@atbash/sdk 0.3.25 → 0.4.0-dev.1

package/dist/index.d.cts

@@ -1,339 +0,0 @@
-type Verdict = "ALLOW" | "HOLD" | "BLOCK" | "No verdict";
-type Provider = "openai" | "google" | "microsoft" | "custom" | (string & {});
-type ActionType = "allow" | "hold_for_user_confirm" | "block" | (string & {});
-type PubkeyValue = string | Buffer | {
-    data: number[];
-};
-type JudgmentStatusState = "pending" | "answered" | "error";
-interface Subscription {
-    subscription_name: string;
-    agent_number: number;
-    is_private_blockchain: boolean;
-    monthly_price: number;
-    yearly_price: number;
-}
-interface OrgSubscription extends Subscription {
-    org_name: string;
-    duration_months: number;
-    assigned_at: number;
-    expires_at: number;
-    is_active: boolean;
-}
-interface AgentAuth {
-    pubkey: string;
-    privkey: string;
-}
-interface ClientOpts {
-    endpoint?: string;
-    timeout?: number;
-    auth?: AgentAuth;
-}
-interface ChainOpts {
-    nodeUrls?: string[];
-    blockchainRid?: string;
-}
-interface JudgeResult {
-    verdict: Verdict;
-    action_type: ActionType;
-    reason: string;
-    confidence: number;
-    provider: Provider;
-    latency_ms: number;
-    tool_call_id: string;
-    on_chain: boolean;
-}
-interface JudgeOptions extends ClientOpts {
-    provider?: Provider;
-    model?: string;
-    toolName?: string;
-    toolArgsJson?: string;
-    orgName?: string;
-    chainOpts?: ChainOpts;
-    verifyPubKey?: string;
-}
-interface JudgmentStatus {
-    status: JudgmentStatusState;
-    verdict: Verdict;
-    reason: string;
-    judgmentId: string;
-    onChain?: boolean;
-    cached?: boolean;
-    responseTimeMs?: number;
-}
-interface ToolCallRecord {
-    tool_call_id: string;
-    agent_pubkey: PubkeyValue;
-    tool_name: string;
-    command_text: string;
-    tool_args_json: string;
-    context_text: string;
-    org_name: string;
-    rowid: number;
-}
-interface ToolCallFull {
-    tool_call_id: string;
-    agent_pubkey: PubkeyValue;
-    tool_name: string;
-    command_text: string;
-    context_text: string;
-    tool_args_json?: string;
-    org_name: string;
-    created_at?: number;
-    action_type?: ActionType;
-    result_status?: string;
-    verdict_color?: string;
-    verdict_reason?: string;
-    verdict_source?: string;
-    verdict_response_time_ms?: number;
-}
-interface HeldAction {
-    judgment_id: string;
-    agent_pubkey: PubkeyValue;
-    action_text: string;
-    action_context: string;
-    verdict: Verdict;
-    reason: string;
-    created_at: number;
-}
-interface HeldActionReview {
-    judgment_id: string;
-    action_text: string;
-    status: string;
-    review_note: string;
-    reviewed_by: PubkeyValue | null;
-    reviewed_at: number;
-    created_at: number;
-}
-interface AgentPolicy {
-    policy: string;
-    is_jailed: boolean;
-    is_custom: boolean;
-    default_policy: string;
-}
-type DecisionVerdict = "ALLOW" | "HOLD" | "BLOCK" | "ERROR";
-interface Decision {
-    allow: boolean;
-    verdict: DecisionVerdict;
-    reason?: string;
-    toolCallId?: string;
-}
-interface ToolCallInput {
-    toolName: string;
-    args?: unknown;
-    context?: string;
-}
-type JudgeEndpointConfig = {
-    policy?: "default";
-    endpoint?: string;
-} | {
-    policy: "self-hosted";
-    endpoint: string;
-    verifyPubKey: string;
-};
-interface ValidatedEndpoint {
-    url: string;
-    policy: "default" | "self-hosted";
-    verifyPubKey: string | null;
-}
-interface MemoryEntry {
-    key: string;
-    value: string;
-    source?: string;
-    timestamp?: number;
-}
-type MemoryScanVerdict = "green" | "yellow" | "red";
-type AnomalySeverity = "low" | "medium" | "high" | "critical";
-type AnomalyType = "behavioral_override" | "bulk_insertion" | "safety_bypass" | "privilege_escalation" | "gradual_drift";
-interface MemoryScanResult {
-    safe: boolean;
-    verdict: MemoryScanVerdict;
-    reason: string;
-    confidence: number;
-    toolCallId?: string;
-}
-interface MemoryScanOptions extends JudgeOptions {
-    /** Confidence threshold below which the entry is allowed (default 0.6). */
-    threshold?: number;
-    /** Stop batch scanning on the first red verdict (default true). */
-    stopOnRed?: boolean;
-}
-interface MemorySnapshot {
-    entries: MemoryEntry[];
-    takenAt: number;
-}
-interface MemoryAnomaly {
-    type: AnomalyType;
-    severity: AnomalySeverity;
-    description: string;
-    entries: string[];
-}
-interface MemoryDiffResult {
-    safe: boolean;
-    added: MemoryEntry[];
-    removed: MemoryEntry[];
-    modified: Array<{
-        key: string;
-        before: string;
-        after: string;
-    }>;
-    anomalies: MemoryAnomaly[];
-}
-interface AtbashClientConfig {
-    judge?: JudgeEndpointConfig;
-    nodeUrls?: string[];
-    blockchainRid?: string;
-    orgName?: string;
-    keyPath?: string;
-    keyPair?: {
-        privKey: string;
-        pubKey: string;
-    };
-    failClosed?: boolean;
-    logger?: {
-        info?(...a: unknown[]): void;
-        warn?(...a: unknown[]): void;
-    };
-}
-
-declare const DEFAULT_ENDPOINT = "https://atbash.ai";
-declare const DEFAULT_CHROMIA_NODE_URLS: string[];
-declare const DEFAULT_BLOCKCHAIN_RID = "B91106947F1EAED7B5D789C7D35755330A8A7DD7CB990D59366114EFFB79ED10";
-declare function isValidPrivateKey(hex: string): boolean;
-declare function derivePublicKey(privKeyHex: string): string;
-declare function generateKeyPair(): {
-    privKey: string;
-    pubKey: string;
-};
-declare function loadAgent(privkey: string): AgentAuth;
-declare function toPubkeyHex(val: unknown): string;
-declare function checkAgentExists(pubkey: string, opts?: ClientOpts): Promise<boolean>;
-declare function judgeAction(action: string, context: string | undefined, auth: AgentAuth, opts?: JudgeOptions): Promise<JudgeResult>;
-declare function getJudgmentStatus(judgmentId: string, agentPubkey: string, opts?: ClientOpts): Promise<JudgmentStatus>;
-declare function getToolCalls(maxCount: number, opts?: ClientOpts): Promise<ToolCallRecord[]>;
-declare function getOrgToolCalls(orgName: string, maxCount: number, opts?: ClientOpts): Promise<ToolCallRecord[]>;
-declare function getAgentToolCalls(agentPubkey: string, maxCount: number, opts?: ClientOpts): Promise<ToolCallRecord[]>;
-declare function getToolCallCount(opts?: ClientOpts): Promise<number>;
-declare function getToolCallFull(toolCallId: string, opts?: ClientOpts): Promise<ToolCallFull | null>;
-declare function getOrgSubscription(orgName: string, opts?: ClientOpts): Promise<OrgSubscription | null>;
-declare function getPendingHeldActions(orgName: string, maxCount: number, opts?: ClientOpts): Promise<HeldAction[]>;
-declare function getHeldActionReviews(orgName: string, maxCount: number, opts?: ClientOpts): Promise<HeldActionReview[]>;
-declare function getAgentDetail(agentPubkey: string, opts?: ClientOpts): Promise<Record<string, unknown>>;
-declare function getAgentPolicy(agentPubkey: string, opts?: ClientOpts): Promise<AgentPolicy>;
-declare function getSafetyStats(opts?: ClientOpts): Promise<Record<string, unknown>>;
-
-interface AtbashClient {
-    auditToolCall(input: ToolCallInput): Promise<Decision>;
-}
-declare function createAtbashClient(config?: AtbashClientConfig): AtbashClient;
-
-declare function validateJudgeEndpoint(judge?: JudgeEndpointConfig): ValidatedEndpoint;
-
-declare function resolveKeyPath(input?: string): string;
-declare function loadAgentFromFile(keyPath?: string): AgentAuth;
-
-declare function verifyJudgeResponseSignature(bodyBytes: Uint8Array, signatureHex: string | null, pubKeyHex: string): {
-    ok: boolean;
-    reason?: string;
-};
-
-/**
- * Atbash SDK Telemetry — OpenTelemetry metrics for usage tracking.
- *
- * Tracks: function call counts, latency, source (CLI/plugin/SDK),
- * and agent identity. ON by default.
- *
- * Opt-out: create ~/.config/atbash/telemetry.json with { "enabled": false }
- * The file must be mode 0600. If missing, corrupted, or unreadable → telemetry stays ON.
- * Environment variables cannot disable telemetry (prevents agent bypass).
- */
-type ClientSource = "cli" | "sdk" | "plugin:openclaw" | "plugin:langchain" | "plugin:langgraph" | "plugin:hermes" | "plugin:eliza" | "plugin:crewai" | "plugin:mcp" | "plugin:autogen" | "plugin:jeenai" | (string & {});
-interface TelemetryConfig {
-    /** Must be true to send any telemetry. Default: false */
-    enabled: boolean;
-    /** Where calls originate */
-    source?: ClientSource;
-    /** Flush interval in ms. Default: 60000 */
-    exportIntervalMs?: number;
-}
-declare function setupTelemetry(config: TelemetryConfig): void;
-/**
- * Flush pending metrics and shut down. Call before process exits.
- */
-declare function shutdownTelemetry(): Promise<void>;
-
-interface AtbashUserConfig {
-    agentKey?: string;
-    orgName?: string;
-    judgeEndpoint?: string;
-    blockchainRid?: string;
-    network?: string;
-    provider?: string;
-    providerModel?: string;
-}
-declare function getConfigDir(): string;
-declare function getConfigPath(): string;
-declare function loadUserConfig(): AtbashUserConfig;
-declare function saveUserConfig(config: AtbashUserConfig): void;
-declare function resolve(key: keyof AtbashUserConfig, flagValue?: string): string;
-
-/**
- * Scan a single memory entry for poisoning.
- *
- * Defence layers (in order):
- * 1. **Regex pre-filter** — catches obvious attacks instantly, zero latency
- * 2. **LLM-as-Judge** — catches semantic / rephrased attacks the regex misses
- *
- * Both layers run against unicode-normalized text. The entry is fenced
- * in the judge prompt so attackers cannot meta-inject into the scanner.
- * Every scan is logged on-chain via the judge API for forensic audit.
- */
-declare function scanMemory(entry: MemoryEntry, auth: AgentAuth, opts?: MemoryScanOptions): Promise<MemoryScanResult>;
-/**
- * Scan multiple memory entries. By default stops on the first red
- * verdict. Set `stopOnRed: false` to scan all entries regardless.
- */
-declare function scanMemoryBatch(entries: MemoryEntry[], auth: AgentAuth, opts?: MemoryScanOptions): Promise<MemoryScanResult[]>;
-
-/**
- * Create a timestamped snapshot of the current memory state.
- */
-declare function createMemorySnapshot(entries: MemoryEntry[]): MemorySnapshot;
-/**
- * Compute the diff between two memory snapshots and run anomaly
- * detection heuristics on the result.
- *
- * Catches what other defenses miss:
- * - HMAC detects external tampering, not entries the agent wrote itself
- * - Provenance tagging neutralizes untrusted sources, but a trusted
- *   channel can still be exploited
- * - Regex catches fixed phrases, but attackers rephrase
- * - LLM-as-judge catches semantic manipulation on individual entries
- * - This function catches the *cumulative effect* — gradual multi-step
- *   poisoning where entries shift agent behavior across sessions
- */
-declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
-
-/**
- * Unicode normalization for memory content before regex matching.
- *
- * Defeats evasion techniques:
- * - Zero-width characters inserted between letters
- * - Homoglyphs (Cyrillic "а" instead of Latin "a")
- * - Mixed-script confusables
- * - Invisible formatting characters
- */
-/**
- * Normalize a string for safe regex matching:
- * 1. NFKC normalization (collapses compatibility decompositions)
- * 2. Strip zero-width / invisible characters
- * 3. Map common confusable characters to their Latin equivalents
- */
-declare function normalizeForMatching(input: string): string;
-/**
- * Check whether a string contains suspicious encoding that may indicate
- * an evasion attempt (presence of confusables, invisible chars, etc.).
- * Returns true if the raw and normalized forms differ.
- */
-declare function containsEvasionCharacters(input: string): boolean;
-
-export { type ActionType, type AgentAuth, type AgentPolicy, type AnomalySeverity, type AnomalyType, type AtbashClient, type AtbashClientConfig, type AtbashUserConfig, type ClientOpts, type ClientSource, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, type Decision, type DecisionVerdict, type HeldAction, type HeldActionReview, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentStatus, type JudgmentStatusState, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type OrgSubscription, type Provider, type PubkeyValue, type TelemetryConfig, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, checkAgentExists, containsEvasionCharacters, createAtbashClient, createMemorySnapshot, derivePublicKey, diffMemorySnapshots, generateKeyPair, getAgentDetail, getAgentPolicy, getAgentToolCalls, getConfigDir, getConfigPath, getHeldActionReviews, getJudgmentStatus, getOrgSubscription, getOrgToolCalls, getPendingHeldActions, getSafetyStats, getToolCallCount, getToolCallFull, getToolCalls, isValidPrivateKey, judgeAction, loadAgent, loadAgentFromFile, loadUserConfig, normalizeForMatching, resolve, resolveKeyPath, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, toPubkeyHex, validateJudgeEndpoint, verifyJudgeResponseSignature };