@belticlabs/agent-risk-sdk 0.5.0 → 0.7.0

package/dist/x402/hono.d.ts

@@ -1,24 +1,12 @@
-import { PaywallConfig, RoutesConfig, x402ResourceServer } from '@x402/core/server';
+import { RoutesConfig, x402ResourceServer } from '@x402/core/server';
 import { MiddlewareHandler } from 'hono';
-import { B as Beltic } from '../session-D9E-efc0.js';
-import { A as AttachOptions } from '../adapter-DEdhsNt-.js';
-export { a as attachX402 } from '../adapter-DEdhsNt-.js';
-import '../verdict-DMnbFuS5.js';
+import { B as Beltic } from '../client-Xn9M58OJ.js';
+import '../index-DAVKGJs5.js';
 import 'zod';
-
-/**
- * The seller half as one middleware: the framework's `@x402/*` payment
- * middleware over an `x402HTTPResourceServer` with the Beltic hooks
- * attached. `@belticlabs/agent-risk-sdk/hono` hands in its framework's
- * `paymentMiddlewareFromHTTPServer`.
- */
-
-type GuardedMiddlewareOptions = AttachOptions & {
-    paywall?: PaywallConfig | undefined;
-};
+import '../session-DAN29XoB.js';
 
 /** Seller half for hono: `@x402/hono`'s payment middleware with the Beltic hooks attached. */
 
-declare function belticPaymentMiddleware(beltic: Beltic, routes: RoutesConfig, server: x402ResourceServer, opts?: GuardedMiddlewareOptions): MiddlewareHandler;
+declare function belticPaymentMiddleware(beltic: Beltic, routes: RoutesConfig, server: x402ResourceServer): MiddlewareHandler;
 
 export { belticPaymentMiddleware };

package/dist/x402/hono.js

@@ -1,27 +1,21 @@
 import {
   attachX402
-} from "../chunk-GM4KEEZB.js";
+} from "../chunk-HI656UWG.js";
+import "../chunk-M4I3FGZG.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-X3W2Z5GC.js";
+import "../chunk-UXXSE643.js";
+import "../chunk-FNU4CRJJ.js";
 
 // src/x402/hono.ts
-import { paymentMiddlewareFromHTTPServer } from "@x402/hono";
-
-// src/x402/middleware.ts
 import {
   x402HTTPResourceServer
 } from "@x402/core/server";
-function guardedPaymentMiddleware(fromHTTPServer, beltic, routes, server, opts = {}) {
+import { paymentMiddlewareFromHTTPServer } from "@x402/hono";
+function belticPaymentMiddleware(beltic, routes, server) {
   const http = new x402HTTPResourceServer(server, routes);
-  attachX402(beltic, server, http, opts);
-  return fromHTTPServer(http, opts.paywall);
-}
-
-// src/x402/hono.ts
-function belticPaymentMiddleware(beltic, routes, server, opts) {
-  return guardedPaymentMiddleware(paymentMiddlewareFromHTTPServer, beltic, routes, server, opts);
+  attachX402(beltic, server, http);
+  return paymentMiddlewareFromHTTPServer(http);
 }
 export {
-  attachX402,
   belticPaymentMiddleware
 };

package/dist/x402/index.d.ts

@@ -1,28 +1,25 @@
-export { A as AttachOptions, b as AttachedX402, a as attachX402 } from '../adapter-DEdhsNt-.js';
-import { S as SessionSource } from '../session-D9E-efc0.js';
-import { p as DeclaredIntent, P as PaymentMomentPayload, Y as JsonObject, a8 as PaymentSummary } from '../verdict-DMnbFuS5.js';
-import '@x402/core/server';
+import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
+import { B as Beltic } from '../client-Xn9M58OJ.js';
+import { S as Session } from '../session-DAN29XoB.js';
+import { h as DeclaredIntent, N as PaymentSummary } from '../index-DAVKGJs5.js';
 import 'zod';
 
+declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer): void;
+
 /**
  * Session binding on the x402 rail (Fraud SDK RFC › Protocol Adapter — x402:
  * "`PAYMENT-SIGNATURE` extension `beltic.sessionId`"). Where exactly it
  * lives is GAP-30; that it is outside the wallet-signed payload is GAP-56.
- * A presentation the buyer had evaluated first also carries the
- * `decisionId` the platform answered with, next to the session (GAP-80).
  */
 declare const SESSION_EXTENSION = "beltic.sessionId";
 declare const SESSION_HEADER = "Beltic-Session-Id";
-declare const DECISION_EXTENSION = "beltic.decisionId";
-declare function sessionIdOf(extensions: Readonly<Record<string, unknown>> | undefined): string | null;
-declare function decisionIdOf(extensions: Readonly<Record<string, unknown>> | undefined): string | null;
 
 /**
- * The paying fetch, observed. Takes a session or the run that owns one; a
- * request made while a fail-open run has no session (the platform could
- * not open one, GAP-70) goes through the inner fetch unrecorded.
+ * The paying fetch, observed. A request made while the session has no
+ * stream (the platform could not open one, GAP-70) goes through the inner
+ * fetch unrecorded.
  */
-declare function belticFetch(source: SessionSource, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
+declare function belticFetch(session: Session, inner?: typeof globalThis.fetch): typeof globalThis.fetch;
 
 /**
  * The declared intent for an x402 mandate (Fraud SDK RFC › Session ›
@@ -53,7 +50,6 @@ declare function x402Intent(input: X402IntentInput): DeclaredIntent;
  * about and what the wrapper records are one and the same.
  */
 
-declare function x402Currency(network: string, asset: string): string;
 /**
  * The minimum an `accepts` entry needs to become a moment; unknown parts
  * are named, never dropped.
@@ -64,22 +60,6 @@ interface AcceptsLike {
     network?: string | undefined;
     asset?: string | undefined;
 }
-/**
- * A 402 challenge and a presented payment, as far as a moment needs them.
- * `@x402/core`'s `PaymentRequired` and `PaymentPayload` satisfy these
- * structurally, so the seller adapter passes its typed values through and
- * the buyer needs no `@x402/*` types.
- */
-interface PaymentRequiredLike {
-    x402Version?: number | undefined;
-    accepts?: readonly AcceptsLike[] | undefined;
-}
-interface PaymentPayloadLike {
-    x402Version?: number | undefined;
-    accepted?: AcceptsLike | undefined;
-    payload?: Readonly<Record<string, unknown>> | undefined;
-    extensions?: Readonly<Record<string, unknown>> | undefined;
-}
 /**
  * The one normalization of an x402 `accepts` entry: the payment in the
  * shape `evaluate` takes, with the payer as `payerOf` would read it. Every
@@ -88,17 +68,5 @@ interface PaymentPayloadLike {
 declare function x402Summary(accepts: AcceptsLike | undefined, opts?: {
     payer?: string | undefined;
 }): PaymentSummary;
-/** The payer is scheme-specific; the common EVM shapes are read, anything else stays in `raw`. */
-declare function payerOf(payload: PaymentPayloadLike): string | undefined;
-declare const x402Moments: {
-    /** The 402 challenge as the buyer saw it, from the `PAYMENT-REQUIRED` header. */
-    required(required: PaymentRequiredLike): PaymentMomentPayload;
-    /** The requirements the seller's resource server resolved for a request. */
-    requirements(req: AcceptsLike): PaymentMomentPayload;
-    /** A route's static `accepts` config, before any payment header exists. */
-    route(route: unknown, raw: JsonObject): PaymentMomentPayload;
-    /** The signed payment the buyer presented, with the requirement it accepted. */
-    payload(payload: PaymentPayloadLike): PaymentMomentPayload;
-};
 
-export { type AcceptsLike, DECISION_EXTENSION, type PaymentPayloadLike, type PaymentRequiredLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, belticFetch, decisionIdOf, payerOf, sessionIdOf, x402Currency, x402Intent, x402Moments, x402Summary };
+export { type AcceptsLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, attachX402, belticFetch, x402Intent, x402Summary };

package/dist/x402/index.js

@@ -1,97 +1,86 @@
 import {
-  Session,
-  Sessions
-} from "../chunk-JSE6JQJC.js";
-import {
-  DECISION_EXTENSION,
   SESSION_EXTENSION,
   SESSION_HEADER,
   attachX402,
-  decisionIdOf,
-  payerOf,
-  sessionIdOf,
-  x402Currency,
   x402Moments,
   x402Summary
-} from "../chunk-GM4KEEZB.js";
+} from "../chunk-HI656UWG.js";
+import "../chunk-M4I3FGZG.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-X3W2Z5GC.js";
+import "../chunk-UXXSE643.js";
+import {
+  Money
+} from "../chunk-FNU4CRJJ.js";
 
 // src/x402/fetch.ts
-var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
-function belticFetch(source, inner = globalThis.fetch) {
-  const run = source instanceof Session ? null : source;
+import { z } from "zod";
+var Base64Json = z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).transform((value, ctx) => {
+  try {
+    return JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+  } catch {
+    ctx.addIssue({ code: "custom", message: "not base64 JSON" });
+    return z.NEVER;
+  }
+});
+var Accepts = z.looseObject({
+  payTo: z.string().optional().catch(void 0),
+  amount: z.string().optional().catch(void 0),
+  network: z.string().optional().catch(void 0),
+  asset: z.string().optional().catch(void 0)
+});
+var PaymentRequired = Base64Json.pipe(
+  z.looseObject({ accepts: z.array(Accepts).optional().catch(void 0) })
+);
+var PaymentPayload = Base64Json.pipe(
+  z.looseObject({
+    accepted: Accepts.optional().catch(void 0),
+    payload: z.record(z.string(), z.unknown()).optional().catch(void 0),
+    extensions: z.record(z.string(), z.unknown()).optional().catch(void 0)
+  })
+);
+function belticFetch(session, inner = globalThis.fetch) {
   return async (input, init) => {
-    const session = await Sessions.resolve(source);
-    if (!session) return inner(input, init);
+    const stream = await session.stream();
+    if (!stream) return inner(input, init);
     const headers = new Headers(
       init?.headers ?? (input instanceof Request ? input.headers : void 0)
     );
-    headers.set(SESSION_HEADER, session.id);
-    const signature = headers.get("PAYMENT-SIGNATURE");
-    const payload = signature ? decodeHeader(signature) : null;
+    headers.set(SESSION_HEADER, stream.id);
+    const payload = PaymentPayload.safeParse(headers.get("PAYMENT-SIGNATURE")).data;
     if (payload) {
-      const decision = run?.decisionFor(x402Moments.payload(payload));
-      const decisionId = decision && !decision.absent ? decision.decisionId : null;
       const bound = {
         ...payload,
-        extensions: {
-          ...payload.extensions,
-          [SESSION_EXTENSION]: session.id,
-          ...decisionId ? { [DECISION_EXTENSION]: decisionId } : {}
-        }
+        extensions: { ...payload.extensions, [SESSION_EXTENSION]: stream.id }
       };
       headers.set("PAYMENT-SIGNATURE", encodeHeader(bound));
-      await session.emit("payment.presented", x402Moments.payload(bound));
-      await session.flush();
+      await stream.emit("payment.presented", x402Moments.payload(bound));
+      await stream.flush();
     }
     const res = await inner(input, { ...init, headers });
     if (res.status !== 402) return res;
-    const required = challengeOf(res);
-    if (required) await session.emit("payment.requested", x402Moments.required(required));
+    const required = PaymentRequired.safeParse(res.headers.get("PAYMENT-REQUIRED")).data;
+    if (required) await stream.emit("payment.requested", x402Moments.required(required));
     return res;
   };
 }
-function decodeHeader(value) {
-  if (!BASE64.test(value)) return null;
-  try {
-    const parsed = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
 function encodeHeader(value) {
   return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
 }
-function challengeOf(res) {
-  const header = res.headers.get("PAYMENT-REQUIRED");
-  return header ? decodeHeader(header) : null;
-}
 
 // src/x402/intent.ts
 function x402Intent(input) {
   return {
     mandate: input.mandate,
-    maxAmount: {
-      value: input.maxAmount.toString(),
-      currency: x402Currency(input.network, input.asset)
-    },
+    maxAmount: Money.x402(input.network, input.asset, input.maxAmount).toAmount(),
     validUntil: new Date(input.validUntil).toISOString(),
     ...input.merchantAllowlist ? { merchantAllowlist: input.merchantAllowlist } : {}
   };
 }
 export {
-  DECISION_EXTENSION,
   SESSION_EXTENSION,
   SESSION_HEADER,
   attachX402,
   belticFetch,
-  decisionIdOf,
-  payerOf,
-  sessionIdOf,
-  x402Currency,
   x402Intent,
-  x402Moments,
   x402Summary
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@belticlabs/agent-risk-sdk",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "The Beltic Agent Risk SDK — one client, two halves: instrument the buyer agent (AI SDK, x402 fetch) and guard the seller boundary (x402 over hono, evaluate).",
   "license": "UNLICENSED",
   "repository": {

package/dist/adapter-DEdhsNt-.d.ts

@@ -1,22 +0,0 @@
-import { D as Decision } from './verdict-DMnbFuS5.js';
-import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
-import { B as Beltic, j as SessionBorn, i as Session } from './session-D9E-efc0.js';
-
-interface AttachOptions {
-    /** Called with every decision; the default logs nothing. */
-    onDecision?: ((d: {
-        sessionId: string;
-        decision: Decision;
-        reasonCodes: string[];
-        born: SessionBorn;
-        /** The verdict the buyer says it obtained before presenting (GAP-80), unverified. */
-        buyerDecisionId: string | null;
-    }) => void) | undefined;
-}
-interface AttachedX402 {
-    /** Sessions resolved at verify time, keyed by payment digest — for tests and settle hooks. */
-    readonly inFlight: ReadonlyMap<string, Session>;
-}
-declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer, opts?: AttachOptions): AttachedX402;
-
-export { type AttachOptions as A, attachX402 as a, type AttachedX402 as b };