@belticlabs/agent-risk-sdk 0.3.0 → 0.5.0

package/dist/{adapter-BEpzr2R3.d.ts → adapter-DEdhsNt-.d.ts}

@@ -1,15 +1,8 @@
-import { D as Decision } from './verdict-6vCyoAHE.js';
+import { D as Decision } from './verdict-DMnbFuS5.js';
 import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
-import { B as Beltic, n as SessionBorn, a as Session } from './session-DsBWEP8d.js';
+import { B as Beltic, j as SessionBorn, i as Session } from './session-D9E-efc0.js';
 
-interface CorrelationContext {
-    path: string;
-    method: string;
-    header: (name: string) => string | undefined;
-}
 interface AttachOptions {
-    /** A key the merchant will see again at verify time, for delegated flows (GAP-31). */
-    correlate?: ((ctx: CorrelationContext) => string | null) | undefined;
     /** Called with every decision; the default logs nothing. */
     onDecision?: ((d: {
         sessionId: string;
@@ -26,4 +19,4 @@ interface AttachedX402 {
 }
 declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer, opts?: AttachOptions): AttachedX402;
 
-export { type AttachOptions as A, type CorrelationContext as C, attachX402 as a, type AttachedX402 as b };
+export { type AttachOptions as A, attachX402 as a, type AttachedX402 as b };

package/dist/ai/index.d.ts

@@ -1,6 +1,6 @@
-import { P as PaymentMomentPayload } from '../verdict-6vCyoAHE.js';
+import { P as PaymentMomentPayload } from '../verdict-DMnbFuS5.js';
 import { LanguageModelMiddleware, Tool, ToolSet } from 'ai';
-import { S as SessionSource } from '../session-DsBWEP8d.js';
+import { S as SessionSource } from '../session-D9E-efc0.js';
 import 'zod';
 
 interface PaymentMoments {

package/dist/ai/index.js

@@ -1,15 +1,14 @@
 import {
   Sessions,
   recordCall
-} from "../chunk-4MG6VNAU.js";
-import {
-  uuidv7
-} from "../chunk-X3W2Z5GC.js";
-import "../chunk-46QN2KEZ.js";
+} from "../chunk-JSE6JQJC.js";
 import {
   toJson,
   toJsonObject
 } from "../chunk-FQDHFTVR.js";
+import {
+  uuidv7
+} from "../chunk-X3W2Z5GC.js";
 
 // src/ai/index.ts
 var PARAM_KEYS = [
@@ -25,7 +24,6 @@ var PARAM_KEYS = [
   "stopSequences"
 ];
 function middleware(source) {
-  if (!source) return {};
   return {
     wrapGenerate: async ({ doGenerate, params, model }) => {
       const session = await Sessions.resolve(source);
@@ -81,7 +79,7 @@ function middleware(source) {
   };
 }
 function wrapTool(source, tool, opts = {}) {
-  if (!source || !tool.execute) return tool;
+  if (!tool.execute) return tool;
   const original = tool.execute;
   const toolName = opts.name ?? tool.name ?? "tool";
   const execute = async (input, options) => {
@@ -90,7 +88,7 @@ function wrapTool(source, tool, opts = {}) {
     return recordCall(
       session,
       "tool_call",
-      options?.toolCallId ?? uuidv7(),
+      options.toolCallId,
       { toolName, input: toJson(input), transport: "local" },
       async () => {
         const output = await original(input, options);

package/dist/{chunk-46QN2KEZ.js → chunk-4BUUPU3O.js}

@@ -326,13 +326,6 @@ var EvaluateOutputSchema = z4.strictObject({
   /** Additive (GAP-21). */
   decisionId: z4.uuid()
 });
-var AnchorEntrySchema = z4.strictObject({
-  epoch: z4.string().min(1),
-  root: Hex64Schema,
-  sig: z4.string().min(1),
-  chainRef: z4.string().optional()
-});
-var AnchorsOutputSchema = z4.strictObject({ entries: z4.array(AnchorEntrySchema) });
 var CreatePolicyInputSchema = z4.strictObject({ rules: PolicyRulesSchema });
 var CreatePolicyOutputSchema = z4.strictObject({
   policyId: z4.uuid(),
@@ -542,8 +535,6 @@ export {
   EvaluateInputSchema,
   DecisionSchema,
   EvaluateOutputSchema,
-  AnchorEntrySchema,
-  AnchorsOutputSchema,
   CreatePolicyInputSchema,
   CreatePolicyOutputSchema,
   ApiErrorSchema,

package/dist/chunk-GM4KEEZB.js

@@ -0,0 +1,163 @@
+import {
+  toJsonObject
+} from "./chunk-FQDHFTVR.js";
+import {
+  payloadDigest
+} from "./chunk-X3W2Z5GC.js";
+
+// src/x402/binding.ts
+var SESSION_EXTENSION = "beltic.sessionId";
+var SESSION_HEADER = "Beltic-Session-Id";
+var DECISION_EXTENSION = "beltic.decisionId";
+function sessionIdOf(extensions) {
+  return stringAt(extensions, SESSION_EXTENSION);
+}
+function decisionIdOf(extensions) {
+  return stringAt(extensions, DECISION_EXTENSION);
+}
+function stringAt(extensions, key) {
+  const v = extensions?.[key];
+  return typeof v === "string" && v.length > 0 ? v : null;
+}
+
+// src/x402/moments.ts
+function x402Currency(network, asset) {
+  return `${network}/${asset}`;
+}
+function x402Summary(accepts, opts = {}) {
+  const payer = opts.payer?.toLowerCase();
+  return {
+    protocol: "x402",
+    payee: accepts?.payTo ?? "unknown",
+    amount: {
+      value: accepts?.amount ?? "0",
+      currency: accepts ? x402Currency(accepts.network ?? "unknown", accepts.asset ?? "unknown") : "unknown"
+    },
+    ...payer ? { payer } : {}
+  };
+}
+function fromAccepts(a, artifact, raw, payer) {
+  return { ...x402Summary(a, { payer }), artifact, raw };
+}
+function payerOf(payload) {
+  const p = payload.payload ?? {};
+  const auth = p.authorization;
+  const candidates = [
+    auth?.from,
+    p.from,
+    p.payer,
+    p.signer,
+    p.permit?.owner
+  ];
+  const hit = candidates.find((c) => typeof c === "string" && c.length > 0);
+  return typeof hit === "string" ? hit.toLowerCase() : void 0;
+}
+var x402Moments = {
+  /** The 402 challenge as the buyer saw it, from the `PAYMENT-REQUIRED` header. */
+  required(required) {
+    return fromAccepts(required.accepts?.[0], "http-402", toJsonObject(required));
+  },
+  /** The requirements the seller's resource server resolved for a request. */
+  requirements(req) {
+    return fromAccepts(req, "http-402", toJsonObject(req));
+  },
+  /** A route's static `accepts` config, before any payment header exists. */
+  route(route, raw) {
+    const accepts = route ?? {};
+    const extra = accepts.extra;
+    return fromAccepts(
+      {
+        payTo: typeof accepts.payTo === "string" ? accepts.payTo : "dynamic",
+        amount: priceValue(accepts.price),
+        network: accepts.network,
+        asset: extra?.asset ?? "route"
+      },
+      "http-402",
+      raw
+    );
+  },
+  /** The signed payment the buyer presented, with the requirement it accepted. */
+  payload(payload) {
+    return fromAccepts(
+      payload.accepted,
+      "payment-signature",
+      toJsonObject(payload),
+      payerOf(payload)
+    );
+  }
+};
+function priceValue(price) {
+  if (typeof price === "string") return price.replace(/[^0-9.]/g, "") || "0";
+  if (typeof price === "number") return String(price);
+  if (price && typeof price === "object" && typeof price.amount === "string")
+    return price.amount;
+  return "0";
+}
+
+// src/x402/adapter.ts
+function attachX402(beltic, server, http, opts = {}) {
+  const inFlight = /* @__PURE__ */ new Map();
+  http?.onProtectedRequest(async (ctx, route) => {
+    if (ctx.paymentHeader) return;
+    const bound = ctx.adapter.getHeader(SESSION_HEADER) ?? ctx.adapter.getHeader(SESSION_HEADER.toLowerCase());
+    if (!bound) return;
+    const session = await beltic.sessions.ensure(bound);
+    const accepts = Array.isArray(route.accepts) ? route.accepts[0] : route.accepts;
+    await session.emit(
+      "payment.requested",
+      x402Moments.route(accepts, {
+        path: ctx.path,
+        method: ctx.method,
+        route: JSON.parse(JSON.stringify(route))
+      })
+    );
+  });
+  server.onBeforeVerify(async (ctx) => {
+    const payload = ctx.paymentPayload;
+    const requirements = ctx.requirements;
+    const session = await beltic.sessions.ensure(sessionIdOf(payload.extensions));
+    if (session.born === "seller")
+      await session.emit("payment.requested", x402Moments.requirements(requirements));
+    const presented = x402Moments.payload(payload);
+    await session.emit("payment.presented", presented);
+    inFlight.set(payloadDigest(payload), session);
+    const out = await beltic.evaluate(session.id, presented);
+    if (!out) return;
+    opts.onDecision?.({
+      sessionId: session.id,
+      decision: out.decision,
+      reasonCodes: out.reasonCodes,
+      born: session.born,
+      buyerDecisionId: decisionIdOf(payload.extensions)
+    });
+    if (out.verdict.blocks(beltic.onReview)) {
+      return {
+        abort: true,
+        reason: `BELTIC_${out.verdict.value}`,
+        message: out.reasonCodes.join(",")
+      };
+    }
+    return;
+  });
+  server.onAfterSettle(async (ctx) => {
+    const key = payloadDigest(ctx.paymentPayload);
+    const session = inFlight.get(key);
+    if (!session) return;
+    inFlight.delete(key);
+    if (ctx.result.success) await session.close("settled", { transaction: ctx.result.transaction });
+  });
+  return { inFlight };
+}
+
+export {
+  SESSION_EXTENSION,
+  SESSION_HEADER,
+  DECISION_EXTENSION,
+  sessionIdOf,
+  decisionIdOf,
+  x402Currency,
+  x402Summary,
+  payerOf,
+  x402Moments,
+  attachX402
+};