@belticlabs/agent-risk-sdk 0.4.0 → 0.6.0

package/dist/protocol/index.d.ts

@@ -1,5 +1,5 @@
-import { b as JsonValue, E as EvidenceSourceAll } from '../verdict-CDAsxktI.js';
-export { A as ALL_SOURCES, c as ANOMALY_TYPES, d as Amount, e as AmountSchema, f as ApiError, g as ApiErrorSchema, C as ChainHead, h as ChainHeadSchema, i as CreatePolicyInput, j as CreatePolicyInputSchema, k as CreatePolicyOutput, l as CreatePolicyOutputSchema, m as CreateSessionInput, n as CreateSessionInputSchema, o as CreateSessionOutput, p as CreateSessionOutputSchema, D as Decision, q as DecisionSchema, r as DeclaredIntent, s as DeclaredIntentSchema, t as DigestedEnvelope, u as EvaluateInput, v as EvaluateInputSchema, w as EvaluateOutput, x as EvaluateOutputSchema, y as EventResult, z as EventResultSchema, B as EventResultStatus, F as EventResultStatusSchema, G as EvidenceAck, H as EvidenceAckSchema, I as EvidenceBatchInput, K as EvidenceBatchInputSchema, L as EvidenceEnvelope, M as EvidenceEvent, N as EvidenceEventSchema, O as EvidenceKind, Q as EvidenceKindSchema, R as EvidenceSource, S as EvidenceSourceAllSchema, T as EvidenceSourceSchema, U as GatewayDecisionPayload, V as GatewayDecisionPayloadSchema, W as Hex64, X as Hex64Schema, Y as IntentDeclaredPayload, Z as IntentDeclaredPayloadSchema, J as JsonObject, _ as JsonValueSchema, $ as LlmCallEndPayload, a0 as LlmCallEndPayloadSchema, a1 as LlmCallStartPayload, a2 as LlmCallStartPayloadSchema, a3 as MAX_BATCH_EVENTS, a4 as OnReview, a5 as PAYMENT_ARTIFACTS, a6 as PLATFORM_KINDS, a7 as PayloadByKind, P as PaymentMomentPayload, a8 as PaymentMomentPayloadSchema, a as PaymentSummary, a9 as PaymentSummarySchema, aa as PlatformAnomalyPayload, ab as PlatformAnomalyPayloadSchema, ac as PlatformEvidenceKind, ad as PlatformEvidenceKindSchema, ae as PlatformObservationPayload, af as PlatformObservationPayloadSchema, ag as SESSION_CLOSE_REASONS, ah as SOURCE_ORDER, ai as SeqSchema, aj as SessionClosePayload, ak as SessionClosePayloadSchema, al as SessionIdSchema, am as SessionOpenPayload, an as SessionOpenPayloadSchema, ao as Sig, ap as SigSchema, aq as TimestampSchema, ar as ToolCallEndPayload, as as ToolCallEndPayloadSchema, at as ToolCallStartPayload, au as ToolCallStartPayloadSchema, av as TransportGapPayload, aw as TransportGapPayloadSchema, ax as Verdict, ay as WIRE_KINDS, az as WIRE_SOURCES, aA as WireEvidenceKind, aB as WireEvidenceKindSchema, aC as compareBySessionSource, aD as compareBySourceSeq, aE as isPlatformKind, aF as isWireKind, aG as payloadSchemaFor } from '../verdict-CDAsxktI.js';
+import { J as JsonValue, E as EvidenceSourceAll, D as Decision } from '../index-IfY4XCvJ.js';
+export { A as ALL_SOURCES, a as ANOMALY_TYPES, b as Amount, c as AmountSchema, d as ApiError, e as ApiErrorSchema, C as ChainHead, f as ChainHeadSchema, g as CreatePolicyInput, h as CreatePolicyInputSchema, i as CreatePolicyOutput, j as CreatePolicyOutputSchema, k as CreateSessionInput, l as CreateSessionInputSchema, m as CreateSessionOutput, n as CreateSessionOutputSchema, o as DecisionSchema, p as DeclaredIntent, q as DeclaredIntentSchema, r as DigestedEnvelope, s as EvaluateInput, t as EvaluateInputSchema, u as EvaluateOutput, v as EvaluateOutputSchema, w as EventResult, x as EventResultSchema, y as EventResultStatus, z as EventResultStatusSchema, B as EvidenceAck, F as EvidenceAckSchema, G as EvidenceBatchInput, H as EvidenceBatchInputSchema, I as EvidenceEnvelope, K as EvidenceEvent, L as EvidenceEventSchema, M as EvidenceKind, N as EvidenceKindSchema, O as EvidenceSource, P as EvidenceSourceAllSchema, Q as EvidenceSourceSchema, R as GatewayDecisionPayload, S as GatewayDecisionPayloadSchema, T as Hex64, U as Hex64Schema, V as IntentDeclaredPayload, W as IntentDeclaredPayloadSchema, X as JsonObject, Y as JsonValueSchema, Z as LlmCallEndPayload, _ as LlmCallEndPayloadSchema, $ as LlmCallStartPayload, a0 as LlmCallStartPayloadSchema, a1 as MAX_BATCH_EVENTS, a2 as PAYMENT_ARTIFACTS, a3 as PLATFORM_KINDS, a4 as PayloadByKind, a5 as PaymentMomentPayload, a6 as PaymentMomentPayloadSchema, a7 as PaymentSummary, a8 as PaymentSummarySchema, a9 as PlatformAnomalyPayload, aa as PlatformAnomalyPayloadSchema, ab as PlatformEvidenceKind, ac as PlatformEvidenceKindSchema, ad as PlatformObservationPayload, ae as PlatformObservationPayloadSchema, af as SESSION_CLOSE_REASONS, ag as SOURCE_ORDER, ah as SeqSchema, ai as SessionClosePayload, aj as SessionClosePayloadSchema, ak as SessionIdSchema, al as SessionOpenPayload, am as SessionOpenPayloadSchema, an as Sig, ao as SigSchema, ap as TimestampSchema, aq as ToolCallEndPayload, ar as ToolCallEndPayloadSchema, as as ToolCallStartPayload, at as ToolCallStartPayloadSchema, au as TransportGapPayload, av as TransportGapPayloadSchema, aw as WIRE_KINDS, ax as WIRE_SOURCES, ay as WireEvidenceKind, az as WireEvidenceKindSchema, aA as compareBySessionSource, aB as compareBySourceSeq, aC as isPlatformKind, aD as isWireKind, aE as payloadSchemaFor } from '../index-IfY4XCvJ.js';
 import { z } from 'zod';
 
 declare const PRIMITIVES: readonly ["THRESHOLD", "MEMBERSHIP", "MATCH", "PRESENCE", "FRESHNESS"];
@@ -154,4 +154,27 @@ declare function parseSelectorRef(ref: string): Selector;
 declare function walkPath(value: unknown, path: readonly PathSegment[]): unknown;
 declare const SelectorStringSchema: z.ZodString;
 
-export { ANNOTATION_CODES, type AnnotationCode, COLLECTOR_CODES, type CollectorCode, DEFAULT_RULE_CODES, type DefaultRuleCode, EvidenceSourceAll, INDICATOR_CODES, type IndicatorCode, JsonValue, PRIMITIVES, type PathSegment, type PolicyRules, PolicyRulesSchema, type Primitive, PrimitiveSchema, REASON_CODE_PATTERN, type ReasonCode, type Rule, RuleSchema, type RuleVerdict, RuleVerdictSchema, type Selector, SelectorStringSchema, SelectorSyntaxError, formatSelector, isSelectorRef, parseSelector, parseSelectorRef, walkPath };
+/**
+ * The verdict as a value (Fraud Engine RFC › API: ALLOW | DENY | REVIEW).
+ * Layers combine by severity (GAP-45); a synchronous seller hook turns
+ * REVIEW into a stop or a pass according to its `onReview` (GAP-52). Both
+ * halves of the SDK and the engine share this one rule.
+ */
+
+type OnReview = 'abort' | 'allow';
+declare class Verdict {
+    readonly value: Decision;
+    private constructor();
+    static readonly ALLOW: Verdict;
+    static readonly REVIEW: Verdict;
+    static readonly DENY: Verdict;
+    static of(value: Decision): Verdict;
+    /** The more severe of the two. */
+    atLeast(other: Verdict | Decision): Verdict;
+    /** Whether a synchronous gate must stop the call (GAP-52). */
+    blocks(onReview: OnReview): boolean;
+    /** What the gate effectively did: DENY when it blocked, else the verdict itself. */
+    effective(onReview: OnReview): Decision;
+}
+
+export { ANNOTATION_CODES, type AnnotationCode, COLLECTOR_CODES, type CollectorCode, DEFAULT_RULE_CODES, Decision, type DefaultRuleCode, EvidenceSourceAll, INDICATOR_CODES, type IndicatorCode, JsonValue, type OnReview, PRIMITIVES, type PathSegment, type PolicyRules, PolicyRulesSchema, type Primitive, PrimitiveSchema, REASON_CODE_PATTERN, type ReasonCode, type Rule, RuleSchema, type RuleVerdict, RuleVerdictSchema, type Selector, SelectorStringSchema, SelectorSyntaxError, Verdict, formatSelector, isSelectorRef, parseSelector, parseSelectorRef, walkPath };

package/dist/protocol/index.js

@@ -1,77 +1,490 @@
-import {
-  ALL_SOURCES,
-  ANNOTATION_CODES,
-  ANOMALY_TYPES,
-  AmountSchema,
-  ApiErrorSchema,
-  COLLECTOR_CODES,
-  ChainHeadSchema,
-  CreatePolicyInputSchema,
-  CreatePolicyOutputSchema,
-  CreateSessionInputSchema,
-  CreateSessionOutputSchema,
-  DEFAULT_RULE_CODES,
-  DecisionSchema,
-  DeclaredIntentSchema,
-  EvaluateInputSchema,
-  EvaluateOutputSchema,
-  EventResultSchema,
-  EventResultStatusSchema,
-  EvidenceAckSchema,
-  EvidenceBatchInputSchema,
-  EvidenceEventSchema,
-  EvidenceKindSchema,
-  EvidenceSourceAllSchema,
-  EvidenceSourceSchema,
-  GatewayDecisionPayloadSchema,
-  Hex64Schema,
-  INDICATOR_CODES,
-  IntentDeclaredPayloadSchema,
-  JsonValueSchema,
-  LlmCallEndPayloadSchema,
-  LlmCallStartPayloadSchema,
-  MAX_BATCH_EVENTS,
-  PAYMENT_ARTIFACTS,
-  PLATFORM_KINDS,
-  PRIMITIVES,
-  PaymentMomentPayloadSchema,
-  PaymentSummarySchema,
-  PlatformAnomalyPayloadSchema,
-  PlatformEvidenceKindSchema,
-  PlatformObservationPayloadSchema,
-  PolicyRulesSchema,
-  PrimitiveSchema,
-  REASON_CODE_PATTERN,
-  RuleSchema,
-  RuleVerdictSchema,
-  SESSION_CLOSE_REASONS,
-  SOURCE_ORDER,
-  SelectorStringSchema,
-  SelectorSyntaxError,
-  SeqSchema,
-  SessionClosePayloadSchema,
-  SessionIdSchema,
-  SessionOpenPayloadSchema,
-  SigSchema,
-  TimestampSchema,
-  ToolCallEndPayloadSchema,
-  ToolCallStartPayloadSchema,
-  TransportGapPayloadSchema,
-  Verdict,
-  WIRE_KINDS,
-  WIRE_SOURCES,
-  WireEvidenceKindSchema,
-  compareBySessionSource,
-  compareBySourceSeq,
-  formatSelector,
-  isPlatformKind,
-  isSelectorRef,
-  isWireKind,
-  parseSelector,
-  parseSelectorRef,
-  payloadSchemaFor,
-  walkPath
-} from "../chunk-4BUUPU3O.js";
+// ../protocol/src/api.ts
+import { z as z4 } from "zod";
+
+// ../protocol/src/evidence.ts
+import { z } from "zod";
+var WIRE_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK"];
+var ALL_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK", "PLATFORM"];
+var EvidenceSourceSchema = z.enum(WIRE_SOURCES);
+var EvidenceSourceAllSchema = z.enum(ALL_SOURCES);
+var SOURCE_ORDER = {
+  AGENT_TRACE: 0,
+  INTERNAL_NETWORK: 1,
+  PLATFORM: 2
+};
+function compareBySourceSeq(a, b) {
+  return SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || a.seq - b.seq;
+}
+function compareBySessionSource(a, b) {
+  return a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source];
+}
+var WIRE_KINDS = [
+  "session.open",
+  "session.close",
+  "intent.declared",
+  "llm_call.start",
+  "llm_call.end",
+  "tool_call.start",
+  "tool_call.end",
+  "payment.requested",
+  "payment.presented",
+  "gateway.decision",
+  "transport.gap"
+];
+var PLATFORM_KINDS = ["platform.observation", "platform.anomaly"];
+var WireEvidenceKindSchema = z.enum(WIRE_KINDS);
+var PlatformEvidenceKindSchema = z.enum(PLATFORM_KINDS);
+var EvidenceKindSchema = z.enum([...WIRE_KINDS, ...PLATFORM_KINDS]);
+var Hex64Schema = z.string().regex(/^[0-9a-f]{64}$/, "expected 64 lowercase hex chars");
+var SigSchema = z.string().regex(/^ed25519:[A-Za-z0-9_-]{86}$/, "expected ed25519:<base64url>");
+var SessionIdSchema = z.uuid();
+var SeqSchema = z.number().int().min(0);
+var TimestampSchema = z.iso.datetime({ offset: false });
+var JsonValueSchema = z.lazy(
+  () => z.union([
+    z.null(),
+    z.boolean(),
+    z.number().finite(),
+    z.string(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema)
+  ])
+);
+var EvidenceEventSchema = z.strictObject({
+  sessionId: SessionIdSchema,
+  source: EvidenceSourceSchema,
+  seq: SeqSchema,
+  ts: TimestampSchema,
+  kind: WireEvidenceKindSchema,
+  payload: z.record(z.string(), JsonValueSchema),
+  prevHash: Hex64Schema,
+  sig: SigSchema.optional()
+});
+function isWireKind(kind) {
+  return WIRE_KINDS.includes(kind);
+}
+function isPlatformKind(kind) {
+  return PLATFORM_KINDS.includes(kind);
+}
+
+// ../protocol/src/policy.ts
+import { z as z3 } from "zod";
+
+// ../protocol/src/reason-codes.ts
+var INDICATOR_CODES = [
+  "CHAIN_BROKEN",
+  "EVIDENCE_MISMATCH",
+  "CREDENTIAL_REVOKED",
+  "SESSION_INVALID",
+  "PRINCIPAL_FLAGGED"
+];
+var ANNOTATION_CODES = ["NO_AGENT_TRACE", "NO_POLICY"];
+var COLLECTOR_CODES = [
+  "SCHEMA_INVALID",
+  "SESSION_UNKNOWN",
+  "SESSION_CLOSED",
+  "SESSION_EXPIRED",
+  "SOURCE_FORBIDDEN",
+  "KIND_FORBIDDEN",
+  "SEQ_GAP",
+  "PREV_HASH_MISMATCH",
+  "SIG_MISSING",
+  "SIG_INVALID",
+  "PAYLOAD_INVALID",
+  "EVENT_TOO_LARGE"
+];
+var DEFAULT_RULE_CODES = [
+  "CAP_EXCEEDED",
+  "PAYEE_NOT_ALLOWED",
+  "NO_INTENT",
+  "INTENT_EXPIRED"
+];
+var REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/;
+
+// ../protocol/src/selector.ts
+import { z as z2 } from "zod";
+var SelectorSyntaxError = class extends Error {
+  constructor(input, at, detail) {
+    super(`invalid selector "${input}" at ${at}: ${detail}`);
+    this.input = input;
+    this.at = at;
+    this.name = "SelectorSyntaxError";
+  }
+  code = "SELECTOR_SYNTAX";
+};
+var IDENT = /^[A-Za-z_][A-Za-z0-9_-]*/;
+var NAME = /^[A-Za-z_][A-Za-z0-9_.-]*/;
+function parsePath(input, from) {
+  const path = [];
+  let i = from;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === ".") {
+      const m = IDENT.exec(input.slice(i + 1));
+      if (!m) throw new SelectorSyntaxError(input, i + 1, 'expected identifier after "."');
+      path.push({ key: m[0] });
+      i += 1 + m[0].length;
+    } else if (ch === "[") {
+      const close = input.indexOf("]", i);
+      if (close < 0) throw new SelectorSyntaxError(input, i, 'unterminated "["');
+      const body = input.slice(i + 1, close);
+      if (!/^\d+$/.test(body))
+        throw new SelectorSyntaxError(input, i + 1, "expected integer index");
+      path.push({ index: Number(body) });
+      i = close + 1;
+    } else {
+      throw new SelectorSyntaxError(input, i, `unexpected "${ch}"`);
+    }
+  }
+  return { path, end: i };
+}
+function parseSelector(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new SelectorSyntaxError(String(input), 0, "empty selector");
+  }
+  if (input.length > 512)
+    throw new SelectorSyntaxError(input.slice(0, 32), 512, "selector too long");
+  for (const root of ["payment", "intent", "session"]) {
+    if (input === root || input.startsWith(`${root}.`) || input.startsWith(`${root}[`)) {
+      return { root, path: parsePath(input, root.length).path };
+    }
+  }
+  if (input.startsWith("signal[name=")) {
+    const rest = input.slice("signal[name=".length);
+    const m = NAME.exec(rest);
+    if (!m) throw new SelectorSyntaxError(input, "signal[name=".length, "expected signal name");
+    const after = "signal[name=".length + m[0].length;
+    if (input[after] !== "]") throw new SelectorSyntaxError(input, after, 'expected "]"');
+    return { root: "signal", name: m[0], path: parsePath(input, after + 1).path };
+  }
+  if (input === "evidence[*]" || input.startsWith("evidence[*]")) {
+    return {
+      root: "evidence",
+      kind: "*",
+      all: true,
+      path: parsePath(input, "evidence[*]".length).path
+    };
+  }
+  if (input.startsWith("evidence[kind=")) {
+    let i = "evidence[kind=".length;
+    const km = NAME.exec(input.slice(i));
+    if (!km) throw new SelectorSyntaxError(input, i, "expected evidence kind");
+    const kind = km[0];
+    i += kind.length;
+    let source;
+    if (input.startsWith(",source=", i)) {
+      i += ",source=".length;
+      const sm = /^[A-Z_]+/.exec(input.slice(i));
+      if (!sm || !ALL_SOURCES.includes(sm[0])) {
+        throw new SelectorSyntaxError(input, i, `expected one of ${ALL_SOURCES.join("|")}`);
+      }
+      source = sm[0];
+      i += sm[0].length;
+    }
+    if (input[i] !== "]") throw new SelectorSyntaxError(input, i, 'expected "]"');
+    i += 1;
+    let all = false;
+    if (input.startsWith("[*]", i)) {
+      all = true;
+      i += 3;
+    }
+    const sel = { root: "evidence", kind, all, path: parsePath(input, i).path };
+    if (source) sel.source = source;
+    return sel;
+  }
+  throw new SelectorSyntaxError(
+    input,
+    0,
+    "unknown root (payment | intent | session | signal[name=\u2026] | evidence[\u2026])"
+  );
+}
+function formatSelector(sel) {
+  const path = sel.path.map((p) => "key" in p ? `.${p.key}` : `[${p.index}]`).join("");
+  switch (sel.root) {
+    case "payment":
+    case "intent":
+    case "session":
+      return `${sel.root}${path}`;
+    case "signal":
+      return `signal[name=${sel.name}]${path}`;
+    case "evidence":
+      if (sel.kind === "*") return `evidence[*]${path}`;
+      return `evidence[kind=${sel.kind}${sel.source ? `,source=${sel.source}` : ""}]${sel.all ? "[*]" : ""}${path}`;
+  }
+}
+function isSelectorRef(value) {
+  return typeof value === "string" && value.startsWith("@") && value.length > 1;
+}
+function parseSelectorRef(ref) {
+  return parseSelector(ref.slice(1));
+}
+function walkPath(value, path) {
+  let cur = value;
+  for (const seg of path) {
+    if (cur === null || cur === void 0) return void 0;
+    if ("key" in seg) {
+      if (typeof cur !== "object" || Array.isArray(cur)) return void 0;
+      cur = cur[seg.key];
+    } else {
+      if (!Array.isArray(cur)) return void 0;
+      cur = cur[seg.index];
+    }
+  }
+  return cur;
+}
+var SelectorStringSchema = z2.string().refine(
+  (s) => {
+    try {
+      parseSelector(s);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "invalid selector" }
+);
+
+// ../protocol/src/policy.ts
+var PRIMITIVES = ["THRESHOLD", "MEMBERSHIP", "MATCH", "PRESENCE", "FRESHNESS"];
+var PrimitiveSchema = z3.enum(PRIMITIVES);
+var RuleVerdictSchema = z3.enum(["DENY", "REVIEW"]);
+var RuleSchema = z3.strictObject({
+  id: z3.string().min(1).max(64),
+  primitive: PrimitiveSchema,
+  selector: SelectorStringSchema,
+  params: z3.record(z3.string(), JsonValueSchema),
+  onFail: RuleVerdictSchema,
+  /** What to do when the selector (or a `@ref`) resolves to nothing. Default: skip (GAP-44). */
+  onMissing: z3.enum(["skip", "DENY", "REVIEW"]).optional(),
+  /** Reason code surfaced to the caller when the rule fails (GAP-44). */
+  code: z3.string().regex(REASON_CODE_PATTERN)
+});
+var PolicyRulesSchema = z3.strictObject({
+  rules: z3.array(RuleSchema).max(200).refine((rules) => new Set(rules.map((r) => r.id)).size === rules.length, {
+    message: "rule ids must be unique"
+  }),
+  /** Domain-score thresholds — the only configurable part of the scores layer. */
+  scoreThresholds: z3.record(z3.string(), z3.number().min(0).max(1)).optional()
+});
+
+// ../protocol/src/api.ts
+var AmountSchema = z4.strictObject({
+  /** Decimal string — never a float. For x402 this is the atomic amount (GAP-49). */
+  value: z4.string().regex(/^\d+(\.\d+)?$/, "expected a decimal string"),
+  /** ISO code, or `<network>/<asset>` for on-chain rails (GAP-49). */
+  currency: z4.string().min(1).max(128)
+});
+var DeclaredIntentSchema = z4.strictObject({
+  mandate: z4.string().min(1).max(4e3),
+  maxAmount: AmountSchema.optional(),
+  merchantAllowlist: z4.array(z4.string().min(1)).optional(),
+  validUntil: TimestampSchema
+});
+var CreateSessionInputSchema = z4.strictObject({
+  source: EvidenceSourceSchema,
+  /** Buyer-born sessions. `credential` is opaque this phase (GAP-11). */
+  agent: z4.strictObject({ did: z4.string().min(1), credential: z4.string().min(1) }).optional(),
+  intent: DeclaredIntentSchema.optional()
+});
+var CreateSessionOutputSchema = z4.strictObject({
+  sessionId: SessionIdSchema,
+  expiresAt: TimestampSchema
+});
+var MAX_BATCH_EVENTS = 500;
+var EvidenceBatchInputSchema = z4.array(EvidenceEventSchema).min(1).max(MAX_BATCH_EVENTS);
+var EventResultStatusSchema = z4.enum(["ok", "duplicate", "fork", "rejected"]);
+var EventResultSchema = z4.strictObject({
+  index: z4.number().int().min(0),
+  sessionId: SessionIdSchema.nullable(),
+  source: EvidenceSourceSchema.nullable(),
+  seq: z4.number().int().min(0).nullable(),
+  status: EventResultStatusSchema,
+  code: z4.string().optional(),
+  eventDigest: Hex64Schema.optional()
+});
+var ChainHeadSchema = z4.strictObject({
+  seq: z4.number().int().min(0),
+  digest: Hex64Schema
+});
+var EvidenceAckSchema = z4.strictObject({
+  results: z4.array(EventResultSchema),
+  /** Head of every chain touched by the batch, after the batch. Keyed `sessionId:source`. */
+  heads: z4.record(z4.string(), ChainHeadSchema)
+});
+var PaymentSummarySchema = z4.strictObject({
+  protocol: z4.string().min(1),
+  payee: z4.string().min(1),
+  amount: AmountSchema,
+  /** Not in the RFC; needed by `principal-links` and `EVIDENCE_MISMATCH` (GAP-06). */
+  payer: z4.string().min(1).optional()
+});
+var EvaluateInputSchema = z4.strictObject({
+  sessionId: SessionIdSchema,
+  payment: PaymentSummarySchema
+});
+var DecisionSchema = z4.enum(["ALLOW", "DENY", "REVIEW"]);
+var EvaluateOutputSchema = z4.strictObject({
+  decision: DecisionSchema,
+  reasonCodes: z4.array(z4.string().regex(REASON_CODE_PATTERN)),
+  sessionId: SessionIdSchema,
+  /** Additive (GAP-21). */
+  decisionId: z4.uuid()
+});
+var CreatePolicyInputSchema = z4.strictObject({ rules: PolicyRulesSchema });
+var CreatePolicyOutputSchema = z4.strictObject({
+  policyId: z4.uuid(),
+  version: z4.number().int().min(1),
+  status: z4.enum(["ACTIVE", "SUPERSEDED", "DRAFT"])
+});
+var ApiErrorSchema = z4.strictObject({
+  error: z4.strictObject({
+    code: z4.string().min(1),
+    message: z4.string().min(1),
+    details: JsonValueSchema.optional(),
+    request_id: z4.string().optional()
+  })
+});
+
+// ../protocol/src/payloads/index.ts
+import { z as z5 } from "zod";
+var Json = JsonValueSchema;
+var JsonRecord = z5.record(z5.string(), Json);
+var SessionOpenPayloadSchema = z5.looseObject({
+  runtime: z5.looseObject({
+    sdk: z5.string().min(1),
+    version: z5.string().min(1),
+    framework: z5.string().optional(),
+    model: z5.string().optional()
+  }),
+  /** Runtime / repo attestations read by the (staged) Attestation Assurance score. */
+  attestations: JsonRecord.optional()
+});
+var SESSION_CLOSE_REASONS = ["completed", "settled", "aborted", "expired"];
+var SessionClosePayloadSchema = z5.looseObject({
+  reason: z5.enum(SESSION_CLOSE_REASONS),
+  transaction: z5.string().optional()
+});
+var IntentDeclaredPayloadSchema = DeclaredIntentSchema.loose();
+var LlmCallStartPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  // GAP-07
+  provider: z5.string().min(1),
+  modelId: z5.string().min(1),
+  params: JsonRecord
+});
+var LlmCallEndPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  content: Json.optional(),
+  finishReason: z5.string().optional(),
+  usage: JsonRecord.optional(),
+  durationMs: z5.number().int().min(0),
+  error: z5.looseObject({ name: z5.string(), message: z5.string() }).optional()
+});
+var ToolCallStartPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  // GAP-07
+  toolName: z5.string().min(1),
+  input: Json,
+  transport: z5.enum(["local", "mcp"]).optional(),
+  server: z5.string().optional()
+});
+var ToolCallEndPayloadSchema = z5.looseObject({
+  callId: z5.string().min(1),
+  output: Json.optional(),
+  error: z5.looseObject({ name: z5.string(), message: z5.string() }).optional(),
+  durationMs: z5.number().int().min(0)
+});
+var PAYMENT_ARTIFACTS = [
+  "http-402",
+  "mrtr-input-required",
+  "payment-signature",
+  "checkout-url"
+];
+var PaymentMomentPayloadSchema = z5.looseObject({
+  protocol: z5.string().min(1),
+  payee: z5.string().min(1),
+  amount: z5.looseObject({ value: z5.string().min(1), currency: z5.string().min(1) }),
+  payer: z5.string().optional(),
+  artifact: z5.enum(PAYMENT_ARTIFACTS),
+  raw: JsonRecord
+});
+var GatewayDecisionPayloadSchema = z5.looseObject({
+  gateway: z5.string().min(1),
+  call: z5.looseObject({ tool: z5.string().min(1), args: Json.optional() }),
+  decision: z5.enum(["ALLOW", "DENY", "REVIEW", "CHALLENGE"]),
+  reasonCodes: z5.array(z5.string()),
+  /** The gateway's own record of what it decided on — a black box to the platform. */
+  record: JsonRecord
+});
+var TransportGapPayloadSchema = z5.looseObject({
+  dropped: z5.number().int().min(1),
+  firstTs: z5.string(),
+  lastTs: z5.string()
+});
+var PlatformObservationPayloadSchema = z5.strictObject({
+  origin: z5.string().min(1),
+  params: Json,
+  response: Json
+});
+var ANOMALY_TYPES = [
+  "fork",
+  "seq_gap",
+  "prev_hash_mismatch",
+  "bad_sig",
+  "clock_skew",
+  "source_conflict"
+];
+var PlatformAnomalyPayloadSchema = z5.looseObject({
+  type: z5.enum(ANOMALY_TYPES),
+  source: EvidenceSourceAllSchema,
+  seq: z5.number().int().min(0).nullable(),
+  detail: JsonRecord
+});
+var REGISTRY = {
+  "session.open": SessionOpenPayloadSchema,
+  "session.close": SessionClosePayloadSchema,
+  "intent.declared": IntentDeclaredPayloadSchema,
+  "llm_call.start": LlmCallStartPayloadSchema,
+  "llm_call.end": LlmCallEndPayloadSchema,
+  "tool_call.start": ToolCallStartPayloadSchema,
+  "tool_call.end": ToolCallEndPayloadSchema,
+  "payment.requested": PaymentMomentPayloadSchema,
+  "payment.presented": PaymentMomentPayloadSchema,
+  "gateway.decision": GatewayDecisionPayloadSchema,
+  "transport.gap": TransportGapPayloadSchema,
+  "platform.observation": PlatformObservationPayloadSchema,
+  "platform.anomaly": PlatformAnomalyPayloadSchema
+};
+function payloadSchemaFor(kind) {
+  return REGISTRY[kind];
+}
+
+// ../protocol/src/verdict.ts
+var SEVERITY = { ALLOW: 0, REVIEW: 1, DENY: 2 };
+var Verdict = class _Verdict {
+  constructor(value) {
+    this.value = value;
+  }
+  static ALLOW = new _Verdict("ALLOW");
+  static REVIEW = new _Verdict("REVIEW");
+  static DENY = new _Verdict("DENY");
+  static of(value) {
+    return value === "DENY" ? _Verdict.DENY : value === "REVIEW" ? _Verdict.REVIEW : _Verdict.ALLOW;
+  }
+  /** The more severe of the two. */
+  atLeast(other) {
+    const o = typeof other === "string" ? _Verdict.of(other) : other;
+    return SEVERITY[o.value] > SEVERITY[this.value] ? o : this;
+  }
+  /** Whether a synchronous gate must stop the call (GAP-52). */
+  blocks(onReview) {
+    return this.value === "DENY" || this.value === "REVIEW" && onReview === "abort";
+  }
+  /** What the gate effectively did: DENY when it blocked, else the verdict itself. */
+  effective(onReview) {
+    return this.blocks(onReview) ? "DENY" : this.value;
+  }
+};
 export {
   ALL_SOURCES,
   ANNOTATION_CODES,