  _chainCache = /* @__PURE__ */ new Map();
+  /**
+   * Cached bearer token for risk-engine / insurance read calls. Built
+   * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
+   * server-side replay protection windows never expire it mid-session.
+   */
+  _authBearer = null;
+  constructor(privkey, options = {}) {
+    this.auth = native.loadAgent(privkey);
+    this.endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "") || DEFAULT_ENDPOINT;
+    this.nodeUrls = options.nodeUrls ? [...options.nodeUrls] : DEFAULT_CHROMIA_NODE_URLS;
+    this.blockchainRid = options.blockchainRid ?? native.DEFAULT_BLOCKCHAIN_RID;
+    this.orgName = options.orgName;
+    this.verifyPubKey = options.verifyPubKey;
+    this.failClosed = options.failClosed !== false;
+    this.logger = options.logger ?? {};
+    this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 3e4);
+    if (this.endpoint !== DEFAULT_ENDPOINT) {
+      this.logger.warn?.("[atbash] running on non-default judge endpoint", {
+        endpoint: this.endpoint,
+        verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
+      });
+    }
+  }
+  /**
+   * Construct from resolved config: explicit overrides → env vars → the
+   * `~/.config/atbash/config.json` file (see userConfig.resolve). The private
+   * key comes from `agentKey` (override/env/file) or, failing that, the agent
+   * key file (`~/.config/atbash/guard-client-key`). The judge endpoint is
+   * validated against the trusted allowlist / self-hosted policy; a
+   * self-hosted endpoint's `verifyPubKey` becomes the client default.
+   */
+  static fromConfig(options = {}) {
+    const validated = validateJudgeEndpoint(
+      options.judge ?? { endpoint: resolve("judgeEndpoint") || void 0 }
+    );
+    const agentKey = resolve("agentKey", options.agentKey);
+    const auth = agentKey ? native.loadAgent(agentKey) : loadAgentFromFile(options.keyPath);
+    const blockchainRid = resolve("blockchainRid", options.blockchainRid) || void 0;
+    return new _Atbash(auth.privkey, {
+      endpoint: validated.url,
+      blockchainRid,
+      timeoutMs: options.timeoutMs,
+      nodeUrls: options.nodeUrls,
+      orgName: options.orgName,
+      verifyPubKey: validated.verifyPubKey ?? void 0,
+      failClosed: options.failClosed,
+      logger: options.logger
+    });
+  }
+  get pubkey() {
+    return this.auth.pubkey;
+  }
+  get privkey() {
+    return this.auth.privkey;
+  }
+  /* ── agent existence (/api/ai/exists) ──────────────────────────────────── */
+  /** GET /api/ai/exists?pubkey=… — defaults to this client's pubkey. */
+  async checkAgentExists(pubkey) {
+    const pk = pubkey ?? this.auth.pubkey;
+    return this.track("checkAgentExists", pk, async () => {
+      const resp = await this.http.get(
+        "/api/ai/exists",
+        { pubkey: pk },
+        this.authHeaders()
+      );
+      await this.raiseIfError(resp);
+      const data = await this.json(resp);
+      return Boolean(data?.registered);
+    });
+  }
+  /* ── log_tool_call (sign-only) ─────────────────────────────────────────── */
+  /**
+   * Pre-flight `checkAgentExists`, then sign `log_tool_call` locally and
+   * return the signed tx hex. The server broadcasts to chain.
+   */
+  async logToolCall(action, context = "", options = {}) {
+    const start = performance.now();
+    recordCall("logToolCall", void 0, this.auth.pubkey);
+    let exists;
+    try {
+      exists = await this.checkAgentExists();
+    } catch (err) {
+      recordDuration("logToolCall", performance.now() - start, "error");
+      return { success: false, toolCallId: null, error: errorMessage(err) };
+    }
+    if (!exists) {
+      recordDuration("logToolCall", performance.now() - start, "error");
+      return {
+        success: false,
+        toolCallId: null,
+        error: "Agent not registered. Onboard the agent at the dashboard before submitting actions."
+      };
+    }
+    const toolCallId = generateToolCallId();
+    const brid = options.chainOpts?.blockchainRid ?? this.blockchainRid;
+    try {
+      const signedHex = native.signLogToolCall(
+        toolCallId,
+        action,
+        context,
+        options.toolName ?? "",
+        options.toolArgsJson ?? "",
+        this.auth.privkey,
+        brid
+      );
+      recordDuration("logToolCall", performance.now() - start, "success");
+      return { success: true, toolCallId, signedHex };
+    } catch (err) {
+      recordDuration("logToolCall", performance.now() - start, "error");
+      return { success: false, toolCallId: null, error: errorMessage(err) };
+    }
+  }
+  /* ── judge_action ──────────────────────────────────────────────────────── */
+  /**
+   * Sign log_tool_call + optionally judge_action, POST /api/v1/judge.
+   *
+   * `verifyPubKey` checks the `X-Atbash-Signature` header against the exact
+   * response bytes via the Rust core's `verifySignature`.
+   */
+  async judgeAction(action, context = "", options = {}) {
+    return this.track(
+      "judgeAction",
+      this.auth.pubkey,
+      () => this._judgeAction(action, context, options)
+    );
+  }
+  async _judgeAction(action, context, options) {
+    if (!action?.trim()) {
+      throw new Error("action is required and cannot be empty.");
+    }
+    let chainOpts = options.chainOpts;
+    if (options.orgName) {
+      const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
+      if (mapNetwork) {
+        chainOpts = { network: mapNetwork };
+      } else if (!chainOpts?.blockchainRid) {
+        const resolved = await this.resolveChainFromMap(options.orgName, null);
+        chainOpts = { ...chainOpts, network: resolved.network };
+      }
+    }
+    const brid = this.bridFromChainOpts(chainOpts);
+    const logResult = await this.logToolCall(action, context, {
+      toolName: options.toolName,
+      toolArgsJson: options.toolArgsJson,
+      chainOpts
+    });
+    if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
+      throw new Error(logResult.error || "Failed to sign log_tool_call");
+    }
+    let signedJudgeAction;
+    if (!options.provider) {
+      const judgmentId = generateToolCallId();
+      signedJudgeAction = native.signJudgeAction(
+        judgmentId,
+        action,
+        context || "",
+        "",
+        this.auth.privkey,
+        brid
+      );
+    }
+    const body = {
+      tool_call_id: logResult.toolCallId,
+      agent_pubkey: this.auth.pubkey,
+      action,
+      signed_log_tool_call: logResult.signedHex
+    };
+    if (signedJudgeAction) body.signed_judge_action = signedJudgeAction;
+    if (context) body.context = context;
+    if (options.provider) body.provider = options.provider;
+    if (options.toolName) body.tool_name = options.toolName;
+    if (options.model) body.model = options.model;
+    let resp;
+    try {
+      resp = await this.http.post("/api/v1/judge", body);
+    } catch (err) {
+      throw this.transportError(err);
+    }
+    if (!resp.ok) throw await this.httpError(resp);
+    const bodyBytes = Buffer.from(await resp.arrayBuffer());
+    const verifyPubKey = options.verifyPubKey ?? this.verifyPubKey;
+    if (verifyPubKey !== void 0) {
+      const sig = resp.headers.get("X-Atbash-Signature");
+      if (!sig) {
+        throw new SignatureVerificationError(
+          "missing X-Atbash-Signature header"
+        );
+      }
+      let ok;
+      try {
+        ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
+      } catch (err) {
+        throw new SignatureVerificationError(
+          `signature verification threw: ${errorMessage(err)}`
+        );
+      }
+      if (!ok) {
+        throw new SignatureVerificationError(
+          "signature does not verify against configured verifyPubKey"
+        );
+      }
+    }
+    const data = parseJson(bodyBytes);
+    return {
+      verdict: normalizeVerdict(data.verdict),
+      actionType: String(data.action_type ?? ""),
+      reason: String(data.reason ?? ""),
+      confidence: Number(data.confidence ?? 0),
+      provider: String(data.provider ?? ""),
+      latencyMs: Number(data.latency_ms ?? 0),
+      toolCallId: String(data.tool_call_id ?? logResult.toolCallId),
+      onChain: Boolean(data.on_chain)
+    };
+  }
+  /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
+  /**
+   * High-level guard: redact secrets, submit for judgement, and collapse the
+   * result into an allow/deny `Decision`. Fails closed by default — any error
+   * (judge unreachable, unrecognized verdict) denies unless `failClosed` is
+   * explicitly false.
+   */
+  async auditToolCall(input) {
+    const toolName = input.toolName || "unknown";
+    const argsRedaction = native.redactSecrets(stringifyArgs(input.args));
+    const ctxRedaction = native.redactSecrets(input.context ?? toolName);
+    const argsJson = argsRedaction.redacted;
+    const actionText = truncate(argsJson);
+    const contextText = ctxRedaction.redacted;
+    const totalRedactions = argsRedaction.found.length + ctxRedaction.found.length;
+    if (totalRedactions > 0) {
+      const kinds = [
+        .../* @__PURE__ */ new Set([
+          ...argsRedaction.found.map((f) => f.kind),
+          ...ctxRedaction.found.map((f) => f.kind)
+        ])
+      ];
+      this.logger.warn?.("[atbash] redacted secrets before judge call", {
+        tool: toolName,
+        count: totalRedactions,
+        kinds
+      });
+    }
+    try {
+      this.logger.info?.("[atbash] judge API called", { tool: toolName });
+      const result = await this.judgeAction(actionText, contextText, {
+        toolName,
+        toolArgsJson: argsJson,
+        orgName: this.orgName
+      });
+      if (result.verdict === "No verdict") {
+        return {
+          allow: true,
+          verdict: "ALLOW",
+          reason: result.reason || "audit tier \u2014 request logged on-chain, no AI enforcement",
+          toolCallId: result.toolCallId
+        };
+      }
+      const action = result.actionType;
+      if (action === "block") {
+        return {
+          allow: false,
+          verdict: "BLOCK",
+          reason: result.reason,
+          toolCallId: result.toolCallId
+        };
+      }
+      if (action === "hold_for_user_confirm") {
+        return {
+          allow: false,
+          verdict: "HOLD",
+          reason: result.reason || "held for human confirmation",
+          toolCallId: result.toolCallId
+        };
+      }
+      if (action === "allow") {
+        if (result.verdict === "HOLD") {
+          return {
+            allow: false,
+            verdict: "HOLD",
+            reason: result.reason,
+            toolCallId: result.toolCallId
+          };
+        }
+        if (result.verdict === "BLOCK") {
+          return {
+            allow: false,
+            verdict: "BLOCK",
+            reason: result.reason,
+            toolCallId: result.toolCallId
+          };
+        }
+        return {
+          allow: true,
+          verdict: "ALLOW",
+          reason: result.reason,
+          toolCallId: result.toolCallId
+        };
+      }
+      return this.fail(
+        "unrecognized action_type from judge",
+        result.toolCallId
+      );
+    } catch (err) {
+      const message = errorMessage(err);
+      this.logger.warn?.("[atbash] judge API failed", { reason: message });
+      return this.fail(message);
+    }
+  }
+  fail(reason, toolCallId) {
+    return { allow: !this.failClosed, verdict: "ERROR", reason, toolCallId };
+  }
+  /* ── judgment status ───────────────────────────────────────────────────── */
+  async getJudgmentStatus(judgmentId, agentPubkey) {
+    const pk = agentPubkey ?? this.auth.pubkey;
+    return this.track("getJudgmentStatus", pk, async () => {
+      const resp = await this.http.get(
+        "/api/v1/judge",
+        { tool_call_id: judgmentId, agent_pubkey: pk },
+        this.authHeaders()
+      );
+      await this.raiseIfError(resp);
+      const data = await this.json(resp) ?? {};
+      return {
+        status: normalizeStatus(data.status),
+        verdict: normalizeVerdict(data.verdict),
+        reason: String(data.reason ?? ""),
+        judgmentId: String(data.judgmentId ?? judgmentId),
+        onChain: optBool(data.onChain),
+        cached: optBool(data.cached),
+        responseTimeMs: optNumber(data.responseTimeMs)
+      };
+    });
+  }
+  /* ── risk-engine queries (action-dispatched GET) ───────────────────────── */
+  getToolCalls(maxCount) {
+    return this.track(
+      "getToolCalls",
+      void 0,
+      () => this.riskEngineRecords("tool-calls", { limit: maxCount })
+    );
+  }
+  getOrgToolCalls(orgName, maxCount) {
+    return this.track(
+      "getOrgToolCalls",
+      void 0,
+      () => this.riskEngineRecords("org-tool-calls", {
+        org: orgName,
+        limit: maxCount
+      })
+    );
+  }
+  getAgentToolCalls(agentPubkey, maxCount) {
+    return this.track(
+      "getAgentToolCalls",
+      agentPubkey,
+      () => this.riskEngineRecords("agent-tool-calls", {
+        agent: agentPubkey,
+        limit: maxCount
+      })
+    );
+  }
+  async getToolCallCount() {
+    return this.track("getToolCallCount", void 0, async () => {
+      const raw = await this.riskEngineGet("tool-call-count", {});
+      const n = Number(raw);
+      return Number.isFinite(n) ? n : 0;
+    });
+  }
+  async getToolCallFull(toolCallId) {
+    return this.track("getToolCallFull", void 0, async () => {
+      const raw = await this.riskEngineGet("tool-call-full", {
+        tool_call_id: toolCallId
+      });
+      if (!isRecord(raw)) return null;
+      return toToolCallFull(raw);
+    });
+  }
+  async getOrgTierInfo(orgName) {
+    return this.track("getOrgTierInfo", void 0, async () => {
+      const raw = await this.riskEngineGet("org-tier-info", { org: orgName });
+      if (!isRecord(raw)) return null;
+      return {
+        orgName: String(raw.org_name ?? ""),
+        tier: String(raw.tier ?? ""),
+        verdictEnabled: Boolean(raw.verdict_enabled),
+        enforcementEnabled: Boolean(raw.enforcement_enabled)
+      };
+    });
+  }
+  async getPendingHeldActions(orgName, maxCount) {
+    return this.track("getPendingHeldActions", void 0, async () => {
+      const raw = await this.riskEngineGet("pending-held-actions", {
+        org: orgName,
+        limit: maxCount
+      });
+      if (!Array.isArray(raw)) return [];
+      return raw.map((item) => toHeldAction(item));
+    });
+  }
+  async getHeldActionReviews(orgName, maxCount) {
+    return this.track("getHeldActionReviews", void 0, async () => {
+      const raw = await this.riskEngineGet("held-action-reviews", {
+        org: orgName,
+        limit: maxCount
+      });
+      if (!Array.isArray(raw)) return [];
+      return raw.map(
+        (item) => toHeldActionReview(item)
+      );
+    });
+  }
+  /* ── risk-engine batched (action-dispatched POST) ──────────────────────── */
+  getAgentDetail(agentPubkey) {
+    return this.track(
+      "getAgentDetail",
+      agentPubkey,
+      () => this.riskEnginePost({ action: "agent-detail-batch", agent: agentPubkey })
+    );
+  }
+  async getAgentPolicy(agentPubkey) {
+    return this.track("getAgentPolicy", agentPubkey, async () => {
+      const raw = await this.riskEnginePost({
+        action: "agent-policy-batch",
+        agent: agentPubkey
+      });
+      return {
+        policy: String(raw.policy ?? ""),
+        isJailed: Boolean(raw.is_jailed),
+        isCustom: Boolean(raw.is_custom),
+        defaultPolicy: String(raw.default_policy ?? "")
+      };
+    });
+  }
+  /* ── safety stats (/api/insurance?action=safety-stats) ─────────────────── */
+  async getSafetyStats() {
+    return this.track("getSafetyStats", void 0, async () => {
+      const resp = await this.http.get(
+        "/api/insurance",
+        { action: "safety-stats" },
+        this.authHeaders()
+      );
+      await this.raiseIfError(resp);
+      const data = await this.json(resp) ?? {};
+      if (isRecord(data.data)) return data.data;
+      return data;
+    });
+  }
+  /* ── chain resolution (org → chain) ────────────────────────────────────── */
+  /**
+   * Org's subscription on a specific chain. The `network` arg selects
+   * which chain to query; without it, the dashboard picks the default.
+   * Returns null when the org has no record on that chain.
+   */
+  async getOrgSubscription(orgName, network) {
+    return this.track("getOrgSubscription", void 0, async () => {
+      const params = { org: orgName };
+      if (network) params.network = network;
+      const raw = await this.riskEngineGet("org-subscription", params);
+      if (!isRecord(raw)) return null;
+      return coerceOrgSubscription(raw, orgName);
+    });
+  }
+  /**
+   * Read the org's active network from the dashboard's off-chain
+   * `org_networks` map. The map is the authoritative source after a
+   * plan switch — subscription rows on the source chain go stale, but
+   * the map is updated on every assign. Returns null when there's no
+   * entry (caller falls back to per-chain subscription resolution).
+   */
+  async getActiveNetworkForOrg(orgName) {
+    try {
+      const resp = await this.http.get(
+        "/api/org-network",
+        { org: orgName },
+        this.authHeaders()
+      );
+      if (resp.status !== 200) return null;
+      const data = await this.json(resp);
+      if (data?.network === "public" || data?.network === "private") {
+        return data.network;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Resolve which chain an org's actions should run against. Cached
+   * per-client by orgName. Resolution order:
+   *   1. `org_networks` map (authoritative).
+   *   2. Per-chain subscription fallback — public + private records
+   *      are fetched in parallel, with `is_private_blockchain` and
+   *      `assigned_at` reconciling mixed states.
+   * Defaults to the public chain when nothing else resolves.
+   */
+  async resolveChainForOrg(orgName) {
+    const cached = this._chainCache.get(orgName);
+    if (cached) return cached;
+    const mapNetwork = await this.getActiveNetworkForOrg(orgName);
+    return this.resolveChainFromMap(orgName, mapNetwork);
+  }
+  /**
+   * Resolve a chain given an already-fetched `org_networks` map result.
+   * Split out from {@link resolveChainForOrg} so callers that have already
+   * queried the map (the judge path) don't fetch /api/org-network twice.
+   * Caches per orgName like its caller.
+   */
+  async resolveChainFromMap(orgName, mapNetwork) {
+    const cached = this._chainCache.get(orgName);
+    if (cached) return cached;
+    if (mapNetwork) {
+      const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      this._chainCache.set(orgName, chain);
+      return chain;
+    }
+    try {
+      const [pubSub, privSub] = await Promise.all([
+        this.getOrgSubscription(orgName, "public").catch(() => null),
+        this.getOrgSubscription(orgName, "private").catch(() => null)
+      ]);
+      if (pubSub?.is_private_blockchain) {
+        this._chainCache.set(orgName, PRIVATE_CHAIN);
+        return PRIVATE_CHAIN;
+      }
+      if (pubSub && privSub) {
+        const chain = privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+        this._chainCache.set(orgName, chain);
+        return chain;
+      }
+      if (pubSub) {
+        this._chainCache.set(orgName, PUBLIC_CHAIN);
+        return PUBLIC_CHAIN;
+      }
+      if (privSub?.is_private_blockchain) {
+        this._chainCache.set(orgName, PRIVATE_CHAIN);
+        return PRIVATE_CHAIN;
+      }
+    } catch {
+    }
+    this._chainCache.set(orgName, PUBLIC_CHAIN);
+    return PUBLIC_CHAIN;
+  }
+  /** Drop any cached chain resolutions. Useful in tests. */
+  clearChainCache() {
+    this._chainCache.clear();
+  }
+  /* ── internals ─────────────────────────────────────────────────────────── */
+  /**
+   * Wrap an SDK method body in telemetry — records the call at start
+   * and a success/error duration at end. Re-throws on failure so the
+   * caller sees the original exception. Pass `agentPubkey` when the
+   * method is keyed to a specific agent; tracked methods that don't
+   * depend on an agent (read queries) pass `undefined`.
+   */
+  async track(name, agentPubkey, fn) {
+    const start = performance.now();
+    recordCall(name, void 0, agentPubkey);
+    try {
+      const result = await fn();
+      recordDuration(name, performance.now() - start, "success");
+      return result;
+    } catch (err) {
+      recordDuration(name, performance.now() - start, "error");
+      throw err;
+    }
+  }
+  /**
+   * Pick the BRID for a given per-call chain override. `blockchainRid`
+   * takes precedence; otherwise `network` maps to one of the known
+   * chains; otherwise the client's default.
+   */
+  bridFromChainOpts(chainOpts) {
+    if (chainOpts?.blockchainRid) return chainOpts.blockchainRid;
+    if (chainOpts?.network === "private") return PRIVATE_CHAIN.blockchainRid;
+    if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
+    return this.blockchainRid;
+  }
+  /**
+   * Get-or-create a Bearer token for dashboard reads. The token is a
+   * signed `log_tool_call` op (locally signed, never submitted) — the
+   * dashboard verifies the signature against the agent's pubkey. Cached
+   * for 4 minutes; refreshed after that so a long-lived client never
+   * trips the server's replay window.
+   */
+  getAuthBearer() {
+    const now = Date.now();
+    if (this._authBearer && now - this._authBearer.issuedAt < 4 * 60 * 1e3) {
+      return this._authBearer.hex;
+    }
+    const nonce = `auth-${now.toString(36)}-${randomBytes(4).toString("hex")}`;
+    const hex = native.signLogToolCall(
+      nonce,
+      `auth:${now}`,
+      "",
+      "auth-bearer",
+      "",
+      this.auth.privkey,
+      this.blockchainRid
+    );
+    this._authBearer = { hex, issuedAt: now };
+    return hex;
+  }
+  authHeaders() {
+    return { Authorization: `Bearer ${this.getAuthBearer()}` };
+  }
+  async riskEngineGet(action, params) {
+    let resp;
+    try {
+      resp = await this.http.get(
+        "/api/risk-engine",
+        { action, ...params },
+        this.authHeaders()
+      );
+    } catch (err) {
+      throw this.transportError(err);
+    }
+    if (resp.status !== 200) throw await this.httpError(resp);
+    return this.json(resp);
+  }
+  async riskEnginePost(body) {
+    let resp;
+    try {
+      resp = await this.http.post("/api/risk-engine", body, this.authHeaders());
+    } catch (err) {
+      throw this.transportError(err);
+    }
+    if (resp.status !== 200) throw await this.httpError(resp);
+    const data = await this.json(resp);
+    return isRecord(data) ? data : {};
+  }
+  async riskEngineRecords(action, params) {
+    const raw = await this.riskEngineGet(action, params);
+    if (!Array.isArray(raw)) return [];
+    return raw.map((item) => toToolCallRecord(item));
+  }
+  async raiseIfError(resp) {
+    if (resp.ok) return;
+    throw await this.httpError(resp);
+  }
+  /** Wrap a failed HTTP *response* (non-2xx / non-200) as an AtbashAPIError. */
+  async httpError(resp) {
+    return new AtbashAPIError(
+      resp.status,
+      await safeText(resp),
+      resp.statusText,
+      this.endpoint
+    );
+  }
+  /** Wrap a *transport* failure (fetch threw, no response) as an AtbashAPIError. */
+  transportError(err) {
+    return new AtbashAPIError(0, errorMessage(err), "", this.endpoint);
+  }
+  async json(resp) {
+    const text = await safeText(resp);
+    if (!text) return null;
+    const parsed = tryParseJson(text);
+    return parsed === void 0 ? null : parsed;
+  }
+  /* ── crypto / redaction passthroughs (Rust core) ───────────────────────── */
+  static generateKeypair() {
+    return native.generateKeypair();
+  }
+  static isValidPrivateKey(hex) {
+    return native.isValidPrivateKey(hex);
+  }
+  static derivePublicKey(privkey) {
+    return native.derivePublicKey(privkey);
+  }
+  static redactSecrets(text) {
+    return native.redactSecrets(text);
+  }
+  static normalizeForMatching(text) {
+    return native.normalizeForMatching(text);
+  }
+  static containsEvasionCharacters(text) {
+    return native.containsEvasionCharacters(text);
+  }
+};
+function baseToolCall(raw) {
+  return {
+    toolCallId: String(raw.tool_call_id ?? ""),
+    agentPubkey: pubkeyToHex(raw.agent_pubkey),
+    toolName: String(raw.tool_name ?? ""),
+    commandText: String(raw.command_text ?? ""),
+    contextText: String(raw.context_text ?? ""),
+    orgName: String(raw.org_name ?? "")
+  };
+}
+function toToolCallRecord(raw) {
+  return {
+    ...baseToolCall(raw),
+    toolArgsJson: String(raw.tool_args_json ?? ""),
+    rowid: Number(raw.rowid ?? 0)
+  };
+}
+function toToolCallFull(raw) {
+  return {
+    ...baseToolCall(raw),
+    toolArgsJson: optString(raw.tool_args_json),
+    createdAt: optNumber(raw.created_at),
+    actionType: optString(raw.action_type),
+    resultStatus: optString(raw.result_status),
+    verdictColor: optString(raw.verdict_color),
+    verdictReason: optString(raw.verdict_reason),
+    verdictSource: optString(raw.verdict_source),
+    verdictResponseTimeMs: optNumber(raw.verdict_response_time_ms)
+  };
+}
+function toHeldAction(raw) {
+  return {
+    judgmentId: String(raw.judgment_id ?? ""),
+    agentPubkey: pubkeyToHex(raw.agent_pubkey),
+    actionText: String(raw.action_text ?? ""),
+    actionContext: String(raw.action_context ?? ""),
+    verdict: normalizeVerdict(raw.verdict),
+    reason: String(raw.reason ?? ""),
+    createdAt: Number(raw.created_at ?? 0)
+  };
+}
+function toHeldActionReview(raw) {
+  return {
+    judgmentId: String(raw.judgment_id ?? ""),
+    actionText: String(raw.action_text ?? ""),
+    status: String(raw.status ?? ""),
+    reviewNote: String(raw.review_note ?? ""),
+    reviewedAt: Number(raw.reviewed_at ?? 0),
+    createdAt: Number(raw.created_at ?? 0),
+    reviewedBy: optString(raw.reviewed_by) || pubkeyToHex(raw.reviewed_by) || void 0
+  };
+}
+function coerceOrgSubscription(raw, orgName) {
+  return {
+    org_name: String(raw.org_name ?? orgName),
+    subscription_name: String(raw.subscription_name ?? ""),
+    agent_number: Number(raw.agent_number ?? 0),
+    is_private_blockchain: Boolean(raw.is_private_blockchain),
+    monthly_price: Number(raw.monthly_price ?? 0),
+    yearly_price: Number(raw.yearly_price ?? 0),
+    duration_months: Number(raw.duration_months ?? 0),
+    assigned_at: Number(raw.assigned_at ?? 0),
+    expires_at: Number(raw.expires_at ?? 0),
+    is_active: Boolean(raw.is_active)
+  };
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function optString(v) {
+  if (v === null || v === void 0) return void 0;
+  return typeof v === "string" ? v : String(v);
+}
+function optNumber(v) {
+  if (v === null || v === void 0) return void 0;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function optBool(v) {
+  if (v === null || v === void 0) return void 0;
+  return Boolean(v);
+}
+function tryParseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function parseJson(bytes) {
+  const parsed = tryParseJson(bytes.toString("utf-8"));
+  return parsed === void 0 ? {} : parsed;
+}
+async function safeText(resp) {
+  try {
+    return await resp.text();
+  } catch {
+    return "";
+  }
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function stringifyArgs(args) {
+  if (args === null || args === void 0) return "";
+  if (typeof args === "string") return args;
+  try {
+    return JSON.stringify(args);
+  } catch {
+    return String(args);
+  }
+}
+var MAX_ACTION_LEN = 4e3;
+function truncate(text) {
+  if (text.length <= MAX_ACTION_LEN) return text;
+  return text.slice(0, MAX_ACTION_LEN) + "\u2026";
+}
+
+// src-ts/redact.ts
+function redactJsonStrings(value) {
+  if (typeof value === "string") {
+    return native.redactSecrets(value).redacted;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => redactJsonStrings(v));
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactJsonStrings(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+// src-ts/signature.ts
+function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
+  if (!signatureHex) {
+    return { ok: false, reason: "missing X-Atbash-Signature header" };
+  }
+  const body = Buffer.isBuffer(bodyBytes) ? bodyBytes : Buffer.from(bodyBytes);
+  let isValid;
+  try {
+    isValid = native.verifySignature(body, signatureHex, pubKeyHex);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err ?? "");
+    if (message.includes("signature is not hex") || message.includes("signature length out of range")) {
+      return { ok: false, reason: "malformed signature header" };
+    }
+    return { ok: false, reason: `signature verification threw: ${message}` };
+  }
+  return isValid ? { ok: true } : {
+    ok: false,
+    reason: "signature does not verify against configured verifyPubKey"
+  };
+}
+
+// src-ts/index.ts
+function isValidPrivateKey(hex) {
+  return native.isValidPrivateKey(hex);
+}
+function derivePublicKey(privkey) {
+  return native.derivePublicKey(privkey);
+}
+function generateKeypair() {
+  return native.generateKeypair();
+}
+function loadAgent(privkey) {
+  return native.loadAgent(privkey);
+}
+function signLogToolCall(toolCallId, action, context, toolName, toolArgsJson, privkey, blockchainRid) {
+  return native.signLogToolCall(
+    toolCallId,
+    action,
+    context,
+    toolName,
+    toolArgsJson,
+    privkey,
+    blockchainRid
+  );
+}
+function signJudgeAction(judgmentId, action, context, extra, privkey, blockchainRid) {
+  return native.signJudgeAction(
+    judgmentId,
+    action,
+    context,
+    extra,
+    privkey,
+    blockchainRid
+  );
+}
+function verifySignature(body, signatureHex, pubkeyHex) {
+  return native.verifySignature(body, signatureHex, pubkeyHex);
+}
+function normalizeForMatching(text) {
+  return native.normalizeForMatching(text);
+}
+function containsEvasionCharacters(text) {
+  return native.containsEvasionCharacters(text);
+}
+function redactSecrets(text) {
+  return native.redactSecrets(text);
+}
+function containsSecret(text) {
+  return native.containsSecret(text);
+}
+function createMemorySnapshot(entries, takenAt) {
+  return native.createMemorySnapshot(entries, takenAt);
+}
+function diffMemorySnapshots(before, after) {
+  return native.diffMemorySnapshots(before, after);
+}
+export {
+  Atbash,
+  AtbashAPIError,
+  DEFAULT_BLOCKCHAIN_RID,
+  DEFAULT_CHROMIA_NODE_URLS,
+  DEFAULT_ENDPOINT,
+  SignatureVerificationError,
+  containsEvasionCharacters,
+  containsSecret,
+  createMemorySnapshot,
+  derivePublicKey,
+  diffMemorySnapshots,
+  flushTelemetry,
+  generateKeypair,
+  getConfigDir,
+  getConfigPath,
+  isValidPrivateKey,
+  loadAgent,
+  loadAgentFromFile,
+  loadUserConfig,
+  normalizeForMatching,
+  normalizeStatus,
+  normalizeVerdict,
+  pubkeyToHex,
+  recordCall,
+  recordDuration,
+  redactJsonStrings,
+  redactSecrets,
+  resolve,
+  resolveKeyPath,
+  saveUserConfig,
+  setupTelemetry,
+  shutdownTelemetry,
+  signJudgeAction,
+  signLogToolCall,
+  validateJudgeEndpoint,
+  verifyJudgeResponseSignature,
+  verifySignature
+};
+//# sourceMappingURL=index.mjs.map