@belticlabs/agent-risk-sdk 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,9 +1,12 @@
 import {
   openCall
-} from "./chunk-ZMPKY7AX.js";
+} from "./chunk-JGVVQUXQ.js";
 import {
-  summaryOf
-} from "./chunk-M4I3FGZG.js";
+  SESSION_EXTENSION,
+  SESSION_HEADER,
+  summaryOf,
+  x402Moments
+} from "./chunk-DI3LZR65.js";
 import {
   Chain,
   canonicalBytes,
@@ -12,7 +15,13 @@ import {
   memorySigner,
   sha256,
   toHex
-} from "./chunk-77D74TWX.js";
+} from "./chunk-MWXXX35V.js";
+import {
+  ApiErrorSchema,
+  Hex64Schema,
+  JsonValueSchema,
+  Money
+} from "./chunk-PDE55ZZV.js";
 
 // src/core/api-client.ts
 var TIMEOUT_MS = 1e4;
@@ -41,15 +50,26 @@ var ApiClient = class {
       "user-agent": userAgent
     };
   }
-  async post(path, body) {
+  post(path, body) {
+    return this.request("POST", path, JSON.stringify(body));
+  }
+  /** A read; `query` entries left undefined are not sent. */
+  get(path, query = {}) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query))
+      if (value !== void 0) params.set(key, String(value));
+    const search = params.toString();
+    return this.request("GET", search ? `${path}?${search}` : path);
+  }
+  async request(method, path, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
     let res;
     try {
       res = await globalThis.fetch(`${this.baseUrl}${path}`, {
-        method: "POST",
+        method,
         headers: this.headers,
-        body: JSON.stringify(body),
+        ...body !== void 0 ? { body } : {},
         signal: controller.signal
       });
     } catch (err) {
@@ -69,7 +89,7 @@ var ApiClient = class {
       json = null;
     }
     if (!res.ok) {
-      const e = json?.error;
+      const e = ApiErrorSchema.safeParse(json).data?.error;
       throw new BelticApiError(
         res.status,
         e?.code ?? `HTTP_${res.status}`,
@@ -134,10 +154,11 @@ var Decision = class _Decision {
 };
 
 // src/core/identity.ts
-var SEED_HEX = /^[0-9a-f]{64}$/i;
 function identityFromSeed(seedHex) {
-  if (!SEED_HEX.test(seedHex))
-    throw new BelticConfigError("agentSeed must be 64 hex characters (a 32-byte Ed25519 seed)");
+  if (!Hex64Schema.safeParse(seedHex).success)
+    throw new BelticConfigError(
+      "agentSeed must be 64 lowercase hex characters (a 32-byte Ed25519 seed)"
+    );
   const signer = memorySigner(fromHex(seedHex));
   const did = didKeyFromEd25519(signer.publicKey);
   return { did, signer: { ...signer, keyId: did } };
@@ -157,14 +178,16 @@ var Memory = class {
   }
 };
 var Session = class _Session {
-  constructor(deps, key, opts = {}) {
+  constructor(deps, opts = {}, resume = null) {
     this.deps = deps;
-    this.key = key;
     this.opts = opts;
+    this.conversationId = resume;
     this.openedWith = opts.intent ? _Session.hash(opts.intent) : null;
   }
   opened = null;
   current = null;
+  /** The conversation id: what was resumed, then what the platform answered. */
+  conversationId;
   /** JCS hash of the mandate on the chain, and of the one the options carried. */
   declared = null;
   openedWith;
@@ -172,18 +195,29 @@ var Session = class _Session {
   timer = null;
   calls = new Memory();
   decisions = new Memory();
-  /** The platform's id for this session — opened on first use, `null` while there is none. */
+  /**
+   * The conversation id — what the host stores and resumes with (GAP-84).
+   * Opened on first use; `null` while the platform has not answered and
+   * nothing was resumed.
+   */
   id() {
-    return this.stream().then((stream) => stream?.id ?? null);
+    return this.stream().then((stream) => stream?.conversationId ?? this.conversationId);
   }
   /**
-   * The stream this session records into — opened on first use, `null`
+   * The stream this session records into — opened on first use, reopened
+   * in the same conversation once the platform ended it (GAP-85), `null`
    * when there is none. For the integrations; a host never holds it.
    * @internal
    */
   stream() {
-    const next = this.deps.streams.open(this.key, this.opts);
+    const prior = this.opened ?? Promise.resolve(null);
+    const next = prior.catch(() => null).then(
+      (stream) => stream && (this.deps.streams.halted(stream) || !stream.isClosed) ? stream : this.open()
+    );
     this.opened = next;
+    next.catch(() => {
+      if (this.opened === next) this.opened = null;
+    });
     return next.then((stream) => {
       if (stream !== this.current) {
         this.current = stream;
@@ -192,6 +226,17 @@ var Session = class _Session {
       return stream;
     });
   }
+  async open() {
+    const stream = await this.deps.streams.open({
+      ...this.opts,
+      resume: this.conversationId ?? void 0
+    });
+    if (stream) {
+      this.conversationId = stream.conversationId;
+      this.deps.onOpened(this, stream.conversationId);
+    }
+    return stream;
+  }
   /**
    * The platform's verdict on a payment about to be presented. Asked once
    * per call id: a host that re-runs its approval step reads the same
@@ -205,7 +250,7 @@ var Session = class _Session {
     if (!stream) return Decision.absent();
     if (opts.intent) await this.declare(stream, opts.intent);
     const summary = summaryOf(payment);
-    const decision = await this.deps.evaluate(stream.id, summary);
+    const decision = await this.deps.evaluate(stream.id, summary, opts.callId);
     if (decision.absent) return decision;
     if (opts.callId) this.decisions.set(opts.callId, decision);
     const call = opts.callId ? this.calls.get(opts.callId)?.call : void 0;
@@ -304,86 +349,46 @@ var Session = class _Session {
   }
 };
 
-// src/core/stream.ts
-var Stream = class {
-  constructor(deps, id, source, born) {
-    this.deps = deps;
-    this.id = id;
-    this.source = source;
-    this.born = born;
-    this.chain = Chain.genesis(id, source);
-  }
-  chain;
-  building = Promise.resolve();
-  dropped = 0;
-  droppedFirstTs = null;
-  droppedLastTs = null;
-  closed = false;
-  get isClosed() {
-    return this.closed;
-  }
-  /**
-   * Resolves once the event is sequenced and buffered — not once it is
-   * acknowledged. `false` when the event was dropped for lack of room.
-   */
-  async emit(kind, payload) {
-    const halted = this.deps.transport.haltedError(this.id, this.source);
-    if (halted) throw halted;
-    const ts = (/* @__PURE__ */ new Date()).toISOString();
-    if (!this.deps.transport.hasRoom()) {
-      this.dropped++;
-      this.droppedFirstTs ??= ts;
-      this.droppedLastTs = ts;
-      return false;
-    }
-    if (this.dropped > 0) {
-      this.deps.transport.enqueue(
-        await this.next(
-          "transport.gap",
-          { dropped: this.dropped, firstTs: this.droppedFirstTs, lastTs: this.droppedLastTs },
-          ts
-        )
-      );
-      this.dropped = 0;
-      this.droppedFirstTs = this.droppedLastTs = null;
-    }
-    this.deps.transport.enqueue(await this.next(kind, payload, ts));
-    return true;
-  }
-  /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
-  toolCall(call) {
-    const { callId, ...start } = call;
-    return openCall(this, "tool_call", callId, { transport: "local", ...start });
-  }
-  async close(reason = "completed", extra = {}) {
-    if (this.closed) return;
-    this.closed = true;
-    await this.emit("session.close", { reason, ...extra });
-    await this.flush();
-    this.deps.onClosed?.(this);
-  }
-  /** Read-your-writes: the platform must hold the evidence before anyone judges it (GAP-16/66). */
-  flush() {
-    return this.deps.transport.flush();
-  }
-  /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
-  next(kind, payload, ts) {
-    const run = this.building.then(async () => {
-      const built = await this.chain.append({ ts, kind, payload }, this.deps.signer);
-      this.chain = built.chain;
-      return built.event;
-    });
-    this.building = run.catch(() => void 0);
-    return run;
+// src/core/prompt-ledger.ts
+var PromptLedger = class _PromptLedger {
+  last;
+  constructor(base = null) {
+    this.last = base;
+  }
+  /** How the platform digests one message: over its canonical bytes. */
+  static digest(message) {
+    return toHex(sha256(canonicalBytes(message)));
+  }
+  /** The prompt as the wire carries it — whole, or against the last one — and this call becomes the last. */
+  encode(callId, messages) {
+    const digests = messages.map(_PromptLedger.digest);
+    const last = this.last;
+    this.last = { prior: callId, digests };
+    if (!last) return { prompt: messages };
+    let shared = 0;
+    while (shared < last.digests.length && shared < digests.length && last.digests[shared] === digests[shared])
+      shared++;
+    if (shared === 0) return { prompt: messages };
+    return { promptDelta: { prior: last.prior, shared, messages: messages.slice(shared) } };
+  }
+  /** The last call never reached the platform: the next one ships whole. */
+  forget() {
+    this.last = null;
   }
 };
 
 // src/core/transport.ts
 var FLUSH_MS = 1e3;
 var MAX_BATCH = 50;
+var MAX_BATCH_BYTES = 8 * 1024 * 1024;
+var MAX_EVENT_BYTES = 1024 * 1024;
 var MAX_BUFFERED = 5e3;
+var MAX_BUFFERED_BYTES = 32 * 1024 * 1024;
+var MAX_IN_FLIGHT = 8;
+var ENVELOPE_BYTES = 512;
 var BACKOFF_BASE_MS = 200;
 var BACKOFF_MAX_MS = 3e4;
+var ENDED_CODES = /* @__PURE__ */ new Set(["SESSION_CLOSED", "SESSION_EXPIRED"]);
 var ChainRejectedError = class extends Error {
   constructor(sessionId, source, result, options) {
     super(
@@ -396,18 +401,15 @@ var ChainRejectedError = class extends Error {
     this.name = "ChainRejectedError";
   }
 };
-var TransportClosedError = class extends Error {
-  constructor() {
-    super("transport is closed");
-    this.name = "TransportClosedError";
-  }
-};
 var Transport = class _Transport {
   constructor(api) {
     this.api = api;
   }
   chains = /* @__PURE__ */ new Map();
+  waiting = [];
+  running = 0;
   buffered = 0;
+  bufferedBytes = 0;
   timer = null;
   closed = false;
   /**
@@ -419,35 +421,62 @@ var Transport = class _Transport {
   static outage(err) {
     return err instanceof BelticApiError && err.retryable;
   }
-  get size() {
-    return this.buffered;
+  /** The bytes the platform will measure for an event with this payload (GAP-59), known before a `seq` is spent. */
+  static measure(payload) {
+    return canonicalBytes(payload).length + ENVELOPE_BYTES;
+  }
+  /** Whether the platform would take an event of this size at all. */
+  static fits(bytes) {
+    return bytes <= MAX_EVENT_BYTES;
   }
-  hasRoom() {
-    return !this.closed && this.buffered < MAX_BUFFERED;
+  hasRoom(bytes) {
+    return !this.closed && this.buffered < MAX_BUFFERED && this.bufferedBytes + bytes <= MAX_BUFFERED_BYTES;
   }
   haltedError(sessionId, source) {
     return this.chains.get(`${sessionId}:${source}`)?.halted ?? null;
   }
-  /** Callers check `hasRoom()` first and assign `seq` only then (GAP-38). */
-  enqueue(ev) {
-    if (this.closed) throw new TransportClosedError();
+  /** Whether the platform ended the session under this chain (GAP-85). */
+  ended(sessionId, source) {
+    return this.chains.get(`${sessionId}:${source}`)?.ended ?? false;
+  }
+  /** Callers check `hasRoom(bytes)` first and assign `seq` only then (GAP-38). */
+  enqueue(ev, bytes) {
+    if (this.closed) throw new Error("transport is closed");
     const key = `${ev.sessionId}:${ev.source}`;
     let chain = this.chains.get(key);
     if (!chain) {
-      chain = { pending: [], inFlight: null, retry: null, attempts: 0, halted: null };
+      chain = {
+        sessionId: ev.sessionId,
+        pending: [],
+        inFlight: null,
+        start: null,
+        retry: null,
+        attempts: 0,
+        halted: null,
+        ended: false
+      };
       this.chains.set(key, chain);
     }
     if (chain.halted) throw chain.halted;
-    if (!this.hasRoom()) throw new Error("transport buffer is full");
-    chain.pending.push(ev);
+    if (chain.ended) return;
+    if (!this.hasRoom(bytes)) throw new Error("transport buffer is full");
+    chain.pending.push({ ev, bytes });
     this.buffered++;
+    this.bufferedBytes += bytes;
     if (chain.pending.length >= MAX_BATCH) void this.deliver(chain, false);
     else this.schedule();
   }
-  /** One attempt per chain, now — a chain waiting out its backoff included; resolves once every attempt settled. */
-  async flush() {
-    this.unschedule();
-    await Promise.all([...this.chains.values()].map((chain) => this.deliver(chain, true)));
+  /**
+   * One attempt per chain, now — a chain waiting out its backoff included;
+   * resolves once every attempt settled. With a scope, only that session's
+   * chains (GAP-88).
+   */
+  async flush(scope) {
+    if (!scope) this.unschedule();
+    const chains = [...this.chains.values()].filter(
+      (chain) => !scope || chain.sessionId === scope.sessionId
+    );
+    await Promise.all(chains.map((chain) => this.deliver(chain, true)));
   }
   async close() {
     await this.flush();
@@ -470,28 +499,72 @@ var Transport = class _Transport {
     clearTimeout(this.timer);
     this.timer = null;
   }
-  /** A chain waiting out its backoff is left alone unless forced: only `flush` cuts a backoff short. */
+  /**
+   * Queues the chain for a delivery slot — at the front when forced. A
+   * chain waiting out its backoff is left alone unless forced: only
+   * `flush` cuts a backoff short.
+   */
   deliver(chain, force) {
-    if (chain.inFlight) return chain.inFlight;
-    if (chain.halted || chain.pending.length === 0) return Promise.resolve();
+    if (chain.inFlight) {
+      if (force && chain.start) this.promote(chain);
+      return chain.inFlight;
+    }
+    if (chain.halted || chain.ended || chain.pending.length === 0) return Promise.resolve();
     if (chain.retry) {
       if (!force) return Promise.resolve();
       clearTimeout(chain.retry);
       chain.retry = null;
     }
-    chain.inFlight = this.attempt(chain).finally(() => {
-      chain.inFlight = null;
+    chain.inFlight = new Promise((resolve) => {
+      chain.start = () => {
+        chain.start = null;
+        this.running++;
+        void this.attempt(chain).finally(() => {
+          this.running--;
+          chain.inFlight = null;
+          resolve();
+          this.pump();
+        });
+      };
     });
+    if (force) this.waiting.unshift(chain);
+    else this.waiting.push(chain);
+    this.pump();
     return chain.inFlight;
   }
+  promote(chain) {
+    const at = this.waiting.indexOf(chain);
+    if (at > 0) {
+      this.waiting.splice(at, 1);
+      this.waiting.unshift(chain);
+    }
+  }
+  pump() {
+    while (this.running < MAX_IN_FLIGHT && this.waiting.length > 0) this.waiting.shift().start?.();
+  }
+  /** The head of the queue that fits one batch: by count or by bytes, whichever comes first, and never empty. */
+  static batchOf(chain) {
+    const batch = [];
+    let bytes = 0;
+    for (const item of chain.pending) {
+      if (batch.length >= MAX_BATCH) break;
+      if (batch.length > 0 && bytes + item.bytes > MAX_BATCH_BYTES) break;
+      batch.push(item);
+      bytes += item.bytes;
+    }
+    return batch;
+  }
   /** Batches until the chain drains; a retryable failure schedules the next attempt and returns. */
   async attempt(chain) {
     while (chain.pending.length > 0 && !chain.halted) {
-      const batch = chain.pending.slice(0, MAX_BATCH);
-      const first = batch[0];
+      const batch = _Transport.batchOf(chain);
+      const first = batch[0].ev;
       let ack;
       try {
-        ack = await this.api.post("/v1/evidence", batch);
+        ack = await this.api.post(
+          "/v1/evidence",
+          batch.map((item) => item.ev)
+        );
       } catch (err) {
         console.error("[beltic]", err);
         if (!_Transport.outage(err)) {
@@ -522,19 +595,142 @@ var Transport = class _Transport {
         chain.retry.unref?.();
         return;
       }
-      chain.pending.splice(0, batch.length);
-      this.buffered -= batch.length;
+      this.release(chain, batch.length);
       chain.attempts = 0;
       const bad = ack.results.find((r) => r.status === "fork" || r.status === "rejected");
-      if (bad) this.halt(chain, new ChainRejectedError(first.sessionId, first.source, bad));
+      if (!bad) continue;
+      if (bad.status === "rejected" && bad.code && ENDED_CODES.has(bad.code)) this.end(chain);
+      else this.halt(chain, new ChainRejectedError(first.sessionId, first.source, bad));
+    }
+  }
+  release(chain, count) {
+    for (const item of chain.pending.splice(0, count)) {
+      this.buffered--;
+      this.bufferedBytes -= item.bytes;
     }
   }
+  drop(chain) {
+    this.release(chain, chain.pending.length);
+  }
   halt(chain, error) {
     chain.halted = error;
-    this.buffered -= chain.pending.length;
-    chain.pending = [];
+    this.drop(chain);
     console.error("[beltic]", error);
   }
+  end(chain) {
+    chain.ended = true;
+    this.drop(chain);
+  }
+};
+
+// src/core/stream.ts
+var Stream = class {
+  constructor(deps, id, conversationId, source, born) {
+    this.deps = deps;
+    this.id = id;
+    this.conversationId = conversationId;
+    this.source = source;
+    this.born = born;
+    this.chain = Chain.genesis(id, source);
+    this.ledger = new PromptLedger(deps.prompt ?? null);
+  }
+  chain;
+  ledger;
+  building = Promise.resolve();
+  dropped = 0;
+  oversized = 0;
+  droppedFirstTs = null;
+  droppedLastTs = null;
+  closed = false;
+  /** Closed by this side, or ended by the platform (GAP-85). */
+  get isClosed() {
+    return this.closed || this.deps.transport.ended(this.id, this.source);
+  }
+  /**
+   * Resolves once the event is sequenced and buffered — not once it is
+   * acknowledged. `false` when the event was dropped for lack of room.
+   */
+  async emit(kind, payload) {
+    const halted = this.deps.transport.haltedError(this.id, this.source);
+    if (halted) throw halted;
+    if (this.deps.transport.ended(this.id, this.source)) return false;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const bytes = Transport.measure(payload);
+    const gap = this.dropped > 0 ? this.gap() : null;
+    const gapBytes = gap ? Transport.measure(gap) : 0;
+    if (!Transport.fits(bytes) || !this.deps.transport.hasRoom(bytes + gapBytes)) {
+      this.dropped++;
+      if (!Transport.fits(bytes)) this.oversized++;
+      this.droppedFirstTs ??= ts;
+      this.droppedLastTs = ts;
+      return false;
+    }
+    if (gap) {
+      this.dropped = this.oversized = 0;
+      this.droppedFirstTs = this.droppedLastTs = null;
+      this.deps.transport.enqueue(
+        await this.next("transport.gap", gap, ts),
+        gapBytes
+      );
+    }
+    this.deps.transport.enqueue(await this.next(kind, payload, ts), bytes);
+    return true;
+  }
+  /** What the drops since the last accepted event add up to (GAP-38/87). */
+  gap() {
+    return {
+      dropped: this.dropped,
+      ...this.oversized > 0 ? { oversized: this.oversized } : {},
+      firstTs: this.droppedFirstTs,
+      lastTs: this.droppedLastTs
+    };
+  }
+  /**
+   * A model call as a span: `llm_call.start` now, with the prompt as a
+   * delta against the last one on this chain (GAP-89), `llm_call.end` when
+   * the host reports the result. A start that never left (dropped) forgets
+   * the ledger, so the next call ships its prompt whole.
+   */
+  llmCall(call) {
+    const { callId, params, ...start } = call;
+    const { prompt, ...rest } = params;
+    const encoded = Array.isArray(prompt) ? this.ledger.encode(callId, prompt) : prompt === void 0 ? {} : { prompt };
+    const span = openCall(this, "llm_call", callId, { ...start, params: { ...rest, ...encoded } });
+    if (Array.isArray(prompt))
+      span.opened.then(
+        (sequenced) => {
+          if (!sequenced) this.ledger.forget();
+        },
+        () => this.ledger.forget()
+      );
+    return span;
+  }
+  /** The tool call whose `execute` the host runs itself; see `ToolCallSpan`. */
+  toolCall(call) {
+    const { callId, ...start } = call;
+    return openCall(this, "tool_call", callId, { transport: "local", ...start });
+  }
+  async close(reason = "completed", extra = {}) {
+    if (this.closed) return;
+    this.closed = true;
+    await this.emit("session.close", { reason, ...extra });
+    await this.flush();
+    this.deps.onClosed?.(this);
+  }
+  /** Read-your-writes for this session's chains, and only them (GAP-16/66/88). */
+  flush() {
+    return this.deps.transport.flush({ sessionId: this.id });
+  }
+  /** Serialized: two concurrent emits get consecutive seqs, never the same one. */
+  next(kind, payload, ts) {
+    const run = this.building.then(async () => {
+      const built = await this.chain.append({ ts, kind, payload }, this.deps.signer);
+      this.chain = built.chain;
+      return built.event;
+    });
+    this.building = run.catch(() => void 0);
+    return run;
+  }
 };
 
 // src/core/streams.ts
@@ -544,35 +740,12 @@ var Streams = class {
     this.deps = deps;
   }
   attached = /* @__PURE__ */ new Map();
-  /** Buyer streams by the host's own key (GAP-71). */
-  opened = /* @__PURE__ */ new Map();
   retryAt = 0;
   /**
-   * Buyer half: the stream for a key of the host's own, opened on first
-   * use and reused after. A halted chain is reopened as a fresh session
-   * that continues the same key; a closed key is forgotten.
+   * Buyer half: a fresh AGENT_TRACE stream — a new conversation, or a new
+   * session of the one `resume` names. `null` while the platform is out.
    */
-  open(key, input = {}) {
-    const prior = this.opened.get(key) ?? Promise.resolve(null);
-    const next = prior.catch(() => null).then(
-      (stream) => stream && !stream.isClosed && !this.deps.transport.haltedError(stream.id, stream.source) ? stream : this.openFresh(input, () => this.forget(key, next))
-    );
-    this.opened.set(key, next);
-    next.catch(() => this.forget(key, next));
-    return next;
-  }
-  /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
-  async ensure(sessionId) {
-    if (sessionId) return this.attach(sessionId, "INTERNAL_NETWORK", "buyer");
-    const out = await this.deps.api.post("/v1/sessions", {
-      source: "INTERNAL_NETWORK"
-    });
-    return this.attach(out.sessionId, "INTERNAL_NETWORK", "seller");
-  }
-  forget(key, entry) {
-    if (this.opened.get(key) === entry) this.opened.delete(key);
-  }
-  async openFresh(input, onClosed) {
+  async open(input = {}, onClosed) {
     const identity = this.deps.identity;
     if (!identity)
       throw new BelticConfigError(
@@ -590,14 +763,30 @@ var Streams = class {
       return null;
     }
   }
+  /** Seller half: emit INTERNAL_NETWORK evidence into a session the buyer bound, or open a seller-born one. */
+  async ensure(sessionId) {
+    if (sessionId) return this.attach(sessionId, sessionId, "INTERNAL_NETWORK", "buyer");
+    const out = await this.deps.api.post("/v1/sessions", {
+      source: "INTERNAL_NETWORK"
+    });
+    return this.attach(out.sessionId, out.conversationId, "INTERNAL_NETWORK", "seller");
+  }
+  /** Whether the platform refused this stream's chain: its next `emit` throws (GAP-85). */
+  halted(stream) {
+    return this.deps.transport.haltedError(stream.id, stream.source) !== null;
+  }
   async create(identity, input, onClosed) {
     const body = {
       source: "AGENT_TRACE",
       agent: { did: identity.did, credential: identity.did },
-      ...input.intent ? { intent: input.intent } : {}
+      ...input.intent ? { intent: input.intent } : {},
+      ...input.resume ? { resume: input.resume } : {}
     };
     const out = await this.deps.api.post("/v1/sessions", body);
-    const stream = this.attach(out.sessionId, "AGENT_TRACE", "buyer", onClosed);
+    const stream = this.attach(out.sessionId, out.conversationId, "AGENT_TRACE", "buyer", {
+      prompt: out.prompt,
+      onClosed
+    });
     await stream.emit("session.open", {
       runtime: {
         sdk: "@belticlabs/agent-risk-sdk",
@@ -609,7 +798,7 @@ var Streams = class {
     if (input.intent) await stream.emit("intent.declared", input.intent);
     return stream;
   }
-  attach(id, source, born, onClosed) {
+  attach(id, conversationId, source, born, opts = {}) {
     const key = `${id}:${source}`;
     const existing = this.attached.get(key);
     if (existing) return existing;
@@ -617,12 +806,14 @@ var Streams = class {
       {
         transport: this.deps.transport,
         signer: source === "AGENT_TRACE" ? this.deps.identity?.signer : void 0,
+        prompt: opts.prompt,
         onClosed: () => {
           this.attached.delete(key);
-          onClosed?.();
+          opts.onClosed?.();
         }
       },
       id,
+      conversationId,
       source,
       born
     );
@@ -631,13 +822,201 @@ var Streams = class {
   }
 };
 
+// src/x402/headers.ts
+import { z } from "zod";
+var Base64Json = z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/).transform((value, ctx) => {
+  try {
+    return JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+  } catch {
+    ctx.addIssue({ code: "custom", message: "not base64 JSON" });
+    return z.NEVER;
+  }
+});
+var Accepts = z.looseObject({
+  payTo: z.string().optional().catch(void 0),
+  amount: z.string().optional().catch(void 0),
+  network: z.string().optional().catch(void 0),
+  asset: z.string().optional().catch(void 0)
+});
+var PaymentRequired = Base64Json.pipe(
+  z.looseObject({ accepts: z.array(Accepts).optional().catch(void 0) })
+);
+var PaymentPayload = Base64Json.pipe(
+  z.looseObject({
+    accepted: Accepts.optional().catch(void 0),
+    payload: z.record(z.string(), z.unknown()).optional().catch(void 0),
+    extensions: z.record(z.string(), z.unknown()).optional().catch(void 0)
+  })
+);
+var Requirement = z.looseObject({
+  scheme: z.string().min(1),
+  network: z.string().min(1),
+  asset: z.string().min(1),
+  amount: z.string().regex(/^\d+$/),
+  payTo: z.string().min(1),
+  maxTimeoutSeconds: z.number().int().positive().optional()
+});
+var Shape = JsonValueSchema.optional().catch(void 0);
+var Challenge = Base64Json.pipe(
+  z.looseObject({
+    x402Version: z.literal(2),
+    accepts: z.array(z.unknown()),
+    resource: z.looseObject({ url: z.string(), description: z.string().optional().catch(void 0) }).optional().catch(void 0),
+    extensions: z.looseObject({
+      bazaar: z.looseObject({
+        info: z.looseObject({ input: Shape }).optional().catch(void 0),
+        schema: z.looseObject({
+          properties: z.looseObject({ input: Shape }).optional().catch(void 0)
+        }).optional().catch(void 0)
+      }).optional().catch(void 0)
+    }).optional().catch(void 0)
+  })
+).transform((c) => ({
+  resource: c.resource ? { url: c.resource.url, description: c.resource.description } : null,
+  accepts: c.accepts.flatMap((a) => {
+    const r = Requirement.safeParse(a);
+    return r.success ? [r.data] : [];
+  }),
+  input: c.extensions?.bazaar?.info?.input ?? null,
+  inputSchema: c.extensions?.bazaar?.schema?.properties?.input ?? null
+}));
+var Settlement = Base64Json.pipe(
+  z.looseObject({
+    success: z.boolean(),
+    transaction: z.string().optional().catch(void 0),
+    network: z.string().optional().catch(void 0),
+    payer: z.string().optional().catch(void 0),
+    errorReason: z.string().optional().catch(void 0),
+    errorMessage: z.string().optional().catch(void 0)
+  })
+);
+
+// src/x402/x402.ts
+var X402 = class _X402 {
+  constructor(api) {
+    this.api = api;
+  }
+  /**
+   * x402-payable APIs matching `q`, grouped by vendor, as the platform finds
+   * them live in public catalogs (GAP-90); with `network`, only what can be
+   * paid there. `sources` says which catalogs answered. Null when the
+   * platform could not be reached (GAP-70); a rejected query throws.
+   */
+  async catalog(search) {
+    try {
+      return await this.api.get("/v1/x402/catalog", {
+        q: search.q,
+        network: search.network,
+        limit: search.limit
+      });
+    } catch (err) {
+      if (!Transport.outage(err)) throw err;
+      console.error("[beltic]", err);
+      return null;
+    }
+  }
+  /**
+   * A fetch bound to `session` that records what x402 crosses it. A request
+   * made while the session has no stream (the platform could not open one,
+   * GAP-70) goes through unrecorded.
+   */
+  fetch(session) {
+    return async (input, init) => {
+      const stream = await session.stream();
+      if (!stream) return globalThis.fetch(input, init);
+      const headers = new Headers(
+        init?.headers ?? (input instanceof Request ? input.headers : void 0)
+      );
+      headers.set(SESSION_HEADER, stream.id);
+      const payload = PaymentPayload.safeParse(headers.get("PAYMENT-SIGNATURE")).data;
+      if (payload) {
+        const bound = {
+          ...payload,
+          extensions: { ...payload.extensions, [SESSION_EXTENSION]: stream.id }
+        };
+        headers.set("PAYMENT-SIGNATURE", _X402.encode(bound));
+        await stream.emit("payment.presented", x402Moments.payload(bound));
+        await stream.flush();
+      }
+      const res = await globalThis.fetch(input, { ...init, headers });
+      if (res.status !== 402) return res;
+      const required = PaymentRequired.safeParse(res.headers.get("PAYMENT-REQUIRED")).data;
+      if (required) await stream.emit("payment.requested", x402Moments.required(required));
+      return res;
+    };
+  }
+  /** The unpaid request, sent as it will be paid, and the challenge it answered. */
+  async quote(session, url, request = {}) {
+    const res = await this.fetch(session)(url, _X402.init(request));
+    await res.body?.cancel();
+    if (res.status !== 402) return { status: res.status, challenge: null };
+    const challenge = Challenge.safeParse(res.headers.get("PAYMENT-REQUIRED"));
+    return { status: 402, challenge: challenge.success ? challenge.data : null };
+  }
+  /**
+   * The request, sent as it was quoted, carrying `signed` as an x402 v2
+   * `PAYMENT-SIGNATURE` through `fetch` — so the presentation is recorded,
+   * bound to the session and flushed before it leaves (GAP-66). What the
+   * seller settled is read, not recorded (GAP-77).
+   */
+  async pay(session, url, signed, request = {}) {
+    const payment = {
+      x402Version: 2,
+      resource: { url },
+      accepted: signed.accepted,
+      payload: signed.payload
+    };
+    const response = await this.fetch(session)(
+      url,
+      _X402.init(request, { "PAYMENT-SIGNATURE": _X402.encode(payment) })
+    );
+    const settlement = Settlement.safeParse(response.headers.get("PAYMENT-RESPONSE"));
+    return { response, settlement: settlement.success ? settlement.data : null };
+  }
+  /** An `accepts` entry as the payment `session.decide` takes — the normalization the recorded moments use. */
+  summary(accepts, opts = {}) {
+    return x402Moments.summary(accepts, opts);
+  }
+  /**
+   * The declared intent for an x402 mandate (Fraud SDK RFC › Session ›
+   * `intent.declared`). The cap must be in the currency the rail's moments
+   * carry — `<network>/<asset>`, atomic units (GAP-49) — or the platform's
+   * spend detectors compare two currencies and never meet.
+   */
+  intent(input) {
+    return {
+      mandate: input.mandate,
+      maxAmount: Money.x402(input.network, input.asset, input.maxAmount).toAmount(),
+      validUntil: new Date(input.validUntil).toISOString(),
+      ...input.merchantAllowlist ? { merchantAllowlist: input.merchantAllowlist } : {}
+    };
+  }
+  /** The request as `quote` and `pay` send it: `GET` bare, `POST` with a JSON body, unless told otherwise. */
+  static init(request, extra = {}) {
+    const headers = { accept: "*/*", ...extra };
+    if (request.body === void 0) return { method: request.method ?? "GET", headers };
+    return {
+      method: request.method ?? "POST",
+      headers: { ...headers, "content-type": "application/json" },
+      body: JSON.stringify(request.body)
+    };
+  }
+  /** An x402 header value: base64 of the JSON. */
+  static encode(value) {
+    return Buffer.from(JSON.stringify(value), "utf8").toString("base64");
+  }
+};
+
 // src/client.ts
-var SDK_VERSION = "0.6.0";
+var SDK_VERSION = "0.8.0";
 var Beltic = class _Beltic {
+  /** x402 for the buyer: `catalog`, `fetch`, `quote`, `pay`, `summary`, `intent`. */
+  x402;
   /** The stream registry, for the protocol adapters. @internal */
   streams;
   api;
   transport;
+  /** Open handles by conversation id (GAP-84). */
   sessions = /* @__PURE__ */ new Map();
   /**
    * The client the environment describes: `BELTIC_API_KEY` and
@@ -665,6 +1044,7 @@ var Beltic = class _Beltic {
       `@belticlabs/agent-risk-sdk/${SDK_VERSION}`
     );
     this.transport = new Transport(this.api);
+    this.x402 = new X402(this.api);
     this.streams = new Streams({
       api: this.api,
       transport: this.transport,
@@ -673,38 +1053,48 @@ var Beltic = class _Beltic {
     });
   }
   /**
-   * The session for a key of the host's own (its session, run or
-   * conversation id) — one object per key until it closes; the options
-   * count on the first call only. See `Session`.
+   * A conversation: new without an id, resumed with one — the id `session.id()`
+   * answered in this or any earlier process (GAP-84). One handle per
+   * conversation in-process until it closes; the options count when a
+   * session is opened. See `Session`.
    */
-  session(key, opts = {}) {
-    const existing = this.sessions.get(key);
+  session(id, opts = {}) {
+    const existing = id ? this.sessions.get(id) : void 0;
     if (existing) return existing;
     const session = new Session(
       {
         streams: this.streams,
-        evaluate: (sessionId, payment) => this.evaluate(sessionId, payment),
+        evaluate: (sessionId, payment, callId) => this.evaluate(sessionId, payment, { callId }),
+        onOpened: (opened, conversationId) => {
+          if (!this.sessions.has(conversationId)) this.sessions.set(conversationId, opened);
+        },
         onClosed: (closed) => {
-          if (this.sessions.get(key) === closed) this.sessions.delete(key);
+          for (const [key, s] of this.sessions) if (s === closed) this.sessions.delete(key);
         }
       },
-      key,
-      opts
+      opts,
+      id ?? null
     );
-    this.sessions.set(key, session);
+    if (id) this.sessions.set(id, session);
     return session;
   }
   /**
    * The platform's verdict on a payment — the seller's before it verifies,
    * the buyer's before it presents (Fraud SDK RFC › Evaluation Client).
-   * Read-your-writes: the buffered evidence is flushed first so the
-   * platform judges what the caller already saw (GAP-16). Absent when the
-   * platform could not be reached (GAP-70).
+   * Read-your-writes: the session's buffered evidence is flushed first so
+   * the platform judges what the caller already saw (GAP-16/88). With a `callId`
+   * the platform answers the decision already taken for that call anywhere
+   * in the conversation (GAP-84). Absent when the platform could not be
+   * reached (GAP-70).
    */
-  async evaluate(sessionId, payment) {
-    const input = { sessionId, payment };
+  async evaluate(sessionId, payment, opts = {}) {
+    const input = {
+      sessionId,
+      payment,
+      ...opts.callId ? { callId: opts.callId } : {}
+    };
     try {
-      await this.transport.flush();
+      await this.transport.flush({ sessionId });
       return Decision.of(await this.api.post("/v1/evaluate", input));
     } catch (err) {
       if (!Transport.outage(err)) throw err;
@@ -712,7 +1102,7 @@ var Beltic = class _Beltic {
       return Decision.absent();
     }
   }
-  /** Send everything buffered now and wait for that attempt. */
+  /** Send everything buffered now — every session's — and wait for that attempt. */
   flush() {
     return this.transport.flush();
   }
@@ -731,5 +1121,6 @@ export {
   ChainRejectedError,
   Decision,
   SDK_VERSION,
-  Session
+  Session,
+  X402
 };