@belticlabs/agent-risk-sdk 0.2.0 → 0.3.0

package/dist/{adapter-CF-cUYSA.d.ts → adapter-BEpzr2R3.d.ts}

@@ -1,7 +1,6 @@
-import { D as Decision } from './index-Bjs3BPPU.js';
+import { D as Decision } from './verdict-6vCyoAHE.js';
 import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
-import { B as Beltic } from './client-C-mV_3A0.js';
-import { d as SessionBorn, S as Session } from './session-5TClPLI4.js';
+import { B as Beltic, n as SessionBorn, a as Session } from './session-DsBWEP8d.js';
 
 interface CorrelationContext {
     path: string;
@@ -17,6 +16,8 @@ interface AttachOptions {
         decision: Decision;
         reasonCodes: string[];
         born: SessionBorn;
+        /** The verdict the buyer says it obtained before presenting (GAP-80), unverified. */
+        buyerDecisionId: string | null;
     }) => void) | undefined;
 }
 interface AttachedX402 {

package/dist/ai/index.d.ts

@@ -1,6 +1,6 @@
-import { P as PaymentMomentPayload } from '../index-Bjs3BPPU.js';
+import { P as PaymentMomentPayload } from '../verdict-6vCyoAHE.js';
 import { LanguageModelMiddleware, Tool, ToolSet } from 'ai';
-import { S as Session } from '../session-5TClPLI4.js';
+import { S as SessionSource } from '../session-DsBWEP8d.js';
 import 'zod';
 
 interface PaymentMoments {
@@ -12,8 +12,8 @@ interface WrapToolOptions<I = unknown, O = unknown> {
     /** When the tool performs a purchase, map its input/output to the payment moments it produced. */
     payment?: (input: I, output: O) => PaymentMoments | null;
 }
-declare function middleware(session: Session | null | undefined): LanguageModelMiddleware;
-declare function wrapTool<T extends Tool>(session: Session | null | undefined, tool: T, opts?: WrapToolOptions): T;
-declare function wrapTools<T extends ToolSet>(session: Session | null | undefined, tools: T, opts?: Record<string, WrapToolOptions>): T;
+declare function middleware(source: SessionSource): LanguageModelMiddleware;
+declare function wrapTool<T extends Tool>(source: SessionSource, tool: T, opts?: WrapToolOptions): T;
+declare function wrapTools<T extends ToolSet>(source: SessionSource, tools: T, opts?: Record<string, WrapToolOptions>): T;
 
 export { type PaymentMoments, type WrapToolOptions, middleware, wrapTool, wrapTools };

package/dist/ai/index.js

@@ -1,9 +1,10 @@
 import {
+  Sessions,
   recordCall
-} from "../chunk-GSH5APZW.js";
+} from "../chunk-4MG6VNAU.js";
 import {
   uuidv7
-} from "../chunk-SFGM7KOG.js";
+} from "../chunk-X3W2Z5GC.js";
 import "../chunk-46QN2KEZ.js";
 import {
   toJson,
@@ -23,23 +24,29 @@ var PARAM_KEYS = [
   "responseFormat",
   "stopSequences"
 ];
-function middleware(session) {
-  if (!session) return {};
+function middleware(source) {
+  if (!source) return {};
   return {
-    wrapGenerate: ({ doGenerate, params, model }) => recordCall(
-      session,
-      "llm_call",
-      uuidv7(),
-      { provider: model.provider, modelId: model.modelId, params: pick(params) },
-      doGenerate,
-      (result) => ({
-        content: toJson(result.content),
-        finishReason: result.finishReason.unified,
-        usage: toJsonObject(result.usage)
-      })
-    ),
+    wrapGenerate: async ({ doGenerate, params, model }) => {
+      const session = await Sessions.resolve(source);
+      if (!session) return doGenerate();
+      return recordCall(
+        session,
+        "llm_call",
+        uuidv7(),
+        { provider: model.provider, modelId: model.modelId, params: pick(params) },
+        doGenerate,
+        (result) => ({
+          content: toJson(result.content),
+          finishReason: result.finishReason.unified,
+          usage: toJsonObject(result.usage)
+        })
+      );
+    },
     // A stream ends when it drains, not when doStream resolves — so its end is emitted at flush.
     wrapStream: async ({ doStream, params, model }) => {
+      const session = await Sessions.resolve(source);
+      if (!session) return doStream();
       const callId = uuidv7();
       const started = Date.now();
       await session.emit("llm_call.start", {
@@ -73,32 +80,36 @@ function middleware(session) {
     }
   };
 }
-function wrapTool(session, tool, opts = {}) {
-  if (!session || !tool.execute) return tool;
+function wrapTool(source, tool, opts = {}) {
+  if (!source || !tool.execute) return tool;
   const original = tool.execute;
   const toolName = opts.name ?? tool.name ?? "tool";
-  const execute = (input, options) => recordCall(
-    session,
-    "tool_call",
-    options?.toolCallId ?? uuidv7(),
-    { toolName, input: toJson(input), transport: "local" },
-    async () => {
-      const output = await original(input, options);
-      return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;
-    },
-    async (output) => {
-      const moments = opts.payment?.(input, output) ?? null;
-      if (moments?.requested) await session.emit("payment.requested", moments.requested);
-      if (moments?.presented) await session.emit("payment.presented", moments.presented);
-      return { output: toJson(output) };
-    }
-  );
+  const execute = async (input, options) => {
+    const session = await Sessions.resolve(source);
+    if (!session) return original(input, options);
+    return recordCall(
+      session,
+      "tool_call",
+      options?.toolCallId ?? uuidv7(),
+      { toolName, input: toJson(input), transport: "local" },
+      async () => {
+        const output = await original(input, options);
+        return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;
+      },
+      async (output) => {
+        const moments = opts.payment?.(input, output) ?? null;
+        if (moments?.requested) await session.emit("payment.requested", moments.requested);
+        if (moments?.presented) await session.emit("payment.presented", moments.presented);
+        return { output: toJson(output) };
+      }
+    );
+  };
   return { ...tool, execute };
 }
-function wrapTools(session, tools, opts = {}) {
+function wrapTools(source, tools, opts = {}) {
   const out = {};
   for (const [name, tool] of Object.entries(tools))
-    out[name] = wrapTool(session, tool, { name, ...opts[name] });
+    out[name] = wrapTool(source, tool, { name, ...opts[name] });
   return out;
 }
 function pick(params) {

package/dist/chunk-4MG6VNAU.js

@@ -0,0 +1,276 @@
+import {
+  Chain
+} from "./chunk-X3W2Z5GC.js";
+
+// src/core/disabled-error.ts
+var BelticDisabledError = class extends Error {
+  code = "SDK_DISABLED";
+  constructor(entry) {
+    super(`${entry} needs a configured client: this Beltic is disabled (no BELTIC_* configured)`);
+    this.name = "BelticDisabledError";
+  }
+};
+
+// src/core/record.ts
+function errorOf(err) {
+  const e = err;
+  return { name: String(e?.name ?? "Error"), message: String(e?.message ?? err) };
+}
+function openCall(session, kind, callId, start) {
+  const started = Date.now();
+  const opened = session.emit(`${kind}.start`, { callId, ...start });
+  const close = async (outcome) => {
+    await opened;
+    return session.emit(
+      `${kind}.end`,
+      { callId, ...outcome, durationMs: Date.now() - started }
+    );
+  };
+  return {
+    callId,
+    opened,
+    end: (outcome = {}) => close(outcome),
+    fail: (error, outcome = {}) => close({ error: errorOf(error), ...outcome })
+  };
+}
+async function recordCall(session, kind, callId, start, run, end = () => ({})) {
+  const span = openCall(session, kind, callId, start);
+  await span.opened;
+  try {
+    const result = await run();
+    await span.end(await end(result));
+    return result;
+  } catch (err) {
+    await span.fail(err);
+    throw err;
+  }
+}
+
+// src/core/session.ts
+var Session = class {
+  constructor(deps, id, source, expiresAt, born) {
+    this.deps = deps;
+    this.id = id;
+    this.source = source;
+    this.expiresAt = expiresAt;
+    this.born = born;
+    this.chain = Chain.genesis(id, source);
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  chain;
+  building = Promise.resolve();
+  dropped = 0;
+  droppedFirstTs = null;
+  droppedLastTs = null;
+  closed = false;
+  now;
+  get head() {
+    return this.chain.head;
+  }
+  get droppedCount() {
+    return this.dropped;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  /**
+   * Resolves once the event is sequenced and buffered — not once it is
+   * acknowledged. `false` when the event was dropped, or (fail-open) when
+   * the chain can no longer take it.
+   */
+  async emit(kind, payload) {
+    if (!this.deps.failOpen) return this.chainEvent(kind, payload);
+    try {
+      return await this.chainEvent(kind, payload);
+    } catch (err) {
+      this.deps.onError?.(err);
+      return false;
+    }
+  }
+  /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+  toolCall(call) {
+    const { callId, ...start } = call;
+    return openCall(this, "tool_call", callId, { transport: "local", ...start });
+  }
+  async chainEvent(kind, payload) {
+    const halted = this.deps.transport.haltedError(this.id, this.source);
+    if (halted) throw halted;
+    const ts = this.now().toISOString();
+    if (!this.deps.transport.hasRoom()) {
+      this.dropped++;
+      this.droppedFirstTs ??= ts;
+      this.droppedLastTs = ts;
+      return false;
+    }
+    if (this.dropped > 0) {
+      this.deps.transport.enqueue(
+        await this.next(
+          "transport.gap",
+          { dropped: this.dropped, firstTs: this.droppedFirstTs, lastTs: this.droppedLastTs },
+          ts
+        )
+      );
+      this.dropped = 0;
+      this.droppedFirstTs = this.droppedLastTs = null;
+    }
+    const body = payload;
+    this.deps.transport.enqueue(
+      await this.next(kind, this.deps.redact ? this.deps.redact(kind, body) : body, ts)
+    );
+    return true;
+  }
+  async close(reason = "completed", extra = {}) {
+    if (this.closed) return;
+    this.closed = true;
+    await this.emit("session.close", { reason, ...extra });
+    await this.flush();
+    this.deps.onClosed?.(this);
+  }
+  /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
+  flush() {
+    return this.deps.transport.flush();
+  }
+  /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
+  next(kind, payload, ts) {
+    const run = this.building.then(async () => {
+      const built = await this.chain.append({ ts, kind, payload }, this.deps.signer);
+      this.chain = built.chain;
+      return built.event;
+    });
+    this.building = run.catch(() => void 0);
+    return run;
+  }
+};
+var DEFAULT_OPEN_RETRY_MS = 6e4;
+var Sessions = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * One session object per (session, source) per process: a chain's head
+   * lives in it, so two objects for the same chain would both start at
+   * seq 0 and fork it. Closed sessions are forgotten; a process restart
+   * mid-session still loses the head (GAP-67).
+   */
+  attached = /* @__PURE__ */ new Map();
+  /** Buyer sessions by the host's own key (GAP-71). */
+  opened = /* @__PURE__ */ new Map();
+  retryAt = 0;
+  /** The session behind a source: itself, or the one the run opens (null when there is none). */
+  static resolve(source) {
+    if (!source) return Promise.resolve(null);
+    return source instanceof Session ? Promise.resolve(source) : source.session();
+  }
+  /**
+   * Buyer half: the evidence session for a key of the host's own (its
+   * session, run or conversation id), opened on first use and reused
+   * after. A halted chain is reopened as a fresh session that continues
+   * the same key; a closed key is forgotten. When the platform refuses to
+   * open one, a fail-open client resolves null — the host runs without
+   * evidence — until `openRetryMs` has passed (GAP-71); otherwise the
+   * refusal is thrown and the next call tries again. The identity is
+   * required either way: that is configuration.
+   */
+  open(key, input = {}) {
+    if (this.deps.enabled === false) return Promise.resolve(null);
+    const prior = this.opened.get(key) ?? Promise.resolve(null);
+    const next = prior.catch(() => null).then(
+      (session) => session && !session.isClosed && !this.deps.transport.haltedError(session.id, session.source) ? session : this.openFresh(input, () => this.forget(key, next))
+    );
+    this.opened.set(key, next);
+    next.catch(() => this.forget(key, next));
+    return next;
+  }
+  forget(key, entry) {
+    if (this.opened.get(key) === entry) this.opened.delete(key);
+  }
+  async openFresh(input, onClosed) {
+    this.identityFor("open");
+    const create = async () => this.create(typeof input === "function" ? await input() : input, onClosed);
+    if (!this.deps.failOpen) return create();
+    if (Date.now() < this.retryAt) return null;
+    try {
+      const session = await create();
+      this.retryAt = 0;
+      return session;
+    } catch (err) {
+      this.retryAt = Date.now() + (this.deps.openRetryMs ?? DEFAULT_OPEN_RETRY_MS);
+      this.deps.onError?.(err);
+      return null;
+    }
+  }
+  /** Buyer half: create an AGENT_TRACE session bound to the agent identity, then announce it on the chain. */
+  start(input = {}) {
+    if (this.deps.enabled === false)
+      return Promise.reject(new BelticDisabledError("sessions.start"));
+    return this.create(input);
+  }
+  identityFor(entry) {
+    const identity = this.deps.identity;
+    if (!identity)
+      throw new Error(`sessions.${entry} needs an agent identity (createBeltic({ identity }))`);
+    return identity;
+  }
+  async create(input, onClosed) {
+    const identity = this.identityFor("start");
+    const body = {
+      source: "AGENT_TRACE",
+      agent: { did: identity.did, credential: identity.credential ?? identity.did },
+      ...input.intent ? { intent: input.intent } : {}
+    };
+    const out = await this.deps.api.post("/v1/sessions", body);
+    const session = this.attach(out.sessionId, "AGENT_TRACE", out.expiresAt, "buyer", onClosed);
+    await session.emit("session.open", {
+      runtime: {
+        sdk: "@belticlabs/agent-risk-sdk",
+        version: this.deps.sdkVersion,
+        ...input.runtime
+      },
+      ...input.attestations ? { attestations: input.attestations } : {}
+    });
+    if (input.intent) await session.emit("intent.declared", input.intent);
+    return session;
+  }
+  /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
+  async ensure(sessionId) {
+    if (this.deps.enabled === false) throw new BelticDisabledError("sessions.ensure");
+    if (sessionId) return this.attach(sessionId, "INTERNAL_NETWORK", null, "buyer");
+    const out = await this.deps.api.post("/v1/sessions", {
+      source: "INTERNAL_NETWORK"
+    });
+    return this.attach(out.sessionId, "INTERNAL_NETWORK", out.expiresAt, "seller");
+  }
+  attach(id, source, expiresAt, born, onClosed) {
+    const key = `${id}:${source}`;
+    const existing = this.attached.get(key);
+    if (existing) return existing;
+    const session = new Session(
+      {
+        transport: this.deps.transport,
+        signer: source === "AGENT_TRACE" ? this.deps.identity?.signer : void 0,
+        redact: this.deps.redact,
+        now: this.deps.now,
+        failOpen: this.deps.failOpen,
+        onError: this.deps.onError,
+        onClosed: () => {
+          this.attached.delete(key);
+          onClosed?.();
+        }
+      },
+      id,
+      source,
+      expiresAt,
+      born
+    );
+    this.attached.set(key, session);
+    return session;
+  }
+};
+
+export {
+  BelticDisabledError,
+  recordCall,
+  Session,
+  DEFAULT_OPEN_RETRY_MS,
+  Sessions
+};

package/dist/chunk-FAQ442YH.js

@@ -0,0 +1,24 @@
+// src/x402/binding.ts
+var SESSION_EXTENSION = "beltic.sessionId";
+var SESSION_HEADER = "Beltic-Session-Id";
+var DECISION_EXTENSION = "beltic.decisionId";
+var DECISION_HEADER = "Beltic-Decision-Id";
+function sessionIdOf(extensions) {
+  return stringAt(extensions, SESSION_EXTENSION);
+}
+function decisionIdOf(extensions) {
+  return stringAt(extensions, DECISION_EXTENSION);
+}
+function stringAt(extensions, key) {
+  const v = extensions?.[key];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+
+export {
+  SESSION_EXTENSION,
+  SESSION_HEADER,
+  DECISION_EXTENSION,
+  DECISION_HEADER,
+  sessionIdOf,
+  decisionIdOf
+};

package/dist/{chunk-U7HM37CB.js → chunk-NJVO2WIV.js}

@@ -1,6 +1,6 @@
 import {
   attachX402
-} from "./chunk-SO6HPRJT.js";
+} from "./chunk-OKC6VMFH.js";
 
 // src/x402/middleware.ts
 import {

package/dist/{chunk-SO6HPRJT.js → chunk-OKC6VMFH.js}

@@ -1,10 +1,11 @@
 import {
   SESSION_HEADER,
+  decisionIdOf,
   sessionIdOf
-} from "./chunk-VM7MK43J.js";
+} from "./chunk-FAQ442YH.js";
 import {
   payloadDigest
-} from "./chunk-SFGM7KOG.js";
+} from "./chunk-X3W2Z5GC.js";
 import {
   x402Moments
 } from "./chunk-LM4NIYE5.js";
@@ -56,7 +57,8 @@ function attachX402(beltic, server, http, opts = {}) {
       sessionId: session.id,
       decision: out.decision,
       reasonCodes: out.reasonCodes,
-      born: session.born
+      born: session.born,
+      buyerDecisionId: decisionIdOf(payload.extensions)
     });
     if (out.verdict.blocks(beltic.onReview)) {
       return {

package/dist/{chunk-SFGM7KOG.js → chunk-X3W2Z5GC.js}

@@ -304,6 +304,9 @@ function didKeyFromEd25519(publicKey) {
 export {
   toHex,
   fromHex,
+  sha256,
+  canonicalize,
+  canonicalBytes,
   payloadDigest,
   memorySigner,
   Chain,

package/dist/index.d.ts

@@ -1,10 +1,19 @@
-export { B as Beltic, a as BelticOptions, C as CorrelationStore, E as Evaluation, M as MemoryCorrelationStore, S as SDK_VERSION, c as createBeltic } from './client-C-mV_3A0.js';
-import { S as Session } from './session-5TClPLI4.js';
-export { A as AgentIdentity, a as ApiClient, b as ApiClientOptions, B as BelticApiError, C as ChainRejectedError, D as DEFAULT_OPEN_RETRY_MS, c as DEFAULT_TRANSPORT, O as OpenSessionInput, R as RedactFn, d as SessionBorn, e as Sessions, f as StartSessionInput, T as ToolCallSpan, g as Transport, h as TransportClosedError, i as TransportOptions, j as ephemeralIdentity, k as fileIdentity, l as identityFromSeed } from './session-5TClPLI4.js';
-import { a as PaymentSummary, J as JsonObject, P as PaymentMomentPayload } from './index-Bjs3BPPU.js';
-import './verdict-BAahb5po.js';
+import { a as Session } from './session-DsBWEP8d.js';
+export { A as AgentIdentity, b as ApiClient, c as ApiClientOptions, B as Beltic, d as BelticApiError, e as BelticOptions, C as ChainRejectedError, f as CorrelationStore, D as DEFAULT_OPEN_RETRY_MS, g as DEFAULT_TRANSPORT, h as DecideOptions, i as Decision, E as Env, j as Evaluation, H as HumanDecisionInput, M as MemoryCorrelationStore, O as OpenSessionInput, R as RedactFn, k as Run, l as RunOptions, m as SDK_VERSION, n as SessionBorn, S as SessionSource, o as Sessions, p as StartSessionInput, T as ToolCallSpan, q as Transport, r as TransportClosedError, s as TransportOptions, t as createBeltic, u as ephemeralIdentity, v as fileIdentity, w as identityFromSeed } from './session-DsBWEP8d.js';
+import { a as PaymentSummary, J as JsonObject, P as PaymentMomentPayload } from './verdict-6vCyoAHE.js';
 import 'zod';
 
+/**
+ * Thrown by the two primitives that cannot fail open (`sessions.start`,
+ * `sessions.ensure`) when the client is disabled: a `Beltic.fromEnv` with
+ * no `BELTIC_*` configured is a client that records nothing (GAP-78), and
+ * a caller that insists on a session gets told so rather than a `null`.
+ */
+declare class BelticDisabledError extends Error {
+    readonly code = "SDK_DISABLED";
+    constructor(entry: string);
+}
+
 /**
  * The shape the platform judges (`PaymentSummary`) and the shape the record
  * keeps (`PaymentMomentPayload`) share their comparable core: payee, amount,
@@ -27,4 +36,4 @@ declare function presentedFrom(summary: PaymentSummary, raw: JsonObject): Paymen
 type CallKind = 'llm_call' | 'tool_call';
 declare function recordCall<T>(session: Session, kind: CallKind, callId: string, start: JsonObject, run: () => PromiseLike<T>, end?: (result: T) => Promise<JsonObject> | JsonObject): Promise<T>;
 
-export { type CallKind, Session, presentedFrom, recordCall, summaryOf };
+export { BelticDisabledError, type CallKind, Session, presentedFrom, recordCall, summaryOf };