@belticlabs/agent-risk-sdk 0.2.0 → 0.3.0

package/dist/x402/express.js

@@ -1,11 +1,11 @@
 import {
   guardedPaymentMiddleware
-} from "../chunk-U7HM37CB.js";
+} from "../chunk-NJVO2WIV.js";
 import {
   attachX402
-} from "../chunk-SO6HPRJT.js";
-import "../chunk-VM7MK43J.js";
-import "../chunk-SFGM7KOG.js";
+} from "../chunk-OKC6VMFH.js";
+import "../chunk-FAQ442YH.js";
+import "../chunk-X3W2Z5GC.js";
 import "../chunk-46QN2KEZ.js";
 import "../chunk-LM4NIYE5.js";
 import "../chunk-FQDHFTVR.js";

package/dist/x402/hono.d.ts

@@ -1,12 +1,10 @@
 import { RoutesConfig, x402ResourceServer } from '@x402/core/server';
 import { MiddlewareHandler } from 'hono';
-import { B as Beltic } from '../client-C-mV_3A0.js';
-import { G as GuardedMiddlewareOptions } from '../middleware-BwAYpBTl.js';
-export { a as attachX402 } from '../adapter-CF-cUYSA.js';
-import '../index-Bjs3BPPU.js';
+import { B as Beltic } from '../session-DsBWEP8d.js';
+import { G as GuardedMiddlewareOptions } from '../middleware-9gI0ou2i.js';
+export { a as attachX402 } from '../adapter-BEpzr2R3.js';
+import '../verdict-6vCyoAHE.js';
 import 'zod';
-import '../verdict-BAahb5po.js';
-import '../session-5TClPLI4.js';
 
 /** Seller half for hono: `@x402/hono`'s payment middleware with the Beltic hooks attached. */
 

package/dist/x402/hono.js

@@ -1,11 +1,11 @@
 import {
   guardedPaymentMiddleware
-} from "../chunk-U7HM37CB.js";
+} from "../chunk-NJVO2WIV.js";
 import {
   attachX402
-} from "../chunk-SO6HPRJT.js";
-import "../chunk-VM7MK43J.js";
-import "../chunk-SFGM7KOG.js";
+} from "../chunk-OKC6VMFH.js";
+import "../chunk-FAQ442YH.js";
+import "../chunk-X3W2Z5GC.js";
 import "../chunk-46QN2KEZ.js";
 import "../chunk-LM4NIYE5.js";
 import "../chunk-FQDHFTVR.js";

package/dist/x402/index.d.ts

@@ -1,45 +1,31 @@
-export { A as AttachOptions, b as AttachedX402, C as CorrelationContext, a as attachX402 } from '../adapter-CF-cUYSA.js';
-import { S as Session } from '../session-5TClPLI4.js';
-import { v as DeclaredIntent, P as PaymentMomentPayload, J as JsonObject, a as PaymentSummary } from '../index-Bjs3BPPU.js';
+export { A as AttachOptions, b as AttachedX402, C as CorrelationContext, a as attachX402 } from '../adapter-BEpzr2R3.js';
+import { S as SessionSource } from '../session-DsBWEP8d.js';
+import { v as DeclaredIntent, P as PaymentMomentPayload, J as JsonObject, a as PaymentSummary } from '../verdict-6vCyoAHE.js';
 import '@x402/core/server';
-import '../client-C-mV_3A0.js';
-import '../verdict-BAahb5po.js';
 import 'zod';
 
 /**
  * Session binding on the x402 rail (Fraud SDK RFC › Protocol Adapter — x402:
  * "`PAYMENT-SIGNATURE` extension `beltic.sessionId`"). Where exactly it
  * lives is GAP-30; that it is outside the wallet-signed payload is GAP-56.
+ * A presentation the buyer had evaluated first also carries the
+ * `decisionId` the platform answered with, next to the session (GAP-80).
  */
 declare const SESSION_EXTENSION = "beltic.sessionId";
 declare const SESSION_HEADER = "Beltic-Session-Id";
+declare const DECISION_EXTENSION = "beltic.decisionId";
+declare const DECISION_HEADER = "Beltic-Decision-Id";
 declare function sessionIdOf(extensions: Readonly<Record<string, unknown>> | undefined): string | null;
+declare function decisionIdOf(extensions: Readonly<Record<string, unknown>> | undefined): string | null;
 
 /**
- * Buyer half › the x402 fetch wrapper. Sits *inside* the agent's paying
- * fetch (e.g. `wrapFetchWithPayment(belticFetch(session))`), so it sees the
- * 402 challenge → `payment.requested`, and the retry carrying the payment
- * → `payment.presented`, into which it injects the session binding
- * (GAP-30). It never pays and never decides.
- *
- * Before a request that presents payment leaves, the buffered evidence is
- * flushed: the seller will evaluate as soon as it sees the payment, and
- * the platform must already hold the buyer's side of the story (GAP-66).
- *
- * Both x402 generations are read: v2 (`PAYMENT-REQUIRED` header,
- * `PAYMENT-SIGNATURE` retry, binding in `extensions`) and v1 (challenge in
- * the 402 body, `X-PAYMENT` retry, binding by header only — a v1 payload
- * has no extensions and names no asset, so the challenge this wrapper saw
- * for the same URL supplies it; GAP-72). The header codec is base64 JSON,
- * kept here so a buyer needs no `@x402/*` package to be observed.
+ * The paying fetch, observed. Takes a session or the run that owns one;
+ * without either (the evidence stream is not configured, or the platform
+ * refused to open one) the inner fetch is returned as is — or runs as is
+ * per request when the run has no session yet — so a host wires it
+ * unconditionally.
  */
-
-/**
- * The paying fetch, observed. Without a session (the evidence stream is
- * not configured, or the platform refused to open one) the inner fetch is
- * returned as is, so a host wires it unconditionally.
- */
-declare function belticFetch(session: Session | null | undefined, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
+declare function belticFetch(source: SessionSource, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
 
 /**
  * The declared intent for an x402 mandate (Fraud SDK RFC › Session ›
@@ -127,4 +113,4 @@ declare const x402Moments: {
     payload(payload: PaymentPayloadLike, accepts?: AcceptsLike | undefined): PaymentMomentPayload;
 };
 
-export { type AcceptsLike, type PaymentPayloadLike, type PaymentRequiredLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, belticFetch, payerOf, sessionIdOf, x402Currency, x402Intent, x402Moments, x402Summary };
+export { type AcceptsLike, DECISION_EXTENSION, DECISION_HEADER, type PaymentPayloadLike, type PaymentRequiredLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, belticFetch, decisionIdOf, payerOf, sessionIdOf, x402Currency, x402Intent, x402Moments, x402Summary };

package/dist/x402/index.js

@@ -1,12 +1,19 @@
 import {
   attachX402
-} from "../chunk-SO6HPRJT.js";
+} from "../chunk-OKC6VMFH.js";
 import {
+  Session,
+  Sessions
+} from "../chunk-4MG6VNAU.js";
+import {
+  DECISION_EXTENSION,
+  DECISION_HEADER,
   SESSION_EXTENSION,
   SESSION_HEADER,
+  decisionIdOf,
   sessionIdOf
-} from "../chunk-VM7MK43J.js";
-import "../chunk-SFGM7KOG.js";
+} from "../chunk-FAQ442YH.js";
+import "../chunk-X3W2Z5GC.js";
 import "../chunk-46QN2KEZ.js";
 import {
   payerOf,
@@ -19,10 +26,13 @@ import "../chunk-FQDHFTVR.js";
 // src/x402/fetch.ts
 var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
 var CHALLENGE_MEMORY = 32;
-function belticFetch(session, inner = globalThis.fetch) {
-  if (!session) return inner;
+function belticFetch(source, inner = globalThis.fetch) {
+  if (!source) return inner;
+  const run = source instanceof Session ? null : source;
   const challenges = /* @__PURE__ */ new Map();
   return async (input, init) => {
+    const session = await Sessions.resolve(source);
+    if (!session) return inner(input, init);
     const url = urlOf(input);
     const headers = new Headers(
       init?.headers ?? (input instanceof Request ? input.headers : void 0)
@@ -32,9 +42,19 @@ function belticFetch(session, inner = globalThis.fetch) {
     const presented = signature ?? headers.get("X-PAYMENT");
     const payload = presented ? decodeHeader(presented) : null;
     if (payload) {
-      const bound = signature ? { ...payload, extensions: { ...payload.extensions, [SESSION_EXTENSION]: session.id } } : payload;
+      const accepts = payload.accepted ?? answeredAccepts(challenges.get(url), payload);
+      const decision = run?.decisionFor(x402Moments.payload(payload, accepts));
+      const decisionId = decision && !decision.absent ? decision.decisionId : null;
+      const bound = signature ? {
+        ...payload,
+        extensions: {
+          ...payload.extensions,
+          [SESSION_EXTENSION]: session.id,
+          ...decisionId ? { [DECISION_EXTENSION]: decisionId } : {}
+        }
+      } : payload;
       if (signature) headers.set("PAYMENT-SIGNATURE", encodeHeader(bound));
-      const accepts = bound.accepted ?? answeredAccepts(challenges.get(url), bound);
+      else if (decisionId) headers.set(DECISION_HEADER, decisionId);
       await session.emit("payment.presented", x402Moments.payload(bound, accepts));
       await session.flush();
     }
@@ -105,10 +125,13 @@ function x402Intent(input) {
   };
 }
 export {
+  DECISION_EXTENSION,
+  DECISION_HEADER,
   SESSION_EXTENSION,
   SESSION_HEADER,
   attachX402,
   belticFetch,
+  decisionIdOf,
   payerOf,
   sessionIdOf,
   x402Currency,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@belticlabs/agent-risk-sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "The Beltic Agent Risk SDK — one client, two halves: instrument the buyer agent (AI SDK, x402 fetch, MCP client) and guard the seller boundary (x402, MCP server, evaluate).",
   "license": "UNLICENSED",
   "repository": {

package/dist/chunk-GSH5APZW.js

@@ -1,39 +0,0 @@
-// src/core/record.ts
-function errorOf(err) {
-  const e = err;
-  return { name: String(e?.name ?? "Error"), message: String(e?.message ?? err) };
-}
-function openCall(session, kind, callId, start) {
-  const started = Date.now();
-  const opened = session.emit(`${kind}.start`, { callId, ...start });
-  const close = async (outcome) => {
-    await opened;
-    return session.emit(
-      `${kind}.end`,
-      { callId, ...outcome, durationMs: Date.now() - started }
-    );
-  };
-  return {
-    callId,
-    opened,
-    end: (outcome = {}) => close(outcome),
-    fail: (error, outcome = {}) => close({ error: errorOf(error), ...outcome })
-  };
-}
-async function recordCall(session, kind, callId, start, run, end = () => ({})) {
-  const span = openCall(session, kind, callId, start);
-  await span.opened;
-  try {
-    const result = await run();
-    await span.end(await end(result));
-    return result;
-  } catch (err) {
-    await span.fail(err);
-    throw err;
-  }
-}
-
-export {
-  openCall,
-  recordCall
-};

package/dist/chunk-VM7MK43J.js

@@ -1,13 +0,0 @@
-// src/x402/binding.ts
-var SESSION_EXTENSION = "beltic.sessionId";
-var SESSION_HEADER = "Beltic-Session-Id";
-function sessionIdOf(extensions) {
-  const v = extensions?.[SESSION_EXTENSION];
-  return typeof v === "string" && v.length > 0 ? v : null;
-}
-
-export {
-  SESSION_EXTENSION,
-  SESSION_HEADER,
-  sessionIdOf
-};

package/dist/client-C-mV_3A0.d.ts

@@ -1,91 +0,0 @@
-import { a as PaymentSummary, P as PaymentMomentPayload, B as EvaluateOutput } from './index-Bjs3BPPU.js';
-import { O as OnReview, V as Verdict } from './verdict-BAahb5po.js';
-import { a as ApiClient, g as Transport, e as Sessions, A as AgentIdentity, b as ApiClientOptions, i as TransportOptions, R as RedactFn } from './session-5TClPLI4.js';
-
-/**
- * Correlation without binding (Fraud SDK RFC › Protocol Adapter — x402:
- * "binding travels on the call that initiates the purchase, not
- * necessarily on the payment artifact"). The merchant binds a key it will
- * see again (a checkout session id, a challenge nonce) to the buyer's
- * session; the adapter resolves it when the settlement arrives (GAP-31).
- */
-interface CorrelationStore {
-    bind(key: string, sessionId: string, ttlMs?: number): Promise<void>;
-    resolve(key: string): Promise<string | null>;
-}
-declare class MemoryCorrelationStore implements CorrelationStore {
-    private readonly defaultTtlMs;
-    private readonly entries;
-    constructor(defaultTtlMs?: number);
-    bind(key: string, sessionId: string, ttlMs?: number): Promise<void>;
-    resolve(key: string): Promise<string | null>;
-}
-
-/**
- * One SDK, two halves (Fraud SDK RFC › Summary). `Beltic` is the single
- * client: sessions and evidence for both halves, `evaluate` for whichever
- * half is about to let a payment through. Protocol integrations are plain
- * functions behind subpath exports, each pulling exactly one optional peer:
- *
- *   @belticlabs/agent-risk-sdk/ai    → middleware(session), wrapTools(session, …)
- *   @belticlabs/agent-risk-sdk/x402  → belticFetch(session), x402Summary(…), attachX402(beltic, …)
- *   @belticlabs/agent-risk-sdk/hono  → belticPaymentMiddleware(beltic, …)   (and /express)
- *   @belticlabs/agent-risk-sdk/mcp   → wrapClient(session, …), wrapServer(beltic, …)
- *
- * Neither half decides risk locally: verdicts are platform-side.
- *
- * Evidence is a side channel of the work it observes. With `failOpen`
- * nothing the SDK does throws into that work: `Session.emit` reports and
- * answers `false`, `sessions.open` answers `null`, `evaluate` answers
- * `null` — never an invented verdict; the host decides what to do without
- * one (GAP-70). `sessions.start` and `sessions.ensure` throw either way:
- * they are the primitives the fail-open entries are built on.
- */
-
-declare const SDK_VERSION = "0.2.0";
-interface BelticOptions extends Omit<ApiClientOptions, 'userAgent'> {
-    /** Buyer half. Without it, `sessions.start` is unavailable; the seller half works. */
-    identity?: AgentIdentity | undefined;
-    transport?: Partial<TransportOptions> | undefined;
-    /** What a synchronous seller hook does with REVIEW (GAP-52). */
-    onReview?: OnReview | undefined;
-    correlation?: CorrelationStore | undefined;
-    redact?: RedactFn | undefined;
-    now?: (() => Date) | undefined;
-    /** Evidence never fails the work it observes; see the module note (GAP-70). */
-    failOpen?: boolean | undefined;
-    /** Where fail-open failures go (and transport delivery failures unless `transport` names its own). Default: `console.error`. */
-    onError?: ((err: Error) => void) | undefined;
-    /** Fail-open only: how long `sessions.open` answers null after the platform refused to open a session (GAP-71). */
-    openRetryMs?: number | undefined;
-}
-/** The platform's answer, with the verdict as a value the caller can ask `blocks(onReview)`. */
-type Evaluation = EvaluateOutput & {
-    verdict: Verdict;
-};
-declare class Beltic {
-    readonly api: ApiClient;
-    readonly transport: Transport;
-    readonly sessions: Sessions;
-    readonly identity: AgentIdentity | undefined;
-    readonly correlation: CorrelationStore;
-    readonly onReview: OnReview;
-    readonly failOpen: boolean;
-    private readonly onError;
-    constructor(opts: BelticOptions);
-    /**
-     * The platform's verdict on a payment — the seller's before it verifies,
-     * the buyer's before it presents. Read-your-writes: the buffered evidence
-     * is flushed first so the platform judges what the caller already saw
-     * (GAP-16). A recorded moment is accepted as is: only its comparable core
-     * (payee, amount, payer) is sent. `null` only under `failOpen`, when the
-     * platform could not be asked.
-     */
-    evaluate(sessionId: string, payment: PaymentSummary | PaymentMomentPayload): Promise<Evaluation | null>;
-    private decide;
-    flush(): Promise<void>;
-    shutdown(): Promise<void>;
-}
-declare function createBeltic(opts: BelticOptions): Beltic;
-
-export { Beltic as B, type CorrelationStore as C, type Evaluation as E, MemoryCorrelationStore as M, SDK_VERSION as S, type BelticOptions as a, createBeltic as c };

package/dist/session-5TClPLI4.d.ts

@@ -1,250 +0,0 @@
-import { L as EvidenceAck, G as EventResult, R as EvidenceEvent, V as EvidenceSource, aC as WireEvidenceKind, J as JsonObject, C as ChainHead, aa as PayloadByKind, aw as ToolCallStartPayload, b as JsonValue, am as SessionClosePayload, v as DeclaredIntent } from './index-Bjs3BPPU.js';
-
-/**
- * The edge signs event digests (Fraud SDK RFC › Modules › Identity Module);
- * the platform signs its own PLATFORM chain and epoch anchors. Both are the
- * same operation over different keys, so one interface.
- */
-interface Signer {
-    /** Raw 32-byte Ed25519 public key. */
-    readonly publicKey: Uint8Array;
-    /** Stable identifier for logs and key rotation; `did:key` for agents. */
-    readonly keyId: string;
-    sign(message: Uint8Array): Promise<Uint8Array>;
-}
-
-interface ApiClientOptions {
-    baseUrl: string;
-    apiKey: string;
-    fetch?: typeof globalThis.fetch;
-    timeoutMs?: number;
-    userAgent?: string;
-}
-declare class BelticApiError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly details?: unknown | undefined;
-    readonly requestId?: string | undefined;
-    constructor(status: number, code: string, message: string, details?: unknown | undefined, requestId?: string | undefined);
-    /** 5xx and network failures are retried by the transport; 4xx are not. */
-    get retryable(): boolean;
-}
-declare class ApiClient {
-    private readonly baseUrl;
-    private readonly fetchImpl;
-    private readonly timeoutMs;
-    private readonly headers;
-    constructor(opts: ApiClientOptions);
-    post<T>(path: string, body: unknown, headers?: Record<string, string>): Promise<T>;
-    get<T>(path: string, query?: Record<string, string | undefined>): Promise<T>;
-    private request;
-}
-
-interface AgentIdentity {
-    did: string;
-    signer: Signer;
-    /** Opaque credential presented at session start (stored, not verified this phase). */
-    credential?: string;
-}
-declare function identityFromSeed(seed: Uint8Array, credential?: string): AgentIdentity;
-declare function ephemeralIdentity(credential?: string): AgentIdentity;
-/** A JSON keystore on disk: `{ "seed": "<64 hex>" }`, created 0600 when missing. */
-declare function fileIdentity(path: string, credential?: string): AgentIdentity;
-
-/**
- * Transport (Fraud SDK RFC › Modules: "buffering, batching, chained delivery
- * to the Collector"). Contract as assumed in GAP-18/38: one FIFO per
- * chain; at most one batch in flight per chain, so order is preserved;
- * exponential backoff on network / 5xx; a `fork` or `rejected` ack halts
- * the chain and surfaces `ChainRejectedError` — an SDK must not silently
- * keep chaining onto a head the platform never accepted.
- */
-
-interface TransportOptions {
-    maxBatch: number;
-    flushMs: number;
-    /** Total buffered events across chains; beyond this new events are dropped (GAP-38). */
-    maxBuffered: number;
-    backoff: {
-        baseMs: number;
-        maxMs: number;
-        maxAttempts: number;
-    };
-    onAck?: (ack: EvidenceAck) => void;
-    onError?: (err: Error) => void;
-    onChainHalted?: (err: ChainRejectedError) => void;
-    setTimeout?: typeof globalThis.setTimeout;
-    clearTimeout?: typeof globalThis.clearTimeout;
-}
-declare const DEFAULT_TRANSPORT: TransportOptions;
-declare class ChainRejectedError extends Error {
-    readonly sessionId: string;
-    readonly source: string;
-    readonly result: EventResult;
-    constructor(sessionId: string, source: string, result: EventResult);
-}
-declare class TransportClosedError extends Error {
-    constructor();
-}
-declare class Transport {
-    private readonly api;
-    private readonly opts;
-    private readonly chains;
-    private buffered;
-    private timer;
-    private closed;
-    private inFlightCount;
-    private drainWaiters;
-    constructor(api: ApiClient, opts?: Partial<TransportOptions>);
-    get size(): number;
-    hasRoom(): boolean;
-    haltedError(sessionId: string, source: string): ChainRejectedError | null;
-    /** Callers check `hasRoom()` first and assign `seq` only then (GAP-38). */
-    enqueue(ev: EvidenceEvent): void;
-    /** Send everything pending and wait for every in-flight batch to settle (ack or halt). */
-    flush(): Promise<void>;
-    close(): Promise<void>;
-    private schedule;
-    private unschedule;
-    private drained;
-    private settleWaiters;
-    private flushChain;
-    private send;
-}
-
-/**
- * A risk session as the SDK sees it: one chain per (sessionId, source),
- * built at the edge (Fraud SDK RFC › Wire contract). The buyer half opens
- * AGENT_TRACE sessions and announces them with `session.open` (seq 0) and
- * `intent.declared` (seq 1; GAP-23/60); the seller half attaches to a bound
- * session or opens its own INTERNAL_NETWORK session (GAP-13).
- *
- * `seq` is handed out only when the transport has room for the event
- * (GAP-38): a dropped event never leaves a hole — the next accepted event
- * is preceded by a `transport.gap` that counts the drops. `redact` is off
- * by default (GAP-33).
- *
- * Evidence is a side channel of the agent's work: with `failOpen` an emit
- * that cannot be chained (halted chain, closed transport) is reported and
- * returns `false` instead of throwing into the model or tool call it
- * observes (GAP-70).
- */
-
-type RedactFn = (kind: WireEvidenceKind, payload: JsonObject) => JsonObject;
-/** Who created the session — the seller half treats a bound session as buyer-born. */
-type SessionBorn = 'buyer' | 'seller';
-interface SessionDeps {
-    transport: Transport;
-    signer?: Signer | undefined;
-    redact?: RedactFn | undefined;
-    now?: (() => Date) | undefined;
-    /** Called once the session closed, so the registry can forget it. */
-    onClosed?: ((session: Session) => void) | undefined;
-    /** Report instead of throw when an event cannot be chained (GAP-70). */
-    failOpen?: boolean | undefined;
-    onError?: ((err: Error) => void) | undefined;
-}
-/**
- * One tool call as a span: `tool_call.start` now, `tool_call.end` with the
- * outcome and the elapsed time when the host reports it. For hosts that run
- * their own tool loop and cannot hand the SDK an `execute` to wrap.
- */
-interface ToolCallSpan {
-    readonly callId: string;
-    end(outcome?: {
-        output?: JsonValue;
-    }): Promise<boolean>;
-    fail(error: unknown, outcome?: {
-        output?: JsonValue;
-    }): Promise<boolean>;
-}
-declare class Session {
-    private readonly deps;
-    readonly id: string;
-    readonly source: EvidenceSource;
-    readonly expiresAt: string | null;
-    readonly born: SessionBorn;
-    private chain;
-    private building;
-    private dropped;
-    private droppedFirstTs;
-    private droppedLastTs;
-    private closed;
-    private readonly now;
-    constructor(deps: SessionDeps, id: string, source: EvidenceSource, expiresAt: string | null, born: SessionBorn);
-    get head(): ChainHead | null;
-    get droppedCount(): number;
-    /**
-     * Resolves once the event is sequenced and buffered — not once it is
-     * acknowledged. `false` when the event was dropped, or (fail-open) when
-     * the chain can no longer take it.
-     */
-    emit<K extends WireEvidenceKind>(kind: K, payload: PayloadByKind[K]): Promise<boolean>;
-    /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
-    toolCall(call: ToolCallStartPayload): ToolCallSpan;
-    private chainEvent;
-    close(reason?: SessionClosePayload['reason'], extra?: JsonObject): Promise<void>;
-    /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
-    flush(): Promise<void>;
-    /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
-    private next;
-}
-interface StartSessionInput {
-    intent?: DeclaredIntent;
-    runtime?: {
-        framework?: string;
-        model?: string;
-    };
-    attestations?: JsonObject;
-}
-/** What `open` sends when it actually opens: a value, or a resolver run only then. */
-type OpenSessionInput = StartSessionInput | (() => StartSessionInput | Promise<StartSessionInput>);
-interface SessionsDeps {
-    api: ApiClient;
-    transport: Transport;
-    identity?: AgentIdentity | undefined;
-    redact?: RedactFn | undefined;
-    now?: (() => Date) | undefined;
-    sdkVersion: string;
-    failOpen?: boolean | undefined;
-    onError?: ((err: Error) => void) | undefined;
-    /** Fail-open only: after the platform refused to open a session, `open` resolves null for this long (GAP-71). */
-    openRetryMs?: number | undefined;
-}
-declare const DEFAULT_OPEN_RETRY_MS = 60000;
-declare class Sessions {
-    private readonly deps;
-    /**
-     * One session object per (session, source) per process: a chain's head
-     * lives in it, so two objects for the same chain would both start at
-     * seq 0 and fork it. Closed sessions are forgotten; a process restart
-     * mid-session still loses the head (GAP-67).
-     */
-    private readonly attached;
-    /** Buyer sessions by the host's own key (GAP-71). */
-    private readonly opened;
-    private retryAt;
-    constructor(deps: SessionsDeps);
-    /**
-     * Buyer half: the evidence session for a key of the host's own (its
-     * session, run or conversation id), opened on first use and reused
-     * after. A halted chain is reopened as a fresh session that continues
-     * the same key; a closed key is forgotten. When the platform refuses to
-     * open one, a fail-open client resolves null — the host runs without
-     * evidence — until `openRetryMs` has passed (GAP-71); otherwise the
-     * refusal is thrown and the next call tries again. The identity is
-     * required either way: that is configuration.
-     */
-    open(key: string, input?: OpenSessionInput): Promise<Session | null>;
-    private forget;
-    private openFresh;
-    /** Buyer half: create an AGENT_TRACE session bound to the agent identity, then announce it on the chain. */
-    start(input?: StartSessionInput): Promise<Session>;
-    private identityFor;
-    private create;
-    /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
-    ensure(sessionId?: string | null): Promise<Session>;
-    private attach;
-}
-
-export { type AgentIdentity as A, BelticApiError as B, ChainRejectedError as C, DEFAULT_OPEN_RETRY_MS as D, type OpenSessionInput as O, type RedactFn as R, Session as S, type ToolCallSpan as T, ApiClient as a, type ApiClientOptions as b, DEFAULT_TRANSPORT as c, type SessionBorn as d, Sessions as e, type StartSessionInput as f, Transport as g, TransportClosedError as h, type TransportOptions as i, ephemeralIdentity as j, fileIdentity as k, identityFromSeed as l };

package/dist/verdict-BAahb5po.d.ts

@@ -1,26 +0,0 @@
-import { D as Decision } from './index-Bjs3BPPU.js';
-
-/**
- * The verdict as a value (Fraud Engine RFC › API: ALLOW | DENY | REVIEW).
- * Layers combine by severity (GAP-45); a synchronous seller hook turns
- * REVIEW into a stop or a pass according to its `onReview` (GAP-52). Both
- * halves of the SDK and the engine share this one rule.
- */
-
-type OnReview = 'abort' | 'allow';
-declare class Verdict {
-    readonly value: Decision;
-    private constructor();
-    static readonly ALLOW: Verdict;
-    static readonly REVIEW: Verdict;
-    static readonly DENY: Verdict;
-    static of(value: Decision): Verdict;
-    /** The more severe of the two. */
-    atLeast(other: Verdict | Decision): Verdict;
-    /** Whether a synchronous gate must stop the call (GAP-52). */
-    blocks(onReview: OnReview): boolean;
-    /** What the gate effectively did: DENY when it blocked, else the verdict itself. */
-    effective(onReview: OnReview): Decision;
-}
-
-export { type OnReview as O, Verdict as V };