@belticlabs/agent-risk-sdk 0.1.0 → 0.2.0

package/dist/seller/anti-fraud-gateway.js

@@ -1,13 +1,10 @@
-import {
-  x402Currency
-} from "../chunk-U5Z5Z2BQ.js";
 import {
   presentedFrom
 } from "../chunk-7G5EHNVW.js";
-import "../chunk-FQDHFTVR.js";
 import {
-  Verdict
-} from "../chunk-GCKCAKHA.js";
+  x402Summary
+} from "../chunk-LM4NIYE5.js";
+import "../chunk-FQDHFTVR.js";
 
 // src/seller/anti-fraud-gateway.ts
 var BelticAntiFraudGateway = class {
@@ -16,12 +13,15 @@ var BelticAntiFraudGateway = class {
   }
   async assess(ctx) {
     const session = await this.beltic.sessions.ensure(ctx.sessionId ?? null);
-    const payment = {
-      protocol: "x402",
-      payee: ctx.payTo ?? ctx.resource,
-      amount: { value: ctx.amountAtomic, currency: x402Currency(ctx.network, ctx.asset) },
-      payer: ctx.wallet.toLowerCase()
-    };
+    const payment = x402Summary(
+      {
+        payTo: ctx.payTo ?? ctx.resource,
+        amount: ctx.amountAtomic,
+        network: ctx.network,
+        asset: ctx.asset
+      },
+      { payer: ctx.wallet }
+    );
     await session.emit(
       "payment.presented",
       presentedFrom(payment, {
@@ -30,8 +30,7 @@ var BelticAntiFraudGateway = class {
       })
     );
     const out = await this.beltic.evaluate(session.id, payment);
-    const verdict = Verdict.of(out.decision);
-    return verdict.blocks(this.beltic.onReview) ? { allow: false, reason: `${out.decision}:${out.reasonCodes.join(",")}` } : { allow: true };
+    return out?.verdict.blocks(this.beltic.onReview) ? { allow: false, reason: `${out.decision}:${out.reasonCodes.join(",")}` } : { allow: true };
   }
 };
 export {

package/dist/{session-BMNB1N1g.d.ts → session-5TClPLI4.d.ts}

@@ -1,5 +1,17 @@
-import { Signer } from './base58.js';
-import { EvidenceAck, EventResult, EvidenceEvent, EvidenceSource, WireEvidenceKind, JsonObject, ChainHead, PayloadByKind, SessionClosePayload, DeclaredIntent } from './api.js';
+import { L as EvidenceAck, G as EventResult, R as EvidenceEvent, V as EvidenceSource, aC as WireEvidenceKind, J as JsonObject, C as ChainHead, aa as PayloadByKind, aw as ToolCallStartPayload, b as JsonValue, am as SessionClosePayload, v as DeclaredIntent } from './index-Bjs3BPPU.js';
+
+/**
+ * The edge signs event digests (Fraud SDK RFC › Modules › Identity Module);
+ * the platform signs its own PLATFORM chain and epoch anchors. Both are the
+ * same operation over different keys, so one interface.
+ */
+interface Signer {
+    /** Raw 32-byte Ed25519 public key. */
+    readonly publicKey: Uint8Array;
+    /** Stable identifier for logs and key rotation; `did:key` for agents. */
+    readonly keyId: string;
+    sign(message: Uint8Array): Promise<Uint8Array>;
+}
 
 interface ApiClientOptions {
     baseUrl: string;
@@ -111,6 +123,11 @@ declare class Transport {
  * (GAP-38): a dropped event never leaves a hole — the next accepted event
  * is preceded by a `transport.gap` that counts the drops. `redact` is off
  * by default (GAP-33).
+ *
+ * Evidence is a side channel of the agent's work: with `failOpen` an emit
+ * that cannot be chained (halted chain, closed transport) is reported and
+ * returns `false` instead of throwing into the model or tool call it
+ * observes (GAP-70).
  */
 
 type RedactFn = (kind: WireEvidenceKind, payload: JsonObject) => JsonObject;
@@ -123,6 +140,23 @@ interface SessionDeps {
     now?: (() => Date) | undefined;
     /** Called once the session closed, so the registry can forget it. */
     onClosed?: ((session: Session) => void) | undefined;
+    /** Report instead of throw when an event cannot be chained (GAP-70). */
+    failOpen?: boolean | undefined;
+    onError?: ((err: Error) => void) | undefined;
+}
+/**
+ * One tool call as a span: `tool_call.start` now, `tool_call.end` with the
+ * outcome and the elapsed time when the host reports it. For hosts that run
+ * their own tool loop and cannot hand the SDK an `execute` to wrap.
+ */
+interface ToolCallSpan {
+    readonly callId: string;
+    end(outcome?: {
+        output?: JsonValue;
+    }): Promise<boolean>;
+    fail(error: unknown, outcome?: {
+        output?: JsonValue;
+    }): Promise<boolean>;
 }
 declare class Session {
     private readonly deps;
@@ -140,8 +174,15 @@ declare class Session {
     constructor(deps: SessionDeps, id: string, source: EvidenceSource, expiresAt: string | null, born: SessionBorn);
     get head(): ChainHead | null;
     get droppedCount(): number;
-    /** Resolves once the event is sequenced and buffered — not once it is acknowledged. */
+    /**
+     * Resolves once the event is sequenced and buffered — not once it is
+     * acknowledged. `false` when the event was dropped, or (fail-open) when
+     * the chain can no longer take it.
+     */
     emit<K extends WireEvidenceKind>(kind: K, payload: PayloadByKind[K]): Promise<boolean>;
+    /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+    toolCall(call: ToolCallStartPayload): ToolCallSpan;
+    private chainEvent;
     close(reason?: SessionClosePayload['reason'], extra?: JsonObject): Promise<void>;
     /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
     flush(): Promise<void>;
@@ -156,6 +197,8 @@ interface StartSessionInput {
     };
     attestations?: JsonObject;
 }
+/** What `open` sends when it actually opens: a value, or a resolver run only then. */
+type OpenSessionInput = StartSessionInput | (() => StartSessionInput | Promise<StartSessionInput>);
 interface SessionsDeps {
     api: ApiClient;
     transport: Transport;
@@ -163,7 +206,12 @@ interface SessionsDeps {
     redact?: RedactFn | undefined;
     now?: (() => Date) | undefined;
     sdkVersion: string;
+    failOpen?: boolean | undefined;
+    onError?: ((err: Error) => void) | undefined;
+    /** Fail-open only: after the platform refused to open a session, `open` resolves null for this long (GAP-71). */
+    openRetryMs?: number | undefined;
 }
+declare const DEFAULT_OPEN_RETRY_MS = 60000;
 declare class Sessions {
     private readonly deps;
     /**
@@ -173,12 +221,30 @@ declare class Sessions {
      * mid-session still loses the head (GAP-67).
      */
     private readonly attached;
+    /** Buyer sessions by the host's own key (GAP-71). */
+    private readonly opened;
+    private retryAt;
     constructor(deps: SessionsDeps);
+    /**
+     * Buyer half: the evidence session for a key of the host's own (its
+     * session, run or conversation id), opened on first use and reused
+     * after. A halted chain is reopened as a fresh session that continues
+     * the same key; a closed key is forgotten. When the platform refuses to
+     * open one, a fail-open client resolves null — the host runs without
+     * evidence — until `openRetryMs` has passed (GAP-71); otherwise the
+     * refusal is thrown and the next call tries again. The identity is
+     * required either way: that is configuration.
+     */
+    open(key: string, input?: OpenSessionInput): Promise<Session | null>;
+    private forget;
+    private openFresh;
     /** Buyer half: create an AGENT_TRACE session bound to the agent identity, then announce it on the chain. */
     start(input?: StartSessionInput): Promise<Session>;
+    private identityFor;
+    private create;
     /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
     ensure(sessionId?: string | null): Promise<Session>;
     private attach;
 }
 
-export { type AgentIdentity as A, BelticApiError as B, ChainRejectedError as C, DEFAULT_TRANSPORT as D, type RedactFn as R, Session as S, Transport as T, ApiClient as a, type ApiClientOptions as b, type SessionBorn as c, Sessions as d, type StartSessionInput as e, TransportClosedError as f, type TransportOptions as g, ephemeralIdentity as h, fileIdentity as i, identityFromSeed as j };
+export { type AgentIdentity as A, BelticApiError as B, ChainRejectedError as C, DEFAULT_OPEN_RETRY_MS as D, type OpenSessionInput as O, type RedactFn as R, Session as S, type ToolCallSpan as T, ApiClient as a, type ApiClientOptions as b, DEFAULT_TRANSPORT as c, type SessionBorn as d, Sessions as e, type StartSessionInput as f, Transport as g, TransportClosedError as h, type TransportOptions as i, ephemeralIdentity as j, fileIdentity as k, identityFromSeed as l };

package/dist/verdict-BAahb5po.d.ts

@@ -0,0 +1,26 @@
+import { D as Decision } from './index-Bjs3BPPU.js';
+
+/**
+ * The verdict as a value (Fraud Engine RFC › API: ALLOW | DENY | REVIEW).
+ * Layers combine by severity (GAP-45); a synchronous seller hook turns
+ * REVIEW into a stop or a pass according to its `onReview` (GAP-52). Both
+ * halves of the SDK and the engine share this one rule.
+ */
+
+type OnReview = 'abort' | 'allow';
+declare class Verdict {
+    readonly value: Decision;
+    private constructor();
+    static readonly ALLOW: Verdict;
+    static readonly REVIEW: Verdict;
+    static readonly DENY: Verdict;
+    static of(value: Decision): Verdict;
+    /** The more severe of the two. */
+    atLeast(other: Verdict | Decision): Verdict;
+    /** Whether a synchronous gate must stop the call (GAP-52). */
+    blocks(onReview: OnReview): boolean;
+    /** What the gate effectively did: DENY when it blocked, else the verdict itself. */
+    effective(onReview: OnReview): Decision;
+}
+
+export { type OnReview as O, Verdict as V };

package/dist/x402/express.d.ts

@@ -1,11 +1,12 @@
 import { RoutesConfig, x402ResourceServer } from '@x402/core/server';
 import { RequestHandler } from 'express';
-import { B as Beltic } from '../client-CVx9LgJC.js';
-import { G as GuardedMiddlewareOptions } from '../middleware-_DSwvNIx.js';
-export { a as attachX402 } from '../middleware-_DSwvNIx.js';
-import './api.js';
-import '../session-BMNB1N1g.js';
-import './base58.js';
+import { B as Beltic } from '../client-C-mV_3A0.js';
+import { G as GuardedMiddlewareOptions } from '../middleware-BwAYpBTl.js';
+export { a as attachX402 } from '../adapter-CF-cUYSA.js';
+import '../index-Bjs3BPPU.js';
+import 'zod';
+import '../verdict-BAahb5po.js';
+import '../session-5TClPLI4.js';
 
 /** Seller half for express: `@x402/express`'s payment middleware with the Beltic hooks attached. */
 

package/dist/x402/express.js

@@ -1,13 +1,14 @@
 import {
-  attachX402,
   guardedPaymentMiddleware
-} from "../chunk-YVMJ5CZX.js";
+} from "../chunk-U7HM37CB.js";
+import {
+  attachX402
+} from "../chunk-SO6HPRJT.js";
 import "../chunk-VM7MK43J.js";
 import "../chunk-SFGM7KOG.js";
-import "../chunk-U5Z5Z2BQ.js";
-import "../chunk-7G5EHNVW.js";
+import "../chunk-46QN2KEZ.js";
+import "../chunk-LM4NIYE5.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-GCKCAKHA.js";
 
 // src/x402/express.ts
 import { paymentMiddlewareFromHTTPServer } from "@x402/express";

package/dist/x402/hono.d.ts

@@ -1,11 +1,12 @@
 import { RoutesConfig, x402ResourceServer } from '@x402/core/server';
 import { MiddlewareHandler } from 'hono';
-import { B as Beltic } from '../client-CVx9LgJC.js';
-import { G as GuardedMiddlewareOptions } from '../middleware-_DSwvNIx.js';
-export { a as attachX402 } from '../middleware-_DSwvNIx.js';
-import './api.js';
-import '../session-BMNB1N1g.js';
-import './base58.js';
+import { B as Beltic } from '../client-C-mV_3A0.js';
+import { G as GuardedMiddlewareOptions } from '../middleware-BwAYpBTl.js';
+export { a as attachX402 } from '../adapter-CF-cUYSA.js';
+import '../index-Bjs3BPPU.js';
+import 'zod';
+import '../verdict-BAahb5po.js';
+import '../session-5TClPLI4.js';
 
 /** Seller half for hono: `@x402/hono`'s payment middleware with the Beltic hooks attached. */
 

package/dist/x402/hono.js

@@ -1,13 +1,14 @@
 import {
-  attachX402,
   guardedPaymentMiddleware
-} from "../chunk-YVMJ5CZX.js";
+} from "../chunk-U7HM37CB.js";
+import {
+  attachX402
+} from "../chunk-SO6HPRJT.js";
 import "../chunk-VM7MK43J.js";
 import "../chunk-SFGM7KOG.js";
-import "../chunk-U5Z5Z2BQ.js";
-import "../chunk-7G5EHNVW.js";
+import "../chunk-46QN2KEZ.js";
+import "../chunk-LM4NIYE5.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-GCKCAKHA.js";
 
 // src/x402/hono.ts
 import { paymentMiddlewareFromHTTPServer } from "@x402/hono";

package/dist/x402/index.d.ts

@@ -1,10 +1,10 @@
-export { A as AttachOptions, b as AttachedX402, C as CorrelationContext, G as GuardedMiddlewareOptions, a as attachX402, g as guardedPaymentMiddleware } from '../middleware-_DSwvNIx.js';
-import { S as Session } from '../session-BMNB1N1g.js';
-import { PaymentMomentPayload, JsonObject } from './api.js';
-import { PaymentPayload, PaymentRequired, PaymentRequirements } from '@x402/core/types';
+export { A as AttachOptions, b as AttachedX402, C as CorrelationContext, a as attachX402 } from '../adapter-CF-cUYSA.js';
+import { S as Session } from '../session-5TClPLI4.js';
+import { v as DeclaredIntent, P as PaymentMomentPayload, J as JsonObject, a as PaymentSummary } from '../index-Bjs3BPPU.js';
 import '@x402/core/server';
-import '../client-CVx9LgJC.js';
-import './base58.js';
+import '../client-C-mV_3A0.js';
+import '../verdict-BAahb5po.js';
+import 'zod';
 
 /**
  * Session binding on the x402 rail (Fraud SDK RFC › Protocol Adapter — x402:
@@ -15,40 +15,116 @@ declare const SESSION_EXTENSION = "beltic.sessionId";
 declare const SESSION_HEADER = "Beltic-Session-Id";
 declare function sessionIdOf(extensions: Readonly<Record<string, unknown>> | undefined): string | null;
 
-declare function belticFetch(session: Session, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
+/**
+ * Buyer half › the x402 fetch wrapper. Sits *inside* the agent's paying
+ * fetch (e.g. `wrapFetchWithPayment(belticFetch(session))`), so it sees the
+ * 402 challenge → `payment.requested`, and the retry carrying the payment
+ * → `payment.presented`, into which it injects the session binding
+ * (GAP-30). It never pays and never decides.
+ *
+ * Before a request that presents payment leaves, the buffered evidence is
+ * flushed: the seller will evaluate as soon as it sees the payment, and
+ * the platform must already hold the buyer's side of the story (GAP-66).
+ *
+ * Both x402 generations are read: v2 (`PAYMENT-REQUIRED` header,
+ * `PAYMENT-SIGNATURE` retry, binding in `extensions`) and v1 (challenge in
+ * the 402 body, `X-PAYMENT` retry, binding by header only — a v1 payload
+ * has no extensions and names no asset, so the challenge this wrapper saw
+ * for the same URL supplies it; GAP-72). The header codec is base64 JSON,
+ * kept here so a buyer needs no `@x402/*` package to be observed.
+ */
+
+/**
+ * The paying fetch, observed. Without a session (the evidence stream is
+ * not configured, or the platform refused to open one) the inner fetch is
+ * returned as is, so a host wires it unconditionally.
+ */
+declare function belticFetch(session: Session | null | undefined, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
+
+/**
+ * The declared intent for an x402 mandate (Fraud SDK RFC › Session ›
+ * `intent.declared`). The cap must be in the currency the rail's moments
+ * carry — `<network>/<asset>`, atomic units (GAP-49) — or the platform's
+ * spend detectors compare two currencies and never meet; this is the one
+ * place a buyer spells that. Everything else is the protocol's own shape.
+ */
+
+interface X402IntentInput {
+    mandate: string;
+    network: string;
+    asset: string;
+    /** Atomic units of `asset`, as x402 carries amounts — a decimal string or a bigint, never a float. */
+    maxAmount: string | bigint;
+    validUntil: string | Date;
+    merchantAllowlist?: string[] | undefined;
+}
+declare function x402Intent(input: X402IntentInput): DeclaredIntent;
 
 /**
  * x402 artifacts → protocol moments (Fraud SDK RFC › Protocol Adapter —
  * x402). The moment is normalized (payee, amount, payer) so both sides of
  * a purchase compare; the artifact travels whole in `raw`. For x402 the
  * currency is `<network>/<asset>` (GAP-49) and the value is the atomic
- * amount as the protocol carries it.
+ * amount as the protocol carries it — `x402Summary` gives a buyer the same
+ * normalization for the payment it is about to evaluate, so what it asks
+ * about and what the wrapper records are one and the same.
  */
 
-type Readonlyish<T> = {
-    readonly [K in keyof T]: Readonlyish<T[K]>;
-} | T;
 declare function x402Currency(network: string, asset: string): string;
-/** The minimum an `accepts` entry needs to become a moment; unknown parts are named, never dropped. */
+/**
+ * The minimum an `accepts` entry needs to become a moment; unknown parts
+ * are named, never dropped. v1 spells the amount `maxAmountRequired`.
+ */
 interface AcceptsLike {
     payTo?: string | undefined;
     amount?: string | undefined;
+    maxAmountRequired?: string | undefined;
     network?: string | undefined;
     asset?: string | undefined;
 }
+/**
+ * A 402 challenge and a presented payment of either generation, as far as
+ * a moment needs them. `@x402/core`'s `PaymentRequired` and
+ * `PaymentPayload` satisfy these structurally, so the seller adapter
+ * passes its typed values through and the buyer needs no `@x402/*` types.
+ */
+interface PaymentRequiredLike {
+    x402Version?: number | undefined;
+    accepts?: readonly AcceptsLike[] | undefined;
+}
+interface PaymentPayloadLike {
+    x402Version?: number | undefined;
+    accepted?: AcceptsLike | undefined;
+    /** v1 names the network here, beside the payload, and nowhere else. */
+    network?: string | undefined;
+    payload?: Readonly<Record<string, unknown>> | undefined;
+    extensions?: Readonly<Record<string, unknown>> | undefined;
+}
+/**
+ * The one normalization of an x402 `accepts` entry: the payment in the
+ * shape `evaluate` takes, with the payer as `payerOf` would read it. Every
+ * moment below is this plus its artifact and `raw`.
+ */
+declare function x402Summary(accepts: AcceptsLike | undefined, opts?: {
+    payer?: string | undefined;
+}): PaymentSummary;
 /** The payer is scheme-specific; the common EVM shapes are read, anything else stays in `raw`. */
-declare function payerOf(payload: Readonlyish<PaymentPayload>): string | undefined;
+declare function payerOf(payload: PaymentPayloadLike): string | undefined;
 declare const x402Moments: {
-    /** The 402 challenge as the buyer saw it. */
-    required(required: Readonlyish<PaymentRequired>): PaymentMomentPayload;
+    /** The 402 challenge as the buyer saw it, v2 header or v1 body. */
+    required(required: PaymentRequiredLike): PaymentMomentPayload;
     /** The requirements the seller's resource server resolved for a request. */
-    requirements(req: Readonlyish<PaymentRequirements>): PaymentMomentPayload;
+    requirements(req: AcceptsLike): PaymentMomentPayload;
     /** A route's static `accepts` config, before any payment header exists. */
     route(route: unknown, raw: JsonObject): PaymentMomentPayload;
     /** An in-band ask (MRTR `input_required` or a `_meta` envelope) carrying an x402-style `accepts`. */
     ask(first: AcceptsLike, raw: JsonObject): PaymentMomentPayload;
-    /** The signed payment the buyer presented. */
-    payload(payload: Readonlyish<PaymentPayload>): PaymentMomentPayload;
+    /**
+     * The signed payment the buyer presented. A v2 payload carries the
+     * requirement it accepted; a v1 payload does not, so the caller passes
+     * the `accepts` entry it answered.
+     */
+    payload(payload: PaymentPayloadLike, accepts?: AcceptsLike | undefined): PaymentMomentPayload;
 };
 
-export { type AcceptsLike, SESSION_EXTENSION, SESSION_HEADER, belticFetch, payerOf, sessionIdOf, x402Currency, x402Moments };
+export { type AcceptsLike, type PaymentPayloadLike, type PaymentRequiredLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, belticFetch, payerOf, sessionIdOf, x402Currency, x402Intent, x402Moments, x402Summary };

package/dist/x402/index.js

@@ -1,67 +1,118 @@
 import {
-  attachX402,
-  guardedPaymentMiddleware
-} from "../chunk-YVMJ5CZX.js";
+  attachX402
+} from "../chunk-SO6HPRJT.js";
 import {
   SESSION_EXTENSION,
   SESSION_HEADER,
   sessionIdOf
 } from "../chunk-VM7MK43J.js";
 import "../chunk-SFGM7KOG.js";
+import "../chunk-46QN2KEZ.js";
 import {
   payerOf,
   x402Currency,
-  x402Moments
-} from "../chunk-U5Z5Z2BQ.js";
-import "../chunk-7G5EHNVW.js";
+  x402Moments,
+  x402Summary
+} from "../chunk-LM4NIYE5.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-GCKCAKHA.js";
 
 // src/x402/fetch.ts
-import {
-  decodePaymentRequiredHeader,
-  decodePaymentSignatureHeader,
-  encodePaymentSignatureHeader
-} from "@x402/core/http";
+var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+var CHALLENGE_MEMORY = 32;
 function belticFetch(session, inner = globalThis.fetch) {
+  if (!session) return inner;
+  const challenges = /* @__PURE__ */ new Map();
   return async (input, init) => {
+    const url = urlOf(input);
     const headers = new Headers(
       init?.headers ?? (input instanceof Request ? input.headers : void 0)
     );
     headers.set(SESSION_HEADER, session.id);
-    const sigHeader = headers.get("PAYMENT-SIGNATURE");
-    if (sigHeader) {
-      try {
-        const payload = decodePaymentSignatureHeader(sigHeader);
-        payload.extensions = { ...payload.extensions ?? {}, [SESSION_EXTENSION]: session.id };
-        headers.set("PAYMENT-SIGNATURE", encodePaymentSignatureHeader(payload));
-        await session.emit("payment.presented", x402Moments.payload(payload));
-        await session.flush();
-      } catch {
-      }
+    const signature = headers.get("PAYMENT-SIGNATURE");
+    const presented = signature ?? headers.get("X-PAYMENT");
+    const payload = presented ? decodeHeader(presented) : null;
+    if (payload) {
+      const bound = signature ? { ...payload, extensions: { ...payload.extensions, [SESSION_EXTENSION]: session.id } } : payload;
+      if (signature) headers.set("PAYMENT-SIGNATURE", encodeHeader(bound));
+      const accepts = bound.accepted ?? answeredAccepts(challenges.get(url), bound);
+      await session.emit("payment.presented", x402Moments.payload(bound, accepts));
+      await session.flush();
     }
     const res = await inner(input, { ...init, headers });
-    const required = res.status === 402 ? res.headers.get("PAYMENT-REQUIRED") : null;
+    if (res.status !== 402) return res;
+    const required = await challengeOf(res);
     if (required) {
-      try {
-        await session.emit(
-          "payment.requested",
-          x402Moments.required(decodePaymentRequiredHeader(required))
-        );
-      } catch {
-      }
+      challenges.set(url, required);
+      if (challenges.size > CHALLENGE_MEMORY) challenges.delete(challenges.keys().next().value);
+      await session.emit("payment.requested", x402Moments.required(required));
     }
     return res;
   };
 }
+function decodeHeader(value) {
+  if (!BASE64.test(value)) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function encodeHeader(value) {
+  return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+}
+function urlOf(input) {
+  return typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+}
+async function challengeOf(res) {
+  const header = res.headers.get("PAYMENT-REQUIRED");
+  if (header) return decodeHeader(header);
+  if (!/json/i.test(res.headers.get("content-type") ?? "")) return null;
+  try {
+    const body = await res.clone().json();
+    return Array.isArray(body?.accepts) ? body : null;
+  } catch {
+    return null;
+  }
+}
+function answeredAccepts(required, payload) {
+  const auth = payload.payload?.authorization;
+  const payTo = typeof auth?.to === "string" ? auth.to : void 0;
+  const amount = typeof auth?.value === "string" ? auth.value : void 0;
+  const options = required?.accepts ?? [];
+  const answered = options.find(
+    (a) => a.payTo?.toLowerCase() === payTo?.toLowerCase() && (a.amount ?? a.maxAmountRequired) === amount
+  ) ?? options[0];
+  if (answered) return answered;
+  if (!payTo && !amount) return void 0;
+  return {
+    ...payTo ? { payTo } : {},
+    ...amount ? { amount } : {},
+    ...payload.network ? { network: payload.network } : {}
+  };
+}
+
+// src/x402/intent.ts
+function x402Intent(input) {
+  return {
+    mandate: input.mandate,
+    maxAmount: {
+      value: input.maxAmount.toString(),
+      currency: x402Currency(input.network, input.asset)
+    },
+    validUntil: new Date(input.validUntil).toISOString(),
+    ...input.merchantAllowlist ? { merchantAllowlist: input.merchantAllowlist } : {}
+  };
+}
 export {
   SESSION_EXTENSION,
   SESSION_HEADER,
   attachX402,
   belticFetch,
-  guardedPaymentMiddleware,
   payerOf,
   sessionIdOf,
   x402Currency,
-  x402Moments
+  x402Intent,
+  x402Moments,
+  x402Summary
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@belticlabs/agent-risk-sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The Beltic Agent Risk SDK — one client, two halves: instrument the buyer agent (AI SDK, x402 fetch, MCP client) and guard the seller boundary (x402, MCP server, evaluate).",
   "license": "UNLICENSED",
   "repository": {
@@ -16,6 +16,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./protocol": {
+      "types": "./dist/protocol/index.d.ts",
+      "default": "./dist/protocol/index.js"
+    },
     "./ai": {
       "types": "./dist/ai/index.d.ts",
       "default": "./dist/ai/index.js"

package/dist/chunk-5TWO73OD.js

@@ -1,35 +0,0 @@
-// src/core/record.ts
-function errorOf(err) {
-  const e = err;
-  return { name: String(e?.name ?? "Error"), message: String(e?.message ?? err) };
-}
-async function recordCall(session, kind, callId, start, run, end = () => ({})) {
-  const started = Date.now();
-  await session.emit(`${kind}.start`, { callId, ...start });
-  try {
-    const result = await run();
-    await session.emit(
-      `${kind}.end`,
-      {
-        callId,
-        ...await end(result),
-        durationMs: Date.now() - started
-      }
-    );
-    return result;
-  } catch (err) {
-    await session.emit(
-      `${kind}.end`,
-      {
-        callId,
-        error: errorOf(err),
-        durationMs: Date.now() - started
-      }
-    );
-    throw err;
-  }
-}
-
-export {
-  recordCall
-};