@belticlabs/agent-risk-sdk 0.6.0 → 0.7.0

package/dist/{session-Dcof4UIn.d.ts → session-DAN29XoB.d.ts}

@@ -1,4 +1,4 @@
-import { u as EvaluateOutput, D as Decision$1, w as EventResult, K as EvidenceEvent, O as EvidenceSource, ay as WireEvidenceKind, a4 as PayloadByKind, as as ToolCallStartPayload, J as JsonValue, ai as SessionClosePayload, X as JsonObject, p as DeclaredIntent, a7 as PaymentSummary, a5 as PaymentMomentPayload } from './index-IfY4XCvJ.js';
+import { m as EvaluateOutput, D as Decision$1, y as JsonObject, n as EventResult, r as EvidenceEvent, u as EvidenceSource, T as PromptBase, a4 as WireEvidenceKind, P as PayloadByKind, J as JsonValue, a2 as ToolCallStartPayload, Y as SessionClosePayload, h as DeclaredIntent, N as PaymentSummary, K as PaymentMomentPayload } from './index-DAVKGJs5.js';
 
 /**
  * The platform's verdict on one payment as a value the host can ask
@@ -69,18 +69,21 @@ interface AgentIdentity {
 }
 
 /**
- * Transport (Fraud SDK RFC › Modules: "buffering, batching, chained delivery
- * to the Collector"). Contract as assumed in GAP-18/38: one FIFO per
- * chain; at most one batch in flight per chain, so order is preserved;
- * exponential backoff, without end, on network / 5xx / 429 — an outage is
- * waited out, never surfaced into the work the evidence observes (GAP-70);
- * a `fork` or `rejected` ack, or a 4xx, halts the chain and surfaces
- * `ChainRejectedError` — an SDK must not silently keep chaining onto a
- * head the platform never accepted. `flush` makes one attempt per chain
- * now and waits for it, so read-your-writes holds when the platform is up
- * and a caller is not held hostage when it is down.
+ * One instrumented call = a `*.start` event, the work, a `*.end` event
+ * carrying the outcome or the error (GAP-07 correlates them by `callId`).
+ * `openCall` is the span — `Stream.llmCall` and `Stream.toolCall` open
+ * one — and `recordCall` runs the work inside it. The AI middleware, the
+ * tool wrapper and a host's own tool loop all record the same way.
  */
 
+interface CallSpan {
+    readonly callId: string;
+    /** Resolves once `*.start` is sequenced; `end` and `fail` wait for it. */
+    readonly opened: Promise<boolean>;
+    end(outcome?: JsonObject): Promise<boolean>;
+    fail(error: unknown, outcome?: JsonObject): Promise<boolean>;
+}
+
 declare class ChainRejectedError extends Error {
     readonly sessionId: string;
     readonly source: string;
@@ -89,10 +92,17 @@ declare class ChainRejectedError extends Error {
         cause?: unknown;
     });
 }
+/** Which chains a `flush` sends: one session's, or every chain of the process. */
+interface FlushScope {
+    sessionId: string;
+}
 declare class Transport {
     private readonly api;
     private readonly chains;
+    private readonly waiting;
+    private running;
     private buffered;
+    private bufferedBytes;
     private timer;
     private closed;
     constructor(api: ApiClient);
@@ -103,21 +113,41 @@ declare class Transport {
      * invalid payload) is a fault of the client and throws.
      */
     static outage(err: unknown): boolean;
-    get size(): number;
-    hasRoom(): boolean;
+    /** The bytes the platform will measure for an event with this payload (GAP-59), known before a `seq` is spent. */
+    static measure(payload: unknown): number;
+    /** Whether the platform would take an event of this size at all. */
+    static fits(bytes: number): boolean;
+    hasRoom(bytes: number): boolean;
     haltedError(sessionId: string, source: string): ChainRejectedError | null;
-    /** Callers check `hasRoom()` first and assign `seq` only then (GAP-38). */
-    enqueue(ev: EvidenceEvent): void;
-    /** One attempt per chain, now — a chain waiting out its backoff included; resolves once every attempt settled. */
-    flush(): Promise<void>;
+    /** Whether the platform ended the session under this chain (GAP-85). */
+    ended(sessionId: string, source: string): boolean;
+    /** Callers check `hasRoom(bytes)` first and assign `seq` only then (GAP-38). */
+    enqueue(ev: EvidenceEvent, bytes: number): void;
+    /**
+     * One attempt per chain, now — a chain waiting out its backoff included;
+     * resolves once every attempt settled. With a scope, only that session's
+     * chains (GAP-88).
+     */
+    flush(scope?: FlushScope): Promise<void>;
     close(): Promise<void>;
     private schedule;
     private unschedule;
-    /** A chain waiting out its backoff is left alone unless forced: only `flush` cuts a backoff short. */
+    /**
+     * Queues the chain for a delivery slot — at the front when forced. A
+     * chain waiting out its backoff is left alone unless forced: only
+     * `flush` cuts a backoff short.
+     */
     private deliver;
+    private promote;
+    private pump;
+    /** The head of the queue that fits one batch: by count or by bytes, whichever comes first, and never empty. */
+    private static batchOf;
     /** Batches until the chain drains; a retryable failure schedules the next attempt and returns. */
     private attempt;
+    private release;
+    private drop;
     private halt;
+    private end;
 }
 
 /**
@@ -128,9 +158,15 @@ declare class Transport {
  *
  * `seq` is handed out only when the transport has room for the event
  * (GAP-38): a dropped event never leaves a hole — the next accepted event
- * is preceded by a `transport.gap` that counts the drops. Payloads ship
- * whole (GAP-33). An outage never reaches `emit`: the transport waits it
- * out (GAP-70); what throws here is a chain the platform rejected.
+ * is preceded by a `transport.gap` that counts the drops, and how many of
+ * them the platform would have refused as too large (GAP-87); the size is
+ * measured here, once, before the seq is spent. Payloads ship whole
+ * (GAP-33) — except the prompt of a model call, which ships as a delta
+ * against the last one on the chain (GAP-89; `PromptLedger`). An outage
+ * never reaches `emit`: the transport waits it out (GAP-70); what throws
+ * here is a chain the platform rejected. A session the platform closed or
+ * expired is over, not broken: `emit` answers `false` and the conversation
+ * continues in a fresh stream (GAP-85).
  */
 
 /** Who created the session — the seller half treats a bound session as buyer-born. */
@@ -138,9 +174,18 @@ type StreamBorn = 'buyer' | 'seller';
 interface StreamDeps {
     transport: Transport;
     signer?: Signer | undefined;
+    /** The conversation's last prompt, when resuming one: what the first model call ships a delta against (GAP-89). */
+    prompt?: PromptBase | undefined;
     /** Called once the stream closed, so the registry can forget it. */
     onClosed?: ((stream: Stream) => void) | undefined;
 }
+/** What the host knows of a model call before it runs: the provider-level options, prompt included (GAP-57). */
+interface LlmCallInput {
+    callId: string;
+    provider: string;
+    modelId: string;
+    params: Record<string, JsonValue>;
+}
 /**
  * One tool call as a span: `tool_call.start` now, `tool_call.end` with the
  * outcome and the elapsed time when the host reports it.
@@ -159,25 +204,41 @@ interface ToolCallSpan {
 declare class Stream {
     private readonly deps;
     readonly id: string;
+    /** The conversation this session belongs to — the root's id (GAP-84). */
+    readonly conversationId: string;
     readonly source: EvidenceSource;
     readonly born: StreamBorn;
     private chain;
+    private readonly ledger;
     private building;
     private dropped;
+    private oversized;
     private droppedFirstTs;
     private droppedLastTs;
     private closed;
-    constructor(deps: StreamDeps, id: string, source: EvidenceSource, born: StreamBorn);
+    constructor(deps: StreamDeps, id: string, 
+    /** The conversation this session belongs to — the root's id (GAP-84). */
+    conversationId: string, source: EvidenceSource, born: StreamBorn);
+    /** Closed by this side, or ended by the platform (GAP-85). */
     get isClosed(): boolean;
     /**
      * Resolves once the event is sequenced and buffered — not once it is
      * acknowledged. `false` when the event was dropped for lack of room.
      */
     emit<K extends WireEvidenceKind>(kind: K, payload: PayloadByKind[K]): Promise<boolean>;
+    /** What the drops since the last accepted event add up to (GAP-38/87). */
+    private gap;
+    /**
+     * A model call as a span: `llm_call.start` now, with the prompt as a
+     * delta against the last one on this chain (GAP-89), `llm_call.end` when
+     * the host reports the result. A start that never left (dropped) forgets
+     * the ledger, so the next call ships its prompt whole.
+     */
+    llmCall(call: LlmCallInput): CallSpan;
     /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
     toolCall(call: ToolCallStartPayload): ToolCallSpan;
     close(reason?: SessionClosePayload['reason'], extra?: JsonObject): Promise<void>;
-    /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
+    /** Read-your-writes for this session's chains, and only them (GAP-16/66/88). */
     flush(): Promise<void>;
     /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
     private next;
@@ -187,16 +248,18 @@ declare class Stream {
  * The registry of evidence streams, one object per (session, source) per
  * process: a chain's head lives in it, so two objects for the same chain
  * would both start at seq 0 and fork it. Closed streams are forgotten; a
- * process restart mid-session still loses the head (GAP-67).
+ * process never continues a chain it did not start — it resumes the
+ * conversation in a fresh one (GAP-67/84).
  *
- * The buyer half opens AGENT_TRACE sessions keyed by the host's own id
- * (GAP-71) and announces them with `session.open` (seq 0) and
+ * The buyer half opens AGENT_TRACE sessions, new or resuming a
+ * conversation, and announces them with `session.open` (seq 0) and
  * `intent.declared` (seq 1; GAP-23/60). A session the platform could not
- * open — an outage — resolves `null` for every key during `OPEN_RETRY_MS`,
- * so the host runs without evidence instead of paying a failed request on
- * every step (GAP-70); a refused one (4xx) throws, and the next call tries
- * again. The seller half attaches to a bound session or opens its own
- * INTERNAL_NETWORK one (GAP-13).
+ * open — an outage — resolves `null` for every caller during
+ * `OPEN_RETRY_MS`, so the host runs without evidence instead of paying a
+ * failed request on every step (GAP-70); a refused one (4xx) throws, and
+ * the next call tries again. A resumed conversation's stream starts from
+ * the prompt base the platform answered (GAP-89). The seller half attaches
+ * to a bound session or opens its own INTERNAL_NETWORK one (GAP-13).
  */
 
 interface StartInput {
@@ -207,6 +270,10 @@ interface StartInput {
     } | undefined;
     attestations?: JsonObject | undefined;
 }
+interface OpenInput extends StartInput {
+    /** The conversation to continue: any session id of it (GAP-84). */
+    resume?: string | undefined;
+}
 interface StreamsDeps {
     api: ApiClient;
     transport: Transport;
@@ -216,20 +283,17 @@ interface StreamsDeps {
 declare class Streams {
     private readonly deps;
     private readonly attached;
-    /** Buyer streams by the host's own key (GAP-71). */
-    private readonly opened;
     private retryAt;
     constructor(deps: StreamsDeps);
     /**
-     * Buyer half: the stream for a key of the host's own, opened on first
-     * use and reused after. A halted chain is reopened as a fresh session
-     * that continues the same key; a closed key is forgotten.
+     * Buyer half: a fresh AGENT_TRACE stream — a new conversation, or a new
+     * session of the one `resume` names. `null` while the platform is out.
      */
-    open(key: string, input?: StartInput): Promise<Stream | null>;
+    open(input?: OpenInput, onClosed?: () => void): Promise<Stream | null>;
     /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
     ensure(sessionId?: string | null): Promise<Stream>;
-    private forget;
-    private openFresh;
+    /** Whether the platform refused this stream's chain: its next `emit` throws (GAP-85). */
+    halted(stream: Stream): boolean;
     private create;
     private attach;
 }
@@ -255,16 +319,19 @@ interface DecideOptions {
 }
 interface SessionDeps {
     streams: Streams;
-    evaluate: (sessionId: string, payment: PaymentSummary) => Promise<Decision>;
+    evaluate: (sessionId: string, payment: PaymentSummary, callId?: string) => Promise<Decision>;
+    /** Called once the platform answered with the conversation id, so the registry can key the handle by it. */
+    onOpened: (session: Session, conversationId: string) => void;
     /** Called once the session closed, so the registry forgets it. */
     onClosed: (session: Session) => void;
 }
 declare class Session {
     private readonly deps;
-    readonly key: string;
     private readonly opts;
     private opened;
     private current;
+    /** The conversation id: what was resumed, then what the platform answered. */
+    private conversationId;
     /** JCS hash of the mandate on the chain, and of the one the options carried. */
     private declared;
     private readonly openedWith;
@@ -272,9 +339,14 @@ declare class Session {
     private timer;
     private readonly calls;
     private readonly decisions;
-    constructor(deps: SessionDeps, key: string, opts?: SessionOptions);
-    /** The platform's id for this session — opened on first use, `null` while there is none. */
+    constructor(deps: SessionDeps, opts?: SessionOptions, resume?: string | null);
+    /**
+     * The conversation id — what the host stores and resumes with (GAP-84).
+     * Opened on first use; `null` while the platform has not answered and
+     * nothing was resumed.
+     */
     id(): Promise<string | null>;
+    private open;
     /**
      * The platform's verdict on a payment about to be presented. Asked once
      * per call id: a host that re-runs its approval step reads the same

package/dist/x402/hono.d.ts

@@ -1,10 +1,9 @@
 import { RoutesConfig, x402ResourceServer } from '@x402/core/server';
 import { MiddlewareHandler } from 'hono';
-import { B as Beltic } from '../client-CgCjOrRP.js';
-export { a as attachX402 } from '../adapter-AjCgj-KM.js';
-import '../index-IfY4XCvJ.js';
+import { B as Beltic } from '../client-Xn9M58OJ.js';
+import '../index-DAVKGJs5.js';
 import 'zod';
-import '../session-Dcof4UIn.js';
+import '../session-DAN29XoB.js';
 
 /** Seller half for hono: `@x402/hono`'s payment middleware with the Beltic hooks attached. */
 

package/dist/x402/hono.js

@@ -1,9 +1,10 @@
 import {
   attachX402
-} from "../chunk-IUWC6HT5.js";
+} from "../chunk-HI656UWG.js";
 import "../chunk-M4I3FGZG.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-77D74TWX.js";
+import "../chunk-UXXSE643.js";
+import "../chunk-FNU4CRJJ.js";
 
 // src/x402/hono.ts
 import {
@@ -16,6 +17,5 @@ function belticPaymentMiddleware(beltic, routes, server) {
   return paymentMiddlewareFromHTTPServer(http);
 }
 export {
-  attachX402,
   belticPaymentMiddleware
 };

package/dist/x402/index.d.ts

@@ -1,10 +1,11 @@
-export { a as attachX402 } from '../adapter-AjCgj-KM.js';
-import { S as Session } from '../session-Dcof4UIn.js';
-import { p as DeclaredIntent, a7 as PaymentSummary } from '../index-IfY4XCvJ.js';
-import '@x402/core/server';
-import '../client-CgCjOrRP.js';
+import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
+import { B as Beltic } from '../client-Xn9M58OJ.js';
+import { S as Session } from '../session-DAN29XoB.js';
+import { h as DeclaredIntent, N as PaymentSummary } from '../index-DAVKGJs5.js';
 import 'zod';
 
+declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer): void;
+
 /**
  * Session binding on the x402 rail (Fraud SDK RFC › Protocol Adapter — x402:
  * "`PAYMENT-SIGNATURE` extension `beltic.sessionId`"). Where exactly it
@@ -13,22 +14,6 @@ import 'zod';
 declare const SESSION_EXTENSION = "beltic.sessionId";
 declare const SESSION_HEADER = "Beltic-Session-Id";
 
-/**
- * Buyer half › the x402 fetch wrapper. Sits *inside* the agent's paying
- * fetch (e.g. `wrapFetchWithPayment(belticFetch(session))`), so it sees the
- * 402 challenge → `payment.requested`, and the retry carrying the payment
- * → `payment.presented`, into which it injects the session binding
- * (GAP-30). It never pays and never decides.
- *
- * Before a request that presents payment leaves, the buffered evidence is
- * flushed: the seller will evaluate as soon as it sees the payment, and
- * the platform must already hold the buyer's side of the story (GAP-66).
- *
- * Only x402 v2 is read — `PAYMENT-REQUIRED` header, `PAYMENT-SIGNATURE`
- * retry, binding in `extensions` (GAP-72). The header codec is base64
- * JSON, kept here so a buyer needs no `@x402/*` package to be observed.
- */
-
 /**
  * The paying fetch, observed. A request made while the session has no
  * stream (the platform could not open one, GAP-70) goes through the inner
@@ -84,4 +69,4 @@ declare function x402Summary(accepts: AcceptsLike | undefined, opts?: {
     payer?: string | undefined;
 }): PaymentSummary;
 
-export { type AcceptsLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, belticFetch, x402Intent, x402Summary };
+export { type AcceptsLike, SESSION_EXTENSION, SESSION_HEADER, type X402IntentInput, attachX402, belticFetch, x402Intent, x402Summary };

package/dist/x402/index.js

@@ -2,16 +2,42 @@ import {
   SESSION_EXTENSION,
   SESSION_HEADER,
   attachX402,
-  x402Currency,
   x402Moments,
   x402Summary
-} from "../chunk-IUWC6HT5.js";
+} from "../chunk-HI656UWG.js";
 import "../chunk-M4I3FGZG.js";
 import "../chunk-FQDHFTVR.js";
-import "../chunk-77D74TWX.js";
+import "../chunk-UXXSE643.js";
+import {
+  Money
+} from "../chunk-FNU4CRJJ.js";
 
 // src/x402/fetch.ts
-var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+import { z } from "zod";
+var Base64Json = z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).transform((value, ctx) => {
+  try {
+    return JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+  } catch {
+    ctx.addIssue({ code: "custom", message: "not base64 JSON" });
+    return z.NEVER;
+  }
+});
+var Accepts = z.looseObject({
+  payTo: z.string().optional().catch(void 0),
+  amount: z.string().optional().catch(void 0),
+  network: z.string().optional().catch(void 0),
+  asset: z.string().optional().catch(void 0)
+});
+var PaymentRequired = Base64Json.pipe(
+  z.looseObject({ accepts: z.array(Accepts).optional().catch(void 0) })
+);
+var PaymentPayload = Base64Json.pipe(
+  z.looseObject({
+    accepted: Accepts.optional().catch(void 0),
+    payload: z.record(z.string(), z.unknown()).optional().catch(void 0),
+    extensions: z.record(z.string(), z.unknown()).optional().catch(void 0)
+  })
+);
 function belticFetch(session, inner = globalThis.fetch) {
   return async (input, init) => {
     const stream = await session.stream();
@@ -20,8 +46,7 @@ function belticFetch(session, inner = globalThis.fetch) {
       init?.headers ?? (input instanceof Request ? input.headers : void 0)
     );
     headers.set(SESSION_HEADER, stream.id);
-    const signature = headers.get("PAYMENT-SIGNATURE");
-    const payload = signature ? decodeHeader(signature) : null;
+    const payload = PaymentPayload.safeParse(headers.get("PAYMENT-SIGNATURE")).data;
     if (payload) {
       const bound = {
         ...payload,
@@ -33,36 +58,20 @@ function belticFetch(session, inner = globalThis.fetch) {
     }
     const res = await inner(input, { ...init, headers });
     if (res.status !== 402) return res;
-    const required = challengeOf(res);
+    const required = PaymentRequired.safeParse(res.headers.get("PAYMENT-REQUIRED")).data;
     if (required) await stream.emit("payment.requested", x402Moments.required(required));
     return res;
   };
 }
-function decodeHeader(value) {
-  if (!BASE64.test(value)) return null;
-  try {
-    const parsed = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
 function encodeHeader(value) {
   return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
 }
-function challengeOf(res) {
-  const header = res.headers.get("PAYMENT-REQUIRED");
-  return header ? decodeHeader(header) : null;
-}
 
 // src/x402/intent.ts
 function x402Intent(input) {
   return {
     mandate: input.mandate,
-    maxAmount: {
-      value: input.maxAmount.toString(),
-      currency: x402Currency(input.network, input.asset)
-    },
+    maxAmount: Money.x402(input.network, input.asset, input.maxAmount).toAmount(),
     validUntil: new Date(input.validUntil).toISOString(),
     ...input.merchantAllowlist ? { merchantAllowlist: input.merchantAllowlist } : {}
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@belticlabs/agent-risk-sdk",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The Beltic Agent Risk SDK — one client, two halves: instrument the buyer agent (AI SDK, x402 fetch) and guard the seller boundary (x402 over hono, evaluate).",
   "license": "UNLICENSED",
   "repository": {

package/dist/adapter-AjCgj-KM.d.ts

@@ -1,6 +0,0 @@
-import { x402ResourceServer, x402HTTPResourceServer } from '@x402/core/server';
-import { B as Beltic } from './client-CgCjOrRP.js';
-
-declare function attachX402(beltic: Beltic, server: x402ResourceServer, http?: x402HTTPResourceServer): void;
-
-export { attachX402 as a };