@atbash/sdk 0.9.0 → 0.9.2

package/dist/browser.mjs

@@ -10054,8 +10054,8 @@ Reporter$3.prototype.wrapResult = function wrapResult(result) {
     errors: state2.errors
   };
 };
-function ReporterError$1(path4, msg) {
-  this.path = path4;
+function ReporterError$1(path3, msg) {
+  this.path = path3;
   this.rethrow(msg);
 }
 inherits$v(ReporterError$1, Error);
@@ -12126,7 +12126,7 @@ function requireBuffer_list() {
       }
     }, {
       key: "join",
-      value: function join3(s2) {
+      value: function join2(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -16208,7 +16208,7 @@ function requireBufferList() {
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList2.prototype.join = function join3(s2) {
+      BufferList2.prototype.join = function join2(s2) {
         if (this.length === 0) return "";
         var p = this.head;
         var ret = "" + p.data;
@@ -30276,8 +30276,8 @@ Reporter.prototype.wrapResult = function wrapResult2(result) {
     errors: state2.errors
   };
 };
-function ReporterError(path4, msg) {
-  this.path = path4;
+function ReporterError(path3, msg) {
+  this.path = path3;
   this.rethrow(msg);
 }
 inherits(ReporterError, Error);
@@ -30372,7 +30372,7 @@ function requireBuffer() {
     }
   }
   buffer.EncoderBuffer = EncoderBuffer2;
-  EncoderBuffer2.prototype.join = function join3(out, offset) {
+  EncoderBuffer2.prototype.join = function join2(out, offset) {
     if (!out)
       out = new Buffer5(this.length);
     if (!offset)
@@ -33307,8 +33307,8 @@ var parseUtil = {};
   const errors_js_12 = errors$3;
   const en_js_12 = __importDefault2(en);
   const makeIssue = (params) => {
-    const { data, path: path4, errorMaps, issueData } = params;
-    const fullPath = [...path4, ...issueData.path || []];
+    const { data, path: path3, errorMaps, issueData } = params;
+    const fullPath = [...path3, ...issueData.path || []];
     const fullIssue = {
       ...issueData,
       path: fullPath
@@ -33445,11 +33445,11 @@ var errorUtil_js_1 = errorUtil$1;
 var parseUtil_js_1 = parseUtil;
 var util_js_1 = util;
 var ParseInputLazyPath = class {
-  constructor(parent, value, path4, key3) {
+  constructor(parent, value, path3, key3) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path4;
+    this._path = path3;
     this._key = key3;
   }
   get path() {
@@ -40355,21 +40355,21 @@ function createTimeoutController(timeout) {
   const timeoutId = setTimeout(() => controller.abort(timeoutError), timeout);
   return { controller, timeoutId };
 }
-function handleRequest(method, path4, endpoint, timeout, postObject) {
+function handleRequest(method, path3, endpoint, timeout, postObject) {
   return __awaiter$2(this, void 0, void 0, function* () {
     if (method == enums_1$2.Method.GET) {
-      return yield get(path4, endpoint, timeout);
+      return yield get(path3, endpoint, timeout);
     } else {
-      return yield post(path4, endpoint, timeout, postObject);
+      return yield post(path3, endpoint, timeout, postObject);
     }
   });
 }
-function get(path4, endpoint, timeout) {
+function get(path3, endpoint, timeout) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`GET URL ${new URL(path4, endpoint).href}`);
+    logger.debug(`GET URL ${new URL(path3, endpoint).href}`);
     try {
       const { controller, timeoutId } = createTimeoutController(timeout);
-      const response = yield fetch(new URL(path4, endpoint).href, {
+      const response = yield fetch(new URL(path3, endpoint).href, {
         signal: controller === null || controller === void 0 ? void 0 : controller.signal
       });
       if (timeoutId)
@@ -40407,9 +40407,9 @@ function constructBufferResponseBody(response) {
     return responseText ? responseText : response.statusText;
   });
 }
-function post(path4, endpoint, timeout, requestBody) {
+function post(path3, endpoint, timeout, requestBody) {
   return __awaiter$2(this, void 0, void 0, function* () {
-    logger.debug(`POST URL ${new URL(path4, endpoint).href}`);
+    logger.debug(`POST URL ${new URL(path3, endpoint).href}`);
     logger.debug(`POST body ${JSON.stringify(requestBody)}`);
     if (buffer_1.Buffer.isBuffer(requestBody)) {
       try {
@@ -40423,7 +40423,7 @@ function post(path4, endpoint, timeout, requestBody) {
           },
           signal: controller === null || controller === void 0 ? void 0 : controller.signal
         };
-        const response = yield fetch(new URL(path4, endpoint).href, requestOptions);
+        const response = yield fetch(new URL(path3, endpoint).href, requestOptions);
         if (timeoutId)
           clearTimeout(timeoutId);
         const transactionTimestamp = response.headers.get("X-Transaction-Timestamp");
@@ -40434,7 +40434,7 @@ function post(path4, endpoint, timeout, requestBody) {
     } else {
       try {
         const { controller, timeoutId } = createTimeoutController(timeout);
-        const response = yield fetch(new URL(path4, endpoint).href, {
+        const response = yield fetch(new URL(path3, endpoint).href, {
           method: "post",
           body: JSON.stringify(requestBody),
           headers: {
@@ -40614,10 +40614,10 @@ function requireFailoverStrategies() {
       }
     }
     function abortOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path4,
+          path: path3,
           config: config2,
           postObject,
           timeoutOverride,
@@ -40628,10 +40628,10 @@ function requireFailoverStrategies() {
       });
     }
     function tryNextOnError(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         return yield retryRequest({
           method,
-          path: path4,
+          path: path3,
           config: config2,
           postObject,
           timeoutOverride,
@@ -40647,7 +40647,7 @@ function requireFailoverStrategies() {
       return endpointPoolLength - (endpointPoolLength - 1) / 3;
     }
     function queryMajority(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         var _b;
         const bftMajorityThreshold = calculateBftMajorityThreshold(config2.endpointPool.length);
         const failureThreshold = config2.endpointPool.length - bftMajorityThreshold + 1;
@@ -40658,7 +40658,7 @@ function requireFailoverStrategies() {
         const promises = availableNodes.map((node2) => __awaiter2(this, void 0, void 0, function* () {
           try {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path4, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             const { statusCode } = response;
             if (statusCode && (0, http_utils_1.isSuccessfulStatusCode)(statusCode)) {
               outcomes.push({ type: "SUCCESS", result: response });
@@ -40705,7 +40705,7 @@ function requireFailoverStrategies() {
       });
     }
     function singleEndpoint(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, timeoutOverride }) {
         let statusCode = null;
         let rspBody = null;
         let error4 = null;
@@ -40716,7 +40716,7 @@ function requireFailoverStrategies() {
         }
         for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
           const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-          const response = yield (0, httpUtil_1.handleRequest)(method, path4, endpoint.url, requestTimeout, postObject);
+          const response = yield (0, httpUtil_1.handleRequest)(method, path3, endpoint.url, requestTimeout, postObject);
           if (response) {
             ({ error: error4, statusCode, rspBody, transactionTimestamp } = response);
           }
@@ -40731,7 +40731,7 @@ function requireFailoverStrategies() {
       });
     }
     function retryRequest(_a2) {
-      return __awaiter2(this, arguments, void 0, function* ({ method, path: path4, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
+      return __awaiter2(this, arguments, void 0, function* ({ method, path: path3, config: config2, postObject, useNextNodeOnError, recoveryThreshold, timeoutOverride }) {
         var _b, _c, _d;
         let statusCode = null;
         let rspBody = null;
@@ -40742,7 +40742,7 @@ function requireFailoverStrategies() {
         for (const node2 of availableNodes) {
           for (let attempt = 0; attempt < config2.attemptsPerEndpoint; attempt++) {
             const requestTimeout = timeoutOverride !== null && timeoutOverride !== void 0 ? timeoutOverride : config2.responseTimeout;
-            const response = yield (0, httpUtil_1.handleRequest)(method, path4, node2.url, requestTimeout, postObject);
+            const response = yield (0, httpUtil_1.handleRequest)(method, path3, node2.url, requestTimeout, postObject);
             error4 = (_b = response === null || response === void 0 ? void 0 : response.error) !== null && _b !== void 0 ? _b : null;
             statusCode = (_c = response === null || response === void 0 ? void 0 : response.statusCode) !== null && _c !== void 0 ? _c : null;
             rspBody = (_d = response === null || response === void 0 ? void 0 : response.rspBody) !== null && _d !== void 0 ? _d : null;
@@ -40885,19 +40885,19 @@ function requireRequestWithFailoverStrategy() {
   const enums_12 = enums;
   const failoverStrategies_1 = requireFailoverStrategies();
   function requestWithFailoverStrategy$1(method_1, path_1, config_1, postObject_1) {
-    return __awaiter2(this, arguments, void 0, function* (method, path4, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
+    return __awaiter2(this, arguments, void 0, function* (method, path3, config2, postObject, forceSingleEndpoint = false, timeoutOverride) {
       switch (config2.failoverStrategy) {
         case enums_12.FailoverStrategy.AbortOnError:
-          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.abortOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.TryNextOnError:
-          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.tryNextOnError)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.SingleEndpoint:
-          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
         case enums_12.FailoverStrategy.QueryMajority:
           if (forceSingleEndpoint) {
-            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path4, config: config2, postObject, timeoutOverride });
+            return yield (0, failoverStrategies_1.singleEndpoint)({ method, path: path3, config: config2, postObject, timeoutOverride });
           }
-          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path4, config: config2, postObject, timeoutOverride });
+          return yield (0, failoverStrategies_1.queryMajority)({ method, path: path3, config: config2, postObject, timeoutOverride });
         default:
           throw new Error(`Unsupported failover strategy: ${config2.failoverStrategy}`);
       }
@@ -42096,7 +42096,7 @@ var networkSettings = {};
     const restNetworkSettingsValidationContext = RestNetworkSettingsSchema.safeParse(networkSettings2);
     if ("error" in restNetworkSettingsValidationContext) {
       const { error: { issues } = {} } = restNetworkSettingsValidationContext;
-      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path4 }) => `${path4[0]}: ${message}`).join(", ");
+      const errorMessage2 = issues === null || issues === void 0 ? void 0 : issues.map(({ message, path: path3 }) => `${path3[0]}: ${message}`).join(", ");
       if (throwOnError) {
         throw new Error(errorMessage2);
       }
@@ -44360,6 +44360,13 @@ function buildAllowedJudgeHosts() {
   ]);
 }
 var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -44409,11 +44416,23 @@ var AtbashAPIError = class extends Error {
   status;
   /** Raw response body text (may be empty). */
   body;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
-    super(enrich(status, body, statusText, endpoint));
+  /**
+   * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+   * request never reached a response (transport failures carry status 0).
+   *
+   * A status alone does not say what failed. Several routes answer one call, and
+   * more than one of them can 404: a caller reading only `404` cannot tell "this
+   * agent is not registered" from "the chain-routing lookup did not resolve", and
+   * has to guess from the body's prose — which a 404 raised before any handler
+   * ran does not carry. The path is the fact that settles it.
+   */
+  path;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path3) {
+    super(enrich(status, body, statusText, endpoint, path3));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
+    this.path = path3;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -44422,9 +44441,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint) {
+function enrich(status, body, statusText, endpoint, path3) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}: ${body || statusText}`;
+  let msg = `API error ${status}${path3 ? ` from ${path3}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -44455,8 +44474,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path4, query) {
-    const url = new URL(this.baseUrl + path4);
+  buildUrl(path3, query) {
+    const url = new URL(this.baseUrl + path3);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -44466,14 +44485,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path4, query, headers) {
-    return this.fetch(this.buildUrl(path4, query), {
+  async get(path3, query, headers) {
+    return this.fetch(this.buildUrl(path3, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path4, body, headers) {
-    return this.fetch(this.buildUrl(path4), {
+  async post(path3, body, headers) {
+    return this.fetch(this.buildUrl(path3), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -44516,6 +44535,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -44777,17 +44803,23 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
-    try {
-      setupTelemetry({
-        enabled: true,
-        source: "sdk",
-        endpoint: this.endpoint,
-        getAuthHeaders: () => this.authHeaders()
-      });
-    } catch (err) {
-      this.logger.warn?.(
-        "[atbash] telemetry setup failed \u2014 continuing without metrics",
-        { error: String(err) }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
       );
     }
   }
@@ -45607,8 +45639,8 @@ var Atbash = class _Atbash {
   async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      const path4 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path4, body, this.authHeaders(brid));
+      const path3 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path3, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -45668,7 +45700,8 @@ var Atbash = class _Atbash {
       resp.status,
       await safeText(resp),
       resp.statusText,
-      this.endpoint
+      this.endpoint,
+      requestPath(resp.url)
     );
   }
   /**
@@ -45810,6 +45843,14 @@ function parseJson(bytes) {
   const parsed = tryParseJson(bytes.toString("utf-8"));
   return parsed === void 0 ? {} : parsed;
 }
+function requestPath(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).pathname || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -45839,27 +45880,18 @@ function truncate(text, limit = MAX_ACTION_LEN) {
   return text.slice(0, limit) + "\u2026";
 }
 
-// src-ts/key-path.ts
+// src-ts/browser/key-path.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-import { homedir } from "os";
-import { join as join2 } from "path";
-var KEY_DIR_REL = ".config/atbash";
 var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
-function home() {
-  return process.env.HOME || homedir() || "";
-}
-function expandHome(p) {
-  if (!p.startsWith("~/")) return p;
-  return join2(home(), p.slice(2));
-}
+var unavailable = (name2) => {
+  throw new Error(`${name2} is not available in the browser bundle`);
+};
 function keyPathCandidates() {
-  return KEY_FILENAMES.map((name2) => join2(home(), KEY_DIR_REL, name2));
+  return unavailable("keyPathCandidates");
 }
-function chooseKeyPath(input, exists) {
-  if (input) return expandHome(input);
-  const candidates = keyPathCandidates();
-  return candidates.find(exists) ?? candidates[0];
+function chooseKeyPath(_input, _exists) {
+  return unavailable("chooseKeyPath");
 }
 
 // src-ts/redact.ts
@@ -46079,112 +46111,12 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
   throw new Error(`classifyMemoryWrite ${STUB_MSG4}`);
 }
 
-// src-ts/memory/guard.ts
+// src-ts/browser/memory-guard.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-import path3 from "path";
-function emitDebugProbe(event, ctx, memEntry, logger2) {
-  if (!logger2?.info) return;
-  const ev = event ?? {};
-  const c = ctx ?? {};
-  const argsCandidate = ev.params ?? c.params ?? ev.args ?? c.args ?? ev.arguments ?? c.arguments;
-  const argsObj = argsCandidate && typeof argsCandidate === "object" ? argsCandidate : {};
-  const argsKeys = Object.keys(argsObj).slice(0, 20);
-  const pickedPath = typeof argsObj.file_path === "string" && argsObj.file_path || typeof argsObj.path === "string" && argsObj.path || typeof argsObj.filename === "string" && argsObj.filename || null;
-  const editsArr = Array.isArray(argsObj.edits) ? argsObj.edits : null;
-  const firstEditKeys = editsArr && editsArr[0] && typeof editsArr[0] === "object" ? Object.keys(editsArr[0]).slice(0, 10) : null;
-  const tool = ev.toolName ?? c.tool?.name ?? c.toolName ?? c.name ?? "(none)";
-  logger2.info("[atbash][probe] before_tool_call", {
-    toolName: tool,
-    eventKeys: Object.keys(ev).slice(0, 20),
-    ctxKeys: Object.keys(c).slice(0, 20),
-    argsKeys,
-    pickedPath,
-    firstEditKeys,
-    editsCount: editsArr?.length,
-    memoryWrite: !!memEntry,
-    memoryPath: memEntry?.key
-  });
-}
-async function guardMemoryWrite(input) {
-  const {
-    event,
-    ctx,
-    auth,
-    endpoint,
-    verifyPubKey,
-    orgName,
-    threshold,
-    patterns,
-    toolNames,
-    enforce = true,
-    debug: debug2 = false,
-    logger: logger2
-  } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
-  if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
-  if (!memEntry) return { handled: false };
-  let scanResult;
-  try {
-    scanResult = await scanMemory(memEntry, auth, {
-      endpoint,
-      verifyPubKey,
-      orgName,
-      threshold
-    });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory scan failed", {
-      path: memEntry.key,
-      reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason } : { allow: true }
-    };
-  }
-  if (scanResult.verdict === "red") {
-    logger2?.warn?.("[atbash] memory BLOCK", {
-      path: memEntry.key,
-      reason: scanResult.reason
-    });
-    return {
-      handled: true,
-      decision: enforce ? { allow: false, block: true, reason: scanResult.reason } : { allow: true },
-      scanResult,
-      committed: false
-    };
-  }
-  const filePath = path3.basename(memEntry.key);
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    filePath,
-    orgName,
-    endpoint,
-    verifyPubKey
-  }).catch((err) => {
-    const reason = err instanceof Error ? err.message : String(err);
-    logger2?.warn?.("[atbash] memory commit to chain failed", {
-      path: memEntry.key,
-      filePath,
-      reason
-    });
-  });
-  logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
-    {
-      path: memEntry.key,
-      filePath,
-      score: scanResult.score,
-      reason: scanResult.reason
-    }
-  );
-  return {
-    handled: true,
-    decision: { allow: true },
-    scanResult,
-    committed: true
-  };
+var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 guard memory writes agent-side";
+async function guardMemoryWrite(_input) {
+  throw new Error(`guardMemoryWrite ${STUB_MSG5}`);
 }
 
 // src-ts/memory/sync.ts
@@ -46206,7 +46138,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   if (withinTtl) {
     return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
     return { drifted: false, checked: true, pointer: nextPointer };
@@ -46224,7 +46156,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 // src-ts/browser/memory-pointer-store.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable = (name2) => {
+var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var PointerStore = class {
@@ -46238,38 +46170,38 @@ var PointerStore = class {
   }
 };
 function defaultPointerPath(_workspaceDir) {
-  return unavailable("defaultPointerPath");
+  return unavailable2("defaultPointerPath");
 }
 
 // src-ts/browser/memory-file-logger.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable2 = (name2) => {
+var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 function createFileLogger(_logFilePath, _hostLogger) {
-  return unavailable2("createFileLogger");
+  return unavailable3("createFileLogger");
 }
 function defaultPluginLogPath(_workspaceDir) {
-  return unavailable2("defaultPluginLogPath");
+  return unavailable3("defaultPluginLogPath");
 }
 
 // src-ts/browser/memory-read-classifier.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
+var STUB_MSG6 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
   "memory_search",
   "memory_get"
 ];
 function classifyMemoryRead(_event, _ctx, _opts = {}) {
-  throw new Error(`classifyMemoryRead ${STUB_MSG5}`);
+  throw new Error(`classifyMemoryRead ${STUB_MSG6}`);
 }
 
 // src-ts/browser/memory-guard-manager.ts
 init_define_ATBASH_CHROMIA_NODE_URLS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
-var unavailable3 = (name2) => {
+var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
 var MemoryGuardManager = class {
@@ -46289,7 +46221,7 @@ var MemoryGuardManager = class {
   }
 };
 function createMemoryGuardManager(_opts) {
-  return unavailable3("createMemoryGuardManager");
+  return unavailable4("createMemoryGuardManager");
 }
 
 // src-ts/index.ts