@agent-shield/sdk 0.5.2 → 0.5.4

package/dist/instructions.d.ts

@@ -1,9 +1,106 @@
 import { PublicKey } from "@solana/web3.js";
 import { BN, Program } from "@coral-xyz/anchor";
-import type { AgentShield, InitializeVaultParams, UpdatePolicyParams, QueuePolicyUpdateParams, AgentTransferParams, AuthorizeParams } from "./types";
+import type { AgentShield, InitializeVaultParams, UpdatePolicyParams, QueuePolicyUpdateParams, AgentTransferParams, AuthorizeParams, InitializeOracleRegistryParams, UpdateOracleRegistryParams } from "./types";
+export declare function buildInitializeOracleRegistry(program: Program<AgentShield>, authority: PublicKey, params: InitializeOracleRegistryParams): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
+    name: "initializeOracleRegistry";
+    docs: ["Initialize the protocol-level oracle registry.", "Only called once. The authority becomes the registry admin."];
+    discriminator: [190, 92, 228, 114, 56, 71, 101, 220];
+    accounts: [{
+        name: "authority";
+        writable: true;
+        signer: true;
+    }, {
+        name: "oracleRegistry";
+        writable: true;
+        pda: {
+            seeds: [{
+                kind: "const";
+                value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+            }];
+        };
+    }, {
+        name: "systemProgram";
+        address: "11111111111111111111111111111111";
+    }];
+    args: [{
+        name: "entries";
+        type: {
+            vec: {
+                defined: {
+                    name: "oracleEntry";
+                };
+            };
+        };
+    }];
+} & {
+    name: "initializeOracleRegistry";
+}, {
+    name: "authority";
+    writable: true;
+    signer: true;
+} | {
+    name: "oracleRegistry";
+    writable: true;
+    pda: {
+        seeds: [{
+            kind: "const";
+            value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+        }];
+    };
+} | {
+    name: "systemProgram";
+    address: "11111111111111111111111111111111";
+}>;
+export declare function buildUpdateOracleRegistry(program: Program<AgentShield>, authority: PublicKey, params: UpdateOracleRegistryParams): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
+    name: "updateOracleRegistry";
+    docs: ["Add or remove entries from the oracle registry.", "Only the registry authority can call this."];
+    discriminator: [184, 234, 19, 21, 41, 240, 100, 14];
+    accounts: [{
+        name: "authority";
+        signer: true;
+    }, {
+        name: "oracleRegistry";
+        writable: true;
+        pda: {
+            seeds: [{
+                kind: "const";
+                value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+            }];
+        };
+    }];
+    args: [{
+        name: "entriesToAdd";
+        type: {
+            vec: {
+                defined: {
+                    name: "oracleEntry";
+                };
+            };
+        };
+    }, {
+        name: "mintsToRemove";
+        type: {
+            vec: "pubkey";
+        };
+    }];
+} & {
+    name: "updateOracleRegistry";
+}, {
+    name: "authority";
+    signer: true;
+} | {
+    name: "oracleRegistry";
+    writable: true;
+    pda: {
+        seeds: [{
+            kind: "const";
+            value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+        }];
+    };
+}>;
 export declare function buildInitializeVault(program: Program<AgentShield>, owner: PublicKey, params: InitializeVaultParams): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "initializeVault";
-    docs: ["Initialize a new agent vault with policy configuration.", "Only the owner can call this. Creates vault PDA, policy PDA, and spend tracker PDA.", "`tracker_tier`: 0 = Standard (200 entries), 1 = Pro (500), 2 = Max (1000)."];
+    docs: ["Initialize a new agent vault with policy configuration.", "Only the owner can call this. Creates vault PDA, policy PDA,", "and zero-copy spend tracker PDA."];
     discriminator: [48, 191, 163, 44, 71, 129, 63, 164];
     accounts: [{
         name: "owner";
@@ -38,6 +135,7 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
         };
     }, {
         name: "tracker";
+        docs: ["Zero-copy SpendTracker \u2014 2,352 bytes fixed size"];
         writable: true;
         pda: {
             seeds: [{
@@ -50,7 +148,6 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
         };
     }, {
         name: "feeDestination";
-        docs: ["The protocol treasury that receives fees"];
     }, {
         name: "systemProgram";
         address: "11111111111111111111111111111111";
@@ -65,16 +162,10 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
         name: "maxTransactionSizeUsd";
         type: "u64";
     }, {
-        name: "allowedTokens";
-        type: {
-            vec: {
-                defined: {
-                    name: "allowedToken";
-                };
-            };
-        };
+        name: "protocolMode";
+        type: "u8";
     }, {
-        name: "allowedProtocols";
+        name: "protocols";
         type: {
             vec: "pubkey";
         };
@@ -95,9 +186,6 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
         type: {
             vec: "pubkey";
         };
-    }, {
-        name: "trackerTier";
-        type: "u8";
     }];
 } & {
     name: "initializeVault";
@@ -134,6 +222,7 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
     };
 } | {
     name: "tracker";
+    docs: ["Zero-copy SpendTracker \u2014 2,352 bytes fixed size"];
     writable: true;
     pda: {
         seeds: [{
@@ -146,7 +235,6 @@ export declare function buildInitializeVault(program: Program<AgentShield>, owne
     };
 } | {
     name: "feeDestination";
-    docs: ["The protocol treasury that receives fees"];
 } | {
     name: "systemProgram";
     address: "11111111111111111111111111111111";
@@ -359,7 +447,7 @@ export declare function buildRegisterAgent(program: Program<AgentShield>, owner:
 }>;
 export declare function buildUpdatePolicy(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey, params: UpdatePolicyParams): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "updatePolicy";
-    docs: ["Update the policy configuration for a vault.", "Only the owner can call this. Cannot be called by the agent.", "Blocked when timelock_duration > 0 \u2014 use queue_policy_update instead."];
+    docs: ["Update the policy configuration for a vault.", "Only the owner can call this. Blocked when timelock > 0."];
     discriminator: [212, 245, 246, 7, 163, 151, 18, 57];
     accounts: [{
         name: "owner";
@@ -380,7 +468,7 @@ export declare function buildUpdatePolicy(program: Program<AgentShield>, owner:
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker"];
+        relations: ["policy"];
     }, {
         name: "policy";
         writable: true;
@@ -393,18 +481,6 @@ export declare function buildUpdatePolicy(program: Program<AgentShield>, owner:
                 path: "vault";
             }];
         };
-    }, {
-        name: "tracker";
-        writable: true;
-        pda: {
-            seeds: [{
-                kind: "const";
-                value: [116, 114, 97, 99, 107, 101, 114];
-            }, {
-                kind: "account";
-                path: "vault";
-            }];
-        };
     }];
     args: [{
         name: "dailySpendingCapUsd";
@@ -417,18 +493,12 @@ export declare function buildUpdatePolicy(program: Program<AgentShield>, owner:
             option: "u64";
         };
     }, {
-        name: "allowedTokens";
+        name: "protocolMode";
         type: {
-            option: {
-                vec: {
-                    defined: {
-                        name: "allowedToken";
-                    };
-                };
-            };
+            option: "u8";
         };
     }, {
-        name: "allowedProtocols";
+        name: "protocols";
         type: {
             option: {
                 vec: "pubkey";
@@ -488,7 +558,7 @@ export declare function buildUpdatePolicy(program: Program<AgentShield>, owner:
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker"];
+    relations: ["policy"];
 } | {
     name: "policy";
     writable: true;
@@ -501,22 +571,18 @@ export declare function buildUpdatePolicy(program: Program<AgentShield>, owner:
             path: "vault";
         }];
     };
-} | {
-    name: "tracker";
-    writable: true;
-    pda: {
-        seeds: [{
-            kind: "const";
-            value: [116, 114, 97, 99, 107, 101, 114];
-        }, {
-            kind: "account";
-            path: "vault";
-        }];
-    };
 }>;
-export declare function buildValidateAndAuthorize(program: Program<AgentShield>, agent: PublicKey, vault: PublicKey, vaultTokenAccount: PublicKey, params: AuthorizeParams, oracleFeedAccount?: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
+/**
+ * Build a validate_and_authorize instruction.
+ *
+ * @param oracleFeedAccount - Required for non-stablecoin tokens. Omitting this
+ *   for tokens that have an oracle feed in the registry will cause an on-chain
+ *   `OracleAccountMissing` error (6032). Use `resolveOracleFeed()` to look up
+ *   the correct feed account for a given token mint.
+ */
+export declare function buildValidateAndAuthorize(program: Program<AgentShield>, agent: PublicKey, vault: PublicKey, vaultTokenAccount: PublicKey, params: AuthorizeParams, oracleFeedAccount?: PublicKey, fallbackOracleFeedAccount?: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "validateAndAuthorize";
-    docs: ["Core permission check. Called by the agent before a DeFi action.", "Validates the action against all policy constraints (USD caps, per-token caps).", "If approved, creates a SessionAuthority PDA, delegates tokens to agent,", "and updates spend tracking.", "If denied, reverts the entire transaction (including subsequent DeFi instructions)."];
+    docs: ["Core permission check. Called by the agent before a DeFi action.", "Validates against policy constraints + oracle registry.", "Creates a SessionAuthority PDA, delegates tokens to agent."];
     discriminator: [22, 183, 48, 222, 218, 11, 197, 152];
     accounts: [{
         name: "agent";
@@ -539,7 +605,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker"];
+        relations: ["policy"];
     }, {
         name: "policy";
         pda: {
@@ -553,6 +619,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
         };
     }, {
         name: "tracker";
+        docs: ["Zero-copy SpendTracker"];
         writable: true;
         pda: {
             seeds: [{
@@ -563,6 +630,15 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
                 path: "vault";
             }];
         };
+    }, {
+        name: "oracleRegistry";
+        docs: ["Protocol-level oracle registry (shared across all vaults)"];
+        pda: {
+            seeds: [{
+                kind: "const";
+                value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+            }];
+        };
     }, {
         name: "session";
         docs: ["Ephemeral session PDA \u2014 `init` ensures no double-authorization.", "Seeds include token_mint for per-token concurrent sessions."];
@@ -584,7 +660,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
         };
     }, {
         name: "vaultTokenAccount";
-        docs: ["Vault's PDA-owned token account for the spend token (delegation source)"];
+        docs: ["Vault's PDA-owned token account for the spend token"];
         writable: true;
     }, {
         name: "tokenMintAccount";
@@ -641,7 +717,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker"];
+    relations: ["policy"];
 } | {
     name: "policy";
     pda: {
@@ -655,6 +731,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
     };
 } | {
     name: "tracker";
+    docs: ["Zero-copy SpendTracker"];
     writable: true;
     pda: {
         seeds: [{
@@ -665,6 +742,15 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
             path: "vault";
         }];
     };
+} | {
+    name: "oracleRegistry";
+    docs: ["Protocol-level oracle registry (shared across all vaults)"];
+    pda: {
+        seeds: [{
+            kind: "const";
+            value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+        }];
+    };
 } | {
     name: "session";
     docs: ["Ephemeral session PDA \u2014 `init` ensures no double-authorization.", "Seeds include token_mint for per-token concurrent sessions."];
@@ -686,7 +772,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
     };
 } | {
     name: "vaultTokenAccount";
-    docs: ["Vault's PDA-owned token account for the spend token (delegation source)"];
+    docs: ["Vault's PDA-owned token account for the spend token"];
     writable: true;
 } | {
     name: "tokenMintAccount";
@@ -700,7 +786,7 @@ export declare function buildValidateAndAuthorize(program: Program<AgentShield>,
 }>;
 export declare function buildFinalizeSession(program: Program<AgentShield>, payer: PublicKey, vault: PublicKey, agent: PublicKey, tokenMint: PublicKey, success: boolean, vaultTokenAccount: PublicKey, feeDestinationTokenAccount?: PublicKey | null, protocolTreasuryTokenAccount?: PublicKey | null): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "finalizeSession";
-    docs: ["Finalize a session after the DeFi action completes.", "Revokes token delegation, collects fees, closes the SessionAuthority PDA,", "and records the transaction in the audit log.", "Can be called by the agent or permissionlessly (for cleanup of expired sessions)."];
+    docs: ["Finalize a session after the DeFi action completes.", "Revokes delegation, collects fees, closes the SessionAuthority PDA."];
     discriminator: [34, 148, 144, 47, 37, 130, 206, 161];
     accounts: [{
         name: "payer";
@@ -723,7 +809,7 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker", "session"];
+        relations: ["policy", "session"];
     }, {
         name: "policy";
         pda: {
@@ -735,21 +821,9 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
                 path: "vault";
             }];
         };
-    }, {
-        name: "tracker";
-        writable: true;
-        pda: {
-            seeds: [{
-                kind: "const";
-                value: [116, 114, 97, 99, 107, 101, 114];
-            }, {
-                kind: "account";
-                path: "vault";
-            }];
-        };
     }, {
         name: "session";
-        docs: ["Session rent is returned to the session's agent (who paid for it),", "not the arbitrary payer, to prevent rent theft.", "Seeds include token_mint for per-token concurrent sessions."];
+        docs: ["Session rent is returned to the session's agent (who paid for it).", "Seeds include token_mint for per-token concurrent sessions."];
         writable: true;
         pda: {
             seeds: [{
@@ -770,21 +844,20 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
         };
     }, {
         name: "sessionRentRecipient";
-        docs: ["Validated in handler to equal session.agent."];
         writable: true;
     }, {
         name: "vaultTokenAccount";
-        docs: ["Vault's PDA token account for the session's token (fee source + delegation revocation)"];
+        docs: ["Vault's PDA token account for the session's token"];
         writable: true;
         optional: true;
     }, {
         name: "feeDestinationTokenAccount";
-        docs: ["Developer fee destination token account \u2014 must match vault.fee_destination"];
+        docs: ["Developer fee destination token account"];
         writable: true;
         optional: true;
     }, {
         name: "protocolTreasuryTokenAccount";
-        docs: ["Protocol treasury token account \u2014 must be owned by PROTOCOL_TREASURY"];
+        docs: ["Protocol treasury token account"];
         writable: true;
         optional: true;
     }, {
@@ -821,7 +894,7 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker", "session"];
+    relations: ["policy", "session"];
 } | {
     name: "policy";
     pda: {
@@ -833,21 +906,9 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
             path: "vault";
         }];
     };
-} | {
-    name: "tracker";
-    writable: true;
-    pda: {
-        seeds: [{
-            kind: "const";
-            value: [116, 114, 97, 99, 107, 101, 114];
-        }, {
-            kind: "account";
-            path: "vault";
-        }];
-    };
 } | {
     name: "session";
-    docs: ["Session rent is returned to the session's agent (who paid for it),", "not the arbitrary payer, to prevent rent theft.", "Seeds include token_mint for per-token concurrent sessions."];
+    docs: ["Session rent is returned to the session's agent (who paid for it).", "Seeds include token_mint for per-token concurrent sessions."];
     writable: true;
     pda: {
         seeds: [{
@@ -868,21 +929,20 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
     };
 } | {
     name: "sessionRentRecipient";
-    docs: ["Validated in handler to equal session.agent."];
     writable: true;
 } | {
     name: "vaultTokenAccount";
-    docs: ["Vault's PDA token account for the session's token (fee source + delegation revocation)"];
+    docs: ["Vault's PDA token account for the session's token"];
     writable: true;
     optional: true;
 } | {
     name: "feeDestinationTokenAccount";
-    docs: ["Developer fee destination token account \u2014 must match vault.fee_destination"];
+    docs: ["Developer fee destination token account"];
     writable: true;
     optional: true;
 } | {
     name: "protocolTreasuryTokenAccount";
-    docs: ["Protocol treasury token account \u2014 must be owned by PROTOCOL_TREASURY"];
+    docs: ["Protocol treasury token account"];
     writable: true;
     optional: true;
 } | {
@@ -894,7 +954,7 @@ export declare function buildFinalizeSession(program: Program<AgentShield>, paye
 }>;
 export declare function buildRevokeAgent(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "revokeAgent";
-    docs: ["Kill switch. Immediately freezes the vault, preventing all agent actions.", "Only the owner can call this. Funds can still be withdrawn by the owner."];
+    docs: ["Kill switch. Immediately freezes the vault.", "Only the owner can call this."];
     discriminator: [227, 60, 209, 125, 240, 117, 163, 73];
     accounts: [{
         name: "owner";
@@ -943,7 +1003,7 @@ export declare function buildRevokeAgent(program: Program<AgentShield>, owner: P
 }>;
 export declare function buildReactivateVault(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey, newAgent?: PublicKey | null): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "reactivateVault";
-    docs: ["Reactivate a frozen vault. Optionally rotate the agent key.", "Only the owner can call this."];
+    docs: ["Reactivate a frozen vault. Optionally rotate the agent key."];
     discriminator: [245, 50, 143, 70, 114, 220, 25, 251];
     accounts: [{
         name: "owner";
@@ -997,7 +1057,7 @@ export declare function buildReactivateVault(program: Program<AgentShield>, owne
 }>;
 export declare function buildWithdrawFunds(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey, mint: PublicKey, amount: BN): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "withdrawFunds";
-    docs: ["Withdraw tokens from the vault back to the owner.", "Works in any vault status (Active or Frozen). Only the owner can call this."];
+    docs: ["Withdraw tokens from the vault back to the owner."];
     discriminator: [241, 36, 29, 111, 208, 31, 104, 217];
     accounts: [{
         name: "owner";
@@ -1139,7 +1199,7 @@ export declare function buildWithdrawFunds(program: Program<AgentShield>, owner:
 }>;
 export declare function buildCloseVault(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "closeVault";
-    docs: ["Close the vault entirely. Withdraws all remaining funds and closes all PDAs.", "Reclaims rent. Vault must have no open positions. Only the owner can call this."];
+    docs: ["Close the vault entirely. Reclaims rent from all PDAs."];
     discriminator: [141, 103, 17, 126, 72, 75, 29, 29];
     accounts: [{
         name: "owner";
@@ -1162,7 +1222,7 @@ export declare function buildCloseVault(program: Program<AgentShield>, owner: Pu
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker"];
+        relations: ["policy"];
     }, {
         name: "policy";
         writable: true;
@@ -1177,6 +1237,7 @@ export declare function buildCloseVault(program: Program<AgentShield>, owner: Pu
         };
     }, {
         name: "tracker";
+        docs: ["Zero-copy SpendTracker \u2014 close returns rent to owner"];
         writable: true;
         pda: {
             seeds: [{
@@ -1215,7 +1276,7 @@ export declare function buildCloseVault(program: Program<AgentShield>, owner: Pu
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker"];
+    relations: ["policy"];
 } | {
     name: "policy";
     writable: true;
@@ -1230,6 +1291,7 @@ export declare function buildCloseVault(program: Program<AgentShield>, owner: Pu
     };
 } | {
     name: "tracker";
+    docs: ["Zero-copy SpendTracker \u2014 close returns rent to owner"];
     writable: true;
     pda: {
         seeds: [{
@@ -1246,7 +1308,7 @@ export declare function buildCloseVault(program: Program<AgentShield>, owner: Pu
 }>;
 export declare function buildQueuePolicyUpdate(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey, params: QueuePolicyUpdateParams): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "queuePolicyUpdate";
-    docs: ["Queue a policy update when timelock is active.", "Creates a PendingPolicyUpdate PDA that becomes executable after", "the timelock period expires."];
+    docs: ["Queue a policy update when timelock is active."];
     discriminator: [149, 18, 76, 197, 179, 193, 91, 77];
     accounts: [{
         name: "owner";
@@ -1307,18 +1369,12 @@ export declare function buildQueuePolicyUpdate(program: Program<AgentShield>, ow
             option: "u64";
         };
     }, {
-        name: "allowedTokens";
+        name: "protocolMode";
         type: {
-            option: {
-                vec: {
-                    defined: {
-                        name: "allowedToken";
-                    };
-                };
-            };
+            option: "u8";
         };
     }, {
-        name: "allowedProtocols";
+        name: "protocols";
         type: {
             option: {
                 vec: "pubkey";
@@ -1409,7 +1465,7 @@ export declare function buildQueuePolicyUpdate(program: Program<AgentShield>, ow
 }>;
 export declare function buildApplyPendingPolicy(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "applyPendingPolicy";
-    docs: ["Apply a queued policy update after the timelock period has expired.", "Closes the PendingPolicyUpdate PDA and returns rent to the owner."];
+    docs: ["Apply a queued policy update after the timelock expires."];
     discriminator: [114, 212, 19, 227, 89, 199, 74, 62];
     accounts: [{
         name: "owner";
@@ -1431,7 +1487,7 @@ export declare function buildApplyPendingPolicy(program: Program<AgentShield>, o
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker", "pendingPolicy"];
+        relations: ["policy", "pendingPolicy"];
     }, {
         name: "policy";
         writable: true;
@@ -1444,18 +1500,6 @@ export declare function buildApplyPendingPolicy(program: Program<AgentShield>, o
                 path: "vault";
             }];
         };
-    }, {
-        name: "tracker";
-        writable: true;
-        pda: {
-            seeds: [{
-                kind: "const";
-                value: [116, 114, 97, 99, 107, 101, 114];
-            }, {
-                kind: "account";
-                path: "vault";
-            }];
-        };
     }, {
         name: "pendingPolicy";
         writable: true;
@@ -1492,7 +1536,7 @@ export declare function buildApplyPendingPolicy(program: Program<AgentShield>, o
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker", "pendingPolicy"];
+    relations: ["policy", "pendingPolicy"];
 } | {
     name: "policy";
     writable: true;
@@ -1505,18 +1549,6 @@ export declare function buildApplyPendingPolicy(program: Program<AgentShield>, o
             path: "vault";
         }];
     };
-} | {
-    name: "tracker";
-    writable: true;
-    pda: {
-        seeds: [{
-            kind: "const";
-            value: [116, 114, 97, 99, 107, 101, 114];
-        }, {
-            kind: "account";
-            path: "vault";
-        }];
-    };
 } | {
     name: "pendingPolicy";
     writable: true;
@@ -1532,7 +1564,7 @@ export declare function buildApplyPendingPolicy(program: Program<AgentShield>, o
 }>;
 export declare function buildCancelPendingPolicy(program: Program<AgentShield>, owner: PublicKey, vault: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "cancelPendingPolicy";
-    docs: ["Cancel a queued policy update. Closes the PendingPolicyUpdate PDA", "and returns rent to the owner."];
+    docs: ["Cancel a queued policy update."];
     discriminator: [153, 36, 104, 200, 50, 94, 207, 33];
     accounts: [{
         name: "owner";
@@ -1605,9 +1637,17 @@ export declare function buildCancelPendingPolicy(program: Program<AgentShield>,
         }];
     };
 }>;
-export declare function buildAgentTransfer(program: Program<AgentShield>, agent: PublicKey, vault: PublicKey, params: AgentTransferParams, oracleFeedAccount?: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
+/**
+ * Build an agent_transfer instruction.
+ *
+ * @param oracleFeedAccount - Required for non-stablecoin tokens. Omitting this
+ *   for tokens that have an oracle feed in the registry will cause an on-chain
+ *   `OracleAccountMissing` error (6032). Use `resolveOracleFeed()` to look up
+ *   the correct feed account for a given token mint.
+ */
+export declare function buildAgentTransfer(program: Program<AgentShield>, agent: PublicKey, vault: PublicKey, params: AgentTransferParams, oracleFeedAccount?: PublicKey, fallbackOracleFeedAccount?: PublicKey): import("@coral-xyz/anchor/dist/cjs/program/namespace/methods").MethodsBuilder<AgentShield, {
     name: "agentTransfer";
-    docs: ["Transfer tokens from the vault to an allowed destination.", "Only the agent can call this. Respects destination allowlist,", "spending caps, and per-token limits."];
+    docs: ["Transfer tokens from the vault to an allowed destination.", "Only the agent can call this."];
     discriminator: [199, 111, 151, 49, 124, 13, 150, 44];
     accounts: [{
         name: "agent";
@@ -1630,7 +1670,7 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
                 account: "agentVault";
             }];
         };
-        relations: ["policy", "tracker"];
+        relations: ["policy"];
     }, {
         name: "policy";
         pda: {
@@ -1644,6 +1684,7 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
         };
     }, {
         name: "tracker";
+        docs: ["Zero-copy SpendTracker"];
         writable: true;
         pda: {
             seeds: [{
@@ -1654,17 +1695,29 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
                 path: "vault";
             }];
         };
+    }, {
+        name: "oracleRegistry";
+        docs: ["Protocol-level oracle registry"];
+        pda: {
+            seeds: [{
+                kind: "const";
+                value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+            }];
+        };
     }, {
         name: "vaultTokenAccount";
         docs: ["Vault's PDA-owned token account (source)"];
         writable: true;
+    }, {
+        name: "tokenMintAccount";
+        docs: ["Token mint account for decimals validation"];
     }, {
         name: "destinationTokenAccount";
-        docs: ["Destination token account (must be in allowed destinations if configured)"];
+        docs: ["Destination token account (must be in allowed destinations)"];
         writable: true;
     }, {
         name: "feeDestinationTokenAccount";
-        docs: ["Developer fee destination token account \u2014 must match vault.fee_destination"];
+        docs: ["Developer fee destination token account"];
         writable: true;
         optional: true;
     }, {
@@ -1703,7 +1756,7 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
             account: "agentVault";
         }];
     };
-    relations: ["policy", "tracker"];
+    relations: ["policy"];
 } | {
     name: "policy";
     pda: {
@@ -1717,6 +1770,7 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
     };
 } | {
     name: "tracker";
+    docs: ["Zero-copy SpendTracker"];
     writable: true;
     pda: {
         seeds: [{
@@ -1727,17 +1781,29 @@ export declare function buildAgentTransfer(program: Program<AgentShield>, agent:
             path: "vault";
         }];
     };
+} | {
+    name: "oracleRegistry";
+    docs: ["Protocol-level oracle registry"];
+    pda: {
+        seeds: [{
+            kind: "const";
+            value: [111, 114, 97, 99, 108, 101, 95, 114, 101, 103, 105, 115, 116, 114, 121];
+        }];
+    };
 } | {
     name: "vaultTokenAccount";
     docs: ["Vault's PDA-owned token account (source)"];
     writable: true;
+} | {
+    name: "tokenMintAccount";
+    docs: ["Token mint account for decimals validation"];
 } | {
     name: "destinationTokenAccount";
-    docs: ["Destination token account (must be in allowed destinations if configured)"];
+    docs: ["Destination token account (must be in allowed destinations)"];
     writable: true;
 } | {
     name: "feeDestinationTokenAccount";
-    docs: ["Developer fee destination token account \u2014 must match vault.fee_destination"];
+    docs: ["Developer fee destination token account"];
     writable: true;
     optional: true;
 } | {