@belticlabs/agent-risk-sdk 0.6.0 → 0.7.0

package/dist/ai/index.d.ts

@@ -1,6 +1,6 @@
 import { LanguageModelMiddleware, ToolSet } from 'ai';
-import { S as Session } from '../session-Dcof4UIn.js';
-import '../index-IfY4XCvJ.js';
+import { S as Session } from '../session-DAN29XoB.js';
+import '../index-DAVKGJs5.js';
 import 'zod';
 
 declare function middleware(session: Session): LanguageModelMiddleware;

package/dist/ai/index.js

@@ -1,13 +1,14 @@
 import {
   recordCall
-} from "../chunk-ZMPKY7AX.js";
+} from "../chunk-JGVVQUXQ.js";
 import {
   toJson,
   toJsonObject
 } from "../chunk-FQDHFTVR.js";
 import {
   uuidv7
-} from "../chunk-77D74TWX.js";
+} from "../chunk-UXXSE643.js";
+import "../chunk-FNU4CRJJ.js";
 
 // src/ai/index.ts
 var PARAM_KEYS = [
@@ -28,10 +29,12 @@ function middleware(session) {
       const stream = await session.stream();
       if (!stream) return doGenerate();
       return recordCall(
-        stream,
-        "llm_call",
-        uuidv7(),
-        { provider: model.provider, modelId: model.modelId, params: pick(params) },
+        stream.llmCall({
+          callId: uuidv7(),
+          provider: model.provider,
+          modelId: model.modelId,
+          params: pick(params)
+        }),
         doGenerate,
         (result) => ({
           content: toJson(result.content),
@@ -44,14 +47,13 @@ function middleware(session) {
     wrapStream: async ({ doStream, params, model }) => {
       const evidence = await session.stream();
       if (!evidence) return doStream();
-      const callId = uuidv7();
-      const started = Date.now();
-      await evidence.emit("llm_call.start", {
-        callId,
+      const span = evidence.llmCall({
+        callId: uuidv7(),
         provider: model.provider,
         modelId: model.modelId,
         params: pick(params)
       });
+      await span.opened;
       const { stream, ...rest } = await doStream();
       const parts = [];
       let finish = {};
@@ -64,12 +66,10 @@ function middleware(session) {
           controller.enqueue(part);
         },
         flush: async () => {
-          await evidence.emit("llm_call.end", {
-            callId,
+          await span.end({
             content: toJson(parts),
             ...finish.finishReason ? { finishReason: finish.finishReason } : {},
-            ...finish.usage ? { usage: toJsonObject(finish.usage) } : {},
-            durationMs: Date.now() - started
+            ...finish.usage ? { usage: toJsonObject(finish.usage) } : {}
           });
         }
       });
@@ -90,10 +90,7 @@ function wrapTool(session, toolName, tool) {
     const stream = await session.stream();
     if (!stream) return original(input, options);
     return recordCall(
-      stream,
-      "tool_call",
-      options.toolCallId,
-      { toolName, input: toJson(input), transport: "local" },
+      stream.toolCall({ callId: options.toolCallId, toolName, input: toJson(input) }),
       async () => {
         const output = await original(input, options);
         return output && typeof output === "object" && Symbol.asyncIterator in output ? collect(output) : output;

package/dist/chunk-FNU4CRJJ.js

@@ -0,0 +1,547 @@
+// ../protocol/src/evidence.ts
+import { z } from "zod";
+var WIRE_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK"];
+var ALL_SOURCES = ["AGENT_TRACE", "INTERNAL_NETWORK", "PLATFORM"];
+var EvidenceSourceSchema = z.enum(WIRE_SOURCES);
+var EvidenceSourceAllSchema = z.enum(ALL_SOURCES);
+var SOURCE_ORDER = {
+  AGENT_TRACE: 0,
+  INTERNAL_NETWORK: 1,
+  PLATFORM: 2
+};
+function compareBySourceSeq(a, b) {
+  return SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source] || a.seq - b.seq;
+}
+function chainKey(sessionId, source) {
+  return `${sessionId}:${source}`;
+}
+function compareByArrival(a, b) {
+  return a.ts.localeCompare(b.ts) || a.receivedAt.localeCompare(b.receivedAt) || a.sessionId.localeCompare(b.sessionId) || compareBySourceSeq(a, b);
+}
+function compareRootFirst(conversationId) {
+  return (a, b) => Number(b.id === conversationId) - Number(a.id === conversationId);
+}
+function withinHeads(heads) {
+  return (e) => {
+    const cap = heads[chainKey(e.sessionId, e.source)];
+    return cap !== void 0 && e.seq <= cap;
+  };
+}
+function compareBySessionSource(a, b) {
+  return a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : SOURCE_ORDER[a.source] - SOURCE_ORDER[b.source];
+}
+var WIRE_KINDS = [
+  "session.open",
+  "session.close",
+  "intent.declared",
+  "llm_call.start",
+  "llm_call.end",
+  "tool_call.start",
+  "tool_call.end",
+  "payment.requested",
+  "payment.presented",
+  "gateway.decision",
+  "transport.gap"
+];
+var PLATFORM_KINDS = ["platform.observation", "platform.anomaly"];
+var WireEvidenceKindSchema = z.enum(WIRE_KINDS);
+var PlatformEvidenceKindSchema = z.enum(PLATFORM_KINDS);
+var EvidenceKindSchema = z.enum([...WIRE_KINDS, ...PLATFORM_KINDS]);
+var Hex64Schema = z.string().regex(/^[0-9a-f]{64}$/, "expected 64 lowercase hex chars");
+var SigSchema = z.string().regex(/^ed25519:[A-Za-z0-9_-]{86}$/, "expected ed25519:<base64url>");
+var SESSION_ID_PREFIX = "sess_";
+var SESSION_ID_CHARS = 22;
+var SessionIdSchema = z.string().regex(
+  new RegExp(`^${SESSION_ID_PREFIX}[0-9A-Za-z]{${SESSION_ID_CHARS}}$`),
+  `expected ${SESSION_ID_PREFIX} followed by ${SESSION_ID_CHARS} base62 chars`
+);
+var SeqSchema = z.number().int().min(0);
+var TimestampSchema = z.iso.datetime({ offset: false });
+var JsonValueSchema = z.lazy(
+  () => z.union([
+    z.null(),
+    z.boolean(),
+    z.number().finite(),
+    z.string(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema)
+  ])
+);
+var EvidenceEventSchema = z.strictObject({
+  sessionId: SessionIdSchema,
+  source: EvidenceSourceSchema,
+  seq: SeqSchema,
+  ts: TimestampSchema,
+  kind: WireEvidenceKindSchema,
+  payload: z.record(z.string(), JsonValueSchema),
+  prevHash: Hex64Schema,
+  sig: SigSchema.optional()
+});
+
+// ../protocol/src/money.ts
+import { z as z2 } from "zod";
+var DecimalStringSchema = z2.string().regex(/^\d+(\.\d+)?$/, "expected a decimal string");
+var AmountSchema = z2.strictObject({
+  /** Decimal string — never a float. For x402 this is the atomic amount (GAP-49). */
+  value: DecimalStringSchema,
+  /** ISO code, or `<network>/<asset>` for on-chain rails (GAP-49). */
+  currency: z2.string().min(1).max(128)
+});
+var ComparableSchema = z2.union([
+  DecimalStringSchema.transform((value) => ({ value, currency: null })),
+  z2.number().finite().transform(String).pipe(DecimalStringSchema).transform((value) => ({ value, currency: null })),
+  z2.object({ value: DecimalStringSchema, currency: z2.string().optional() }).transform((a) => ({ value: a.value, currency: a.currency ?? null }))
+]);
+var Money = class _Money {
+  constructor(value, currency) {
+    this.value = value;
+    this.currency = currency;
+  }
+  static of(amount) {
+    return new _Money(DecimalStringSchema.parse(amount.value), amount.currency);
+  }
+  /** A decimal with no currency: a bound in a rule, a running total. */
+  static bare(value) {
+    return new _Money(DecimalStringSchema.parse(value), null);
+  }
+  /** An x402 amount: atomic units of `asset` on `network`, its currency `<network>/<asset>` (GAP-49). */
+  static x402(network, asset, atomic) {
+    return new _Money(
+      DecimalStringSchema.parse(atomic.toString()),
+      _Money.x402Currency(network, asset)
+    );
+  }
+  static x402Currency(network, asset) {
+    return `${network}/${asset}`;
+  }
+  /** Anything a selector or a rule param may resolve to; null when it is not an amount. */
+  static parse(v) {
+    const r = ComparableSchema.safeParse(v);
+    return r.success ? new _Money(r.data.value, r.data.currency) : null;
+  }
+  comparable(other) {
+    return this.currency === null || other.currency === null || this.currency === other.currency;
+  }
+  compareTo(other) {
+    const [a, b] = _Money.scaled(this.value, other.value);
+    return a < b ? -1 : a > b ? 1 : 0;
+  }
+  exceeds(other) {
+    return this.compareTo(other) > 0;
+  }
+  plus(other) {
+    const [a, b, scale] = _Money.scaled(this.value, other.value);
+    const digits = (a + b).toString().padStart(scale + 1, "0");
+    const int = digits.slice(0, digits.length - scale);
+    const frac = digits.slice(digits.length - scale);
+    return new _Money(scale ? `${int}.${frac}` : int, this.currency);
+  }
+  isZero() {
+    return this.toNumber() === 0;
+  }
+  /** Numeric view for ratios; precision loss is acceptable for a ratio. */
+  toNumber() {
+    return Number(this.value);
+  }
+  /** this / other, or null when `other` is zero. */
+  ratioTo(other) {
+    return other.isZero() ? null : this.toNumber() / other.toNumber();
+  }
+  toAmount() {
+    if (this.currency === null) throw new TypeError("an amount needs a currency");
+    return { value: this.value, currency: this.currency };
+  }
+  static scaled(a, b) {
+    const [ai, af = ""] = a.split(".");
+    const [bi, bf = ""] = b.split(".");
+    const scale = Math.max(af.length, bf.length);
+    return [
+      BigInt(`${ai}${af.padEnd(scale, "0")}`),
+      BigInt(`${bi}${bf.padEnd(scale, "0")}`),
+      scale
+    ];
+  }
+};
+
+// ../protocol/src/reason-codes.ts
+var INDICATOR_CODES = ["CHAIN_BROKEN", "EVIDENCE_MISMATCH", "SESSION_INVALID"];
+var ANNOTATION_CODES = ["NO_AGENT_TRACE", "NO_POLICY"];
+var REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/;
+
+// ../protocol/src/selector.ts
+import { z as z3 } from "zod";
+var SelectorSyntaxError = class extends Error {
+  constructor(input, at, detail) {
+    super(`invalid selector "${input}" at ${at}: ${detail}`);
+    this.input = input;
+    this.at = at;
+    this.name = "SelectorSyntaxError";
+  }
+  code = "SELECTOR_SYNTAX";
+};
+var IDENT = /^[A-Za-z_][A-Za-z0-9_-]*/;
+var NAME = /^[A-Za-z_][A-Za-z0-9_.-]*/;
+function parsePath(input, from) {
+  const path = [];
+  let i = from;
+  while (i < input.length) {
+    const ch = input[i];
+    if (ch === ".") {
+      const m = IDENT.exec(input.slice(i + 1));
+      if (!m) throw new SelectorSyntaxError(input, i + 1, 'expected identifier after "."');
+      path.push({ key: m[0] });
+      i += 1 + m[0].length;
+    } else if (ch === "[") {
+      const close = input.indexOf("]", i);
+      if (close < 0) throw new SelectorSyntaxError(input, i, 'unterminated "["');
+      const body = input.slice(i + 1, close);
+      if (!/^\d+$/.test(body))
+        throw new SelectorSyntaxError(input, i + 1, "expected integer index");
+      path.push({ index: Number(body) });
+      i = close + 1;
+    } else {
+      throw new SelectorSyntaxError(input, i, `unexpected "${ch}"`);
+    }
+  }
+  return { path, end: i };
+}
+function parseSelector(input) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new SelectorSyntaxError(String(input), 0, "empty selector");
+  }
+  if (input.length > 512)
+    throw new SelectorSyntaxError(input.slice(0, 32), 512, "selector too long");
+  for (const root of ["payment", "intent", "session"]) {
+    if (input === root || input.startsWith(`${root}.`) || input.startsWith(`${root}[`)) {
+      return { root, path: parsePath(input, root.length).path };
+    }
+  }
+  if (input.startsWith("signal[name=")) {
+    const rest = input.slice("signal[name=".length);
+    const m = NAME.exec(rest);
+    if (!m) throw new SelectorSyntaxError(input, "signal[name=".length, "expected signal name");
+    const after = "signal[name=".length + m[0].length;
+    if (input[after] !== "]") throw new SelectorSyntaxError(input, after, 'expected "]"');
+    return { root: "signal", name: m[0], path: parsePath(input, after + 1).path };
+  }
+  if (input === "evidence[*]" || input.startsWith("evidence[*]")) {
+    return {
+      root: "evidence",
+      kind: "*",
+      all: true,
+      path: parsePath(input, "evidence[*]".length).path
+    };
+  }
+  if (input.startsWith("evidence[kind=")) {
+    let i = "evidence[kind=".length;
+    const km = NAME.exec(input.slice(i));
+    if (!km) throw new SelectorSyntaxError(input, i, "expected evidence kind");
+    const kind = km[0];
+    i += kind.length;
+    let source;
+    if (input.startsWith(",source=", i)) {
+      i += ",source=".length;
+      const sm = /^[A-Z_]+/.exec(input.slice(i));
+      if (!sm || !ALL_SOURCES.includes(sm[0])) {
+        throw new SelectorSyntaxError(input, i, `expected one of ${ALL_SOURCES.join("|")}`);
+      }
+      source = sm[0];
+      i += sm[0].length;
+    }
+    if (input[i] !== "]") throw new SelectorSyntaxError(input, i, 'expected "]"');
+    i += 1;
+    let all = false;
+    if (input.startsWith("[*]", i)) {
+      all = true;
+      i += 3;
+    }
+    const sel = { root: "evidence", kind, all, path: parsePath(input, i).path };
+    if (source) sel.source = source;
+    return sel;
+  }
+  throw new SelectorSyntaxError(
+    input,
+    0,
+    "unknown root (payment | intent | session | signal[name=\u2026] | evidence[\u2026])"
+  );
+}
+function isSelectorRef(value) {
+  return typeof value === "string" && value.startsWith("@") && value.length > 1;
+}
+function parseSelectorRef(ref) {
+  return parseSelector(ref.slice(1));
+}
+function walkPath(value, path) {
+  let cur = value;
+  for (const seg of path) {
+    if (cur === null || cur === void 0) return void 0;
+    if ("key" in seg) {
+      if (typeof cur !== "object" || Array.isArray(cur)) return void 0;
+      cur = cur[seg.key];
+    } else {
+      if (!Array.isArray(cur)) return void 0;
+      cur = cur[seg.index];
+    }
+  }
+  return cur;
+}
+var SelectorStringSchema = z3.string().refine(
+  (s) => {
+    try {
+      parseSelector(s);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "invalid selector" }
+);
+
+// ../protocol/src/policy.ts
+import { z as z4 } from "zod";
+var PrimitiveSchema = z4.enum(["THRESHOLD", "MEMBERSHIP", "MATCH", "PRESENCE", "FRESHNESS"]);
+var RuleVerdictSchema = z4.enum(["DENY", "REVIEW"]);
+var RuleSchema = z4.strictObject({
+  id: z4.string().min(1).max(64),
+  primitive: PrimitiveSchema,
+  selector: SelectorStringSchema,
+  params: z4.record(z4.string(), JsonValueSchema),
+  onFail: RuleVerdictSchema,
+  /** What to do when the selector (or a `@ref`) resolves to nothing. Default: skip (GAP-44). */
+  onMissing: z4.enum(["skip", "DENY", "REVIEW"]).optional(),
+  /** Reason code surfaced to the caller when the rule fails (GAP-44). */
+  code: z4.string().regex(REASON_CODE_PATTERN)
+});
+var PolicyRulesSchema = z4.strictObject({
+  rules: z4.array(RuleSchema).max(200).refine((rules) => new Set(rules.map((r) => r.id)).size === rules.length, {
+    message: "rule ids must be unique"
+  })
+});
+
+// ../protocol/src/api.ts
+import { z as z5 } from "zod";
+var DeclaredIntentSchema = z5.strictObject({
+  mandate: z5.string().min(1).max(4e3),
+  maxAmount: AmountSchema.optional(),
+  merchantAllowlist: z5.array(z5.string().min(1)).optional(),
+  validUntil: TimestampSchema
+});
+var CreateSessionInputSchema = z5.strictObject({
+  source: EvidenceSourceSchema,
+  /** Buyer-born sessions. `credential` is accepted and not kept: the DID is the credential (GAP-11). */
+  agent: z5.strictObject({ did: z5.string().min(1), credential: z5.string().min(1) }).optional(),
+  intent: DeclaredIntentSchema.optional(),
+  /** Any session of a conversation to continue: the new session joins it as a fresh chain (GAP-84). AGENT_TRACE only. */
+  resume: SessionIdSchema.optional()
+}).describe("session input");
+var MAX_BATCH_EVENTS = 500;
+var EvidenceBatchInputSchema = z5.array(z5.unknown()).min(1).max(MAX_BATCH_EVENTS).describe("evidence batch");
+var PaymentSummarySchema = z5.strictObject({
+  protocol: z5.string().min(1),
+  payee: z5.string().min(1),
+  amount: AmountSchema,
+  /** Not in the RFC; needed by `principal-links` and `EVIDENCE_MISMATCH` (GAP-06). */
+  payer: z5.string().min(1).optional()
+});
+var EvaluateInputSchema = z5.strictObject({
+  sessionId: SessionIdSchema,
+  payment: PaymentSummarySchema,
+  /** The caller's own id for the call under decision: the same id within one conversation reads the decision already taken (GAP-84). */
+  callId: z5.string().min(1).max(256).optional()
+}).describe("evaluate input");
+var CreatePolicyInputSchema = z5.strictObject({ rules: PolicyRulesSchema }).describe("policy input");
+var ApiErrorSchema = z5.strictObject({
+  error: z5.strictObject({
+    code: z5.string().min(1),
+    message: z5.string().min(1),
+    details: JsonValueSchema.optional(),
+    request_id: z5.string().optional()
+  })
+});
+
+// ../protocol/src/payloads/index.ts
+import { z as z6 } from "zod";
+var Json = JsonValueSchema;
+var JsonRecord = z6.record(z6.string(), Json);
+var SessionOpenPayloadSchema = z6.looseObject({
+  runtime: z6.looseObject({
+    sdk: z6.string().min(1),
+    version: z6.string().min(1),
+    framework: z6.string().optional(),
+    model: z6.string().optional()
+  }),
+  /** Runtime / repo attestations read by the (staged) Attestation Assurance score. */
+  attestations: JsonRecord.optional()
+});
+var SESSION_CLOSE_REASONS = ["completed", "settled", "aborted", "expired"];
+var SessionClosePayloadSchema = z6.looseObject({
+  reason: z6.enum(SESSION_CLOSE_REASONS),
+  transaction: z6.string().optional()
+});
+var IntentDeclaredPayloadSchema = DeclaredIntentSchema.loose();
+var PromptDeltaSchema = z6.strictObject({
+  prior: z6.string().min(1),
+  shared: z6.number().int().min(0),
+  messages: z6.array(Json)
+});
+var LlmCallParamsSchema = z6.looseObject({
+  prompt: Json.optional(),
+  promptDelta: PromptDeltaSchema.optional()
+}).refine((p) => p.prompt === void 0 || p.promptDelta === void 0, {
+  message: "params carries prompt or promptDelta, not both"
+});
+var LlmCallStartPayloadSchema = z6.looseObject({
+  callId: z6.string().min(1),
+  // GAP-07
+  provider: z6.string().min(1),
+  modelId: z6.string().min(1),
+  params: LlmCallParamsSchema
+});
+var LlmCallEndPayloadSchema = z6.looseObject({
+  callId: z6.string().min(1),
+  content: Json.optional(),
+  finishReason: z6.string().optional(),
+  usage: JsonRecord.optional(),
+  durationMs: z6.number().int().min(0),
+  error: z6.looseObject({ name: z6.string(), message: z6.string() }).optional()
+});
+var ToolCallStartPayloadSchema = z6.looseObject({
+  callId: z6.string().min(1),
+  // GAP-07
+  toolName: z6.string().min(1),
+  input: Json,
+  transport: z6.enum(["local", "mcp"]).optional(),
+  server: z6.string().optional()
+});
+var ToolCallEndPayloadSchema = z6.looseObject({
+  callId: z6.string().min(1),
+  output: Json.optional(),
+  error: z6.looseObject({ name: z6.string(), message: z6.string() }).optional(),
+  durationMs: z6.number().int().min(0)
+});
+var PAYMENT_ARTIFACTS = [
+  "http-402",
+  "mrtr-input-required",
+  "payment-signature",
+  "checkout-url"
+];
+var PaymentMomentPayloadSchema = z6.looseObject({
+  protocol: z6.string().min(1),
+  payee: z6.string().min(1),
+  amount: z6.looseObject({ value: z6.string().min(1), currency: z6.string().min(1) }),
+  payer: z6.string().optional(),
+  artifact: z6.enum(PAYMENT_ARTIFACTS),
+  raw: JsonRecord
+});
+var GatewayDecisionPayloadSchema = z6.looseObject({
+  gateway: z6.string().min(1),
+  call: z6.looseObject({ tool: z6.string().min(1), args: Json.optional() }),
+  decision: z6.enum(["ALLOW", "DENY", "REVIEW", "CHALLENGE"]),
+  reasonCodes: z6.array(z6.string()),
+  /** The gateway's own record of what it decided on — a black box to the platform. */
+  record: JsonRecord
+});
+var TransportGapPayloadSchema = z6.looseObject({
+  dropped: z6.number().int().min(1),
+  oversized: z6.number().int().min(0).optional(),
+  firstTs: z6.string(),
+  lastTs: z6.string()
+});
+var PlatformObservationPayloadSchema = z6.strictObject({
+  origin: z6.string().min(1),
+  params: Json,
+  response: Json
+});
+var ANOMALY_TYPES = [
+  "fork",
+  "seq_gap",
+  "prev_hash_mismatch",
+  "bad_sig",
+  "clock_skew",
+  "source_conflict"
+];
+var PlatformAnomalyPayloadSchema = z6.looseObject({
+  type: z6.enum(ANOMALY_TYPES),
+  source: EvidenceSourceAllSchema,
+  seq: z6.number().int().min(0).nullable(),
+  detail: JsonRecord
+});
+var REGISTRY = {
+  "session.open": SessionOpenPayloadSchema,
+  "session.close": SessionClosePayloadSchema,
+  "intent.declared": IntentDeclaredPayloadSchema,
+  "llm_call.start": LlmCallStartPayloadSchema,
+  "llm_call.end": LlmCallEndPayloadSchema,
+  "tool_call.start": ToolCallStartPayloadSchema,
+  "tool_call.end": ToolCallEndPayloadSchema,
+  "payment.requested": PaymentMomentPayloadSchema,
+  "payment.presented": PaymentMomentPayloadSchema,
+  "gateway.decision": GatewayDecisionPayloadSchema,
+  "transport.gap": TransportGapPayloadSchema,
+  "platform.observation": PlatformObservationPayloadSchema,
+  "platform.anomaly": PlatformAnomalyPayloadSchema
+};
+function payloadSchemaFor(kind) {
+  return REGISTRY[kind];
+}
+
+// ../protocol/src/verdict.ts
+var SEVERITY = { ALLOW: 0, REVIEW: 1, DENY: 2 };
+var Verdict = class _Verdict {
+  constructor(value) {
+    this.value = value;
+  }
+  static ALLOW = new _Verdict("ALLOW");
+  static REVIEW = new _Verdict("REVIEW");
+  static DENY = new _Verdict("DENY");
+  static of(value) {
+    return value === "DENY" ? _Verdict.DENY : value === "REVIEW" ? _Verdict.REVIEW : _Verdict.ALLOW;
+  }
+  /** The more severe of the two. */
+  atLeast(other) {
+    const o = typeof other === "string" ? _Verdict.of(other) : other;
+    return SEVERITY[o.value] > SEVERITY[this.value] ? o : this;
+  }
+};
+
+export {
+  ALL_SOURCES,
+  EvidenceSourceSchema,
+  EvidenceSourceAllSchema,
+  SOURCE_ORDER,
+  compareBySourceSeq,
+  chainKey,
+  compareByArrival,
+  compareRootFirst,
+  withinHeads,
+  compareBySessionSource,
+  Hex64Schema,
+  SESSION_ID_PREFIX,
+  SESSION_ID_CHARS,
+  SessionIdSchema,
+  TimestampSchema,
+  JsonValueSchema,
+  EvidenceEventSchema,
+  DecimalStringSchema,
+  AmountSchema,
+  Money,
+  INDICATOR_CODES,
+  ANNOTATION_CODES,
+  REASON_CODE_PATTERN,
+  parseSelector,
+  isSelectorRef,
+  parseSelectorRef,
+  walkPath,
+  SelectorStringSchema,
+  PolicyRulesSchema,
+  DeclaredIntentSchema,
+  CreateSessionInputSchema,
+  MAX_BATCH_EVENTS,
+  EvidenceBatchInputSchema,
+  PaymentSummarySchema,
+  EvaluateInputSchema,
+  CreatePolicyInputSchema,
+  ApiErrorSchema,
+  payloadSchemaFor,
+  Verdict
+};

package/dist/{chunk-IUWC6HT5.js → chunk-HI656UWG.js}

@@ -6,7 +6,10 @@ import {
 } from "./chunk-FQDHFTVR.js";
 import {
   payloadDigest
-} from "./chunk-77D74TWX.js";
+} from "./chunk-UXXSE643.js";
+import {
+  Money
+} from "./chunk-FNU4CRJJ.js";
 
 // src/x402/binding.ts
 var SESSION_EXTENSION = "beltic.sessionId";
@@ -17,9 +20,7 @@ function sessionIdOf(extensions) {
 }
 
 // src/x402/moments.ts
-function x402Currency(network, asset) {
-  return `${network}/${asset}`;
-}
+import { z } from "zod";
 function x402Summary(accepts, opts = {}) {
   const payer = opts.payer?.toLowerCase();
   return {
@@ -27,7 +28,7 @@ function x402Summary(accepts, opts = {}) {
     payee: accepts?.payTo ?? "unknown",
     amount: {
       value: accepts?.amount ?? "0",
-      currency: accepts ? x402Currency(accepts.network ?? "unknown", accepts.asset ?? "unknown") : "unknown"
+      currency: accepts ? Money.x402Currency(accepts.network ?? "unknown", accepts.asset ?? "unknown") : "unknown"
     },
     ...payer ? { payer } : {}
   };
@@ -64,7 +65,7 @@ var x402Moments = {
     return fromAccepts(
       {
         payTo: typeof accepts.payTo === "string" ? accepts.payTo : "dynamic",
-        amount: priceValue(accepts.price),
+        amount: PriceSchema.parse(accepts.price),
         network: accepts.network,
         asset: extra?.asset ?? "route"
       },
@@ -82,13 +83,11 @@ var x402Moments = {
     );
   }
 };
-function priceValue(price) {
-  if (typeof price === "string") return price.replace(/[^0-9.]/g, "") || "0";
-  if (typeof price === "number") return String(price);
-  if (price && typeof price === "object" && typeof price.amount === "string")
-    return price.amount;
-  return "0";
-}
+var PriceSchema = z.union([
+  z.string().transform((s) => s.replace(/[^0-9.]/g, "") || "0"),
+  z.number().transform(String),
+  z.object({ amount: z.string() }).transform((p) => p.amount)
+]).catch("0");
 
 // src/x402/adapter.ts
 function attachX402(beltic, server, http) {
@@ -137,7 +136,6 @@ function attachX402(beltic, server, http) {
 export {
   SESSION_EXTENSION,
   SESSION_HEADER,
-  x402Currency,
   x402Summary,
   x402Moments,
   attachX402