@belticlabs/agent-risk-sdk 0.1.0

package/dist/ai/index.d.ts

@@ -0,0 +1,19 @@
+import { PaymentMomentPayload } from './api.js';
+import { LanguageModelMiddleware, Tool, ToolSet } from 'ai';
+import { S as Session } from '../session-BMNB1N1g.js';
+import './base58.js';
+
+interface PaymentMoments {
+    requested?: PaymentMomentPayload;
+    presented?: PaymentMomentPayload;
+}
+interface WrapToolOptions<I = unknown, O = unknown> {
+    name?: string;
+    /** When the tool performs a purchase, map its input/output to the payment moments it produced. */
+    payment?: (input: I, output: O) => PaymentMoments | null;
+}
+declare function middleware(session: Session): LanguageModelMiddleware;
+declare function wrapTool<T extends Tool>(session: Session, tool: T, opts?: WrapToolOptions): T;
+declare function wrapTools<T extends ToolSet>(session: Session, tools: T, opts?: Record<string, WrapToolOptions>): T;
+
+export { type PaymentMoments, type WrapToolOptions, middleware, wrapTool, wrapTools };

package/dist/ai/index.js

@@ -0,0 +1,120 @@
+import {
+  recordCall
+} from "../chunk-5TWO73OD.js";
+import {
+  uuidv7
+} from "../chunk-SFGM7KOG.js";
+import {
+  toJson,
+  toJsonObject
+} from "../chunk-FQDHFTVR.js";
+import "../chunk-GCKCAKHA.js";
+
+// src/ai/index.ts
+var PARAM_KEYS = [
+  "prompt",
+  "tools",
+  "toolChoice",
+  "maxOutputTokens",
+  "temperature",
+  "topP",
+  "topK",
+  "seed",
+  "responseFormat",
+  "stopSequences"
+];
+function middleware(session) {
+  return {
+    wrapGenerate: ({ doGenerate, params, model }) => recordCall(
+      session,
+      "llm_call",
+      uuidv7(),
+      { provider: model.provider, modelId: model.modelId, params: pick(params) },
+      doGenerate,
+      (result) => ({
+        content: toJson(result.content),
+        finishReason: result.finishReason.unified,
+        usage: toJsonObject(result.usage)
+      })
+    ),
+    // A stream ends when it drains, not when doStream resolves — so its end is emitted at flush.
+    wrapStream: async ({ doStream, params, model }) => {
+      const callId = uuidv7();
+      const started = Date.now();
+      await session.emit("llm_call.start", {
+        callId,
+        provider: model.provider,
+        modelId: model.modelId,
+        params: pick(params)
+      });
+      const { stream, ...rest } = await doStream();
+      const parts = [];
+      let finish = {};
+      const tap = new TransformStream({
+        transform(part, controller) {
+          const p = part;
+          if (p.type === "finish")
+            finish = { finishReason: p.finishReason?.unified, usage: p.usage };
+          else if (p.type !== "stream-start" && p.type !== "raw") parts.push(part);
+          controller.enqueue(part);
+        },
+        flush: async () => {
+          await session.emit("llm_call.end", {
+            callId,
+            content: toJson(parts),
+            ...finish.finishReason ? { finishReason: finish.finishReason } : {},
+            ...finish.usage ? { usage: toJsonObject(finish.usage) } : {},
+            durationMs: Date.now() - started
+          });
+        }
+      });
+      return { stream: stream.pipeThrough(tap), ...rest };
+    }
+  };
+}
+function wrapTool(session, tool, opts = {}) {
+  if (!tool.execute) return tool;
+  const original = tool.execute;
+  const toolName = opts.name ?? tool.name ?? "tool";
+  const execute = (input, options) => recordCall(
+    session,
+    "tool_call",
+    options?.toolCallId ?? uuidv7(),
+    { toolName, input: toJson(input), transport: "local" },
+    async () => {
+      const output = await original(input, options);
+      return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;
+    },
+    async (output) => {
+      const moments = opts.payment?.(input, output) ?? null;
+      if (moments?.requested) await session.emit("payment.requested", moments.requested);
+      if (moments?.presented) await session.emit("payment.presented", moments.presented);
+      return { output: toJson(output) };
+    }
+  );
+  return { ...tool, execute };
+}
+function wrapTools(session, tools, opts = {}) {
+  const out = {};
+  for (const [name, tool] of Object.entries(tools))
+    out[name] = wrapTool(session, tool, { name, ...opts[name] });
+  return out;
+}
+function pick(params) {
+  const out = {};
+  for (const k of PARAM_KEYS) {
+    const v = params[k];
+    if (v !== void 0) out[k] = toJson(v);
+  }
+  return out;
+}
+async function collect(it) {
+  const out = [];
+  for await (const x of it) out.push(x);
+  return out;
+}
+export {
+  middleware,
+  wrapTool,
+  wrapTools
+};

package/dist/chunk-5TWO73OD.js

@@ -0,0 +1,35 @@
+// src/core/record.ts
+function errorOf(err) {
+  const e = err;
+  return { name: String(e?.name ?? "Error"), message: String(e?.message ?? err) };
+}
+async function recordCall(session, kind, callId, start, run, end = () => ({})) {
+  const started = Date.now();
+  await session.emit(`${kind}.start`, { callId, ...start });
+  try {
+    const result = await run();
+    await session.emit(
+      `${kind}.end`,
+      {
+        callId,
+        ...await end(result),
+        durationMs: Date.now() - started
+      }
+    );
+    return result;
+  } catch (err) {
+    await session.emit(
+      `${kind}.end`,
+      {
+        callId,
+        error: errorOf(err),
+        durationMs: Date.now() - started
+      }
+    );
+    throw err;
+  }
+}
+
+export {
+  recordCall
+};

package/dist/chunk-7G5EHNVW.js

@@ -0,0 +1,17 @@
+// src/core/payment-moment.ts
+function summaryOf(m) {
+  return {
+    protocol: m.protocol,
+    payee: m.payee,
+    amount: { value: m.amount.value, currency: m.amount.currency },
+    ...m.payer ? { payer: m.payer } : {}
+  };
+}
+function presentedFrom(summary, raw) {
+  return { ...summary, artifact: "payment-signature", raw };
+}
+
+export {
+  summaryOf,
+  presentedFrom
+};

package/dist/chunk-FQDHFTVR.js

@@ -0,0 +1,29 @@
+// src/core/json.ts
+function toJson(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") return Number.isFinite(value) ? value : null;
+  if (typeof value === "bigint") return value.toString();
+  if (value instanceof Uint8Array) return { $bytes: Buffer.from(value).toString("base64") };
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof URL) return value.toString();
+  if (Array.isArray(value)) return value.map(toJson);
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v === void 0 || typeof v === "function") continue;
+      out[k] = toJson(v);
+    }
+    return out;
+  }
+  return null;
+}
+function toJsonObject(value) {
+  const j = toJson(value);
+  return j && typeof j === "object" && !Array.isArray(j) ? j : { value: j };
+}
+
+export {
+  toJson,
+  toJsonObject
+};

package/dist/chunk-GCKCAKHA.js

@@ -0,0 +1,401 @@
+// ../protocol/src/verdict.ts
+var SEVERITY = { ALLOW: 0, REVIEW: 1, DENY: 2 };
+var Verdict = class _Verdict {
+  constructor(value) {
+    this.value = value;
+  }
+  static ALLOW = new _Verdict("ALLOW");
+  static REVIEW = new _Verdict("REVIEW");
+  static DENY = new _Verdict("DENY");
+  static of(value) {
+    return value === "DENY" ? _Verdict.DENY : value === "REVIEW" ? _Verdict.REVIEW : _Verdict.ALLOW;
+  }
+  /** The more severe of the two. */
+  atLeast(other) {
+    const o = typeof other === "string" ? _Verdict.of(other) : other;
+    return SEVERITY[o.value] > SEVERITY[this.value] ? o : this;
+  }
+  /** Whether a synchronous gate must stop the call (GAP-52). */
+  blocks(onReview) {
+    return this.value === "DENY" || this.value === "REVIEW" && onReview === "abort";
+  }
+  /** What the gate effectively did: DENY when it blocked, else the verdict itself. */
+  effective(onReview) {
+    return this.blocks(onReview) ? "DENY" : this.value;
+  }
+};
+
+// ../protocol/src/api.ts
+import { z as z4 } from "zod";
+
+// ../protocol/src/evidence.ts
+import { z } from "zod";
+var WIRE_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK"];
+var ALL_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK", "PLATFORM"];
+var EvidenceSourceSchema = z.enum(WIRE_SOURCES);
+var EvidenceSourceAllSchema = z.enum(ALL_SOURCES);
+var WIRE_KINDS = [
+  "session.open",
+  "session.close",
+  "intent.declared",
+  "llm_call.start",
+  "llm_call.end",
+  "tool_call.start",
+  "tool_call.end",
+  "payment.requested",
+  "payment.presented",
+  "gateway.decision",
+  "transport.gap"
+];
+var PLATFORM_KINDS = ["platform.observation", "platform.anomaly"];
+var WireEvidenceKindSchema = z.enum(WIRE_KINDS);
+var PlatformEvidenceKindSchema = z.enum(PLATFORM_KINDS);
+var EvidenceKindSchema = z.enum([...WIRE_KINDS, ...PLATFORM_KINDS]);
+var Hex64Schema = z.string().regex(/^[0-9a-f]{64}$/, "expected 64 lowercase hex chars");
+var SigSchema = z.string().regex(/^ed25519:[A-Za-z0-9_-]{86}$/, "expected ed25519:<base64url>");
+var SessionIdSchema = z.uuid();
+var SeqSchema = z.number().int().min(0);
+var TimestampSchema = z.iso.datetime({ offset: false });
+var JsonValueSchema = z.lazy(
+  () => z.union([
+    z.null(),
+    z.boolean(),
+    z.number().finite(),
+    z.string(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema)
+  ])
+);
+var EvidenceEventSchema = z.strictObject({
+  sessionId: SessionIdSchema,
+  source: EvidenceSourceSchema,
+  seq: SeqSchema,
+  ts: TimestampSchema,
+  kind: WireEvidenceKindSchema,
+  payload: z.record(z.string(), JsonValueSchema),
+  prevHash: Hex64Schema,
+  sig: SigSchema.optional()
+});
+
+// ../protocol/src/policy.ts
+import { z as z3 } from "zod";
+
+// ../protocol/src/reason-codes.ts
+var REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/;
+
+// ../protocol/src/selector.ts
+import { z as z2 } from "zod";
+var SelectorSyntaxError = class extends Error {
+  constructor(input, at, detail) {
+    super(`invalid selector "${input}" at ${at}: ${detail}`);
+    this.input = input;
+    this.at = at;
+    this.name = "SelectorSyntaxError";
+  }
+  code = "SELECTOR_SYNTAX";
+};
+var IDENT = /^[A-Za-z_][A-Za-z0-9_-]*/;
+var NAME = /^[A-Za-z_][A-Za-z0-9_.-]*/;
+function parsePath(input, from) {
+  const path = [];
+  let i = from;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === ".") {
+      const m = IDENT.exec(input.slice(i + 1));
+      if (!m) throw new SelectorSyntaxError(input, i + 1, 'expected identifier after "."');
+      path.push({ key: m[0] });
+      i += 1 + m[0].length;
+    } else if (ch === "[") {
+      const close = input.indexOf("]", i);
+      if (close < 0) throw new SelectorSyntaxError(input, i, 'unterminated "["');
+      const body = input.slice(i + 1, close);
+      if (!/^\d+$/.test(body))
+        throw new SelectorSyntaxError(input, i + 1, "expected integer index");
+      path.push({ index: Number(body) });
+      i = close + 1;
+    } else {
+      throw new SelectorSyntaxError(input, i, `unexpected "${ch}"`);
+    }
+  }
+  return { path, end: i };
+}
+function parseSelector(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new SelectorSyntaxError(String(input), 0, "empty selector");
+  }
+  if (input.length > 512)
+    throw new SelectorSyntaxError(input.slice(0, 32), 512, "selector too long");
+  for (const root of ["payment", "intent", "session"]) {
+    if (input === root || input.startsWith(`${root}.`) || input.startsWith(`${root}[`)) {
+      return { root, path: parsePath(input, root.length).path };
+    }
+  }
+  if (input.startsWith("signal[name=")) {
+    const rest = input.slice("signal[name=".length);
+    const m = NAME.exec(rest);
+    if (!m) throw new SelectorSyntaxError(input, "signal[name=".length, "expected signal name");
+    const after = "signal[name=".length + m[0].length;
+    if (input[after] !== "]") throw new SelectorSyntaxError(input, after, 'expected "]"');
+    return { root: "signal", name: m[0], path: parsePath(input, after + 1).path };
+  }
+  if (input === "evidence[*]" || input.startsWith("evidence[*]")) {
+    return {
+      root: "evidence",
+      kind: "*",
+      all: true,
+      path: parsePath(input, "evidence[*]".length).path
+    };
+  }
+  if (input.startsWith("evidence[kind=")) {
+    let i = "evidence[kind=".length;
+    const km = NAME.exec(input.slice(i));
+    if (!km) throw new SelectorSyntaxError(input, i, "expected evidence kind");
+    const kind = km[0];
+    i += kind.length;
+    let source;
+    if (input.startsWith(",source=", i)) {
+      i += ",source=".length;
+      const sm = /^[A-Z_]+/.exec(input.slice(i));
+      if (!sm || !ALL_SOURCES.includes(sm[0])) {
+        throw new SelectorSyntaxError(input, i, `expected one of ${ALL_SOURCES.join("|")}`);
+      }
+      source = sm[0];
+      i += sm[0].length;
+    }
+    if (input[i] !== "]") throw new SelectorSyntaxError(input, i, 'expected "]"');
+    i += 1;
+    let all = false;
+    if (input.startsWith("[*]", i)) {
+      all = true;
+      i += 3;
+    }
+    const sel = { root: "evidence", kind, all, path: parsePath(input, i).path };
+    if (source) sel.source = source;
+    return sel;
+  }
+  throw new SelectorSyntaxError(
+    input,
+    0,
+    "unknown root (payment | intent | session | signal[name=\u2026] | evidence[\u2026])"
+  );
+}
+var SelectorStringSchema = z2.string().refine(
+  (s) => {
+    try {
+      parseSelector(s);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "invalid selector" }
+);
+
+// ../protocol/src/policy.ts
+var PRIMITIVES = ["THRESHOLD", "MEMBERSHIP", "MATCH", "PRESENCE", "FRESHNESS"];
+var PrimitiveSchema = z3.enum(PRIMITIVES);
+var RuleVerdictSchema = z3.enum(["DENY", "REVIEW"]);
+var RuleSchema = z3.strictObject({
+  id: z3.string().min(1).max(64),
+  primitive: PrimitiveSchema,
+  selector: SelectorStringSchema,
+  params: z3.record(z3.string(), JsonValueSchema),
+  onFail: RuleVerdictSchema,
+  /** What to do when the selector (or a `@ref`) resolves to nothing. Default: skip (GAP-44). */
+  onMissing: z3.enum(["skip", "DENY", "REVIEW"]).optional(),
+  /** Reason code surfaced to the caller when the rule fails (GAP-44). */
+  code: z3.string().regex(REASON_CODE_PATTERN)
+});
+var PolicyRulesSchema = z3.strictObject({
+  rules: z3.array(RuleSchema).max(200).refine((rules) => new Set(rules.map((r) => r.id)).size === rules.length, {
+    message: "rule ids must be unique"
+  }),
+  /** Domain-score thresholds — the only configurable part of the scores layer. */
+  scoreThresholds: z3.record(z3.string(), z3.number().min(0).max(1)).optional()
+});
+
+// ../protocol/src/api.ts
+var AmountSchema = z4.strictObject({
+  /** Decimal string — never a float. For x402 this is the atomic amount (GAP-49). */
+  value: z4.string().regex(/^\d+(\.\d+)?$/, "expected a decimal string"),
+  /** ISO code, or `<network>/<asset>` for on-chain rails (GAP-49). */
+  currency: z4.string().min(1).max(128)
+});
+var DeclaredIntentSchema = z4.strictObject({
+  mandate: z4.string().min(1).max(4e3),
+  maxAmount: AmountSchema.optional(),
+  merchantAllowlist: z4.array(z4.string().min(1)).optional(),
+  validUntil: TimestampSchema
+});
+var CreateSessionInputSchema = z4.strictObject({
+  source: EvidenceSourceSchema,
+  /** Buyer-born sessions. `credential` is opaque this phase (GAP-11). */
+  agent: z4.strictObject({ did: z4.string().min(1), credential: z4.string().min(1) }).optional(),
+  intent: DeclaredIntentSchema.optional()
+});
+var CreateSessionOutputSchema = z4.strictObject({
+  sessionId: SessionIdSchema,
+  expiresAt: TimestampSchema
+});
+var MAX_BATCH_EVENTS = 500;
+var EvidenceBatchInputSchema = z4.array(EvidenceEventSchema).min(1).max(MAX_BATCH_EVENTS);
+var EventResultStatusSchema = z4.enum(["ok", "duplicate", "fork", "rejected"]);
+var EventResultSchema = z4.strictObject({
+  index: z4.number().int().min(0),
+  sessionId: SessionIdSchema.nullable(),
+  source: EvidenceSourceSchema.nullable(),
+  seq: z4.number().int().min(0).nullable(),
+  status: EventResultStatusSchema,
+  code: z4.string().optional(),
+  eventDigest: Hex64Schema.optional()
+});
+var ChainHeadSchema = z4.strictObject({
+  seq: z4.number().int().min(0),
+  digest: Hex64Schema
+});
+var EvidenceAckSchema = z4.strictObject({
+  results: z4.array(EventResultSchema),
+  /** Head of every chain touched by the batch, after the batch. Keyed `sessionId:source`. */
+  heads: z4.record(z4.string(), ChainHeadSchema)
+});
+var PaymentSummarySchema = z4.strictObject({
+  protocol: z4.string().min(1),
+  payee: z4.string().min(1),
+  amount: AmountSchema,
+  /** Not in the RFC; needed by `principal-links` and `EVIDENCE_MISMATCH` (GAP-06). */
+  payer: z4.string().min(1).optional()
+});
+var EvaluateInputSchema = z4.strictObject({
+  sessionId: SessionIdSchema,
+  payment: PaymentSummarySchema
+});
+var DecisionSchema = z4.enum(["ALLOW", "DENY", "REVIEW"]);
+var EvaluateOutputSchema = z4.strictObject({
+  decision: DecisionSchema,
+  reasonCodes: z4.array(z4.string().regex(REASON_CODE_PATTERN)),
+  sessionId: SessionIdSchema,
+  /** Additive (GAP-21). */
+  decisionId: z4.uuid()
+});
+var AnchorEntrySchema = z4.strictObject({
+  epoch: z4.string().min(1),
+  root: Hex64Schema,
+  sig: z4.string().min(1),
+  chainRef: z4.string().optional()
+});
+var AnchorsOutputSchema = z4.strictObject({ entries: z4.array(AnchorEntrySchema) });
+var CreatePolicyInputSchema = z4.strictObject({ rules: PolicyRulesSchema });
+var CreatePolicyOutputSchema = z4.strictObject({
+  policyId: z4.uuid(),
+  version: z4.number().int().min(1),
+  status: z4.enum(["ACTIVE", "SUPERSEDED", "DRAFT"])
+});
+var ApiErrorSchema = z4.strictObject({
+  error: z4.strictObject({
+    code: z4.string().min(1),
+    message: z4.string().min(1),
+    details: JsonValueSchema.optional(),
+    request_id: z4.string().optional()
+  })
+});
+
+// ../protocol/src/payloads/index.ts
+import { z as z5 } from "zod";
+var Json = JsonValueSchema;
+var JsonRecord = z5.record(z5.string(), Json);
+var SessionOpenPayloadSchema = z5.looseObject({
+  runtime: z5.looseObject({
+    sdk: z5.string().min(1),
+    version: z5.string().min(1),
+    framework: z5.string().optional(),
+    model: z5.string().optional()
+  }),
+  /** Runtime / repo attestations read by the (staged) Attestation Assurance score. */
+  attestations: JsonRecord.optional()
+});
+var SESSION_CLOSE_REASONS = ["completed", "settled", "aborted", "expired"];
+var SessionClosePayloadSchema = z5.looseObject({
+  reason: z5.enum(SESSION_CLOSE_REASONS),
+  transaction: z5.string().optional()
+});
+var IntentDeclaredPayloadSchema = DeclaredIntentSchema.loose();
+var LlmCallStartPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  // GAP-07
+  provider: z5.string().min(1),
+  modelId: z5.string().min(1),
+  params: JsonRecord
+});
+var LlmCallEndPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  content: Json.optional(),
+  finishReason: z5.string().optional(),
+  usage: JsonRecord.optional(),
+  durationMs: z5.number().int().min(0),
+  error: z5.looseObject({ name: z5.string(), message: z5.string() }).optional()
+});
+var ToolCallStartPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  // GAP-07
+  toolName: z5.string().min(1),
+  input: Json,
+  transport: z5.enum(["local", "mcp"]).optional(),
+  server: z5.string().optional()
+});
+var ToolCallEndPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  output: Json.optional(),
+  error: z5.looseObject({ name: z5.string(), message: z5.string() }).optional(),
+  durationMs: z5.number().int().min(0)
+});
+var PAYMENT_ARTIFACTS = [
+  "http-402",
+  "mrtr-input-required",
+  "payment-signature",
+  "checkout-url"
+];
+var PaymentMomentPayloadSchema = z5.looseObject({
+  protocol: z5.string().min(1),
+  payee: z5.string().min(1),
+  amount: z5.looseObject({ value: z5.string().min(1), currency: z5.string().min(1) }),
+  payer: z5.string().optional(),
+  artifact: z5.enum(PAYMENT_ARTIFACTS),
+  raw: JsonRecord
+});
+var GatewayDecisionPayloadSchema = z5.looseObject({
+  gateway: z5.string().min(1),
+  call: z5.looseObject({ tool: z5.string().min(1), args: Json.optional() }),
+  decision: z5.enum(["ALLOW", "DENY", "REVIEW", "CHALLENGE"]),
+  reasonCodes: z5.array(z5.string()),
+  /** The gateway's own record of what it decided on — a black box to the platform. */
+  record: JsonRecord
+});
+var TransportGapPayloadSchema = z5.looseObject({
+  dropped: z5.number().int().min(1),
+  firstTs: z5.string(),
+  lastTs: z5.string()
+});
+var PlatformObservationPayloadSchema = z5.strictObject({
+  origin: z5.string().min(1),
+  params: Json,
+  response: Json
+});
+var ANOMALY_TYPES = [
+  "fork",
+  "seq_gap",
+  "prev_hash_mismatch",
+  "bad_sig",
+  "clock_skew",
+  "source_conflict"
+];
+var PlatformAnomalyPayloadSchema = z5.looseObject({
+  type: z5.enum(ANOMALY_TYPES),
+  source: EvidenceSourceAllSchema,
+  seq: z5.number().int().min(0).nullable(),
+  detail: JsonRecord
+});
+
+export {
+  Verdict
+};