@atbash/sdk 0.9.2 → 0.10.0

package/dist/index.d.mts

@@ -1,3 +1,5 @@
+import { Logger } from '@opentelemetry/api-logs';
+
 type JudgeEndpointConfig = {
     policy?: "default";
     endpoint?: string;
@@ -136,14 +138,24 @@ interface MemoryScanOptions {
 type Network = "public" | "private";
 /**
  * Per-call chain overrides. Pass exactly what you need to override —
- * `network` selects between the SDK's known chains, `blockchainRid` /
- * `nodeUrls` pin a fully custom chain. Pass none of these to fall back
- * to the SDK's defaults (or to org-resolved chain when `orgName` is set).
+ * `network` selects between the SDK's known chains, `blockchainRid` pins a
+ * custom one, and `endpoint` names the Dashboard the calls travel over. Pass
+ * none of these to fall back to the SDK's defaults (or to the org-resolved
+ * chain when `orgName` is set).
  */
 interface ChainOpts {
     network?: Network;
     blockchainRid?: string;
+    /**
+     * No longer dialled: memory reaches the chain through the Dashboard. Kept
+     * because callers and the other bindings still carry it as chain config.
+     */
     nodeUrls?: readonly string[];
+    /**
+     * Dashboard base URL. Memory reaches the chain through it, so this is where
+     * those requests go; defaults to the endpoint compiled into the core.
+     */
+    endpoint?: string;
 }
 /** Canonical verdict after normalization. */
 type Verdict = "ALLOW" | "HOLD" | "BLOCK" | "No verdict";
@@ -198,6 +210,11 @@ interface JudgeResult {
      * missing" — never infer the former from a null verdict alone.
      */
     status: string;
+    /**
+     * The judge's explicit refusal in the raw body (`explicitRefusal`): "BLOCK",
+     * "HOLD", or "" when it neither refused nor is a known refusal shape.
+     */
+    refusal?: "" | "BLOCK" | "HOLD";
 }
 interface JudgmentStatus {
     status: JudgmentState;
@@ -305,6 +322,13 @@ interface AtbashLogger {
 /** Options accepted by the `Atbash` constructor. */
 interface AtbashOptions {
     endpoint?: string;
+    /**
+     * Overall deadline for one `auditToolCall` decision, across every request
+     * it makes (org lookup, exists check, judge). Default 60 000 ms. When it
+     * passes the decision is an ERROR (denied unless `failClosed` is false).
+     * `timeoutMs` still bounds each single request.
+     */
+    decisionTimeoutMs?: number;
     timeoutMs?: number;
     /**
      * Full chain override — BRID + nodeUrls in one object. Wins over every
@@ -350,6 +374,16 @@ interface AtbashOptions {
     orgEncryptionPubKey?: string;
     /** When true (default), `auditToolCall` denies on any error. */
     failClosed?: boolean;
+    /**
+     * When true (the default), an answer that carries no enforcement decision
+     * (the audit tier's `{status:"logged"}` with no verdict) is refused:
+     * `auditToolCall` returns `{allow:false, verdict:"ERROR"}` whatever
+     * `failClosed` says, and `judgeAction().allow` / `getJudgmentStatus().allow`
+     * are false. Set it to `false` only to run deliberately in log-only mode
+     * (security review 2026-09-30, H6: an unsigned marker switched enforcement
+     * off).
+     */
+    requireEnforcement?: boolean;
     /**
      * Verbose diagnostics. Off by default. When on, a failed judge call also
      * logs the response body, which is the difference between "judge API failed"
@@ -400,6 +434,10 @@ interface FromConfigOptions {
     /** Default org name — see {@link AtbashOptions.orgName}. */
     orgName?: string;
     failClosed?: boolean;
+    /** See {@link AtbashOptions.requireEnforcement}. Default true. */
+    requireEnforcement?: boolean;
+    /** See {@link AtbashOptions.decisionTimeoutMs}. Default 60 000 ms. */
+    decisionTimeoutMs?: number;
     /** See {@link AtbashOptions.debug}. */
     debug?: boolean;
     logger?: AtbashLogger;
@@ -456,6 +494,10 @@ declare class Atbash {
     readonly orgEncryptionPubKey?: string;
     /** When true (default), `auditToolCall` denies on any error. */
     readonly failClosed: boolean;
+    /** When true (default), an unenforced (audit-tier) answer is refused. */
+    readonly requireEnforcement: boolean;
+    /** Overall deadline for one auditToolCall decision, in ms. */
+    readonly decisionTimeoutMs: number;
     /** Org key learned from the last agent-exists check, for this agent only. */
     private _orgKeyFromChain;
     private readonly debug;
@@ -497,12 +539,6 @@ declare class Atbash {
      */
     private _agentExistsCache;
     private static readonly AGENT_EXISTS_TTL_MS;
-    /**
-     * Cached bearer token for risk-engine / insurance read calls. Built
-     * lazily as a signed `log_tool_call` tx and refreshed every 4 min so
-     * server-side replay protection windows never expire it mid-session.
-     */
-    private _authBearers;
     /** Guards `logEnvironmentOnce` — hosts construct several clients. */
     private static environmentLogged;
     constructor(privkey: string, options?: AtbashOptions);
@@ -525,6 +561,48 @@ declare class Atbash {
      * validated against the trusted allowlist / self-hosted policy; a
      * self-hosted endpoint's `verifyPubKey` becomes the client default.
      */
+    /**
+     * Decide which key this client signs as.
+     *
+     * Most specific wins: a key passed in code, then a key file the host named,
+     * then the environment, then the default key file. `config.json` is absent
+     * from that list on purpose — it is a settings file, writable by anything
+     * that can write the user's home and read by every Atbash integration on the
+     * machine, so letting it name the key meant one stray value silently
+     * re-pointed who each of them signed as.
+     *
+     * A named `keyPath` that does not exist throws rather than falling through.
+     * The caller said which file holds its identity; quietly signing as a
+     * different one is the outcome worth refusing.
+     *
+     * @param options - The `fromConfig` options, read for `agentKey` and `keyPath`.
+     * @returns The resolved agent identity.
+     * @throws When a named key file is missing, or no identity can be found.
+     */
+    private static resolveIdentity;
+    /**
+     * Add the one thing a machine with no key file needs to hear.
+     *
+     * This is the only path where the operator cannot see what happened: no key
+     * file, and the key they are looking for sits in `config.json`, which no
+     * longer selects the identity. A bare "key file not found" sends them hunting
+     * for a key they already have. Only this branch gets the hint — a caller who
+     * named a `keyPath` is told about that path, where a stranded key is noise.
+     *
+     * @param err - The "key file not found" error from the default lookup.
+     * @returns The same error, or one that also names the key in config.json.
+     */
+    private static explainStrandedKey;
+    /**
+     * Say so when `config.json` still holds an agent key.
+     *
+     * Nothing signs with it any more, and silence would leave an operator
+     * believing one identity is in force while another is. The pubkey is named,
+     * not the key, so the line is safe in a log.
+     *
+     * @param logger - The host logger, when one was supplied.
+     */
+    private static warnOnStrandedKey;
     static fromConfig(options?: FromConfigOptions): Atbash;
     get pubkey(): string;
     get privkey(): string;
@@ -559,6 +637,23 @@ declare class Atbash {
      * explicitly false.
      */
     auditToolCall(input: ToolCallInput): Promise<Decision>;
+    /**
+     * The verify key for one call (R4, governor tier-2 review). A per-call key
+     * may only narrow what the client accepts: on a client pinned to a judge
+     * key it must be that same key, never a replacement; on an unpinned client
+     * it adds the check.
+     */
+    private effectiveVerifyKey;
+    /**
+     * Collapse a judge result into a {@link Decision}. The most restrictive
+     * signal wins (security review 2026-09-30, H1): `action_type`, `verdict`
+     * and the canonical `allow` are each able to deny, and only a result where
+     * all three agree may execute. A present `allow` / `decision.allow` that is
+     * not exactly `true` is the judge declining to grant permission, so it
+     * denies even under `failClosed: false` — that option relaxes *errors*, it
+     * never overrides a refusal.
+     */
+    private decide;
     /**
      * One exit for every judge failure.
      *
@@ -568,6 +663,12 @@ declare class Atbash {
      * The response body follows only under `debug`, since it can echo the action.
      */
     private failJudge;
+    /**
+     * The canonical permission for a response body under this client's
+     * settings: {@link canonicalAllow}, minus the audit tier when
+     * `requireEnforcement` is on. Never more permissive than `auditToolCall`.
+     */
+    private executable;
     private fail;
     /**
      * Return the current status of a previously submitted judgment.
@@ -886,22 +987,6 @@ declare const BOOT_SYNC_HINT = "check the chain endpoint and orgName if the caus
  */
 declare function bootSyncFailureLine(cause: unknown): string;
 
-/**
- * Make a chain query result crossable at the NAPI boundary.
- *
- * `postchain-client` decodes a Rell `byte_array` into a Node `Buffer`. The
- * core's `parse*` functions take `serde_json::Value`, and NAPI-RS cannot
- * convert a `Buffer` into one — it reaches the methods every `Uint8Array`
- * inherits and fails with "JS functions cannot be represented as a
- * serde_json::Value", which names functions for what is a plain Buffer.
- *
- * The conversion has to happen here because the failure is in the argument
- * conversion, before any core code runs. Of the shapes the core accepts —
- * hex string, `[u8]`, `{ data: [...] }` — hex is the cheapest to produce.
- */
-/** Recursively rewrite byte containers to hex, leaving everything else as-is. */
-declare function gtvToFfiSafe(value: unknown): unknown;
-
 /** Derive the 32-byte AES key from an agent's secp256k1 privkey (hex). Deterministic — same privkey always yields the same key. */
 declare function deriveMemoryKey(privkey: string): Promise<Buffer>;
 /** Encrypt UTF-8 plaintext. `ciphertext` has the 16-byte GCM auth tag appended, matching the SDK's on-chain byte layout. */
@@ -940,7 +1025,7 @@ interface CommitMemoryOptions {
     filePath?: string;
     /** Org name — when set, the SDK resolves which chain the agent lives on. */
     orgName?: string;
-    /** Atbash service endpoint for org→chain lookup. */
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
     /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
     verifyPubKey?: string;
@@ -948,6 +1033,7 @@ interface CommitMemoryOptions {
 }
 interface RollbackMemoryOptions {
     orgName?: string;
+    /** Atbash service endpoint — where memory reaches the chain, and the org→chain lookup. */
     endpoint?: string;
     /** Self-hosted judge response-signing pubkey; required with a non-allowlisted `endpoint`. */
     verifyPubKey?: string;
@@ -1121,6 +1207,17 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     debug?: boolean;
     /** Optional logger for debug probe + persist-failure warnings. */
     logger?: GuardLogger;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
+    /**
+     * Root the caller keeps memory under, when it is not an agent home.
+     *
+     * Only pass a value the host stated outright. A root defaulted from the
+     * process working directory would make whichever directory the host happened
+     * to start in look like a memory store — which is how a stray MEMORY.md once
+     * ended up inside a plugin checkout.
+     */
+    memoryRoot?: string;
 }
 /** Plugin-facing decision. Shape mirrors what plugins return from `before_tool_call`. */
 interface GuardMemoryDecision {
@@ -1139,19 +1236,17 @@ interface GuardMemoryWriteResult {
     committed?: boolean;
 }
 /**
- * Guarded memory-write flow. Returns `{ handled: false }` when the tool
- * call isn't a memory write, otherwise returns a `decision` the plugin
- * should return from its hook.
+ * Guard a memory write, and record what was decided.
+ *
+ * Wraps the decision rather than threading telemetry through its eight exits,
+ * so a later return added inside cannot quietly stop being counted.
  *
- * Verdict handling:
- * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with its LLM score; decision allows once the chain confirms
- * - `green`  → persisted with its LLM score; decision allows once the chain confirms
- * - anything else → not persisted; decision blocks (unless `enforce: false`)
+ * Only a call this guard actually handled is recorded. A tool call that was
+ * never a memory write is not a memory operation, and counting it would put
+ * every unrelated edit into the number a memory migration reads.
  *
- * A write is acknowledged only after the chain transaction confirms, for
- * yellow exactly as for green. An unconfirmed write blocks in enforce mode
- * and remains unaudited in observe mode.
+ * @param input - The tool call and the agent to judge it for.
+ * @returns What the guard decided; unchanged by the recording.
  */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
@@ -1216,10 +1311,19 @@ declare class PointerStore {
     private cache;
     private loading;
     constructor(filePath: string);
-    /** Resolves the pointer for `agentPubkeyHex`, or a zero-pointer that will force a sync on first use. */
-    get(agentPubkeyHex: string): Promise<MemoryPointer>;
-    /** Persists an updated pointer. Failures are swallowed to a logger callback (if provided) so sync never blocks the caller. */
-    set(agentPubkeyHex: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
+    /**
+     * The pointer for one agent's file, or a zero-pointer forcing a sync.
+     *
+     * @param filePath - The file's chain slot, i.e. its basename.
+     */
+    get(agentPubkeyHex: string, filePath: string): Promise<MemoryPointer>;
+    /**
+     * Persist one file's pointer, leaving the agent's other files alone.
+     *
+     * Write failures are reported to `onError` rather than thrown: a cache that
+     * cannot be written must not take down the read it was speeding up.
+     */
+    set(agentPubkeyHex: string, filePath: string, pointer: MemoryPointer, onError?: (err: Error) => void): Promise<void>;
     private ensureLoaded;
     private loadOnce;
     private persist;
@@ -1314,6 +1418,17 @@ interface MemoryGuardManagerOptions {
     workspaceDir: string;
     /** Absolute MEMORY.md path. Default `<workspaceDir>/MEMORY.md`. */
     memoryFilePath?: string;
+    /**
+     * Root this host keeps memory under, when it is not an agent home.
+     *
+     * Only set this from a value the host stated outright — never from
+     * `process.cwd()`. A guessed root makes whichever directory the host started
+     * in look like a memory store, which is how a stray MEMORY.md once ended up
+     * inside a plugin checkout.
+     */
+    memoryRoot?: string;
+    /** Agent home directory names to accept beyond the built-in list. */
+    agentHomeDirs?: string[];
     /** Persistent pointer file. Default `<workspaceDir>/.atbash/memory-pointer.json`. */
     pointerFilePath?: string;
     /** File-backed log. Default `<workspaceDir>/.atbash/plugin.log`. */
@@ -1360,6 +1475,10 @@ declare class MemoryGuardManager {
     private readonly pointerStore;
     private readonly logger;
     private readonly memoryFilePath;
+    /** Base for resolving the relative paths a host sends. */
+    private readonly workspaceDir;
+    /** Set by `verifyOneFile` when the file it checked was actually on chain. */
+    private lastVerified;
     private readonly ttlMs;
     private readonly rollbackMinScore;
     private readonly enforce;
@@ -1377,6 +1496,14 @@ declare class MemoryGuardManager {
     private _resolvedChainOpts;
     private _resolveChainInflight?;
     constructor(opts: MemoryGuardManagerOptions);
+    /**
+     * Carry this manager's host into `chainOpts`.
+     *
+     * Memory reads reach the chain through that host, and they are handed only
+     * `chainOpts` — without this a self-hosted deployment would read from the
+     * compiled-in default host while writing to its own.
+     */
+    private withEndpoint;
     /**
      * Resolve `orgName` → chain once, cache forever. `commitMemoryVersion`
      * already does this for writes; without the same call on the read
@@ -1394,15 +1521,27 @@ declare class MemoryGuardManager {
      */
     runBootProbe(): Promise<void>;
     /**
-     * Returns a `HookDecision` when the guard reached a decision about this event.
-     * Returns `null` for non-memory events, other files this manager does not
-     * own, or unverified observe-mode reads. An enforced read of the managed
-     * file blocks when verification cannot complete.
+     * Bring one chain file into step with its local counterpart.
      *
-     * A returned decision carries `audited` (see `HookDecision`). Only
-     * `{ allow: true, audited: true }` means "checked and cleared"; anything else
-     * that allows is a call the host still needs to judge.
+     * Only a file that already exists locally is touched. Restoring one that is
+     * absent would mean choosing where to create it, and the root is a guess the
+     * moment more than one could apply — the same guess that once wrote a
+     * MEMORY.md into a plugin checkout.
+     *
+     * @returns What happened, for the single summary line the caller logs.
      */
+    private syncOneAtBoot;
+    /**
+     * Where a chain slot's file lives locally, or null when we do not have it.
+     *
+     * A stated root is tried first, then each agent home that actually exists in
+     * the user's home directory — the same rule that produced the slot, run
+     * backwards. Only an existing file is returned: creating one would mean
+     * picking a root, and picking is guessing.
+     */
+    private locate;
+    /** Roots a chain slot may be joined to, most specific first. */
+    private memoryRoots;
     handleBeforeToolCall(event: unknown, ctx: unknown): Promise<HookDecision | null>;
     private mapGuardResult;
     /**
@@ -1420,12 +1559,70 @@ declare class MemoryGuardManager {
      * also covers events carrying two different path keys, where the classifier
      * and the host could otherwise disagree about which one is authoritative.
      */
-    private vouchesForTarget;
+    /**
+     * The memory files this tool call reads, as absolute paths.
+     *
+     * Relative paths resolve against the workspace, not `process.cwd()`. The host
+     * sends paths relative to the agent's workspace; resolving them against the
+     * process's own directory made the guard protect whichever directory the host
+     * happened to start in, which on one machine was a plugin checkout.
+     *
+     * @returns Every named target, de-duplicated; empty when the call names none.
+     */
+    private readTargets;
+    /**
+     * Say what the read classifier saw and what it concluded.
+     *
+     * The write path has `emitDebugProbe`; this is its counterpart, so a tool
+     * call can be followed across the fork instead of only after it. `false` here
+     * is the normal answer for a write — it means the call goes to the write
+     * classifier next, not that it was ignored.
+     *
+     * @param isMemoryRead - What `classifyMemoryRead` returned.
+     */
+    private emitReadProbe;
+    /**
+     * The chain slot for a path, or null when the file gets no chain record.
+     *
+     * One helper so the boot probe and every read agree: taking a basename in one
+     * place and a relative path in the other would verify a file against a record
+     * that is not its own.
+     */
+    private slotFor;
+    /**
+     * Verify every memory file this call reads, each against its own chain slot.
+     *
+     * A call naming several files is only cleared when all of them are, so one
+     * unverifiable file cannot ride along with a verified one.
+     *
+     * @returns A block for the first file that fails, an audited allow when all
+     *   were verified, or null when none of them is on chain.
+     */
     private handleMemoryRead;
+    /**
+     * Check one memory file against the chain slot of the same name.
+     *
+     * A file with no chain version is passed through rather than blocked: there
+     * is no claim to protect, so refusing would only stop an agent reading memory
+     * it has never committed. A file that IS on chain must match, or the read is
+     * refused — that is the whole guarantee.
+     *
+     * @returns A decision when the read must not proceed, else null.
+     */
+    private verifyOneFile;
     /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
     flushLogs(): Promise<void>;
+    /**
+     * A read this guard could not verify.
+     *
+     * Enforcing, that is a block. Observing, the host audits it as usual — but
+     * the reason is said out loud either way, or an unverified read looks
+     * identical to a clean one in the log.
+     */
     private unverifiedRead;
     private writeMemoryAtomic;
+    /** Replace `target` in one step, so a reader never sees a half-written file. */
+    private writeFileAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;
 
@@ -1459,6 +1656,20 @@ interface TelemetryConfig {
      * `{ Authorization: "Bearer <hex>" }`). Required to actually export.
      */
     getAuthHeaders?: () => Record<string, string>;
+    /**
+     * Hashes the agent key before it is emitted on a wide event.
+     *
+     * Defaults to an unsalted SHA-256, which is de-identification rather than
+     * anonymisation: agent pubkeys are public on chain and can be enumerated, so
+     * the mapping is recoverable by anyone holding that list. Supply a salted
+     * hasher to make it uncorrelatable, at the cost of joining across
+     * deployments.
+     *
+     * Injected rather than imported so the telemetry modules need nothing from
+     * the native addon. Left unset, the agent field is dropped from events
+     * rather than falling back to the raw key.
+     */
+    hashAgentKey?: (pubkeyHex: string) => string;
 }
 declare function setupTelemetry(config: TelemetryConfig): void;
 /**
@@ -1481,6 +1692,111 @@ declare function flushTelemetry(): Promise<void>;
  */
 declare function shutdownTelemetry(): Promise<void>;
 
+/**
+ * Wide events: one row per SDK operation, alongside the counters.
+ *
+ * The counters in `telemetry.ts` are aggregated inside this process before
+ * export, so Honeycomb never receives a per-operation row. That is fine for
+ * "is it up" and useless for everything else: a question nobody attached an
+ * attribute for in advance cannot be answered later, because the data to
+ * answer it never existed. "Which org sees the most failures", "what preceded
+ * a fail-closed", "is the new release slower" are all that shape.
+ *
+ * So each operation also emits one event carrying its whole context. The
+ * counters stay — they are the right tool for health boards and alerts, and
+ * they are not sampled.
+ *
+ * TWO RULES SHAPE THIS MODULE.
+ *
+ * The payload is METADATA ONLY, and the allowlist below is the whole of it:
+ * function name, outcome, latency, error class, error status and path, SDK
+ * version, chain, and a hash of the agent key. Action text, tool arguments, policy text, organisation
+ * names and keys never appear — not as a field that is emptied, but as a field
+ * that does not exist, so there is nothing to forget to strip.
+ *
+ * The agent key is hashed, never sent raw, and the hasher is INJECTED rather
+ * than imported: this module needs nothing from the native addon. With no
+ * hasher supplied the field is DROPPED rather than falling back to the raw
+ * key, so the guarantee does not depend on wiring somebody could forget.
+ *
+ * NOTE on what hashing does and does not buy. Agent pubkeys are public on
+ * chain and can be enumerated, so an UNSALTED hash is reversible by anyone who
+ * can read the chain: it is de-identification, not anonymisation. A salted
+ * hasher makes it uncorrelatable and costs cross-deployment joins. Which one
+ * is wanted is the caller's decision; this module only guarantees the raw key
+ * never leaves.
+ *
+ * And the richer payload has its own switch. Counters carry a function name
+ * and a source. These events carry agent and org identity off a customer's
+ * machine, which is a different proposition for a security product, so
+ * `ATBASH_TELEMETRY_EVENTS_DISABLED=1` turns them off while leaving the health
+ * counters on. Both remain subject to the existing global opt-out.
+ */
+
+/** Attributes an event may carry. Anything not listed here cannot be emitted. */
+interface OperationEvent {
+    /** SDK function, matching the counter's `function.name` so the two join. */
+    functionName: string;
+    durationMs: number;
+    status: "success" | "error";
+    /**
+     * Hex pubkey of the agent the call was made as. Hashed before it is emitted,
+     * and omitted entirely when no hasher is configured.
+     */
+    agentPubkey?: string;
+    /**
+     * Blockchain RID of the chain this call concerned.
+     *
+     * The RID rather than a network label: it is public infrastructure, it is
+     * unambiguous, and it identifies the deployment without naming a customer.
+     */
+    chain?: string;
+    /** Constructor name of the thrown error, e.g. `AtbashAPIError`. */
+    errorClass?: string;
+    /** HTTP status, or 0 when the request never completed. */
+    errorStatus?: number;
+    /**
+     * Request path the status came from, e.g. `/api/v1/judge`.
+     *
+     * The class alone does not say what failed: several routes answer one call
+     * and more than one can 404, so `AtbashAPIError` cannot distinguish "this
+     * agent is not registered" from "the chain-routing lookup did not resolve".
+     * The path settles it.
+     *
+     * Carries no query string — `requestPath` strips it at the point the error
+     * is built, because a query string carries org names, tool call ids and the
+     * agent pubkey. Structured and already sanitised, so this stays inside the
+     * metadata rule where an error message would not.
+     */
+    errorPath?: string;
+    /**
+     * Short categorical result, when "success" is too coarse — e.g. a memory
+     * write that scanned clean but never reached the chain.
+     *
+     * Categorical by contract: a value a caller chooses from a fixed vocabulary,
+     * never free text and never anything derived from user content.
+     */
+    outcome?: string;
+}
+/** Hashes an agent key for emission. Supplied by `setupTelemetry`. */
+type AgentKeyHasher = (pubkeyHex: string) => string;
+declare function configureEvents(next: Logger | null, opts?: {
+    version?: string;
+    source?: string;
+    hashAgentKey?: AgentKeyHasher;
+}): void;
+/** True when an event would actually be emitted. Exported for tests and callers that build context lazily. */
+declare function eventsAreOn(): boolean;
+/**
+ * Emit one wide event for a completed operation.
+ *
+ * Never throws and never blocks: telemetry failing must not change what the
+ * caller observes. Does nothing when events are off.
+ *
+ * @param e - The completed operation.
+ */
+declare function recordEvent(e: OperationEvent): void;
+
 /**
  * Rust core does the work; `browser/encrypted-toolcall.ts` mirrors it for the
  * browser and must produce the same columns.
@@ -1578,4 +1894,4 @@ declare function containsSecret(text: string): boolean;
 declare function createMemorySnapshot(entries: MemoryEntry[], takenAt: number): MemorySnapshot;
 declare function diffMemorySnapshots(before: MemorySnapshot, after: MemorySnapshot): MemoryDiffResult;
 
-export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, gtvToFfiSafe, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };
+export { type ActionType, type AgentAuth, type AgentLookupOptions, type AgentMemoryEntry, type AgentPolicy, type AnomalySeverity, type AnomalyType, Atbash, AtbashAPIError, type AtbashLogger, type AtbashOptions, type AtbashUserConfig, BOOT_SYNC_HINT, type ChainConfig, type ChainOpts, type ClassifierToolContext, type ClassifierToolEvent, type ClassifyMemoryReadOptions, type ClassifyMemoryWriteOptions, type ClientSource, type CommitMemoryOptions, DEFAULT_BLOCKCHAIN_RID, DEFAULT_CHROMIA_NODE_URLS, DEFAULT_ENDPOINT, DEFAULT_MEMORY_PATH_PATTERNS, DEFAULT_MEMORY_READ_TOOL_NAMES, DEFAULT_MEMORY_WRITE_TOOL_NAMES, type Decision, type DecisionVerdict, EciesDomain, type EncryptedMemory, type Envelope, type FromConfigOptions, type GuardLogger, type GuardMemoryDecision, type GuardMemoryWriteInput, type GuardMemoryWriteResult, type HeldAction, type HeldActionReview, type HookDecision, HttpClient, HttpTransportError, type JudgeEndpointConfig, type JudgeOptions, type JudgeResult, type JudgmentState, type JudgmentStatus, KEY_FILENAMES, type KeyPair, type LogToolCallOptions, type LogToolCallResult, type MemoryAnomaly, type MemoryDiffResult, type MemoryEntry, MemoryGuardManager, type MemoryGuardManagerOptions, MemoryIntegrityError, type MemoryPointer, type MemoryRollbackEvent, type MemoryScanOptions, type MemoryScanResult, type MemoryScanVerdict, type MemorySnapshot, type ModifiedEntry, type Network, type OperationEvent, type OrgSubscription, PRIVATE_CHAIN, PUBLIC_CHAIN, PointerStore, type Provider, type PubkeyValue, type RedactResult, type RollbackMemoryOptions, type SecretKind, type SecretMatch, SignatureVerificationError, type Subscription, type SyncMemoryOptions, type SyncMemoryResult, type TelemetryConfig, type TierInfo, type ToolCallFull, type ToolCallInput, type ToolCallRecord, type ValidatedEndpoint, type Verdict, type WrappedLogger, bootSyncFailureLine, buildAllowedJudgeHosts, canonicalAllow, chainForNetwork, chooseKeyPath, claimHashHex, classifyMemoryRead, classifyMemoryWrite, columnAad, commitMemoryVersion, configureEvents, containsEvasionCharacters, containsSecret, createFileLogger, createMemoryGuardManager, createMemorySnapshot, decryptForOrg, decryptMemoryContent, defaultPluginLogPath, defaultPointerPath, deriveMemoryKey, derivePublicKey, diffMemorySnapshots, encryptForOrg, encryptMemoryContent, encryptedLength, eventsAreOn, flushTelemetry, generateKeypair, getActiveAgentMemory, getActiveMemoryId, getConfigDir, getConfigPath, getMemoryById, getMemoryHistory, getRecentAgentMemory, getRollbackHistory, guardMemoryWrite, isEnvelope, isValidPrivateKey, keyFingerprintOf, keyPathCandidates, loadAgent, loadAgentFromFile, loadUserConfig, normalizeActionForHash, normalizeActionType, normalizeForMatching, normalizeStatus, normalizeVerdict, packEnvelope, parseEnvelope, pubkeyToHex, recordCall, recordDuration, recordEvent, redactJsonStrings, redactSecrets, resolve, resolveKeyPath, rollbackMemory, saveUserConfig, scanMemory, scanMemoryBatch, setupTelemetry, shutdownTelemetry, signEncryptedToolCall, signJudgeAction, signLogToolCall, syncLocalMemory, validateJudgeEndpoint, verifyJudgeResponseSignature, verifySignature };