@belticlabs/agent-risk-sdk 0.5.0 → 0.7.0

package/dist/protocol/index.d.ts

@@ -1,8 +1,49 @@
-import { J as JsonValue, E as EvidenceSourceAll } from '../verdict-DMnbFuS5.js';
-export { A as ALL_SOURCES, a as ANOMALY_TYPES, b as Amount, c as AmountSchema, d as ApiError, e as ApiErrorSchema, C as ChainHead, f as ChainHeadSchema, g as CreatePolicyInput, h as CreatePolicyInputSchema, i as CreatePolicyOutput, j as CreatePolicyOutputSchema, k as CreateSessionInput, l as CreateSessionInputSchema, m as CreateSessionOutput, n as CreateSessionOutputSchema, D as Decision, o as DecisionSchema, p as DeclaredIntent, q as DeclaredIntentSchema, r as DigestedEnvelope, s as EvaluateInput, t as EvaluateInputSchema, u as EvaluateOutput, v as EvaluateOutputSchema, w as EventResult, x as EventResultSchema, y as EventResultStatus, z as EventResultStatusSchema, B as EvidenceAck, F as EvidenceAckSchema, G as EvidenceBatchInput, H as EvidenceBatchInputSchema, I as EvidenceEnvelope, K as EvidenceEvent, L as EvidenceEventSchema, M as EvidenceKind, N as EvidenceKindSchema, O as EvidenceSource, Q as EvidenceSourceAllSchema, R as EvidenceSourceSchema, S as GatewayDecisionPayload, T as GatewayDecisionPayloadSchema, U as Hex64, V as Hex64Schema, W as IntentDeclaredPayload, X as IntentDeclaredPayloadSchema, Y as JsonObject, Z as JsonValueSchema, _ as LlmCallEndPayload, $ as LlmCallEndPayloadSchema, a0 as LlmCallStartPayload, a1 as LlmCallStartPayloadSchema, a2 as MAX_BATCH_EVENTS, a3 as OnReview, a4 as PAYMENT_ARTIFACTS, a5 as PLATFORM_KINDS, a6 as PayloadByKind, P as PaymentMomentPayload, a7 as PaymentMomentPayloadSchema, a8 as PaymentSummary, a9 as PaymentSummarySchema, aa as PlatformAnomalyPayload, ab as PlatformAnomalyPayloadSchema, ac as PlatformEvidenceKind, ad as PlatformEvidenceKindSchema, ae as PlatformObservationPayload, af as PlatformObservationPayloadSchema, ag as SESSION_CLOSE_REASONS, ah as SOURCE_ORDER, ai as SeqSchema, aj as SessionClosePayload, ak as SessionClosePayloadSchema, al as SessionIdSchema, am as SessionOpenPayload, an as SessionOpenPayloadSchema, ao as Sig, ap as SigSchema, aq as TimestampSchema, ar as ToolCallEndPayload, as as ToolCallEndPayloadSchema, at as ToolCallStartPayload, au as ToolCallStartPayloadSchema, av as TransportGapPayload, aw as TransportGapPayloadSchema, ax as Verdict, ay as WIRE_KINDS, az as WIRE_SOURCES, aA as WireEvidenceKind, aB as WireEvidenceKindSchema, aC as compareBySessionSource, aD as compareBySourceSeq, aE as isPlatformKind, aF as isWireKind, aG as payloadSchemaFor } from '../verdict-DMnbFuS5.js';
+import { J as JsonValue, E as EvidenceSourceAll, D as Decision } from '../index-DAVKGJs5.js';
+export { A as ALL_SOURCES, a as ApiError, b as ApiErrorSchema, C as ChainHead, c as CreatePolicyInputSchema, d as CreatePolicyOutput, e as CreateSessionInput, f as CreateSessionInputSchema, g as CreateSessionOutput, h as DeclaredIntent, i as DeclaredIntentSchema, j as DigestedEnvelope, k as EvaluateInput, l as EvaluateInputSchema, m as EvaluateOutput, n as EventResult, o as EvidenceAck, p as EvidenceBatchInputSchema, q as EvidenceEnvelope, r as EvidenceEvent, s as EvidenceEventSchema, t as EvidenceKind, u as EvidenceSource, v as EvidenceSourceAllSchema, w as EvidenceSourceSchema, G as GatewayDecisionPayload, H as Hex64, x as Hex64Schema, I as IntentDeclaredPayload, y as JsonObject, z as JsonValueSchema, L as LlmCallEndPayload, B as LlmCallParams, F as LlmCallStartPayload, M as MAX_BATCH_EVENTS, P as PayloadByKind, K as PaymentMomentPayload, N as PaymentSummary, O as PaymentSummarySchema, Q as PlatformAnomalyPayload, R as PlatformEvidenceKind, S as PlatformObservationPayload, T as PromptBase, U as PromptDelta, V as SESSION_ID_CHARS, W as SESSION_ID_PREFIX, X as SOURCE_ORDER, Y as SessionClosePayload, Z as SessionIdSchema, _ as SessionOpenPayload, $ as Sig, a0 as TimestampSchema, a1 as ToolCallEndPayload, a2 as ToolCallStartPayload, a3 as TransportGapPayload, a4 as WireEvidenceKind, a5 as chainKey, a6 as compareByArrival, a7 as compareBySessionSource, a8 as compareBySourceSeq, a9 as compareRootFirst, aa as payloadSchemaFor, ab as withinHeads } from '../index-DAVKGJs5.js';
 import { z } from 'zod';
 
-declare const PRIMITIVES: readonly ["THRESHOLD", "MEMBERSHIP", "MATCH", "PRESENCE", "FRESHNESS"];
+/**
+ * Amounts are decimal strings, never floats (Fraud Engine RFC › API:
+ * `amount: { value: string; currency: string }`). One grammar for the wire
+ * and the engine, and one value object that compares and adds over scaled
+ * BigInts, so 0.1 + 0.2 is 0.3 and an atomic x402 amount of 18 digits
+ * keeps its precision. A currency mismatch is never coerced away (GAP-49):
+ * two amounts are comparable only when they name the same currency or one
+ * names none (a bare bound in a rule).
+ */
+
+declare const DecimalStringSchema: z.ZodString;
+type DecimalString = z.infer<typeof DecimalStringSchema>;
+declare const AmountSchema: z.ZodObject<{
+    value: z.ZodString;
+    currency: z.ZodString;
+}, z.core.$strict>;
+type Amount = z.infer<typeof AmountSchema>;
+declare class Money {
+    readonly value: DecimalString;
+    readonly currency: string | null;
+    private constructor();
+    static of(amount: Amount): Money;
+    /** A decimal with no currency: a bound in a rule, a running total. */
+    static bare(value: string): Money;
+    /** An x402 amount: atomic units of `asset` on `network`, its currency `<network>/<asset>` (GAP-49). */
+    static x402(network: string, asset: string, atomic: string | bigint): Money;
+    static x402Currency(network: string, asset: string): string;
+    /** Anything a selector or a rule param may resolve to; null when it is not an amount. */
+    static parse(v: unknown): Money | null;
+    comparable(other: Money): boolean;
+    compareTo(other: Money): -1 | 0 | 1;
+    exceeds(other: Money): boolean;
+    plus(other: Money): Money;
+    isZero(): boolean;
+    /** Numeric view for ratios; precision loss is acceptable for a ratio. */
+    toNumber(): number;
+    /** this / other, or null when `other` is zero. */
+    ratioTo(other: Money): number | null;
+    toAmount(): Amount;
+    private static scaled;
+}
+
 declare const PrimitiveSchema: z.ZodEnum<{
     THRESHOLD: "THRESHOLD";
     MEMBERSHIP: "MEMBERSHIP";
@@ -66,18 +107,17 @@ declare const PolicyRulesSchema: z.ZodObject<{
         }>>;
         code: z.ZodString;
     }, z.core.$strict>>;
-    scoreThresholds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strict>;
 type PolicyRules = z.infer<typeof PolicyRulesSchema>;
 
 /**
  * Reason codes are the only thing that crosses the verdict boundary besides
  * the verdict itself (Fraud Engine RFC › API: "the seller receives a verdict
- * and reasons — never the record"). Three families, kept separate so the
- * type system knows which layer may emit which.
+ * and reasons — never the record"). The platform's own codes are named here;
+ * an owner's rule codes are content, checked only against the pattern (GAP-44).
  */
 /** Static platform policy — may DENY alone (Fraud Engine RFC › Fraud indicators). */
-declare const INDICATOR_CODES: readonly ["CHAIN_BROKEN", "EVIDENCE_MISMATCH", "CREDENTIAL_REVOKED", "SESSION_INVALID", "PRINCIPAL_FLAGGED"];
+declare const INDICATOR_CODES: readonly ["CHAIN_BROKEN", "EVIDENCE_MISMATCH", "SESSION_INVALID"];
 type IndicatorCode = (typeof INDICATOR_CODES)[number];
 /**
  * Annotations describe the floor the decision was made on. They never change
@@ -85,14 +125,8 @@ type IndicatorCode = (typeof INDICATOR_CODES)[number];
  * the owner's rules, not a denial (GAP-43).
  */
 declare const ANNOTATION_CODES: readonly ["NO_AGENT_TRACE", "NO_POLICY"];
-type AnnotationCode = (typeof ANNOTATION_CODES)[number];
 /** Why the Collector refused or downgraded an event (per-event ack, GAP-17). */
-declare const COLLECTOR_CODES: readonly ["SCHEMA_INVALID", "SESSION_UNKNOWN", "SESSION_CLOSED", "SESSION_EXPIRED", "SOURCE_FORBIDDEN", "KIND_FORBIDDEN", "SEQ_GAP", "PREV_HASH_MISMATCH", "SIG_MISSING", "SIG_INVALID", "PAYLOAD_INVALID", "EVENT_TOO_LARGE"];
-type CollectorCode = (typeof COLLECTOR_CODES)[number];
-/** Codes the platform default policy uses; owners may define their own (GAP-44). */
-declare const DEFAULT_RULE_CODES: readonly ["CAP_EXCEEDED", "PAYEE_NOT_ALLOWED", "NO_INTENT", "INTENT_EXPIRED"];
-type DefaultRuleCode = (typeof DEFAULT_RULE_CODES)[number];
-type ReasonCode = IndicatorCode | AnnotationCode | DefaultRuleCode | (string & {});
+type CollectorCode = 'SCHEMA_INVALID' | 'SESSION_UNKNOWN' | 'SESSION_CLOSED' | 'SESSION_EXPIRED' | 'SOURCE_FORBIDDEN' | 'SEQ_GAP' | 'PREV_HASH_MISMATCH' | 'SIG_MISSING' | 'SIG_INVALID' | 'PAYLOAD_INVALID' | 'EVENT_TOO_LARGE';
 declare const REASON_CODE_PATTERN: RegExp;
 
 /**
@@ -140,18 +174,28 @@ type Selector = {
     all: boolean;
     path: PathSegment[];
 };
-declare class SelectorSyntaxError extends Error {
-    readonly input: string;
-    readonly at: number;
-    readonly code = "SELECTOR_SYNTAX";
-    constructor(input: string, at: number, detail: string);
-}
 declare function parseSelector(input: string): Selector;
-declare function formatSelector(sel: Selector): string;
 declare function isSelectorRef(value: unknown): value is `@${string}`;
 declare function parseSelectorRef(ref: string): Selector;
 /** Walk a `path` over a value; `undefined` when any step is missing. */
 declare function walkPath(value: unknown, path: readonly PathSegment[]): unknown;
 declare const SelectorStringSchema: z.ZodString;
 
-export { ANNOTATION_CODES, type AnnotationCode, COLLECTOR_CODES, type CollectorCode, DEFAULT_RULE_CODES, type DefaultRuleCode, EvidenceSourceAll, INDICATOR_CODES, type IndicatorCode, JsonValue, PRIMITIVES, type PathSegment, type PolicyRules, PolicyRulesSchema, type Primitive, PrimitiveSchema, REASON_CODE_PATTERN, type ReasonCode, type Rule, RuleSchema, type RuleVerdict, RuleVerdictSchema, type Selector, SelectorStringSchema, SelectorSyntaxError, formatSelector, isSelectorRef, parseSelector, parseSelectorRef, walkPath };
+/**
+ * The verdict as a value (Fraud Engine RFC › API: ALLOW | DENY | REVIEW).
+ * Layers combine by severity (GAP-45): the decision is the most severe
+ * verdict any layer produced.
+ */
+
+declare class Verdict {
+    readonly value: Decision;
+    private constructor();
+    static readonly ALLOW: Verdict;
+    static readonly REVIEW: Verdict;
+    static readonly DENY: Verdict;
+    static of(value: Decision): Verdict;
+    /** The more severe of the two. */
+    atLeast(other: Verdict | Decision): Verdict;
+}
+
+export { ANNOTATION_CODES, type Amount, AmountSchema, type CollectorCode, type DecimalString, DecimalStringSchema, Decision, EvidenceSourceAll, INDICATOR_CODES, type IndicatorCode, JsonValue, Money, type PathSegment, type PolicyRules, PolicyRulesSchema, type Primitive, REASON_CODE_PATTERN, type Rule, type RuleVerdict, type Selector, SelectorStringSchema, Verdict, isSelectorRef, parseSelector, parseSelectorRef, walkPath };

package/dist/protocol/index.js

@@ -1,148 +1,82 @@
 import {
   ALL_SOURCES,
   ANNOTATION_CODES,
-  ANOMALY_TYPES,
   AmountSchema,
   ApiErrorSchema,
-  COLLECTOR_CODES,
-  ChainHeadSchema,
   CreatePolicyInputSchema,
-  CreatePolicyOutputSchema,
   CreateSessionInputSchema,
-  CreateSessionOutputSchema,
-  DEFAULT_RULE_CODES,
-  DecisionSchema,
+  DecimalStringSchema,
   DeclaredIntentSchema,
   EvaluateInputSchema,
-  EvaluateOutputSchema,
-  EventResultSchema,
-  EventResultStatusSchema,
-  EvidenceAckSchema,
   EvidenceBatchInputSchema,
   EvidenceEventSchema,
-  EvidenceKindSchema,
   EvidenceSourceAllSchema,
   EvidenceSourceSchema,
-  GatewayDecisionPayloadSchema,
   Hex64Schema,
   INDICATOR_CODES,
-  IntentDeclaredPayloadSchema,
   JsonValueSchema,
-  LlmCallEndPayloadSchema,
-  LlmCallStartPayloadSchema,
   MAX_BATCH_EVENTS,
-  PAYMENT_ARTIFACTS,
-  PLATFORM_KINDS,
-  PRIMITIVES,
-  PaymentMomentPayloadSchema,
+  Money,
   PaymentSummarySchema,
-  PlatformAnomalyPayloadSchema,
-  PlatformEvidenceKindSchema,
-  PlatformObservationPayloadSchema,
   PolicyRulesSchema,
-  PrimitiveSchema,
   REASON_CODE_PATTERN,
-  RuleSchema,
-  RuleVerdictSchema,
-  SESSION_CLOSE_REASONS,
+  SESSION_ID_CHARS,
+  SESSION_ID_PREFIX,
   SOURCE_ORDER,
   SelectorStringSchema,
-  SelectorSyntaxError,
-  SeqSchema,
-  SessionClosePayloadSchema,
   SessionIdSchema,
-  SessionOpenPayloadSchema,
-  SigSchema,
   TimestampSchema,
-  ToolCallEndPayloadSchema,
-  ToolCallStartPayloadSchema,
-  TransportGapPayloadSchema,
   Verdict,
-  WIRE_KINDS,
-  WIRE_SOURCES,
-  WireEvidenceKindSchema,
+  chainKey,
+  compareByArrival,
   compareBySessionSource,
   compareBySourceSeq,
-  formatSelector,
-  isPlatformKind,
+  compareRootFirst,
   isSelectorRef,
-  isWireKind,
   parseSelector,
   parseSelectorRef,
   payloadSchemaFor,
-  walkPath
-} from "../chunk-4BUUPU3O.js";
+  walkPath,
+  withinHeads
+} from "../chunk-FNU4CRJJ.js";
 export {
   ALL_SOURCES,
   ANNOTATION_CODES,
-  ANOMALY_TYPES,
   AmountSchema,
   ApiErrorSchema,
-  COLLECTOR_CODES,
-  ChainHeadSchema,
   CreatePolicyInputSchema,
-  CreatePolicyOutputSchema,
   CreateSessionInputSchema,
-  CreateSessionOutputSchema,
-  DEFAULT_RULE_CODES,
-  DecisionSchema,
+  DecimalStringSchema,
   DeclaredIntentSchema,
   EvaluateInputSchema,
-  EvaluateOutputSchema,
-  EventResultSchema,
-  EventResultStatusSchema,
-  EvidenceAckSchema,
   EvidenceBatchInputSchema,
   EvidenceEventSchema,
-  EvidenceKindSchema,
   EvidenceSourceAllSchema,
   EvidenceSourceSchema,
-  GatewayDecisionPayloadSchema,
   Hex64Schema,
   INDICATOR_CODES,
-  IntentDeclaredPayloadSchema,
   JsonValueSchema,
-  LlmCallEndPayloadSchema,
-  LlmCallStartPayloadSchema,
   MAX_BATCH_EVENTS,
-  PAYMENT_ARTIFACTS,
-  PLATFORM_KINDS,
-  PRIMITIVES,
-  PaymentMomentPayloadSchema,
+  Money,
   PaymentSummarySchema,
-  PlatformAnomalyPayloadSchema,
-  PlatformEvidenceKindSchema,
-  PlatformObservationPayloadSchema,
   PolicyRulesSchema,
-  PrimitiveSchema,
   REASON_CODE_PATTERN,
-  RuleSchema,
-  RuleVerdictSchema,
-  SESSION_CLOSE_REASONS,
+  SESSION_ID_CHARS,
+  SESSION_ID_PREFIX,
   SOURCE_ORDER,
   SelectorStringSchema,
-  SelectorSyntaxError,
-  SeqSchema,
-  SessionClosePayloadSchema,
   SessionIdSchema,
-  SessionOpenPayloadSchema,
-  SigSchema,
   TimestampSchema,
-  ToolCallEndPayloadSchema,
-  ToolCallStartPayloadSchema,
-  TransportGapPayloadSchema,
   Verdict,
-  WIRE_KINDS,
-  WIRE_SOURCES,
-  WireEvidenceKindSchema,
+  chainKey,
+  compareByArrival,
   compareBySessionSource,
   compareBySourceSeq,
-  formatSelector,
-  isPlatformKind,
+  compareRootFirst,
   isSelectorRef,
-  isWireKind,
   parseSelector,
   parseSelectorRef,
   payloadSchemaFor,
-  walkPath
+  walkPath,
+  withinHeads
 };

package/dist/session-DAN29XoB.d.ts

@@ -0,0 +1,380 @@
+import { m as EvaluateOutput, D as Decision$1, y as JsonObject, n as EventResult, r as EvidenceEvent, u as EvidenceSource, T as PromptBase, a4 as WireEvidenceKind, P as PayloadByKind, J as JsonValue, a2 as ToolCallStartPayload, Y as SessionClosePayload, h as DeclaredIntent, N as PaymentSummary, K as PaymentMomentPayload } from './index-DAVKGJs5.js';
+
+/**
+ * The platform's verdict on one payment as a value the host can ask
+ * questions of (Fraud Engine RFC › API: ALLOW | DENY | REVIEW). `absent`
+ * is the outage case: the platform could not be asked (GAP-70), and no
+ * verdict was invented — the host decides what to do without one. A
+ * `Session` memoizes decisions by the host's call id, so a re-run approval
+ * reads the verdict already given (GAP-79).
+ */
+
+declare class Decision {
+    private readonly output;
+    private static readonly ABSENT;
+    private constructor();
+    static of(output: EvaluateOutput): Decision;
+    static absent(): Decision;
+    get value(): Decision$1 | null;
+    get reasonCodes(): readonly string[];
+    get decisionId(): string | null;
+    get allowed(): boolean;
+    get denied(): boolean;
+    get review(): boolean;
+    get absent(): boolean;
+    /** One sentence for the agent or the person: what Beltic said and why. */
+    explain(): string;
+}
+
+declare class BelticApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly details?: unknown | undefined;
+    readonly requestId?: string | undefined;
+    constructor(status: number, code: string, message: string, details?: unknown | undefined, requestId?: string | undefined);
+    /** 5xx, 429 and network failures are an outage: retried by the transport, absorbed by the fail-open entries; 4xx are neither (GAP-70). */
+    get retryable(): boolean;
+}
+declare class ApiClient {
+    private readonly baseUrl;
+    private readonly headers;
+    constructor(baseUrl: string, apiKey: string, userAgent: string);
+    post<T>(path: string, body: unknown): Promise<T>;
+}
+
+/**
+ * The edge signs event digests (Fraud SDK RFC › Modules › Identity Module);
+ * the platform signs its own PLATFORM chain. Both are the same operation
+ * over different keys, so one interface.
+ */
+interface Signer {
+    /** Raw 32-byte Ed25519 public key. */
+    readonly publicKey: Uint8Array;
+    /** Stable identifier for logs and key rotation; `did:key` for agents. */
+    readonly keyId: string;
+    sign(message: Uint8Array): Promise<Uint8Array>;
+}
+
+/**
+ * Identity Module (Fraud SDK RFC › Modules): the agent's DID and the
+ * event-signing key. Phase 1 is did:key over Ed25519 (GAP-11): the DID *is*
+ * the public key, so the signer and the identity are one, both derived from
+ * the 32-byte seed the host configures. The credential presented at session
+ * start is the DID itself until a VC is verified anywhere (GAP-78).
+ */
+
+interface AgentIdentity {
+    did: string;
+    signer: Signer;
+}
+
+/**
+ * One instrumented call = a `*.start` event, the work, a `*.end` event
+ * carrying the outcome or the error (GAP-07 correlates them by `callId`).
+ * `openCall` is the span — `Stream.llmCall` and `Stream.toolCall` open
+ * one — and `recordCall` runs the work inside it. The AI middleware, the
+ * tool wrapper and a host's own tool loop all record the same way.
+ */
+
+interface CallSpan {
+    readonly callId: string;
+    /** Resolves once `*.start` is sequenced; `end` and `fail` wait for it. */
+    readonly opened: Promise<boolean>;
+    end(outcome?: JsonObject): Promise<boolean>;
+    fail(error: unknown, outcome?: JsonObject): Promise<boolean>;
+}
+
+declare class ChainRejectedError extends Error {
+    readonly sessionId: string;
+    readonly source: string;
+    readonly result: EventResult;
+    constructor(sessionId: string, source: string, result: EventResult, options?: {
+        cause?: unknown;
+    });
+}
+/** Which chains a `flush` sends: one session's, or every chain of the process. */
+interface FlushScope {
+    sessionId: string;
+}
+declare class Transport {
+    private readonly api;
+    private readonly chains;
+    private readonly waiting;
+    private running;
+    private buffered;
+    private bufferedBytes;
+    private timer;
+    private closed;
+    constructor(api: ApiClient);
+    /**
+     * What the fail-open entries absorb (GAP-70): the platform could not be
+     * reached or failed on its side — a network error, a 5xx, a 429.
+     * Everything the platform *rejected* (a 4xx: bad key, unknown session,
+     * invalid payload) is a fault of the client and throws.
+     */
+    static outage(err: unknown): boolean;
+    /** The bytes the platform will measure for an event with this payload (GAP-59), known before a `seq` is spent. */
+    static measure(payload: unknown): number;
+    /** Whether the platform would take an event of this size at all. */
+    static fits(bytes: number): boolean;
+    hasRoom(bytes: number): boolean;
+    haltedError(sessionId: string, source: string): ChainRejectedError | null;
+    /** Whether the platform ended the session under this chain (GAP-85). */
+    ended(sessionId: string, source: string): boolean;
+    /** Callers check `hasRoom(bytes)` first and assign `seq` only then (GAP-38). */
+    enqueue(ev: EvidenceEvent, bytes: number): void;
+    /**
+     * One attempt per chain, now — a chain waiting out its backoff included;
+     * resolves once every attempt settled. With a scope, only that session's
+     * chains (GAP-88).
+     */
+    flush(scope?: FlushScope): Promise<void>;
+    close(): Promise<void>;
+    private schedule;
+    private unschedule;
+    /**
+     * Queues the chain for a delivery slot — at the front when forced. A
+     * chain waiting out its backoff is left alone unless forced: only
+     * `flush` cuts a backoff short.
+     */
+    private deliver;
+    private promote;
+    private pump;
+    /** The head of the queue that fits one batch: by count or by bytes, whichever comes first, and never empty. */
+    private static batchOf;
+    /** Batches until the chain drains; a retryable failure schedules the next attempt and returns. */
+    private attempt;
+    private release;
+    private drop;
+    private halt;
+    private end;
+}
+
+/**
+ * One evidence stream = one chain per (sessionId, source), built at the edge
+ * (Fraud SDK RFC › Wire contract). The buyer half's AGENT_TRACE stream is
+ * signed by the agent identity; the seller half's INTERNAL_NETWORK stream
+ * is not (GAP-61).
+ *
+ * `seq` is handed out only when the transport has room for the event
+ * (GAP-38): a dropped event never leaves a hole — the next accepted event
+ * is preceded by a `transport.gap` that counts the drops, and how many of
+ * them the platform would have refused as too large (GAP-87); the size is
+ * measured here, once, before the seq is spent. Payloads ship whole
+ * (GAP-33) — except the prompt of a model call, which ships as a delta
+ * against the last one on the chain (GAP-89; `PromptLedger`). An outage
+ * never reaches `emit`: the transport waits it out (GAP-70); what throws
+ * here is a chain the platform rejected. A session the platform closed or
+ * expired is over, not broken: `emit` answers `false` and the conversation
+ * continues in a fresh stream (GAP-85).
+ */
+
+/** Who created the session — the seller half treats a bound session as buyer-born. */
+type StreamBorn = 'buyer' | 'seller';
+interface StreamDeps {
+    transport: Transport;
+    signer?: Signer | undefined;
+    /** The conversation's last prompt, when resuming one: what the first model call ships a delta against (GAP-89). */
+    prompt?: PromptBase | undefined;
+    /** Called once the stream closed, so the registry can forget it. */
+    onClosed?: ((stream: Stream) => void) | undefined;
+}
+/** What the host knows of a model call before it runs: the provider-level options, prompt included (GAP-57). */
+interface LlmCallInput {
+    callId: string;
+    provider: string;
+    modelId: string;
+    params: Record<string, JsonValue>;
+}
+/**
+ * One tool call as a span: `tool_call.start` now, `tool_call.end` with the
+ * outcome and the elapsed time when the host reports it.
+ */
+interface ToolCallSpan {
+    readonly callId: string;
+    /** Resolves once `tool_call.start` is sequenced; `end` and `fail` wait for it. */
+    readonly opened: Promise<boolean>;
+    end(outcome?: {
+        output?: JsonValue;
+    }): Promise<boolean>;
+    fail(error: unknown, outcome?: {
+        output?: JsonValue;
+    }): Promise<boolean>;
+}
+declare class Stream {
+    private readonly deps;
+    readonly id: string;
+    /** The conversation this session belongs to — the root's id (GAP-84). */
+    readonly conversationId: string;
+    readonly source: EvidenceSource;
+    readonly born: StreamBorn;
+    private chain;
+    private readonly ledger;
+    private building;
+    private dropped;
+    private oversized;
+    private droppedFirstTs;
+    private droppedLastTs;
+    private closed;
+    constructor(deps: StreamDeps, id: string, 
+    /** The conversation this session belongs to — the root's id (GAP-84). */
+    conversationId: string, source: EvidenceSource, born: StreamBorn);
+    /** Closed by this side, or ended by the platform (GAP-85). */
+    get isClosed(): boolean;
+    /**
+     * Resolves once the event is sequenced and buffered — not once it is
+     * acknowledged. `false` when the event was dropped for lack of room.
+     */
+    emit<K extends WireEvidenceKind>(kind: K, payload: PayloadByKind[K]): Promise<boolean>;
+    /** What the drops since the last accepted event add up to (GAP-38/87). */
+    private gap;
+    /**
+     * A model call as a span: `llm_call.start` now, with the prompt as a
+     * delta against the last one on this chain (GAP-89), `llm_call.end` when
+     * the host reports the result. A start that never left (dropped) forgets
+     * the ledger, so the next call ships its prompt whole.
+     */
+    llmCall(call: LlmCallInput): CallSpan;
+    /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+    toolCall(call: ToolCallStartPayload): ToolCallSpan;
+    close(reason?: SessionClosePayload['reason'], extra?: JsonObject): Promise<void>;
+    /** Read-your-writes for this session's chains, and only them (GAP-16/66/88). */
+    flush(): Promise<void>;
+    /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
+    private next;
+}
+
+/**
+ * The registry of evidence streams, one object per (session, source) per
+ * process: a chain's head lives in it, so two objects for the same chain
+ * would both start at seq 0 and fork it. Closed streams are forgotten; a
+ * process never continues a chain it did not start — it resumes the
+ * conversation in a fresh one (GAP-67/84).
+ *
+ * The buyer half opens AGENT_TRACE sessions, new or resuming a
+ * conversation, and announces them with `session.open` (seq 0) and
+ * `intent.declared` (seq 1; GAP-23/60). A session the platform could not
+ * open — an outage — resolves `null` for every caller during
+ * `OPEN_RETRY_MS`, so the host runs without evidence instead of paying a
+ * failed request on every step (GAP-70); a refused one (4xx) throws, and
+ * the next call tries again. A resumed conversation's stream starts from
+ * the prompt base the platform answered (GAP-89). The seller half attaches
+ * to a bound session or opens its own INTERNAL_NETWORK one (GAP-13).
+ */
+
+interface StartInput {
+    intent?: DeclaredIntent | undefined;
+    runtime?: {
+        framework?: string;
+        model?: string;
+    } | undefined;
+    attestations?: JsonObject | undefined;
+}
+interface OpenInput extends StartInput {
+    /** The conversation to continue: any session id of it (GAP-84). */
+    resume?: string | undefined;
+}
+interface StreamsDeps {
+    api: ApiClient;
+    transport: Transport;
+    identity: AgentIdentity | null;
+    sdkVersion: string;
+}
+declare class Streams {
+    private readonly deps;
+    private readonly attached;
+    private retryAt;
+    constructor(deps: StreamsDeps);
+    /**
+     * Buyer half: a fresh AGENT_TRACE stream — a new conversation, or a new
+     * session of the one `resume` names. `null` while the platform is out.
+     */
+    open(input?: OpenInput, onClosed?: () => void): Promise<Stream | null>;
+    /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
+    ensure(sessionId?: string | null): Promise<Stream>;
+    /** Whether the platform refused this stream's chain: its next `emit` throws (GAP-85). */
+    halted(stream: Stream): boolean;
+    private create;
+    private attach;
+}
+
+interface SessionOptions extends StartInput {
+    /** Close the session (`expired`) after this long without evidence; unset = only the host closes. */
+    idleMs?: number | undefined;
+}
+interface HumanDecisionInput {
+    /** Whether the person let the call proceed. */
+    allowed: boolean;
+    /** The host's own word for what happened: `approved`, `answered`, `rejected`, `cancelled`… */
+    outcome: string;
+    responder?: string | undefined;
+    /** The host's record of what was asked and chosen — a black box to the platform (GAP-75). */
+    record?: JsonObject | undefined;
+}
+interface DecideOptions {
+    /** The host's id for the call the verdict applies to: memoizes the decision and links it to the span. */
+    callId?: string | undefined;
+    /** The mandate as of now; declared first when it differs from the last one. */
+    intent?: DeclaredIntent | undefined;
+}
+interface SessionDeps {
+    streams: Streams;
+    evaluate: (sessionId: string, payment: PaymentSummary, callId?: string) => Promise<Decision>;
+    /** Called once the platform answered with the conversation id, so the registry can key the handle by it. */
+    onOpened: (session: Session, conversationId: string) => void;
+    /** Called once the session closed, so the registry forgets it. */
+    onClosed: (session: Session) => void;
+}
+declare class Session {
+    private readonly deps;
+    private readonly opts;
+    private opened;
+    private current;
+    /** The conversation id: what was resumed, then what the platform answered. */
+    private conversationId;
+    /** JCS hash of the mandate on the chain, and of the one the options carried. */
+    private declared;
+    private readonly openedWith;
+    private closed;
+    private timer;
+    private readonly calls;
+    private readonly decisions;
+    constructor(deps: SessionDeps, opts?: SessionOptions, resume?: string | null);
+    /**
+     * The conversation id — what the host stores and resumes with (GAP-84).
+     * Opened on first use; `null` while the platform has not answered and
+     * nothing was resumed.
+     */
+    id(): Promise<string | null>;
+    private open;
+    /**
+     * The platform's verdict on a payment about to be presented. Asked once
+     * per call id: a host that re-runs its approval step reads the same
+     * `Decision`. An absent verdict is not memoized, so the next attempt
+     * asks again.
+     */
+    decide(payment: PaymentSummary | PaymentMomentPayload, opts?: DecideOptions): Promise<Decision>;
+    /** The decision given for a call id, or absent. */
+    decision(callId: string): Decision;
+    /** A tool call the host runs itself, reported as two events by its own call id. */
+    readonly tools: {
+        start: (call: ToolCallStartPayload) => Promise<boolean>;
+        end: (callId: string, outcome?: {
+            output?: JsonValue;
+        }) => Promise<boolean>;
+        fail: (callId: string, error: unknown, outcome?: {
+            output?: JsonValue;
+        }) => Promise<boolean>;
+    };
+    /** A person's answer about a call, as the decision it was (GAP-75). */
+    humanDecided(callId: string, input: HumanDecisionInput): Promise<boolean>;
+    close(reason?: SessionClosePayload['reason']): Promise<void>;
+    /** `intent.declared`, unless the mandate is the one already on the chain (GAP-76). */
+    private declare;
+    private take;
+    private touch;
+    private static hash;
+    private static callOf;
+}
+
+export { BelticApiError as B, ChainRejectedError as C, type DecideOptions as D, type HumanDecisionInput as H, Session as S, Decision as a, type SessionOptions as b };