@belticlabs/agent-risk-sdk 0.5.0 → 0.6.0

package/dist/index.js

@@ -1,62 +1,116 @@
 import {
-  Verdict
-} from "./chunk-4BUUPU3O.js";
+  openCall
+} from "./chunk-ZMPKY7AX.js";
 import {
-  ApiClient,
-  BelticApiError,
-  BelticConfigError,
-  ChainRejectedError,
-  Session,
-  Sessions,
-  Transport
-} from "./chunk-JSE6JQJC.js";
+  summaryOf
+} from "./chunk-M4I3FGZG.js";
 import {
+  Chain,
   canonicalBytes,
-  canonicalize,
   didKeyFromEd25519,
   fromHex,
   memorySigner,
   sha256,
   toHex
-} from "./chunk-X3W2Z5GC.js";
+} from "./chunk-77D74TWX.js";
 
-// src/core/identity.ts
-function identityFromSeed(seed, credential) {
-  const signer = memorySigner(seed);
-  const did = didKeyFromEd25519(signer.publicKey);
-  return { did, signer: { ...signer, keyId: did }, ...credential ? { credential } : {} };
-}
+// src/core/api-client.ts
+var TIMEOUT_MS = 1e4;
+var BelticApiError = class extends Error {
+  constructor(status, code, message, details, requestId) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.details = details;
+    this.requestId = requestId;
+    this.name = "BelticApiError";
+  }
+  /** 5xx, 429 and network failures are an outage: retried by the transport, absorbed by the fail-open entries; 4xx are neither (GAP-70). */
+  get retryable() {
+    return this.status === 0 || this.status >= 500 || this.status === 429;
+  }
+};
+var ApiClient = class {
+  baseUrl;
+  headers;
+  constructor(baseUrl, apiKey, userAgent) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.headers = {
+      authorization: `Bearer ${apiKey}`,
+      "content-type": "application/json",
+      "user-agent": userAgent
+    };
+  }
+  async post(path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    let res;
+    try {
+      res = await globalThis.fetch(`${this.baseUrl}${path}`, {
+        method: "POST",
+        headers: this.headers,
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+    } catch (err) {
+      throw new BelticApiError(
+        0,
+        "NETWORK",
+        `request to ${path} failed: ${err.message}`
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    const text = await res.text();
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    if (!res.ok) {
+      const e = json?.error;
+      throw new BelticApiError(
+        res.status,
+        e?.code ?? `HTTP_${res.status}`,
+        e?.message ?? res.statusText,
+        e?.details,
+        e?.request_id
+      );
+    }
+    return json;
+  }
+};
 
-// src/core/payment-moment.ts
-function summaryOf(m) {
-  return {
-    protocol: m.protocol,
-    payee: m.payee,
-    amount: { value: m.amount.value, currency: m.amount.currency },
-    ...m.payer ? { payer: m.payer } : {}
-  };
-}
+// src/core/config-error.ts
+var BelticConfigError = class extends Error {
+  code = "CONFIG";
+  constructor(message) {
+    super(`Beltic: ${message}`);
+    this.name = "BelticConfigError";
+  }
+};
 
 // src/core/decision.ts
 var Decision = class _Decision {
-  constructor(evaluation) {
-    this.evaluation = evaluation;
+  constructor(output) {
+    this.output = output;
   }
   static ABSENT = new _Decision(null);
-  static of(evaluation) {
-    return new _Decision(evaluation);
+  static of(output) {
+    return new _Decision(output);
   }
   static absent() {
     return _Decision.ABSENT;
   }
   get value() {
-    return this.evaluation?.decision ?? null;
+    return this.output?.decision ?? null;
   }
   get reasonCodes() {
-    return this.evaluation?.reasonCodes ?? [];
+    return this.output?.reasonCodes ?? [];
   }
   get decisionId() {
-    return this.evaluation?.decisionId ?? null;
+    return this.output?.decisionId ?? null;
   }
   get allowed() {
     return this.value === "ALLOW";
@@ -68,22 +122,28 @@ var Decision = class _Decision {
     return this.value === "REVIEW";
   }
   get absent() {
-    return this.evaluation === null;
-  }
-  /** Whether a gate must stop the payment (GAP-52); an absent verdict never blocks. */
-  blocks(onReview) {
-    return this.evaluation ? Verdict.of(this.evaluation.decision).blocks(onReview) : false;
+    return this.output === null;
   }
   /** One sentence for the agent or the person: what Beltic said and why. */
   explain() {
-    if (!this.evaluation) return "Beltic could not be asked about this payment.";
+    if (!this.output) return "Beltic could not be asked about this payment.";
     const verb = this.denied ? "denied" : this.review ? "asked for review of" : "allowed";
     const why = this.reasonCodes.length > 0 ? ` (${this.reasonCodes.join(", ")})` : "";
     return `Beltic ${verb} this payment${why}.`;
   }
 };
 
-// src/core/run.ts
+// src/core/identity.ts
+var SEED_HEX = /^[0-9a-f]{64}$/i;
+function identityFromSeed(seedHex) {
+  if (!SEED_HEX.test(seedHex))
+    throw new BelticConfigError("agentSeed must be 64 hex characters (a 32-byte Ed25519 seed)");
+  const signer = memorySigner(fromHex(seedHex));
+  const did = didKeyFromEd25519(signer.publicKey);
+  return { did, signer: { ...signer, keyId: did } };
+}
+
+// src/core/session.ts
 var MEMORY = 256;
 var Memory = class {
   map = /* @__PURE__ */ new Map();
@@ -96,51 +156,42 @@ var Memory = class {
     if (this.map.size > MEMORY) this.map.delete(this.map.keys().next().value);
   }
 };
-var Run = class _Run {
+var Session = class _Session {
   constructor(deps, key, opts = {}) {
     this.deps = deps;
     this.key = key;
     this.opts = opts;
+    this.openedWith = opts.intent ? _Session.hash(opts.intent) : null;
   }
   opened = null;
   current = null;
-  /** JCS hash of the mandate on the chain, and of the one the open input carried. */
+  /** JCS hash of the mandate on the chain, and of the one the options carried. */
   declared = null;
-  openedWith = null;
+  openedWith;
   closed = false;
   timer = null;
   calls = new Memory();
   decisions = new Memory();
-  byPayment = new Memory();
-  /** The session this run records into — opened on first use, `null` when there is none. */
-  session() {
-    const next = this.deps.sessions.open(this.key, this.opener);
+  /** The platform's id for this session — opened on first use, `null` while there is none. */
+  id() {
+    return this.stream().then((stream) => stream?.id ?? null);
+  }
+  /**
+   * The stream this session records into — opened on first use, `null`
+   * when there is none. For the integrations; a host never holds it.
+   * @internal
+   */
+  stream() {
+    const next = this.deps.streams.open(this.key, this.opts);
     this.opened = next;
-    return next.then((session) => {
-      if (session !== this.current) {
-        this.current = session;
+    return next.then((stream) => {
+      if (stream !== this.current) {
+        this.current = stream;
         this.declared = this.openedWith;
       }
-      return session;
+      return stream;
     });
   }
-  opener = async () => {
-    const open = this.opts.open;
-    const input = typeof open === "function" ? await open() : open ?? {};
-    this.openedWith = input.intent ? _Run.hash(input.intent) : null;
-    return input;
-  };
-  /** `intent.declared`, unless the mandate is the one already on the chain. */
-  async declare(intent) {
-    const session = await this.session();
-    if (!session) return false;
-    const hash = _Run.hash(intent);
-    if (hash === this.declared) return false;
-    const ok = await session.emit("intent.declared", intent);
-    if (ok) this.declared = hash;
-    this.touch();
-    return ok;
-  }
   /**
    * The platform's verdict on a payment about to be presented. Asked once
    * per call id: a host that re-runs its approval step reads the same
@@ -150,23 +201,21 @@ var Run = class _Run {
   async decide(payment, opts = {}) {
     const known = opts.callId ? this.decisions.get(opts.callId) : void 0;
     if (known) return known;
-    const session = await this.session();
-    if (!session) return Decision.absent();
-    if (opts.intent) await this.declare(opts.intent);
+    const stream = await this.stream();
+    if (!stream) return Decision.absent();
+    if (opts.intent) await this.declare(stream, opts.intent);
     const summary = summaryOf(payment);
-    const evaluation = await this.deps.evaluate(session.id, summary);
-    if (!evaluation) return Decision.absent();
-    const decision = Decision.of(evaluation);
+    const decision = await this.deps.evaluate(stream.id, summary);
+    if (decision.absent) return decision;
     if (opts.callId) this.decisions.set(opts.callId, decision);
-    for (const key of _Run.paymentKeys(summary)) this.byPayment.set(key, decision);
     const call = opts.callId ? this.calls.get(opts.callId)?.call : void 0;
-    await session.emit("gateway.decision", {
+    await stream.emit("gateway.decision", {
       gateway: "beltic",
-      call: _Run.callOf(call),
-      decision: evaluation.decision,
-      reasonCodes: [...evaluation.reasonCodes],
+      call: _Session.callOf(call),
+      decision: decision.value,
+      reasonCodes: [...decision.reasonCodes],
       record: {
-        decisionId: evaluation.decisionId,
+        decisionId: decision.decisionId,
         callId: opts.callId ?? null,
         payment: summary
       }
@@ -178,24 +227,12 @@ var Run = class _Run {
   decision(callId) {
     return this.decisions.get(callId) ?? Decision.absent();
   }
-  /**
-   * The decision given for a payment with the same comparable core (payee,
-   * amount, payer — or payee and amount when one side names no payer), or
-   * absent.
-   */
-  decisionFor(payment) {
-    for (const key of _Run.paymentKeys(summaryOf(payment))) {
-      const known = this.byPayment.get(key);
-      if (known) return known;
-    }
-    return Decision.absent();
-  }
   /** A tool call the host runs itself, reported as two events by its own call id. */
   tools = {
     start: async (call) => {
-      const session = await this.session();
-      if (!session) return false;
-      const span = session.toolCall(call);
+      const stream = await this.stream();
+      if (!stream) return false;
+      const span = stream.toolCall(call);
       this.calls.set(call.callId, { call, span });
       this.touch();
       return span.opened;
@@ -215,11 +252,11 @@ var Run = class _Run {
   };
   /** A person's answer about a call, as the decision it was (GAP-75). */
   async humanDecided(callId, input) {
-    const session = await this.session();
-    if (!session) return false;
-    const ok = await session.emit("gateway.decision", {
+    const stream = await this.stream();
+    if (!stream) return false;
+    const ok = await stream.emit("gateway.decision", {
       gateway: "human",
-      call: _Run.callOf(this.calls.get(callId)?.call),
+      call: _Session.callOf(this.calls.get(callId)?.call),
       decision: input.allowed ? "ALLOW" : "DENY",
       reasonCodes: [`USER_${input.outcome.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`],
       record: {
@@ -237,8 +274,14 @@ var Run = class _Run {
     this.closed = true;
     if (this.timer) clearTimeout(this.timer);
     this.deps.onClosed(this);
-    const session = this.opened ? await this.opened.catch(() => null) : null;
-    await session?.close(reason);
+    const stream = this.opened ? await this.opened.catch(() => null) : null;
+    await stream?.close(reason);
+  }
+  /** `intent.declared`, unless the mandate is the one already on the chain (GAP-76). */
+  async declare(stream, intent) {
+    const hash = _Session.hash(intent);
+    if (hash === this.declared) return;
+    if (await stream.emit("intent.declared", intent)) this.declared = hash;
   }
   take(callId) {
     const known = this.calls.get(callId);
@@ -256,121 +299,420 @@ var Run = class _Run {
   static hash(intent) {
     return toHex(sha256(canonicalBytes(intent)));
   }
-  /** With the payer first, then without it. */
-  static paymentKeys(summary) {
-    const { payer, ...core } = summary;
-    return payer ? [canonicalize(summary), canonicalize(core)] : [canonicalize(core)];
-  }
   static callOf(call) {
     return call ? { tool: call.toolName, args: call.input } : { tool: "unknown" };
   }
 };
 
+// src/core/stream.ts
+var Stream = class {
+  constructor(deps, id, source, born) {
+    this.deps = deps;
+    this.id = id;
+    this.source = source;
+    this.born = born;
+    this.chain = Chain.genesis(id, source);
+  }
+  chain;
+  building = Promise.resolve();
+  dropped = 0;
+  droppedFirstTs = null;
+  droppedLastTs = null;
+  closed = false;
+  get isClosed() {
+    return this.closed;
+  }
+  /**
+   * Resolves once the event is sequenced and buffered — not once it is
+   * acknowledged. `false` when the event was dropped for lack of room.
+   */
+  async emit(kind, payload) {
+    const halted = this.deps.transport.haltedError(this.id, this.source);
+    if (halted) throw halted;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    if (!this.deps.transport.hasRoom()) {
+      this.dropped++;
+      this.droppedFirstTs ??= ts;
+      this.droppedLastTs = ts;
+      return false;
+    }
+    if (this.dropped > 0) {
+      this.deps.transport.enqueue(
+        await this.next(
+          "transport.gap",
+          { dropped: this.dropped, firstTs: this.droppedFirstTs, lastTs: this.droppedLastTs },
+          ts
+        )
+      );
+      this.dropped = 0;
+      this.droppedFirstTs = this.droppedLastTs = null;
+    }
+    this.deps.transport.enqueue(await this.next(kind, payload, ts));
+    return true;
+  }
+  /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+  toolCall(call) {
+    const { callId, ...start } = call;
+    return openCall(this, "tool_call", callId, { transport: "local", ...start });
+  }
+  async close(reason = "completed", extra = {}) {
+    if (this.closed) return;
+    this.closed = true;
+    await this.emit("session.close", { reason, ...extra });
+    await this.flush();
+    this.deps.onClosed?.(this);
+  }
+  /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
+  flush() {
+    return this.deps.transport.flush();
+  }
+  /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
+  next(kind, payload, ts) {
+    const run = this.building.then(async () => {
+      const built = await this.chain.append({ ts, kind, payload }, this.deps.signer);
+      this.chain = built.chain;
+      return built.event;
+    });
+    this.building = run.catch(() => void 0);
+    return run;
+  }
+};
+
+// src/core/transport.ts
+var FLUSH_MS = 1e3;
+var MAX_BATCH = 50;
+var MAX_BUFFERED = 5e3;
+var BACKOFF_BASE_MS = 200;
+var BACKOFF_MAX_MS = 3e4;
+var ChainRejectedError = class extends Error {
+  constructor(sessionId, source, result, options) {
+    super(
+      `chain ${sessionId}:${source} halted at seq ${result.seq}: ${result.status}${result.code ? ` ${result.code}` : ""}`,
+      options
+    );
+    this.sessionId = sessionId;
+    this.source = source;
+    this.result = result;
+    this.name = "ChainRejectedError";
+  }
+};
+var TransportClosedError = class extends Error {
+  constructor() {
+    super("transport is closed");
+    this.name = "TransportClosedError";
+  }
+};
+var Transport = class _Transport {
+  constructor(api) {
+    this.api = api;
+  }
+  chains = /* @__PURE__ */ new Map();
+  buffered = 0;
+  timer = null;
+  closed = false;
+  /**
+   * What the fail-open entries absorb (GAP-70): the platform could not be
+   * reached or failed on its side — a network error, a 5xx, a 429.
+   * Everything the platform *rejected* (a 4xx: bad key, unknown session,
+   * invalid payload) is a fault of the client and throws.
+   */
+  static outage(err) {
+    return err instanceof BelticApiError && err.retryable;
+  }
+  get size() {
+    return this.buffered;
+  }
+  hasRoom() {
+    return !this.closed && this.buffered < MAX_BUFFERED;
+  }
+  haltedError(sessionId, source) {
+    return this.chains.get(`${sessionId}:${source}`)?.halted ?? null;
+  }
+  /** Callers check `hasRoom()` first and assign `seq` only then (GAP-38). */
+  enqueue(ev) {
+    if (this.closed) throw new TransportClosedError();
+    const key = `${ev.sessionId}:${ev.source}`;
+    let chain = this.chains.get(key);
+    if (!chain) {
+      chain = { pending: [], inFlight: null, retry: null, attempts: 0, halted: null };
+      this.chains.set(key, chain);
+    }
+    if (chain.halted) throw chain.halted;
+    if (!this.hasRoom()) throw new Error("transport buffer is full");
+    chain.pending.push(ev);
+    this.buffered++;
+    if (chain.pending.length >= MAX_BATCH) void this.deliver(chain, false);
+    else this.schedule();
+  }
+  /** One attempt per chain, now — a chain waiting out its backoff included; resolves once every attempt settled. */
+  async flush() {
+    this.unschedule();
+    await Promise.all([...this.chains.values()].map((chain) => this.deliver(chain, true)));
+  }
+  async close() {
+    await this.flush();
+    this.closed = true;
+    for (const chain of this.chains.values()) {
+      if (chain.retry) clearTimeout(chain.retry);
+      chain.retry = null;
+    }
+  }
+  schedule() {
+    if (this.timer) return;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      for (const chain of this.chains.values()) void this.deliver(chain, false);
+    }, FLUSH_MS);
+    this.timer.unref?.();
+  }
+  unschedule() {
+    if (!this.timer) return;
+    clearTimeout(this.timer);
+    this.timer = null;
+  }
+  /** A chain waiting out its backoff is left alone unless forced: only `flush` cuts a backoff short. */
+  deliver(chain, force) {
+    if (chain.inFlight) return chain.inFlight;
+    if (chain.halted || chain.pending.length === 0) return Promise.resolve();
+    if (chain.retry) {
+      if (!force) return Promise.resolve();
+      clearTimeout(chain.retry);
+      chain.retry = null;
+    }
+    chain.inFlight = this.attempt(chain).finally(() => {
+      chain.inFlight = null;
+    });
+    return chain.inFlight;
+  }
+  /** Batches until the chain drains; a retryable failure schedules the next attempt and returns. */
+  async attempt(chain) {
+    while (chain.pending.length > 0 && !chain.halted) {
+      const batch = chain.pending.slice(0, MAX_BATCH);
+      const first = batch[0];
+      let ack;
+      try {
+        ack = await this.api.post("/v1/evidence", batch);
+      } catch (err) {
+        console.error("[beltic]", err);
+        if (!_Transport.outage(err)) {
+          this.halt(
+            chain,
+            new ChainRejectedError(
+              first.sessionId,
+              first.source,
+              {
+                index: 0,
+                sessionId: first.sessionId,
+                source: first.source,
+                seq: first.seq,
+                status: "rejected",
+                code: "DELIVERY_FAILED"
+              },
+              { cause: err }
+            )
+          );
+          return;
+        }
+        const delay = Math.min(BACKOFF_MAX_MS, BACKOFF_BASE_MS * 2 ** chain.attempts) * (0.5 + Math.random() / 2);
+        chain.attempts++;
+        chain.retry = setTimeout(() => {
+          chain.retry = null;
+          void this.deliver(chain, false);
+        }, delay);
+        chain.retry.unref?.();
+        return;
+      }
+      chain.pending.splice(0, batch.length);
+      this.buffered -= batch.length;
+      chain.attempts = 0;
+      const bad = ack.results.find((r) => r.status === "fork" || r.status === "rejected");
+      if (bad) this.halt(chain, new ChainRejectedError(first.sessionId, first.source, bad));
+    }
+  }
+  halt(chain, error) {
+    chain.halted = error;
+    this.buffered -= chain.pending.length;
+    chain.pending = [];
+    console.error("[beltic]", error);
+  }
+};
+
+// src/core/streams.ts
+var OPEN_RETRY_MS = 6e4;
+var Streams = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  attached = /* @__PURE__ */ new Map();
+  /** Buyer streams by the host's own key (GAP-71). */
+  opened = /* @__PURE__ */ new Map();
+  retryAt = 0;
+  /**
+   * Buyer half: the stream for a key of the host's own, opened on first
+   * use and reused after. A halted chain is reopened as a fresh session
+   * that continues the same key; a closed key is forgotten.
+   */
+  open(key, input = {}) {
+    const prior = this.opened.get(key) ?? Promise.resolve(null);
+    const next = prior.catch(() => null).then(
+      (stream) => stream && !stream.isClosed && !this.deps.transport.haltedError(stream.id, stream.source) ? stream : this.openFresh(input, () => this.forget(key, next))
+    );
+    this.opened.set(key, next);
+    next.catch(() => this.forget(key, next));
+    return next;
+  }
+  /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
+  async ensure(sessionId) {
+    if (sessionId) return this.attach(sessionId, "INTERNAL_NETWORK", "buyer");
+    const out = await this.deps.api.post("/v1/sessions", {
+      source: "INTERNAL_NETWORK"
+    });
+    return this.attach(out.sessionId, "INTERNAL_NETWORK", "seller");
+  }
+  forget(key, entry) {
+    if (this.opened.get(key) === entry) this.opened.delete(key);
+  }
+  async openFresh(input, onClosed) {
+    const identity = this.deps.identity;
+    if (!identity)
+      throw new BelticConfigError(
+        "beltic.session needs an agent seed (new Beltic({ agentSeed }) or BELTIC_AGENT_SEED)"
+      );
+    if (Date.now() < this.retryAt) return null;
+    try {
+      const stream = await this.create(identity, input, onClosed);
+      this.retryAt = 0;
+      return stream;
+    } catch (err) {
+      if (!Transport.outage(err)) throw err;
+      this.retryAt = Date.now() + OPEN_RETRY_MS;
+      console.error("[beltic]", err);
+      return null;
+    }
+  }
+  async create(identity, input, onClosed) {
+    const body = {
+      source: "AGENT_TRACE",
+      agent: { did: identity.did, credential: identity.did },
+      ...input.intent ? { intent: input.intent } : {}
+    };
+    const out = await this.deps.api.post("/v1/sessions", body);
+    const stream = this.attach(out.sessionId, "AGENT_TRACE", "buyer", onClosed);
+    await stream.emit("session.open", {
+      runtime: {
+        sdk: "@belticlabs/agent-risk-sdk",
+        version: this.deps.sdkVersion,
+        ...input.runtime
+      },
+      ...input.attestations ? { attestations: input.attestations } : {}
+    });
+    if (input.intent) await stream.emit("intent.declared", input.intent);
+    return stream;
+  }
+  attach(id, source, born, onClosed) {
+    const key = `${id}:${source}`;
+    const existing = this.attached.get(key);
+    if (existing) return existing;
+    const stream = new Stream(
+      {
+        transport: this.deps.transport,
+        signer: source === "AGENT_TRACE" ? this.deps.identity?.signer : void 0,
+        onClosed: () => {
+          this.attached.delete(key);
+          onClosed?.();
+        }
+      },
+      id,
+      source,
+      born
+    );
+    this.attached.set(key, stream);
+    return stream;
+  }
+};
+
 // src/client.ts
-var SDK_VERSION = "0.5.0";
-var ENV_REQUIRED = ["BELTIC_API_KEY", "BELTIC_BASE_URL", "BELTIC_AGENT_SEED"];
-var ENV_CREDENTIAL = "BELTIC_AGENT_CREDENTIAL";
+var SDK_VERSION = "0.6.0";
 var Beltic = class _Beltic {
-  transport;
-  sessions;
-  identity;
-  onReview;
-  failOpen;
+  /** The stream registry, for the protocol adapters. @internal */
+  streams;
   api;
-  onError;
-  runs = /* @__PURE__ */ new Map();
+  transport;
+  sessions = /* @__PURE__ */ new Map();
   /**
-   * The client the environment describes: `BELTIC_API_KEY`,
-   * `BELTIC_BASE_URL`, `BELTIC_AGENT_SEED` (64 hex) and optionally
-   * `BELTIC_AGENT_CREDENTIAL`. Any of the three missing is a configuration
-   * error, thrown (GAP-78).
+   * The client the environment describes: `BELTIC_API_KEY` and
+   * `BELTIC_BASE_URL`, both required, and `BELTIC_AGENT_SEED` (64 hex) for
+   * the buyer half. A missing required variable is a configuration error,
+   * thrown (GAP-78).
    */
-  static fromEnv(env = _Beltic.processEnv(), opts = {}) {
-    const missing = ENV_REQUIRED.filter((name) => !env[name]);
+  static fromEnv(env = _Beltic.processEnv()) {
+    const missing = ["BELTIC_API_KEY", "BELTIC_BASE_URL"].filter((name) => !env[name]);
     if (missing.length > 0)
-      throw new BelticConfigError(
-        `${missing.join(", ")} missing \u2014 fromEnv needs ${ENV_REQUIRED.join(", ")}`
-      );
+      throw new BelticConfigError(`${missing.join(", ")} missing from the environment`);
     return new _Beltic({
-      ...opts,
       apiKey: env.BELTIC_API_KEY,
       baseUrl: env.BELTIC_BASE_URL,
-      identity: identityFromSeed(fromHex(env.BELTIC_AGENT_SEED), env[ENV_CREDENTIAL])
+      agentSeed: env.BELTIC_AGENT_SEED
     });
   }
   constructor(opts) {
     if (!opts.apiKey) throw new BelticConfigError("apiKey is required");
     if (!URL.canParse(opts.baseUrl))
       throw new BelticConfigError(`baseUrl is not a URL: ${JSON.stringify(opts.baseUrl)}`);
-    this.failOpen = opts.failOpen ?? false;
-    this.onError = opts.onError ?? ((err) => console.error("[beltic]", err));
-    this.api = new ApiClient({
-      baseUrl: opts.baseUrl,
-      apiKey: opts.apiKey,
-      fetch: opts.fetch,
-      userAgent: `@belticlabs/agent-risk-sdk/${SDK_VERSION}`
-    });
-    this.transport = new Transport(this.api, {
-      ...opts.transport,
-      onError: this.onError,
-      onChainHalted: this.onError
-    });
-    this.sessions = new Sessions({
+    this.api = new ApiClient(
+      opts.baseUrl,
+      opts.apiKey,
+      `@belticlabs/agent-risk-sdk/${SDK_VERSION}`
+    );
+    this.transport = new Transport(this.api);
+    this.streams = new Streams({
       api: this.api,
       transport: this.transport,
-      sdkVersion: SDK_VERSION,
-      identity: opts.identity,
-      failOpen: this.failOpen,
-      onError: this.onError,
-      openRetryMs: opts.openRetryMs
+      identity: opts.agentSeed ? identityFromSeed(opts.agentSeed) : null,
+      sdkVersion: SDK_VERSION
     });
-    this.identity = opts.identity;
-    this.onReview = opts.onReview ?? "abort";
-  }
-  /**
-   * The platform's verdict on a payment — the seller's before it verifies,
-   * the buyer's before it presents. Read-your-writes: the buffered evidence
-   * is flushed first so the platform judges what the caller already saw
-   * (GAP-16). A recorded moment is accepted as is: only its comparable core
-   * (payee, amount, payer) is sent. `null` only under `failOpen`, when the
-   * platform could not be reached.
-   */
-  async evaluate(sessionId, payment) {
-    const input = { sessionId, payment: summaryOf(payment) };
-    try {
-      return await this.decide(input);
-    } catch (err) {
-      if (!this.failOpen || !Transport.outage(err)) throw err;
-      this.onError(err);
-      return null;
-    }
-  }
-  async decide(input) {
-    await this.transport.flush();
-    const out = await this.api.post("/v1/evaluate", input);
-    return { ...out, verdict: Verdict.of(out.decision) };
   }
   /**
-   * The run for a key of the host's own — one object per key until it
-   * closes (the options count on the first call only). See `Run`.
+   * The session for a key of the host's own (its session, run or
+   * conversation id) — one object per key until it closes; the options
+   * count on the first call only. See `Session`.
    */
-  run(key, opts = {}) {
-    const existing = this.runs.get(key);
+  session(key, opts = {}) {
+    const existing = this.sessions.get(key);
     if (existing) return existing;
-    const run = new Run(
+    const session = new Session(
       {
-        sessions: this.sessions,
+        streams: this.streams,
         evaluate: (sessionId, payment) => this.evaluate(sessionId, payment),
         onClosed: (closed) => {
-          if (this.runs.get(key) === closed) this.runs.delete(key);
+          if (this.sessions.get(key) === closed) this.sessions.delete(key);
         }
       },
       key,
       opts
     );
-    this.runs.set(key, run);
-    return run;
+    this.sessions.set(key, session);
+    return session;
+  }
+  /**
+   * The platform's verdict on a payment — the seller's before it verifies,
+   * the buyer's before it presents (Fraud SDK RFC › Evaluation Client).
+   * Read-your-writes: the buffered evidence is flushed first so the
+   * platform judges what the caller already saw (GAP-16). Absent when the
+   * platform could not be reached (GAP-70).
+   */
+  async evaluate(sessionId, payment) {
+    const input = { sessionId, payment };
+    try {
+      await this.transport.flush();
+      return Decision.of(await this.api.post("/v1/evaluate", input));
+    } catch (err) {
+      if (!Transport.outage(err)) throw err;
+      console.error("[beltic]", err);
+      return Decision.absent();
+    }
   }
+  /** Send everything buffered now and wait for that attempt. */
   flush() {
     return this.transport.flush();
   }
@@ -383,15 +725,11 @@ var Beltic = class _Beltic {
   }
 };
 export {
-  ApiClient,
   Beltic,
   BelticApiError,
   BelticConfigError,
   ChainRejectedError,
   Decision,
-  Run,
   SDK_VERSION,
-  Session,
-  Transport,
-  identityFromSeed
+  Session
 };