@belticlabs/agent-risk-sdk 0.1.0

package/dist/chunk-SFGM7KOG.js

@@ -0,0 +1,312 @@
+// ../canon/src/uuidv7.ts
+import { randomBytes } from "crypto";
+function uuidv7(now = Date.now()) {
+  const b = randomBytes(16);
+  b.writeUIntBE(now, 0, 6);
+  b[6] = b[6] & 15 | 112;
+  b[8] = b[8] & 63 | 128;
+  const h = b.toString("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+
+// ../canon/src/base58.ts
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var MAP = new Map([...ALPHABET].map((c, i) => [c, i]));
+function base58Encode(bytes) {
+  let zeros = 0;
+  while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
+  const digits = [];
+  for (let i = zeros; i < bytes.length; i++) {
+    let carry = bytes[i];
+    for (let j = 0; j < digits.length; j++) {
+      carry += digits[j] << 8;
+      digits[j] = carry % 58;
+      carry = carry / 58 | 0;
+    }
+    while (carry > 0) {
+      digits.push(carry % 58);
+      carry = carry / 58 | 0;
+    }
+  }
+  return "1".repeat(zeros) + digits.reverse().map((d) => ALPHABET[d]).join("");
+}
+
+// ../canon/src/encoding.ts
+function toHex(buf) {
+  return Buffer.from(buf).toString("hex");
+}
+function fromHex(hex) {
+  if (!/^[0-9a-f]*$/.test(hex) || hex.length % 2 !== 0) {
+    throw new Error(`invalid lowercase hex string: ${hex.slice(0, 32)}\u2026`);
+  }
+  return Buffer.from(hex, "hex");
+}
+function toB64Url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+function fromB64Url(s) {
+  if (!/^[A-Za-z0-9_-]*$/.test(s)) throw new Error("invalid base64url string");
+  return Buffer.from(s, "base64url");
+}
+
+// ../canon/src/hash.ts
+import { createHash } from "crypto";
+var LEAF_PREFIX = Buffer.from([0]);
+var NODE_PREFIX = Buffer.from([1]);
+function sha256(...parts) {
+  const h = createHash("sha256");
+  for (const p of parts) h.update(p);
+  return h.digest();
+}
+
+// ../canon/src/jcs.ts
+function canonicalize(value) {
+  if (value === null) return "null";
+  const t = typeof value;
+  if (t === "boolean") return value ? "true" : "false";
+  if (t === "number") {
+    const n = value;
+    if (!Number.isFinite(n)) throw new Error("JCS: non-finite number");
+    return JSON.stringify(n);
+  }
+  if (t === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    const items = value.map((v) => v === void 0 ? "null" : canonicalize(v));
+    return `[${items.join(",")}]`;
+  }
+  if (t === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0).sort();
+    const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalize(obj[k])}`);
+    return `{${parts.join(",")}}`;
+  }
+  throw new Error(`JCS: unsupported type ${t}`);
+}
+function canonicalBytes(value) {
+  return Buffer.from(canonicalize(value), "utf8");
+}
+
+// ../canon/src/digest.ts
+function payloadDigest(payload) {
+  return toHex(sha256(canonicalBytes(payload)));
+}
+function digestedEnvelope(env) {
+  return {
+    sessionId: env.sessionId,
+    source: env.source,
+    seq: env.seq,
+    ts: env.ts,
+    kind: env.kind,
+    payload: env.payloadDigest,
+    prevHash: env.prevHash
+  };
+}
+function eventDigest(env) {
+  return toHex(sha256(canonicalBytes(digestedEnvelope(env))));
+}
+function genesisHash(sessionId, source) {
+  return toHex(sha256(canonicalBytes({ sessionId, source })));
+}
+
+// ../canon/src/ed25519.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  generateKeyPairSync
+} from "crypto";
+var PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+var SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+function generateKeyPair(seed) {
+  if (seed) {
+    if (seed.length !== 32) throw new Error("ed25519 seed must be 32 bytes");
+    return { publicKey: publicFromPrivate(privKeyObject(seed)), privateKey: Buffer.from(seed) };
+  }
+  const { privateKey } = generateKeyPairSync("ed25519");
+  const der = privateKey.export({ format: "der", type: "pkcs8" });
+  const rawSeed = der.subarray(der.length - 32);
+  return { publicKey: publicFromPrivate(privateKey), privateKey: Buffer.from(rawSeed) };
+}
+function publicFromPrivate(priv) {
+  const pub = createPublicKey(priv);
+  const der = pub.export({ format: "der", type: "spki" });
+  return Buffer.from(der.subarray(der.length - 32));
+}
+function privKeyObject(seed) {
+  return createPrivateKey({
+    key: Buffer.concat([PKCS8_PREFIX, Buffer.from(seed)]),
+    format: "der",
+    type: "pkcs8"
+  });
+}
+function pubKeyObject(raw) {
+  if (raw.length !== 32) throw new Error("ed25519 public key must be 32 bytes");
+  return createPublicKey({
+    key: Buffer.concat([SPKI_PREFIX, Buffer.from(raw)]),
+    format: "der",
+    type: "spki"
+  });
+}
+function sign(message, privateSeed) {
+  return cryptoSign(null, Buffer.from(message), privKeyObject(privateSeed));
+}
+function verify(message, signature, publicKey) {
+  try {
+    return cryptoVerify(
+      null,
+      Buffer.from(message),
+      pubKeyObject(publicKey),
+      Buffer.from(signature)
+    );
+  } catch {
+    return false;
+  }
+}
+function derivePublicKey(privateSeed) {
+  return publicFromPrivate(privKeyObject(privateSeed));
+}
+
+// ../canon/src/signer.ts
+var SIG_PREFIX = "ed25519:";
+function encodeSig(raw) {
+  if (raw.length !== 64) throw new Error("ed25519 signature must be 64 bytes");
+  return `${SIG_PREFIX}${toB64Url(raw)}`;
+}
+function decodeSig(sig) {
+  if (!sig.startsWith(SIG_PREFIX)) throw new Error("unsupported signature algorithm");
+  const raw = fromB64Url(sig.slice(SIG_PREFIX.length));
+  if (raw.length !== 64) throw new Error("ed25519 signature must be 64 bytes");
+  return raw;
+}
+function verifySig(message, sig, publicKey) {
+  try {
+    return verify(message, decodeSig(sig), publicKey);
+  } catch {
+    return false;
+  }
+}
+function memorySigner(seed, keyId) {
+  const kp = seed ? { publicKey: derivePublicKey(seed), privateKey: Buffer.from(seed) } : generateKeyPair();
+  return {
+    seed: kp.privateKey,
+    publicKey: kp.publicKey,
+    keyId: keyId ?? `ed25519:${toB64Url(kp.publicKey)}`,
+    async sign(message) {
+      return sign(message, kp.privateKey);
+    }
+  };
+}
+
+// ../canon/src/chain.ts
+function toEnvelope(ev) {
+  const env = {
+    sessionId: ev.sessionId,
+    source: ev.source,
+    seq: ev.seq,
+    ts: ev.ts,
+    kind: ev.kind,
+    payloadDigest: "payloadDigest" in ev ? ev.payloadDigest : payloadDigest(ev.payload),
+    prevHash: ev.prevHash
+  };
+  if (ev.sig !== void 0) env.sig = ev.sig;
+  return env;
+}
+var Chain = class _Chain {
+  constructor(sessionId, source, head) {
+    this.sessionId = sessionId;
+    this.source = source;
+    this.head = head;
+  }
+  static genesis(sessionId, source) {
+    return new _Chain(sessionId, source, null);
+  }
+  static at(sessionId, source, head) {
+    return new _Chain(sessionId, source, head);
+  }
+  get nextSeq() {
+    return this.head ? this.head.seq + 1 : 0;
+  }
+  /** `prevHash` the next event must carry (GAP-01). */
+  get nextPrevHash() {
+    return this.head ? this.head.digest : genesisHash(this.sessionId, this.source);
+  }
+  advance(head) {
+    return new _Chain(this.sessionId, this.source, head);
+  }
+  async append(input, signer) {
+    const seq = input.seq ?? this.nextSeq;
+    if (seq !== this.nextSeq) {
+      throw new Error(
+        `chain ${this.sessionId}:${this.source} expects seq ${this.nextSeq}, got ${seq}`
+      );
+    }
+    const event = {
+      sessionId: this.sessionId,
+      source: this.source,
+      seq,
+      ts: input.ts,
+      kind: input.kind,
+      payload: input.payload,
+      prevHash: this.nextPrevHash
+    };
+    const envelope = toEnvelope(event);
+    const digest = eventDigest(envelope);
+    if (signer) {
+      const sig = encodeSig(await signer.sign(fromHex(digest)));
+      event.sig = sig;
+      envelope.sig = sig;
+    }
+    return { event, envelope, digest, chain: this.advance({ seq, digest }) };
+  }
+  /** Streaming verification of one link against this head. */
+  verify(ev, opts) {
+    const envelope = toEnvelope(ev);
+    const digest = eventDigest(envelope);
+    if (envelope.seq !== this.nextSeq) return { ok: false, code: "SEQ_GAP", digest, envelope };
+    if (envelope.prevHash !== this.nextPrevHash) {
+      return { ok: false, code: "PREV_HASH_MISMATCH", digest, envelope };
+    }
+    if (opts.requireSig && !envelope.sig)
+      return { ok: false, code: "SIG_MISSING", digest, envelope };
+    if (envelope.sig && (opts.requireSig || opts.publicKey)) {
+      if (!opts.publicKey || !verifySig(fromHex(digest), envelope.sig, opts.publicKey)) {
+        return { ok: false, code: "SIG_INVALID", digest, envelope };
+      }
+    }
+    return { ok: true, digest, envelope };
+  }
+  /** Verify a run of events starting from this head; the result names the first broken link. */
+  verifyAll(events, opts) {
+    let chain = this;
+    const digests = [];
+    for (const ev of events) {
+      if (ev.sessionId !== this.sessionId || ev.source !== this.source) {
+        return { ok: false, at: ev.seq, code: "PREV_HASH_MISMATCH", head: chain.head, digests };
+      }
+      const r = chain.verify(ev, opts);
+      if (!r.ok) return { ok: false, at: ev.seq, code: r.code, head: chain.head, digests };
+      chain = chain.advance({ seq: ev.seq, digest: r.digest });
+      digests.push(r.digest);
+    }
+    return { ok: true, head: chain.head, digests };
+  }
+};
+
+// ../canon/src/did-key.ts
+var ED25519_PUB_MULTICODEC = Buffer.from([237, 1]);
+var PREFIX = "did:key:z";
+function didKeyFromEd25519(publicKey) {
+  if (publicKey.length !== 32) throw new Error("ed25519 public key must be 32 bytes");
+  return PREFIX + base58Encode(Buffer.concat([ED25519_PUB_MULTICODEC, Buffer.from(publicKey)]));
+}
+
+export {
+  toHex,
+  fromHex,
+  payloadDigest,
+  memorySigner,
+  Chain,
+  didKeyFromEd25519,
+  uuidv7
+};

package/dist/chunk-U5Z5Z2BQ.js

@@ -0,0 +1,86 @@
+import {
+  toJsonObject
+} from "./chunk-FQDHFTVR.js";
+
+// src/x402/moments.ts
+function x402Currency(network, asset) {
+  return `${network}/${asset}`;
+}
+function fromAccepts(a, artifact, raw) {
+  return {
+    protocol: "x402",
+    payee: a?.payTo ?? "unknown",
+    amount: {
+      value: a?.amount ?? "0",
+      currency: a ? x402Currency(a.network ?? "unknown", a.asset ?? "unknown") : "unknown"
+    },
+    artifact,
+    raw
+  };
+}
+function payerOf(payload) {
+  const p = payload.payload;
+  const auth = p.authorization;
+  const candidates = [
+    auth?.from,
+    p.from,
+    p.payer,
+    p.signer,
+    p.permit?.owner
+  ];
+  const hit = candidates.find((c) => typeof c === "string" && c.length > 0);
+  return typeof hit === "string" ? hit.toLowerCase() : void 0;
+}
+var x402Moments = {
+  /** The 402 challenge as the buyer saw it. */
+  required(required) {
+    const r = required;
+    return fromAccepts(r.accepts[0], "http-402", toJsonObject(r));
+  },
+  /** The requirements the seller's resource server resolved for a request. */
+  requirements(req) {
+    const r = req;
+    return fromAccepts(r, "http-402", toJsonObject(r));
+  },
+  /** A route's static `accepts` config, before any payment header exists. */
+  route(route, raw) {
+    const accepts = route ?? {};
+    const extra = accepts.extra;
+    return fromAccepts(
+      {
+        payTo: typeof accepts.payTo === "string" ? accepts.payTo : "dynamic",
+        amount: priceValue(accepts.price),
+        network: accepts.network,
+        asset: extra?.asset ?? "route"
+      },
+      "http-402",
+      raw
+    );
+  },
+  /** An in-band ask (MRTR `input_required` or a `_meta` envelope) carrying an x402-style `accepts`. */
+  ask(first, raw) {
+    return fromAccepts(first, "mrtr-input-required", raw);
+  },
+  /** The signed payment the buyer presented. */
+  payload(payload) {
+    const p = payload;
+    const payer = payerOf(p);
+    return {
+      ...fromAccepts(p.accepted, "payment-signature", toJsonObject(p)),
+      ...payer ? { payer } : {}
+    };
+  }
+};
+function priceValue(price) {
+  if (typeof price === "string") return price.replace(/[^0-9.]/g, "") || "0";
+  if (typeof price === "number") return String(price);
+  if (price && typeof price === "object" && typeof price.amount === "string")
+    return price.amount;
+  return "0";
+}
+
+export {
+  x402Currency,
+  payerOf,
+  x402Moments
+};

package/dist/chunk-VM7MK43J.js

@@ -0,0 +1,13 @@
+// src/x402/binding.ts
+var SESSION_EXTENSION = "beltic.sessionId";
+var SESSION_HEADER = "Beltic-Session-Id";
+function sessionIdOf(extensions) {
+  const v = extensions?.[SESSION_EXTENSION];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+
+export {
+  SESSION_EXTENSION,
+  SESSION_HEADER,
+  sessionIdOf
+};

package/dist/chunk-YVMJ5CZX.js

@@ -0,0 +1,95 @@
+import {
+  SESSION_HEADER,
+  sessionIdOf
+} from "./chunk-VM7MK43J.js";
+import {
+  payloadDigest
+} from "./chunk-SFGM7KOG.js";
+import {
+  x402Moments
+} from "./chunk-U5Z5Z2BQ.js";
+import {
+  summaryOf
+} from "./chunk-7G5EHNVW.js";
+import {
+  Verdict
+} from "./chunk-GCKCAKHA.js";
+
+// src/x402/adapter.ts
+function attachX402(beltic, server, http, opts = {}) {
+  const inFlight = /* @__PURE__ */ new Map();
+  const resolveSession = async (bound, ctx) => {
+    const key = opts.correlate?.(ctx) ?? null;
+    return bound ?? (key ? await beltic.correlation.resolve(key) : null);
+  };
+  http?.onProtectedRequest(async (ctx, route) => {
+    if (ctx.paymentHeader) return;
+    const bound = ctx.adapter.getHeader(SESSION_HEADER) ?? ctx.adapter.getHeader(SESSION_HEADER.toLowerCase());
+    const sessionId = await resolveSession(bound ?? null, {
+      path: ctx.path,
+      method: ctx.method,
+      header: (n) => ctx.adapter.getHeader(n)
+    });
+    if (!sessionId) return;
+    const session = await beltic.sessions.ensure(sessionId);
+    const accepts = Array.isArray(route.accepts) ? route.accepts[0] : route.accepts;
+    await session.emit(
+      "payment.requested",
+      x402Moments.route(accepts, {
+        path: ctx.path,
+        method: ctx.method,
+        route: JSON.parse(JSON.stringify(route))
+      })
+    );
+  });
+  server.onBeforeVerify(async (ctx) => {
+    const payload = ctx.paymentPayload;
+    const requirements = ctx.requirements;
+    const sessionId = await resolveSession(sessionIdOf(payload.extensions), {
+      path: payload.resource?.url ?? "",
+      method: "PAY",
+      header: () => void 0
+    });
+    const session = await beltic.sessions.ensure(sessionId);
+    if (session.born === "seller")
+      await session.emit("payment.requested", x402Moments.requirements(requirements));
+    const presented = x402Moments.payload(payload);
+    await session.emit("payment.presented", presented);
+    inFlight.set(payloadDigest(payload), session);
+    const out = await beltic.evaluate(session.id, summaryOf(presented));
+    opts.onDecision?.({
+      sessionId: session.id,
+      decision: out.decision,
+      reasonCodes: out.reasonCodes,
+      born: session.born
+    });
+    const verdict = Verdict.of(out.decision);
+    if (verdict.blocks(beltic.onReview)) {
+      return { abort: true, reason: `BELTIC_${verdict.value}`, message: out.reasonCodes.join(",") };
+    }
+    return;
+  });
+  server.onAfterSettle(async (ctx) => {
+    const key = payloadDigest(ctx.paymentPayload);
+    const session = inFlight.get(key);
+    if (!session) return;
+    inFlight.delete(key);
+    if (ctx.result.success) await session.close("settled", { transaction: ctx.result.transaction });
+  });
+  return { inFlight };
+}
+
+// src/x402/middleware.ts
+import {
+  x402HTTPResourceServer
+} from "@x402/core/server";
+function guardedPaymentMiddleware(fromHTTPServer, beltic, routes, server, opts = {}) {
+  const http = new x402HTTPResourceServer(server, routes);
+  attachX402(beltic, server, http, opts);
+  return fromHTTPServer(http, opts.paywall);
+}
+
+export {
+  attachX402,
+  guardedPaymentMiddleware
+};

package/dist/client-CVx9LgJC.d.ts

@@ -0,0 +1,63 @@
+import { OnReview, PaymentSummary, EvaluateOutput } from './api.js';
+import { a as ApiClient, T as Transport, d as Sessions, A as AgentIdentity, b as ApiClientOptions, g as TransportOptions, R as RedactFn } from './session-BMNB1N1g.js';
+
+/**
+ * Correlation without binding (Fraud SDK RFC › Protocol Adapter — x402:
+ * "binding travels on the call that initiates the purchase, not
+ * necessarily on the payment artifact"). The merchant binds a key it will
+ * see again (a checkout session id, a challenge nonce) to the buyer's
+ * session; the adapter resolves it when the settlement arrives (GAP-31).
+ */
+interface CorrelationStore {
+    bind(key: string, sessionId: string, ttlMs?: number): Promise<void>;
+    resolve(key: string): Promise<string | null>;
+}
+declare class MemoryCorrelationStore implements CorrelationStore {
+    private readonly defaultTtlMs;
+    private readonly entries;
+    constructor(defaultTtlMs?: number);
+    bind(key: string, sessionId: string, ttlMs?: number): Promise<void>;
+    resolve(key: string): Promise<string | null>;
+}
+
+/**
+ * One SDK, two halves (Fraud SDK RFC › Summary). `Beltic` is the single
+ * client: sessions and evidence for both halves, `evaluate` for the seller
+ * half. Protocol integrations are plain functions behind subpath exports,
+ * each pulling exactly one optional peer:
+ *
+ *   @belticlabs/agent-risk-sdk/ai    → middleware(session), wrapTools(session, …)
+ *   @belticlabs/agent-risk-sdk/x402  → belticFetch(session), attachX402(beltic, …)
+ *   @belticlabs/agent-risk-sdk/hono  → belticPaymentMiddleware(beltic, …)   (and /express)
+ *   @belticlabs/agent-risk-sdk/mcp   → wrapClient(session, …), wrapServer(beltic, …)
+ *
+ * Neither half decides risk locally: verdicts are platform-side.
+ */
+
+declare const SDK_VERSION = "0.1.0";
+interface BelticOptions extends Omit<ApiClientOptions, 'userAgent'> {
+    /** Buyer half. Without it, `sessions.start` is unavailable; the seller half works. */
+    identity?: AgentIdentity | undefined;
+    transport?: Partial<TransportOptions> | undefined;
+    /** What a synchronous seller hook does with REVIEW (GAP-52). */
+    onReview?: OnReview | undefined;
+    correlation?: CorrelationStore | undefined;
+    redact?: RedactFn | undefined;
+    now?: (() => Date) | undefined;
+}
+declare class Beltic {
+    readonly api: ApiClient;
+    readonly transport: Transport;
+    readonly sessions: Sessions;
+    readonly identity: AgentIdentity | undefined;
+    readonly correlation: CorrelationStore;
+    readonly onReview: OnReview;
+    constructor(opts: BelticOptions);
+    /** Read-your-writes: the platform must hold the evidence before it judges it (GAP-16). */
+    evaluate(sessionId: string, payment: PaymentSummary): Promise<EvaluateOutput>;
+    flush(): Promise<void>;
+    shutdown(): Promise<void>;
+}
+declare function createBeltic(opts: BelticOptions): Beltic;
+
+export { Beltic as B, type CorrelationStore as C, MemoryCorrelationStore as M, SDK_VERSION as S, type BelticOptions as a, createBeltic as c };

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+export { B as Beltic, a as BelticOptions, C as CorrelationStore, M as MemoryCorrelationStore, S as SDK_VERSION, c as createBeltic } from './client-CVx9LgJC.js';
+import { S as Session } from './session-BMNB1N1g.js';
+export { A as AgentIdentity, a as ApiClient, b as ApiClientOptions, B as BelticApiError, C as ChainRejectedError, D as DEFAULT_TRANSPORT, R as RedactFn, c as SessionBorn, d as Sessions, e as StartSessionInput, T as Transport, f as TransportClosedError, g as TransportOptions, h as ephemeralIdentity, i as fileIdentity, j as identityFromSeed } from './session-BMNB1N1g.js';
+import { PaymentSummary, JsonObject, PaymentMomentPayload } from './api.js';
+import './base58.js';
+
+/**
+ * The shape the platform judges (`PaymentSummary`) and the shape the record
+ * keeps (`PaymentMomentPayload`) share their comparable core: payee, amount,
+ * payer. Every protocol adapter builds moments through here so the two
+ * sides of one purchase compare (`EVIDENCE_MISMATCH`, GAP-50).
+ */
+
+declare function summaryOf(m: PaymentMomentPayload): PaymentSummary;
+/** A presentation the seller side saw as a signed payment, in any protocol. */
+declare function presentedFrom(summary: PaymentSummary, raw: JsonObject): PaymentMomentPayload;
+
+/**
+ * One instrumented call = a `*.start` event, the work, a `*.end` event
+ * carrying the outcome or the error (GAP-07 correlates them by `callId`).
+ * The AI middleware, the tool wrapper and the MCP client all record the
+ * same way.
+ */
+
+type CallKind = 'llm_call' | 'tool_call';
+declare function recordCall<T>(session: Session, kind: CallKind, callId: string, start: JsonObject, run: () => PromiseLike<T>, end?: (result: T) => Promise<JsonObject> | JsonObject): Promise<T>;
+
+export { type CallKind, Session, presentedFrom, recordCall, summaryOf };