@atbash/sdk 0.7.0 → 0.7.1

package/dist/browser.mjs

@@ -10,6 +10,9 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod2) => function __require2() {
   return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
 };
@@ -30,10 +33,28 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
   mod2
 ));
 
+// <define:__ATBASH_CHROMIA_NODE_URLS__>
+var define_ATBASH_CHROMIA_NODE_URLS_default;
+var init_define_ATBASH_CHROMIA_NODE_URLS = __esm({
+  "<define:__ATBASH_CHROMIA_NODE_URLS__>"() {
+    define_ATBASH_CHROMIA_NODE_URLS_default = ["https://node0.testnet.chromia.com:7740", "https://node1.testnet.chromia.com:7740", "https://node3.testnet.chromia.com:7740"];
+  }
+});
+
+// <define:__ATBASH_PRIVATE_NODE_URLS__>
+var define_ATBASH_PRIVATE_NODE_URLS_default;
+var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
+  "<define:__ATBASH_PRIVATE_NODE_URLS__>"() {
+    define_ATBASH_PRIVATE_NODE_URLS_default = ["https://node0-pvn-testnet.dynamic.chromia.dev"];
+  }
+});
+
 // (disabled):node_modules/buffer/index.js
 var require_buffer = __commonJS({
   "(disabled):node_modules/buffer/index.js"() {
     "use strict";
+    init_define_ATBASH_CHROMIA_NODE_URLS();
+    init_define_ATBASH_PRIVATE_NODE_URLS();
   }
 });
 
@@ -41,6 +62,8 @@ var require_buffer = __commonJS({
 var require_bn = __commonJS({
   "node_modules/bn.js/lib/bn.js"(exports, module) {
     "use strict";
+    init_define_ATBASH_CHROMIA_NODE_URLS();
+    init_define_ATBASH_PRIVATE_NODE_URLS();
     (function(module2, exports2) {
       "use strict";
       function assert2(val, msg) {
@@ -2858,7 +2881,29 @@ var require_bn = __commonJS({
   }
 });
 
+// src-ts/index.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// src-ts/browser/native.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/curves/secp256k1.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/hashes/sha2.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/hashes/_md.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/hashes/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -3279,7 +3324,13 @@ var sha256 = /* @__PURE__ */ createHasher(
   /* @__PURE__ */ oidNist(1)
 );
 
+// node_modules/@noble/curves/abstract/curve.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/curves/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
 var bytesToHex2 = bytesToHex;
@@ -3432,6 +3483,8 @@ function validateObject(object, fields = {}, optFields = {}) {
 }
 
 // node_modules/@noble/curves/abstract/modular.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -4079,7 +4132,13 @@ function createKeygen(randomSecretKey, getPublicKey) {
   };
 }
 
+// node_modules/@noble/curves/abstract/weierstrass.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/hashes/hmac.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var _HMAC = class {
   oHash;
   iHash;
@@ -5111,6 +5170,8 @@ var Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
 var secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);
 
 // node_modules/postchain-client/built/esm/index.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var import_bn = __toESM(require_bn(), 1);
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
 function getDefaultExportFromCjs(x) {
@@ -12065,7 +12126,7 @@ function requireBuffer_list() {
       }
     }, {
       key: "join",
-      value: function join2(s2) {
+      value: function join3(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -16147,7 +16208,7 @@ function requireBufferList() {
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList2.prototype.join = function join2(s2) {
+      BufferList2.prototype.join = function join3(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -30311,7 +30372,7 @@ function requireBuffer() {
     }
   }
   buffer.EncoderBuffer = EncoderBuffer2;
-  EncoderBuffer2.prototype.join = function join2(out, offset) {
+  EncoderBuffer2.prototype.join = function join3(out, offset) {
     if (!out)
       out = new Buffer5(this.length);
     if (!offset)
@@ -43233,17 +43294,11 @@ var index = /* @__PURE__ */ getDefaultExportFromCjs(builtExports);
 
 // src-ts/browser/native.ts
 var { Buffer: Buffer3, gtx: pcgtx } = index;
-var PROD_ENDPOINT = "https://atbash.ai";
-var PROD_BLOCKCHAIN_RID = "0163241D9AF137638E63E48EFCDE15510F38C2426F7AD5DC726AF60351BF4DFE";
-var PROD_PRIVATE_BLOCKCHAIN_RID = "39FFD3557D0296CB2C57FDC6A3B8C024E95639CF4964DA08141AC20C6344D408";
-var DEFAULT_CHROMIA_NODE_URLS_ARR = [
-  "https://node0.testnet.chromia.com:7740",
-  "https://node1.testnet.chromia.com:7740",
-  "https://node3.testnet.chromia.com:7740"
-];
-var DEFAULT_PRIVATE_NODE_URLS_ARR = [
-  "https://node0-pvn-testnet.dynamic.chromia.dev"
-];
+var ATBASH_ENDPOINT = "https://atbash.ai";
+var ATBASH_BLOCKCHAIN_RID = "0163241D9AF137638E63E48EFCDE15510F38C2426F7AD5DC726AF60351BF4DFE";
+var ATBASH_PRIVATE_BLOCKCHAIN_RID = "39FFD3557D0296CB2C57FDC6A3B8C024E95639CF4964DA08141AC20C6344D408";
+var DEFAULT_CHROMIA_NODE_URLS_ARR = define_ATBASH_CHROMIA_NODE_URLS_default;
+var DEFAULT_PRIVATE_NODE_URLS_ARR = define_ATBASH_PRIVATE_NODE_URLS_default;
 var MERKLE_HASH_VERSION = 2;
 function stripHex(s2) {
   return s2.trim().replace(/^0x/i, "").toLowerCase();
@@ -43394,9 +43449,9 @@ var native = {
   deriveMemoryKey,
   encryptMemoryContent,
   decryptMemoryContent,
-  DEFAULT_BLOCKCHAIN_RID: PROD_BLOCKCHAIN_RID,
-  DEFAULT_PRIVATE_BLOCKCHAIN_RID: PROD_PRIVATE_BLOCKCHAIN_RID,
-  DEFAULT_ENDPOINT: PROD_ENDPOINT,
+  DEFAULT_BLOCKCHAIN_RID: ATBASH_BLOCKCHAIN_RID,
+  DEFAULT_PRIVATE_BLOCKCHAIN_RID: ATBASH_PRIVATE_BLOCKCHAIN_RID,
+  DEFAULT_ENDPOINT: ATBASH_ENDPOINT,
   // Browser has no NAPI channel to Rust's HONEYCOMB_KEY — telemetry
   // silently no-ops. `HONEYCOMB_API_KEY` env var still overrides at runtime.
   HONEYCOMB_KEY: "",
@@ -43456,7 +43511,13 @@ var native = {
   ARG_ID: "id"
 };
 
+// src-ts/client.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/random.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function randomBytes4(size) {
   const buf = new Uint8Array(size);
   globalThis.crypto.getRandomValues(buf);
@@ -43471,7 +43532,13 @@ function randomHex(size) {
   return hex;
 }
 
+// src-ts/chain-config.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/constants.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
 var DEFAULT_CHROMIA_NODE_URLS = Object.freeze(
   native.defaultChromiaNodeUrls()
@@ -43494,7 +43561,17 @@ var PRIVATE_CHAIN = {
   nodeUrls: DEFAULT_PRIVATE_NODE_URLS
 };
 
+// src-ts/browser/encrypted-toolcall.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// src-ts/browser/crypto-ecies.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/hashes/hkdf.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function extract(hash3, ikm, salt) {
   ahash(hash3);
   if (salt === void 0)
@@ -43534,7 +43611,17 @@ function expand2(hash3, prk, info2, length = 32) {
 }
 var hkdf = (hash3, ikm, salt, info2, length) => expand2(hash3, extract(hash3, ikm, salt), info2, length);
 
+// node_modules/@noble/ciphers/aes.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
+// node_modules/@noble/ciphers/_polyval.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // node_modules/@noble/ciphers/utils.js
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -44127,6 +44214,8 @@ function encryptedLength(plaintextByteLength) {
 }
 
 // src-ts/crypto/envelope.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var PREFIX = "atb1";
 var SEPARATOR = ".";
 function toBase64(bytes) {
@@ -44259,6 +44348,8 @@ function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJs
 }
 
 // src-ts/endpoint.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function buildAllowedJudgeHosts() {
   return /* @__PURE__ */ new Set([
     "atbash.ai",
@@ -44309,6 +44400,8 @@ function validateJudgeEndpoint(judge) {
 }
 
 // src-ts/errors.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var AtbashAPIError = class extends Error {
   /** HTTP status code (or 0 if the request never completed). */
   status;
@@ -44351,6 +44444,8 @@ function enrich(status, body, statusText, endpoint) {
 }
 
 // src-ts/http/client.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var HttpClient = class {
   baseUrl;
   timeoutMs;
@@ -44383,11 +44478,73 @@ var HttpClient = class {
     });
   }
   async fetch(url, init4) {
-    return fetch(url, { ...init4, signal: AbortSignal.timeout(this.timeoutMs) });
+    try {
+      return await fetch(url, {
+        ...init4,
+        signal: AbortSignal.timeout(this.timeoutMs)
+      });
+    } catch (err) {
+      throw classifyTransportError(err, url, init4.method ?? "GET", this.timeoutMs);
+    }
   }
 };
+var HttpTransportError = class extends Error {
+  kind;
+  constructor(kind, message, options) {
+    super(message, options);
+    this.name = "HttpTransportError";
+    this.kind = kind;
+  }
+};
+function classifyTransportError(err, url, method, timeoutMs) {
+  const name2 = err instanceof Error ? err.name : "";
+  const cause = err instanceof Error ? err.cause : void 0;
+  const code2 = cause && typeof cause === "object" && "code" in cause ? String(cause.code) : "";
+  if (name2 === "TimeoutError") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} did not respond within ${timeoutMs} ms \u2014 the judge may be slow to boot or the LLM is under load; retry in a moment`,
+      { cause: err }
+    );
+  }
+  if (name2 === "AbortError") {
+    return new HttpTransportError(
+      "aborted",
+      `${method} ${url} was cancelled by the caller`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
+    return new HttpTransportError(
+      "dns",
+      `could not resolve the judge hostname (${url}) \u2014 check the endpoint and DNS`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ECONNREFUSED") {
+    return new HttpTransportError(
+      "connect_refused",
+      `judge refused the connection (${url}) \u2014 the service may be down or restarting`,
+      { cause: err }
+    );
+  }
+  if (code2 === "ECONNRESET" || code2 === "EPIPE") {
+    return new HttpTransportError(
+      "connection_reset",
+      `judge dropped the connection mid-request (${url}) \u2014 retry once`,
+      { cause: err }
+    );
+  }
+  return new HttpTransportError(
+    "unknown",
+    `${method} ${url} failed: ${err instanceof Error ? err.message : String(err)}`,
+    { cause: err }
+  );
+}
 
 // src-ts/browser/keyLoader.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE = "keyLoader is not available in the browser bundle \u2014 pass `agentKey` explicitly to Atbash.fromConfig or use `new Atbash(privkey, opts)`.";
 function resolveKeyPath(_input) {
   throw new Error(NOT_AVAILABLE);
@@ -44397,6 +44554,8 @@ function loadAgentFromFile(_keyPath) {
 }
 
 // src-ts/normalize.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function normalizeVerdict(raw2) {
   if (raw2 === null || raw2 === void 0) return "No verdict";
   const v = String(raw2).toUpperCase();
@@ -44422,6 +44581,8 @@ function pubkeyToHex(val) {
 }
 
 // src-ts/browser/opentel/telemetry.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function setupTelemetry(_config) {
 }
 function recordCall(_functionName, _source, _agentPubkey) {
@@ -44434,6 +44595,8 @@ async function shutdownTelemetry() {
 }
 
 // src-ts/browser/userConfig.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var NOT_AVAILABLE2 = "userConfig file I/O is not available in the browser bundle.";
 function getConfigDir() {
   throw new Error(NOT_AVAILABLE2);
@@ -44470,6 +44633,7 @@ var Atbash = class _Atbash {
   failClosed;
   /** Org key learned from the last agent-exists check, for this agent only. */
   _orgKeyFromChain = null;
+  debug;
   logger;
   http;
   /**
@@ -44483,6 +44647,8 @@ var Atbash = class _Atbash {
    * server-side replay protection windows never expire it mid-session.
    */
   _authBearer = null;
+  /** Guards `logEnvironmentOnce` — hosts construct several clients. */
+  static environmentLogged = false;
   constructor(privkey, options = {}) {
     this.auth = native.loadAgent(privkey);
     this.endpoint = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/+$/, "") || DEFAULT_ENDPOINT;
@@ -44492,8 +44658,10 @@ var Atbash = class _Atbash {
     this.verifyPubKey = options.verifyPubKey;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
+    this.debug = options.debug === true;
     this.logger = options.logger ?? {};
-    this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 3e4);
+    this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 6e4);
+    this.logEnvironmentOnce();
     if (this.endpoint !== DEFAULT_ENDPOINT) {
       this.logger.warn?.("[atbash] running on non-default judge endpoint", {
         endpoint: this.endpoint,
@@ -44501,6 +44669,31 @@ var Atbash = class _Atbash {
       });
     }
   }
+  /**
+   * Say which environment this build talks to, once per process.
+   *
+   * The endpoint and both chain RIDs are compiled in, chosen by the npm tag,
+   * and no configuration repoints a released build. So installing the build
+   * for the wrong environment is invisible: the plugin loads, the hook fires,
+   * and every judge call fails because the agent does not exist on the chain
+   * this build targets. Organisation names are not unique across environments
+   * either, so an org resolving is not evidence the build is right.
+   */
+  logEnvironmentOnce() {
+    if (_Atbash.environmentLogged) return;
+    _Atbash.environmentLogged = true;
+    const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
+    this.logger.info?.(
+      `[atbash] environment \u2014 judge=${this.endpoint} publicChain=${brief(native.DEFAULT_BLOCKCHAIN_RID)} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      {
+        judgeEndpoint: this.endpoint,
+        publicBlockchainRid: native.DEFAULT_BLOCKCHAIN_RID,
+        privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
+        activeBlockchainRid: this.blockchainRid,
+        responseSignatureCheck: Boolean(this.verifyPubKey)
+      }
+    );
+  }
   /**
    * Construct from resolved config: explicit overrides → env vars → the
    * `~/.config/atbash/config.json` file (see userConfig.resolve). The private
@@ -44524,6 +44717,9 @@ var Atbash = class _Atbash {
       orgName: options.orgName,
       verifyPubKey: validated.verifyPubKey ?? void 0,
       failClosed: options.failClosed,
+      // ATBASH_DEBUG lets an operator turn diagnostics on without editing a
+      // host's plugin config, which is usually the harder half.
+      debug: options.debug ?? /^(1|true|yes)$/i.test(resolve("debug")),
       logger: options.logger
     });
   }
@@ -44623,11 +44819,15 @@ var Atbash = class _Atbash {
    * response bytes via the Rust core's `verifySignature`.
    */
   async judgeAction(action, context = "", options = {}) {
-    return this.track(
-      "judgeAction",
-      this.auth.pubkey,
-      () => this._judgeAction(action, context, options)
-    );
+    return this.track("judgeAction", this.auth.pubkey, async () => {
+      try {
+        return await this._judgeAction(action, context, options);
+      } catch (err) {
+        if (!isEncryptionStateMismatch(err)) throw err;
+        this._orgKeyFromChain = null;
+        return await this._judgeAction(action, context, options);
+      }
+    });
   }
   async _judgeAction(action, context, options) {
     if (!action?.trim()) {
@@ -44765,8 +44965,9 @@ var Atbash = class _Atbash {
       });
       if (result.verdict === "No verdict") {
         if (result.status !== "logged") {
-          return this.fail(
+          return this.failJudge(
             `judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`,
+            void 0,
             result.toolCallId
           );
         }
@@ -44818,16 +45019,38 @@ var Atbash = class _Atbash {
           toolCallId: result.toolCallId
         };
       }
-      return this.fail(
+      return this.failJudge(
         "unrecognized action_type from judge",
+        void 0,
         result.toolCallId
       );
     } catch (err) {
-      const message = errorMessage(err);
-      this.logger.warn?.("[atbash] judge API failed", { reason: message });
-      return this.fail(message);
+      return this.failJudge(errorMessage(err), err);
     }
   }
+  /**
+   * One exit for every judge failure.
+   *
+   * Status and reason go in the *message*, not only in the meta object: hosts
+   * print the message and drop the meta, which is why this read as a bare
+   * "judge API failed" while the judge was answering with a precise reason.
+   * The response body follows only under `debug`, since it can echo the action.
+   */
+  failJudge(reason, cause, toolCallId) {
+    const api2 = cause instanceof AtbashAPIError ? cause : null;
+    const status = api2 ? ` status=${api2.status || "no-response"}` : "";
+    const body = this.debug && api2?.body ? ` body=${truncate(api2.body, 500)}` : "";
+    this.logger.warn?.(
+      `[atbash] judge API failed \u2014${status} reason=${truncate(reason, 300)}${body}`,
+      {
+        reason,
+        ...api2 ? { status: api2.status, body: api2.body } : {},
+        endpoint: this.endpoint,
+        ...toolCallId ? { toolCallId } : {}
+      }
+    );
+    return this.fail(reason, toolCallId);
+  }
   fail(reason, toolCallId) {
     return { allow: !this.failClosed, verdict: "ERROR", reason, toolCallId };
   }
@@ -45168,8 +45391,27 @@ var Atbash = class _Atbash {
       this.endpoint
     );
   }
-  /** Wrap a *transport* failure (fetch threw, no response) as an AtbashAPIError. */
+  /**
+   * Wrap a transport failure (fetch threw, no response) as an AtbashAPIError.
+   *
+   * `HttpTransportError.kind` names the cause; the message is already
+   * human-readable. `debug` echoes the original exception so operators can
+   * cross-reference with node / undici logs when a class doesn't match.
+   */
   transportError(err) {
+    if (err instanceof HttpTransportError) {
+      if (this.debug) {
+        this.logger.warn?.(
+          `[atbash] transport failed \u2014 kind=${err.kind}`,
+          {
+            kind: err.kind,
+            cause: err.cause instanceof Error ? err.cause.message : String(err.cause ?? ""),
+            endpoint: this.endpoint
+          }
+        );
+      }
+      return new AtbashAPIError(0, err.message, "", this.endpoint);
+    }
     return new AtbashAPIError(0, errorMessage(err), "", this.endpoint);
   }
   async json(resp) {
@@ -45301,6 +45543,10 @@ async function safeText(resp) {
 function errorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
+function isEncryptionStateMismatch(err) {
+  const msg = errorMessage(err);
+  return msg.includes("must be a valid encryption envelope") || msg.includes("must be plaintext");
+}
 function stringifyArgs(args) {
   if (args === null || args === void 0) return "";
   if (typeof args === "string") return args;
@@ -45311,12 +45557,37 @@ function stringifyArgs(args) {
   }
 }
 var MAX_ACTION_LEN = 4e3;
-function truncate(text) {
-  if (text.length <= MAX_ACTION_LEN) return text;
-  return text.slice(0, MAX_ACTION_LEN) + "\u2026";
+function truncate(text, limit = MAX_ACTION_LEN) {
+  if (text.length <= limit) return text;
+  return text.slice(0, limit) + "\u2026";
+}
+
+// src-ts/key-path.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+import { homedir } from "os";
+import { join as join2 } from "path";
+var KEY_DIR_REL = ".config/atbash";
+var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
+function home() {
+  return process.env.HOME || homedir() || "";
+}
+function expandHome(p) {
+  if (!p.startsWith("~/")) return p;
+  return join2(home(), p.slice(2));
+}
+function keyPathCandidates() {
+  return KEY_FILENAMES.map((name2) => join2(home(), KEY_DIR_REL, name2));
+}
+function chooseKeyPath(input, exists) {
+  if (input) return expandHome(input);
+  const candidates = keyPathCandidates();
+  return candidates.find(exists) ?? candidates[0];
 }
 
 // src-ts/redact.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function redactJsonStrings(value) {
   if (typeof value === "string") {
     return native.redactSecrets(value).redacted;
@@ -45335,6 +45606,8 @@ function redactJsonStrings(value) {
 }
 
 // src-ts/signature.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   if (!signatureHex) {
     return { ok: false, reason: "missing X-Atbash-Signature header" };
@@ -45356,7 +45629,26 @@ function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   };
 }
 
+// src-ts/memory/boot-sync-message.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+var BOOT_SYNC_HINT = "check the chain endpoint and orgName if the cause above does not explain it";
+function bootSyncFailureLine(cause) {
+  const reason = cause instanceof Error ? cause.message : String(cause);
+  const trimmed = reason.trim();
+  return trimmed ? `[atbash] boot memory sync failed: ${trimmed}` : (
+    // No cause to show: fall back to the advice rather than a bare colon.
+    `[atbash] boot memory sync failed \u2014 ${BOOT_SYNC_HINT}`
+  );
+}
+
+// src-ts/memory/index.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
+
 // src-ts/browser/memory-crypto.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var { Buffer: Buffer4 } = index;
 var HKDF_INFO = new TextEncoder().encode("atbash:memory-encryption");
 var KEY_LEN = 32;
@@ -45431,6 +45723,8 @@ async function decryptMemoryContent2(ciphertext, nonce, key3) {
 }
 
 // src-ts/browser/memory-scan.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG2 = "not available in @atbash/sdk browser bundle \u2014 scan memory server-side";
 async function scanMemory(_entry, _auth, _opts) {
   throw new Error(`scanMemory ${STUB_MSG2}`);
@@ -45440,6 +45734,8 @@ async function scanMemoryBatch(_entries, _auth, _opts) {
 }
 
 // src-ts/browser/memory-chain.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG3 = "not available in @atbash/sdk browser bundle \u2014 commit/rollback memory server-side";
 async function commitMemoryVersion(_plaintext, _auth, _opts) {
   throw new Error(`commitMemoryVersion ${STUB_MSG3}`);
@@ -45467,6 +45763,8 @@ async function rollbackMemory(_toId, _reason, _auth, _opts) {
 }
 
 // src-ts/browser/memory-classifier.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG4 = "not available in @atbash/sdk browser bundle \u2014 classify memory writes server-side";
 var DEFAULT_MEMORY_WRITE_TOOL_NAMES = [
   "write",
@@ -45489,6 +45787,8 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/memory/guard.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 function emitDebugProbe(event, ctx, memEntry, logger2) {
   if (!logger2?.info) return;
   const ev = event ?? {};
@@ -45585,6 +45885,8 @@ async function guardMemoryWrite(input) {
 }
 
 // src-ts/memory/sync.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var MemoryIntegrityError = class extends Error {
   constructor(id, reason) {
     super(`memory integrity check failed on id ${id}: ${reason}`);
@@ -45617,6 +45919,8 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 }
 
 // src-ts/browser/memory-pointer-store.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -45635,6 +45939,8 @@ function defaultPointerPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-file-logger.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -45646,6 +45952,8 @@ function defaultPluginLogPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-read-classifier.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
   "memory_search",
@@ -45656,6 +45964,8 @@ function classifyMemoryRead(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/browser/memory-guard-manager.ts
+init_define_ATBASH_CHROMIA_NODE_URLS();
+init_define_ATBASH_PRIVATE_NODE_URLS();
 var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -45737,6 +46047,7 @@ function diffMemorySnapshots2(before, after) {
 export {
   Atbash,
   AtbashAPIError,
+  BOOT_SYNC_HINT,
   DEFAULT_BLOCKCHAIN_RID,
   DEFAULT_CHROMIA_NODE_URLS,
   DEFAULT_ENDPOINT,
@@ -45744,11 +46055,16 @@ export {
   DEFAULT_MEMORY_READ_TOOL_NAMES,
   DEFAULT_MEMORY_WRITE_TOOL_NAMES,
   EciesDomain,
+  HttpClient,
+  HttpTransportError,
+  KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
   PointerStore,
   SignatureVerificationError,
+  bootSyncFailureLine,
   buildAllowedJudgeHosts,
+  chooseKeyPath,
   claimHashHex,
   classifyMemoryRead,
   classifyMemoryWrite,
@@ -45783,6 +46099,7 @@ export {
   isEnvelope,
   isValidPrivateKey2 as isValidPrivateKey,
   keyFingerprintOf,
+  keyPathCandidates,
   loadAgent2 as loadAgent,
   loadAgentFromFile,
   loadUserConfig,