@belticlabs/agent-risk-sdk 0.1.1 → 0.3.0

package/dist/adapter-BEpzr2R3.d.ts

@@ -0,0 +1,29 @@
+import { D as Decision } from './verdict-6vCyoAHE.js';
+import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
+import { B as Beltic, n as SessionBorn, a as Session } from './session-DsBWEP8d.js';
+
+interface CorrelationContext {
+    path: string;
+    method: string;
+    header: (name: string) => string | undefined;
+}
+interface AttachOptions {
+    /** A key the merchant will see again at verify time, for delegated flows (GAP-31). */
+    correlate?: ((ctx: CorrelationContext) => string | null) | undefined;
+    /** Called with every decision; the default logs nothing. */
+    onDecision?: ((d: {
+        sessionId: string;
+        decision: Decision;
+        reasonCodes: string[];
+        born: SessionBorn;
+        /** The verdict the buyer says it obtained before presenting (GAP-80), unverified. */
+        buyerDecisionId: string | null;
+    }) => void) | undefined;
+}
+interface AttachedX402 {
+    /** Sessions resolved at verify time, keyed by payment digest — for tests and settle hooks. */
+    readonly inFlight: ReadonlyMap<string, Session>;
+}
+declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer, opts?: AttachOptions): AttachedX402;
+
+export { type AttachOptions as A, type CorrelationContext as C, attachX402 as a, type AttachedX402 as b };

package/dist/ai/index.d.ts

@@ -1,6 +1,6 @@
-import { P as PaymentMomentPayload } from '../index-Bjs3BPPU.js';
+import { P as PaymentMomentPayload } from '../verdict-6vCyoAHE.js';
 import { LanguageModelMiddleware, Tool, ToolSet } from 'ai';
-import { S as Session } from '../session-B2mfurae.js';
+import { S as SessionSource } from '../session-DsBWEP8d.js';
 import 'zod';
 
 interface PaymentMoments {
@@ -12,8 +12,8 @@ interface WrapToolOptions<I = unknown, O = unknown> {
     /** When the tool performs a purchase, map its input/output to the payment moments it produced. */
     payment?: (input: I, output: O) => PaymentMoments | null;
 }
-declare function middleware(session: Session): LanguageModelMiddleware;
-declare function wrapTool<T extends Tool>(session: Session, tool: T, opts?: WrapToolOptions): T;
-declare function wrapTools<T extends ToolSet>(session: Session, tools: T, opts?: Record<string, WrapToolOptions>): T;
+declare function middleware(source: SessionSource): LanguageModelMiddleware;
+declare function wrapTool<T extends Tool>(source: SessionSource, tool: T, opts?: WrapToolOptions): T;
+declare function wrapTools<T extends ToolSet>(source: SessionSource, tools: T, opts?: Record<string, WrapToolOptions>): T;
 
 export { type PaymentMoments, type WrapToolOptions, middleware, wrapTool, wrapTools };

package/dist/ai/index.js

@@ -1,14 +1,15 @@
 import {
+  Sessions,
   recordCall
-} from "../chunk-5TWO73OD.js";
+} from "../chunk-4MG6VNAU.js";
 import {
   uuidv7
-} from "../chunk-SFGM7KOG.js";
+} from "../chunk-X3W2Z5GC.js";
+import "../chunk-46QN2KEZ.js";
 import {
   toJson,
   toJsonObject
 } from "../chunk-FQDHFTVR.js";
-import "../chunk-46QN2KEZ.js";
 
 // src/ai/index.ts
 var PARAM_KEYS = [
@@ -23,22 +24,29 @@ var PARAM_KEYS = [
   "responseFormat",
   "stopSequences"
 ];
-function middleware(session) {
+function middleware(source) {
+  if (!source) return {};
   return {
-    wrapGenerate: ({ doGenerate, params, model }) => recordCall(
-      session,
-      "llm_call",
-      uuidv7(),
-      { provider: model.provider, modelId: model.modelId, params: pick(params) },
-      doGenerate,
-      (result) => ({
-        content: toJson(result.content),
-        finishReason: result.finishReason.unified,
-        usage: toJsonObject(result.usage)
-      })
-    ),
+    wrapGenerate: async ({ doGenerate, params, model }) => {
+      const session = await Sessions.resolve(source);
+      if (!session) return doGenerate();
+      return recordCall(
+        session,
+        "llm_call",
+        uuidv7(),
+        { provider: model.provider, modelId: model.modelId, params: pick(params) },
+        doGenerate,
+        (result) => ({
+          content: toJson(result.content),
+          finishReason: result.finishReason.unified,
+          usage: toJsonObject(result.usage)
+        })
+      );
+    },
     // A stream ends when it drains, not when doStream resolves — so its end is emitted at flush.
     wrapStream: async ({ doStream, params, model }) => {
+      const session = await Sessions.resolve(source);
+      if (!session) return doStream();
       const callId = uuidv7();
       const started = Date.now();
       await session.emit("llm_call.start", {
@@ -72,32 +80,36 @@ function middleware(session) {
     }
   };
 }
-function wrapTool(session, tool, opts = {}) {
-  if (!tool.execute) return tool;
+function wrapTool(source, tool, opts = {}) {
+  if (!source || !tool.execute) return tool;
   const original = tool.execute;
   const toolName = opts.name ?? tool.name ?? "tool";
-  const execute = (input, options) => recordCall(
-    session,
-    "tool_call",
-    options?.toolCallId ?? uuidv7(),
-    { toolName, input: toJson(input), transport: "local" },
-    async () => {
-      const output = await original(input, options);
-      return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;
-    },
-    async (output) => {
-      const moments = opts.payment?.(input, output) ?? null;
-      if (moments?.requested) await session.emit("payment.requested", moments.requested);
-      if (moments?.presented) await session.emit("payment.presented", moments.presented);
-      return { output: toJson(output) };
-    }
-  );
+  const execute = async (input, options) => {
+    const session = await Sessions.resolve(source);
+    if (!session) return original(input, options);
+    return recordCall(
+      session,
+      "tool_call",
+      options?.toolCallId ?? uuidv7(),
+      { toolName, input: toJson(input), transport: "local" },
+      async () => {
+        const output = await original(input, options);
+        return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;
+      },
+      async (output) => {
+        const moments = opts.payment?.(input, output) ?? null;
+        if (moments?.requested) await session.emit("payment.requested", moments.requested);
+        if (moments?.presented) await session.emit("payment.presented", moments.presented);
+        return { output: toJson(output) };
+      }
+    );
+  };
   return { ...tool, execute };
 }
-function wrapTools(session, tools, opts = {}) {
+function wrapTools(source, tools, opts = {}) {
   const out = {};
   for (const [name, tool] of Object.entries(tools))
-    out[name] = wrapTool(session, tool, { name, ...opts[name] });
+    out[name] = wrapTool(source, tool, { name, ...opts[name] });
   return out;
 }
 function pick(params) {

package/dist/chunk-4MG6VNAU.js

@@ -0,0 +1,276 @@
+import {
+  Chain
+} from "./chunk-X3W2Z5GC.js";
+
+// src/core/disabled-error.ts
+var BelticDisabledError = class extends Error {
+  code = "SDK_DISABLED";
+  constructor(entry) {
+    super(`${entry} needs a configured client: this Beltic is disabled (no BELTIC_* configured)`);
+    this.name = "BelticDisabledError";
+  }
+};
+
+// src/core/record.ts
+function errorOf(err) {
+  const e = err;
+  return { name: String(e?.name ?? "Error"), message: String(e?.message ?? err) };
+}
+function openCall(session, kind, callId, start) {
+  const started = Date.now();
+  const opened = session.emit(`${kind}.start`, { callId, ...start });
+  const close = async (outcome) => {
+    await opened;
+    return session.emit(
+      `${kind}.end`,
+      { callId, ...outcome, durationMs: Date.now() - started }
+    );
+  };
+  return {
+    callId,
+    opened,
+    end: (outcome = {}) => close(outcome),
+    fail: (error, outcome = {}) => close({ error: errorOf(error), ...outcome })
+  };
+}
+async function recordCall(session, kind, callId, start, run, end = () => ({})) {
+  const span = openCall(session, kind, callId, start);
+  await span.opened;
+  try {
+    const result = await run();
+    await span.end(await end(result));
+    return result;
+  } catch (err) {
+    await span.fail(err);
+    throw err;
+  }
+}
+
+// src/core/session.ts
+var Session = class {
+  constructor(deps, id, source, expiresAt, born) {
+    this.deps = deps;
+    this.id = id;
+    this.source = source;
+    this.expiresAt = expiresAt;
+    this.born = born;
+    this.chain = Chain.genesis(id, source);
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  chain;
+  building = Promise.resolve();
+  dropped = 0;
+  droppedFirstTs = null;
+  droppedLastTs = null;
+  closed = false;
+  now;
+  get head() {
+    return this.chain.head;
+  }
+  get droppedCount() {
+    return this.dropped;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  /**
+   * Resolves once the event is sequenced and buffered — not once it is
+   * acknowledged. `false` when the event was dropped, or (fail-open) when
+   * the chain can no longer take it.
+   */
+  async emit(kind, payload) {
+    if (!this.deps.failOpen) return this.chainEvent(kind, payload);
+    try {
+      return await this.chainEvent(kind, payload);
+    } catch (err) {
+      this.deps.onError?.(err);
+      return false;
+    }
+  }
+  /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+  toolCall(call) {
+    const { callId, ...start } = call;
+    return openCall(this, "tool_call", callId, { transport: "local", ...start });
+  }
+  async chainEvent(kind, payload) {
+    const halted = this.deps.transport.haltedError(this.id, this.source);
+    if (halted) throw halted;
+    const ts = this.now().toISOString();
+    if (!this.deps.transport.hasRoom()) {
+      this.dropped++;
+      this.droppedFirstTs ??= ts;
+      this.droppedLastTs = ts;
+      return false;
+    }
+    if (this.dropped > 0) {
+      this.deps.transport.enqueue(
+        await this.next(
+          "transport.gap",
+          { dropped: this.dropped, firstTs: this.droppedFirstTs, lastTs: this.droppedLastTs },
+          ts
+        )
+      );
+      this.dropped = 0;
+      this.droppedFirstTs = this.droppedLastTs = null;
+    }
+    const body = payload;
+    this.deps.transport.enqueue(
+      await this.next(kind, this.deps.redact ? this.deps.redact(kind, body) : body, ts)
+    );
+    return true;
+  }
+  async close(reason = "completed", extra = {}) {
+    if (this.closed) return;
+    this.closed = true;
+    await this.emit("session.close", { reason, ...extra });
+    await this.flush();
+    this.deps.onClosed?.(this);
+  }
+  /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
+  flush() {
+    return this.deps.transport.flush();
+  }
+  /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
+  next(kind, payload, ts) {
+    const run = this.building.then(async () => {
+      const built = await this.chain.append({ ts, kind, payload }, this.deps.signer);
+      this.chain = built.chain;
+      return built.event;
+    });
+    this.building = run.catch(() => void 0);
+    return run;
+  }
+};
+var DEFAULT_OPEN_RETRY_MS = 6e4;
+var Sessions = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * One session object per (session, source) per process: a chain's head
+   * lives in it, so two objects for the same chain would both start at
+   * seq 0 and fork it. Closed sessions are forgotten; a process restart
+   * mid-session still loses the head (GAP-67).
+   */
+  attached = /* @__PURE__ */ new Map();
+  /** Buyer sessions by the host's own key (GAP-71). */
+  opened = /* @__PURE__ */ new Map();
+  retryAt = 0;
+  /** The session behind a source: itself, or the one the run opens (null when there is none). */
+  static resolve(source) {
+    if (!source) return Promise.resolve(null);
+    return source instanceof Session ? Promise.resolve(source) : source.session();
+  }
+  /**
+   * Buyer half: the evidence session for a key of the host's own (its
+   * session, run or conversation id), opened on first use and reused
+   * after. A halted chain is reopened as a fresh session that continues
+   * the same key; a closed key is forgotten. When the platform refuses to
+   * open one, a fail-open client resolves null — the host runs without
+   * evidence — until `openRetryMs` has passed (GAP-71); otherwise the
+   * refusal is thrown and the next call tries again. The identity is
+   * required either way: that is configuration.
+   */
+  open(key, input = {}) {
+    if (this.deps.enabled === false) return Promise.resolve(null);
+    const prior = this.opened.get(key) ?? Promise.resolve(null);
+    const next = prior.catch(() => null).then(
+      (session) => session && !session.isClosed && !this.deps.transport.haltedError(session.id, session.source) ? session : this.openFresh(input, () => this.forget(key, next))
+    );
+    this.opened.set(key, next);
+    next.catch(() => this.forget(key, next));
+    return next;
+  }
+  forget(key, entry) {
+    if (this.opened.get(key) === entry) this.opened.delete(key);
+  }
+  async openFresh(input, onClosed) {
+    this.identityFor("open");
+    const create = async () => this.create(typeof input === "function" ? await input() : input, onClosed);
+    if (!this.deps.failOpen) return create();
+    if (Date.now() < this.retryAt) return null;
+    try {
+      const session = await create();
+      this.retryAt = 0;
+      return session;
+    } catch (err) {
+      this.retryAt = Date.now() + (this.deps.openRetryMs ?? DEFAULT_OPEN_RETRY_MS);
+      this.deps.onError?.(err);
+      return null;
+    }
+  }
+  /** Buyer half: create an AGENT_TRACE session bound to the agent identity, then announce it on the chain. */
+  start(input = {}) {
+    if (this.deps.enabled === false)
+      return Promise.reject(new BelticDisabledError("sessions.start"));
+    return this.create(input);
+  }
+  identityFor(entry) {
+    const identity = this.deps.identity;
+    if (!identity)
+      throw new Error(`sessions.${entry} needs an agent identity (createBeltic({ identity }))`);
+    return identity;
+  }
+  async create(input, onClosed) {
+    const identity = this.identityFor("start");
+    const body = {
+      source: "AGENT_TRACE",
+      agent: { did: identity.did, credential: identity.credential ?? identity.did },
+      ...input.intent ? { intent: input.intent } : {}
+    };
+    const out = await this.deps.api.post("/v1/sessions", body);
+    const session = this.attach(out.sessionId, "AGENT_TRACE", out.expiresAt, "buyer", onClosed);
+    await session.emit("session.open", {
+      runtime: {
+        sdk: "@belticlabs/agent-risk-sdk",
+        version: this.deps.sdkVersion,
+        ...input.runtime
+      },
+      ...input.attestations ? { attestations: input.attestations } : {}
+    });
+    if (input.intent) await session.emit("intent.declared", input.intent);
+    return session;
+  }
+  /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
+  async ensure(sessionId) {
+    if (this.deps.enabled === false) throw new BelticDisabledError("sessions.ensure");
+    if (sessionId) return this.attach(sessionId, "INTERNAL_NETWORK", null, "buyer");
+    const out = await this.deps.api.post("/v1/sessions", {
+      source: "INTERNAL_NETWORK"
+    });
+    return this.attach(out.sessionId, "INTERNAL_NETWORK", out.expiresAt, "seller");
+  }
+  attach(id, source, expiresAt, born, onClosed) {
+    const key = `${id}:${source}`;
+    const existing = this.attached.get(key);
+    if (existing) return existing;
+    const session = new Session(
+      {
+        transport: this.deps.transport,
+        signer: source === "AGENT_TRACE" ? this.deps.identity?.signer : void 0,
+        redact: this.deps.redact,
+        now: this.deps.now,
+        failOpen: this.deps.failOpen,
+        onError: this.deps.onError,
+        onClosed: () => {
+          this.attached.delete(key);
+          onClosed?.();
+        }
+      },
+      id,
+      source,
+      expiresAt,
+      born
+    );
+    this.attached.set(key, session);
+    return session;
+  }
+};
+
+export {
+  BelticDisabledError,
+  recordCall,
+  Session,
+  DEFAULT_OPEN_RETRY_MS,
+  Sessions
+};

package/dist/chunk-FAQ442YH.js

@@ -0,0 +1,24 @@
+// src/x402/binding.ts
+var SESSION_EXTENSION = "beltic.sessionId";
+var SESSION_HEADER = "Beltic-Session-Id";
+var DECISION_EXTENSION = "beltic.decisionId";
+var DECISION_HEADER = "Beltic-Decision-Id";
+function sessionIdOf(extensions) {
+  return stringAt(extensions, SESSION_EXTENSION);
+}
+function decisionIdOf(extensions) {
+  return stringAt(extensions, DECISION_EXTENSION);
+}
+function stringAt(extensions, key) {
+  const v = extensions?.[key];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+
+export {
+  SESSION_EXTENSION,
+  SESSION_HEADER,
+  DECISION_EXTENSION,
+  DECISION_HEADER,
+  sessionIdOf,
+  decisionIdOf
+};

package/dist/{chunk-U5Z5Z2BQ.js → chunk-LM4NIYE5.js}

@@ -6,20 +6,23 @@ import {
 function x402Currency(network, asset) {
   return `${network}/${asset}`;
 }
-function fromAccepts(a, artifact, raw) {
+function x402Summary(accepts, opts = {}) {
+  const payer = opts.payer?.toLowerCase();
   return {
     protocol: "x402",
-    payee: a?.payTo ?? "unknown",
+    payee: accepts?.payTo ?? "unknown",
     amount: {
-      value: a?.amount ?? "0",
-      currency: a ? x402Currency(a.network ?? "unknown", a.asset ?? "unknown") : "unknown"
+      value: accepts?.amount ?? accepts?.maxAmountRequired ?? "0",
+      currency: accepts ? x402Currency(accepts.network ?? "unknown", accepts.asset ?? "unknown") : "unknown"
     },
-    artifact,
-    raw
+    ...payer ? { payer } : {}
   };
 }
+function fromAccepts(a, artifact, raw, payer) {
+  return { ...x402Summary(a, { payer }), artifact, raw };
+}
 function payerOf(payload) {
-  const p = payload.payload;
+  const p = payload.payload ?? {};
   const auth = p.authorization;
   const candidates = [
     auth?.from,
@@ -32,15 +35,13 @@ function payerOf(payload) {
   return typeof hit === "string" ? hit.toLowerCase() : void 0;
 }
 var x402Moments = {
-  /** The 402 challenge as the buyer saw it. */
+  /** The 402 challenge as the buyer saw it, v2 header or v1 body. */
   required(required) {
-    const r = required;
-    return fromAccepts(r.accepts[0], "http-402", toJsonObject(r));
+    return fromAccepts(required.accepts?.[0], "http-402", toJsonObject(required));
   },
   /** The requirements the seller's resource server resolved for a request. */
   requirements(req) {
-    const r = req;
-    return fromAccepts(r, "http-402", toJsonObject(r));
+    return fromAccepts(req, "http-402", toJsonObject(req));
   },
   /** A route's static `accepts` config, before any payment header exists. */
   route(route, raw) {
@@ -61,14 +62,18 @@ var x402Moments = {
   ask(first, raw) {
     return fromAccepts(first, "mrtr-input-required", raw);
   },
-  /** The signed payment the buyer presented. */
-  payload(payload) {
-    const p = payload;
-    const payer = payerOf(p);
-    return {
-      ...fromAccepts(p.accepted, "payment-signature", toJsonObject(p)),
-      ...payer ? { payer } : {}
-    };
+  /**
+   * The signed payment the buyer presented. A v2 payload carries the
+   * requirement it accepted; a v1 payload does not, so the caller passes
+   * the `accepts` entry it answered.
+   */
+  payload(payload, accepts) {
+    return fromAccepts(
+      accepts ?? payload.accepted,
+      "payment-signature",
+      toJsonObject(payload),
+      payerOf(payload)
+    );
   }
 };
 function priceValue(price) {
@@ -81,6 +86,7 @@ function priceValue(price) {
 
 export {
   x402Currency,
+  x402Summary,
   payerOf,
   x402Moments
 };

package/dist/chunk-NJVO2WIV.js

@@ -0,0 +1,17 @@
+import {
+  attachX402
+} from "./chunk-OKC6VMFH.js";
+
+// src/x402/middleware.ts
+import {
+  x402HTTPResourceServer
+} from "@x402/core/server";
+function guardedPaymentMiddleware(fromHTTPServer, beltic, routes, server, opts = {}) {
+  const http = new x402HTTPResourceServer(server, routes);
+  attachX402(beltic, server, http, opts);
+  return fromHTTPServer(http, opts.paywall);
+}
+
+export {
+  guardedPaymentMiddleware
+};

package/dist/{chunk-W2OY7QXV.js → chunk-OKC6VMFH.js}

@@ -1,19 +1,14 @@
 import {
   SESSION_HEADER,
+  decisionIdOf,
   sessionIdOf
-} from "./chunk-VM7MK43J.js";
+} from "./chunk-FAQ442YH.js";
 import {
   payloadDigest
-} from "./chunk-SFGM7KOG.js";
+} from "./chunk-X3W2Z5GC.js";
 import {
   x402Moments
-} from "./chunk-U5Z5Z2BQ.js";
-import {
-  summaryOf
-} from "./chunk-7G5EHNVW.js";
-import {
-  Verdict
-} from "./chunk-46QN2KEZ.js";
+} from "./chunk-LM4NIYE5.js";
 
 // src/x402/adapter.ts
 function attachX402(beltic, server, http, opts = {}) {
@@ -56,16 +51,21 @@ function attachX402(beltic, server, http, opts = {}) {
     const presented = x402Moments.payload(payload);
     await session.emit("payment.presented", presented);
     inFlight.set(payloadDigest(payload), session);
-    const out = await beltic.evaluate(session.id, summaryOf(presented));
+    const out = await beltic.evaluate(session.id, presented);
+    if (!out) return;
     opts.onDecision?.({
       sessionId: session.id,
       decision: out.decision,
       reasonCodes: out.reasonCodes,
-      born: session.born
+      born: session.born,
+      buyerDecisionId: decisionIdOf(payload.extensions)
     });
-    const verdict = Verdict.of(out.decision);
-    if (verdict.blocks(beltic.onReview)) {
-      return { abort: true, reason: `BELTIC_${verdict.value}`, message: out.reasonCodes.join(",") };
+    if (out.verdict.blocks(beltic.onReview)) {
+      return {
+        abort: true,
+        reason: `BELTIC_${out.verdict.value}`,
+        message: out.reasonCodes.join(",")
+      };
     }
     return;
   });
@@ -79,17 +79,6 @@ function attachX402(beltic, server, http, opts = {}) {
   return { inFlight };
 }
 
-// src/x402/middleware.ts
-import {
-  x402HTTPResourceServer
-} from "@x402/core/server";
-function guardedPaymentMiddleware(fromHTTPServer, beltic, routes, server, opts = {}) {
-  const http = new x402HTTPResourceServer(server, routes);
-  attachX402(beltic, server, http, opts);
-  return fromHTTPServer(http, opts.paywall);
-}
-
 export {
-  attachX402,
-  guardedPaymentMiddleware
+  attachX402
 };

package/dist/{chunk-SFGM7KOG.js → chunk-X3W2Z5GC.js}

@@ -304,6 +304,9 @@ function didKeyFromEd25519(publicKey) {
 export {
   toHex,
   fromHex,
+  sha256,
+  canonicalize,
+  canonicalBytes,
   payloadDigest,
   memorySigner,
   Chain,