@bondedhq/sdk 0.0.0-stage → 0.1.0

package/dist/agentkit.js

@@ -0,0 +1,206 @@
+import { ActionProvider, EvmWalletProvider, } from "@coinbase/agentkit";
+import { mandateVaultAbi } from "@bondedhq/shared";
+import { encodeFunctionData, getAddress, hexToBytes, isAddressEqual, stringToBytes, } from "viem";
+import { readExecuteOutcome } from "./breaches.js";
+import { BlockedByMandateError, BondedError, VaultFrozenError } from "./errors.js";
+import { GuardedVault } from "./guarded.js";
+import { vaultRevertError } from "./revert.js";
+import { zod3FromJsonSchema } from "./json-schema-zod3.js";
+import { resolveTools, resultText } from "./mcp.js";
+import { BondedVault } from "./vault.js";
+/**
+ * A Coinbase AgentKit wallet provider whose wallet is a Mandate Vault. Every transaction an
+ * action provider sends becomes `vault.execute(to, data)` from the agent key, so the vault checks
+ * it against the mandate and records any breach; `getAddress()` is where the funds
+ * are. Any AgentKit action provider then trades through the mandate unchanged.
+ *
+ * What a vault can't do is refused: native value (the vault is ERC-20 only), contract creation,
+ * and raw signatures or signed transactions from the agent key, which would bypass the vault.
+ * `signMessage` signs with the agent key (e.g. for API logins); it is not the vault's signature.
+ *
+ * In Enforce mode a blocked transaction still mines; `waitForTransactionReceipt` throws
+ * `BlockedByMandateError` for it, so the action reports a failure instead of a success.
+ */
+export class BondedWalletProvider extends EvmWalletProvider {
+    vault;
+    /** Where the funds are: the vault, or a module's smart account. */
+    holder;
+    #wallet;
+    #guard;
+    constructor(options) {
+        super();
+        this.vault = getAddress(options.vault);
+        this.holder = getAddress(options.holder ?? options.vault);
+        this.#wallet = options.wallet;
+        if (options.guard) {
+            const reader = new BondedVault({
+                vault: this.vault,
+                publicClient: options.wallet.getPublicClient(),
+                // Dry runs simulate from the agent key; sending goes through `wallet`.
+                account: { address: getAddress(options.wallet.getAddress()), type: "json-rpc" },
+            });
+            const guard = options.guard === true ? {} : options.guard;
+            // Sentinel checks must be signed by the agent key: that is the AgentKit wallet, not the
+            // address-only account the reader simulates from (which can't sign).
+            const sentinel = guard.sentinel && {
+                ...guard.sentinel,
+                account: guard.sentinel.account ?? agentKitSigner(options.wallet),
+            };
+            this.#guard = new GuardedVault(reader, sentinel ? { ...guard, sentinel } : guard);
+        }
+    }
+    /**
+     * A provider for a vault or a module, with `holder` read from the chain (a module's funds are
+     * in its smart account). Use this for modules; `new` assumes a vault unless `holder` is given.
+     */
+    static async create(options) {
+        if (options.holder)
+            return new BondedWalletProvider(options);
+        const reader = new BondedVault({
+            vault: options.vault,
+            publicClient: options.wallet.getPublicClient(),
+        });
+        const { holder } = await reader.identify();
+        return new BondedWalletProvider({ ...options, holder });
+    }
+    getAddress() {
+        return this.holder;
+    }
+    getNetwork() {
+        return this.#wallet.getNetwork();
+    }
+    getName() {
+        return "bonded_vault_wallet_provider";
+    }
+    /** The native balance where the funds are. The mandate covers ERC-20 tokens; gas is paid by the agent key. */
+    async getBalance() {
+        return this.#wallet.getPublicClient().getBalance({ address: this.holder });
+    }
+    getPublicClient() {
+        return this.#wallet.getPublicClient();
+    }
+    // Generic in its parameters: AgentKit types this with its own copy of viem.
+    readContract(params) {
+        return this.#wallet.readContract(params);
+    }
+    /** Sends `transaction` as `vault.execute(to, data)` from the agent key. */
+    async sendTransaction(transaction) {
+        if (transaction.value !== undefined && BigInt(transaction.value) > 0n)
+            throw new BondedError("NATIVE_VALUE", "the Mandate Vault holds ERC-20 tokens only; it can't send native value");
+        if (!transaction.to)
+            throw new BondedError("UNSUPPORTED", "the Mandate Vault can't deploy contracts");
+        const target = getAddress(transaction.to);
+        const data = transaction.data ?? "0x";
+        await this.#guard?.check({ type: "call", target, data });
+        try {
+            return await this.#wallet.sendTransaction({
+                to: this.vault,
+                data: encodeFunctionData({
+                    abi: mandateVaultAbi,
+                    functionName: "execute",
+                    args: [target, data],
+                }),
+            });
+        }
+        catch (error) {
+            throw vaultRevertError(error, {
+                vault: this.vault,
+                target,
+                signer: getAddress(this.#wallet.getAddress()),
+            });
+        }
+    }
+    /**
+     * Waits for the transaction, then reads the vault's verdict from its events: throws
+     * `BlockedByMandateError` when Enforce mode stopped the call, `VaultFrozenError` when a
+     * freeze skipped it. A Monitor-mode breach goes through and is in the vault's breach log.
+     */
+    async waitForTransactionReceipt(txHash) {
+        const receipt = (await this.#wallet.waitForTransactionReceipt(txHash));
+        if (!receipt.to || !isAddressEqual(receipt.to, this.vault))
+            return receipt;
+        const outcome = readExecuteOutcome(this.vault, receipt.logs);
+        if (receipt.status === "success" && !outcome.executed) {
+            const blocked = outcome.breaches.find((b) => b.blocked);
+            if (blocked)
+                throw new BlockedByMandateError(blocked, txHash);
+            throw new VaultFrozenError(this.vault, outcome.breaches[0], txHash);
+        }
+        return receipt;
+    }
+    async nativeTransfer() {
+        throw new BondedError("NATIVE_VALUE", "the Mandate Vault holds ERC-20 tokens only; it can't send native value");
+    }
+    /** Signs with the agent key. This is not a signature by the vault. */
+    signMessage(message) {
+        return this.#wallet.signMessage(message);
+    }
+    async sign() {
+        throw bypass("raw hashes");
+    }
+    async signTypedData() {
+        throw bypass("typed data (e.g. permits)");
+    }
+    async signTransaction() {
+        throw bypass("transactions");
+    }
+}
+/**
+ * Signs EIP-191 messages with an AgentKit wallet. Text is passed as its UTF-8 bytes, so a
+ * message that happens to look like hex is still signed as text.
+ */
+export function agentKitSigner(wallet) {
+    return {
+        signMessage: ({ message }) => wallet.signMessage(typeof message === "string"
+            ? stringToBytes(message)
+            : typeof message.raw === "string"
+                ? hexToBytes(message.raw)
+                : message.raw),
+    };
+}
+function bypass(what) {
+    return new BondedError("UNSUPPORTED", `the vault holds the funds and can't sign ${what}; a signature from the agent key would act outside the vault`);
+}
+/**
+ * An AgentKit action provider whose actions are the episode's tools, named
+ * `BondedEpisodeActionProvider_<tool>` as AgentKit names its own. Each action returns what the
+ * Arena returned, as text; a failed call returns `Error: ...` so the model can react. Works on
+ * any network and with any wallet provider: the tools don't use the wallet.
+ *
+ * In tools mode the episode's writes (`swap`, `transfer`, `approve`) are tools too. In chain mode
+ * only the reads are, and writes are transactions to the episode vault: use a
+ * `BondedWalletProvider` for `episode.vault` with `episode.sessionKey` and `episode.endpoints.rpc`.
+ */
+export class BondedEpisodeActionProvider extends ActionProvider {
+    #episode;
+    constructor(episode) {
+        super("bonded_episode", []);
+        this.#episode = episode;
+    }
+    getActions() {
+        return this.#episode.tools.map((t) => ({
+            name: `BondedEpisodeActionProvider_${t.name}`,
+            description: t.description,
+            schema: zod3FromJsonSchema(t.inputSchema),
+            invoke: async (args) => resultText(await t.call(args ?? {})),
+        }));
+    }
+    supportsNetwork() {
+        return true;
+    }
+}
+/**
+ * The episode's tools as an AgentKit action provider. With no argument it reads the episode from
+ * the runner's `BONDED_*` variables. Switch to it only while being rated:
+ *
+ * ```ts
+ * const actionProviders = isBondedEpisode()
+ *   ? [await bondedEpisodeActionProvider()]
+ *   : [erc20ActionProvider(), myProviders()];
+ * const kit = await AgentKit.from({ walletProvider, actionProviders });
+ * ```
+ */
+export async function bondedEpisodeActionProvider(from) {
+    return new BondedEpisodeActionProvider(await resolveTools(from));
+}
+//# sourceMappingURL=agentkit.js.map

package/dist/ai-sdk.d.ts

@@ -0,0 +1,39 @@
+import { type Tool } from "ai";
+import { type EpisodeTools, type EpisodeToolsSource } from "./mcp.js";
+import { type BondedVaultToolsOptions } from "./vault-tools.js";
+export type { BondedVaultToolsOptions } from "./vault-tools.js";
+/**
+ * The episode's tools as a Vercel AI SDK tool set, for `generateText`/`streamText`/agents. Each
+ * keeps the tool's own JSON Schema; `execute` returns the Arena's output, or `{ error }` when the
+ * call failed, so the model can react as it would to a production tool.
+ *
+ * With no argument it reads the episode from the runner's `BONDED_*` variables. Switch to them
+ * only while being rated:
+ *
+ * ```ts
+ * const tools = isBondedEpisode() ? await bondedAiSdkTools() : productionTools;
+ * await generateText({ model, tools, stopWhen: stepCountIs(10), prompt: task.goal });
+ * ```
+ *
+ * Peer dependency: `ai` 5 or later (tested with 7).
+ */
+export declare function bondedAiSdkTools(from?: EpisodeTools | EpisodeToolsSource): Promise<Record<string, Tool>>;
+/**
+ * The agent's Mandate Vault as an AI SDK tool set, for production: `swap`, `transfer`, `approve`
+ * and `vault_status`, every write sent through `BondedVault` so the vault checks it against the
+ * mandate. Each write is dry-run first and refused on a predicted breach (`guard`, on by
+ * default). With `sentinel`, Sentinel is asked too; what the agent read is taken from the tool
+ * results earlier in the conversation, unless you pass `context`. A refusal or failure returns
+ * `{ error }`, so the model can react.
+ *
+ * The names and arguments match the episode's write tools, so the agent's prompts work the same
+ * while it is rated:
+ *
+ * ```ts
+ * const tools = isBondedEpisode()
+ *   ? await bondedAiSdkTools()
+ *   : { ...productionTools, ...bondedVaultAiSdkTools({ vault }) };
+ * ```
+ */
+export declare function bondedVaultAiSdkTools(options: BondedVaultToolsOptions): Record<string, Tool>;
+//# sourceMappingURL=ai-sdk.d.ts.map

package/dist/ai-sdk.js

@@ -0,0 +1,86 @@
+import { jsonSchema, tool } from "ai";
+import { SENTINEL_INPUT_CHARS } from "@bondedhq/shared";
+import { resolveTools } from "./mcp.js";
+import { BONDED_VAULT_TOOLS, bondedVaultTools, } from "./vault-tools.js";
+/**
+ * The episode's tools as a Vercel AI SDK tool set, for `generateText`/`streamText`/agents. Each
+ * keeps the tool's own JSON Schema; `execute` returns the Arena's output, or `{ error }` when the
+ * call failed, so the model can react as it would to a production tool.
+ *
+ * With no argument it reads the episode from the runner's `BONDED_*` variables. Switch to them
+ * only while being rated:
+ *
+ * ```ts
+ * const tools = isBondedEpisode() ? await bondedAiSdkTools() : productionTools;
+ * await generateText({ model, tools, stopWhen: stepCountIs(10), prompt: task.goal });
+ * ```
+ *
+ * Peer dependency: `ai` 5 or later (tested with 7).
+ */
+export async function bondedAiSdkTools(from) {
+    const episode = await resolveTools(from);
+    return Object.fromEntries(episode.tools.map((t) => [
+        t.name,
+        tool({
+            description: t.description,
+            inputSchema: jsonSchema(t.inputSchema),
+            execute: async (args) => {
+                const result = await t.call(args ?? {});
+                return result.ok ? result.output : { error: result.error };
+            },
+        }),
+    ]));
+}
+/**
+ * The agent's Mandate Vault as an AI SDK tool set, for production: `swap`, `transfer`, `approve`
+ * and `vault_status`, every write sent through `BondedVault` so the vault checks it against the
+ * mandate. Each write is dry-run first and refused on a predicted breach (`guard`, on by
+ * default). With `sentinel`, Sentinel is asked too; what the agent read is taken from the tool
+ * results earlier in the conversation, unless you pass `context`. A refusal or failure returns
+ * `{ error }`, so the model can react.
+ *
+ * The names and arguments match the episode's write tools, so the agent's prompts work the same
+ * while it is rated:
+ *
+ * ```ts
+ * const tools = isBondedEpisode()
+ *   ? await bondedAiSdkTools()
+ *   : { ...productionTools, ...bondedVaultAiSdkTools({ vault }) };
+ * ```
+ */
+export function bondedVaultAiSdkTools(options) {
+    return Object.fromEntries(bondedVaultTools(options).map((t) => [
+        t.name,
+        tool({
+            description: t.description,
+            inputSchema: jsonSchema(t.inputSchema),
+            execute: async (args, call) => {
+                const context = options.sentinel && !options.context
+                    ? { untrustedInputs: toolResultsIn(call?.messages ?? []) }
+                    : undefined;
+                const result = await t.call(args ?? {}, context);
+                return result.ok ? result.output : { error: result.error };
+            },
+        }),
+    ]));
+}
+/** The tool results the model has seen (the last 20), as Sentinel's untrusted inputs. */
+function toolResultsIn(messages) {
+    const own = new Set(BONDED_VAULT_TOOLS);
+    const inputs = [];
+    for (const message of messages) {
+        const m = message;
+        if (m.role !== "tool" || !Array.isArray(m.content))
+            continue;
+        for (const part of m.content) {
+            if (part.type !== "tool-result" || !part.toolName || own.has(part.toolName))
+                continue;
+            const out = part.output;
+            const value = out && typeof out === "object" && "value" in out ? out.value : out;
+            const text = typeof value === "string" ? value : JSON.stringify(value ?? null);
+            inputs.push({ tool: part.toolName, output: text.slice(0, SENTINEL_INPUT_CHARS) });
+        }
+    }
+    return inputs.slice(-20);
+}
+//# sourceMappingURL=ai-sdk.js.map

package/dist/breaches.d.ts

@@ -0,0 +1,50 @@
+import { type BreachType } from "@bondedhq/shared";
+import { type Address, type Hex, type Log } from "viem";
+/** One entry in the vault's breach log: what pays claims and decides ratings. */
+export interface VaultBreach {
+    /** Index in the vault's log (`getBreach(id)`); predicted ids in a dry run. */
+    id: bigint;
+    type: BreachType;
+    /** Plain-language reason, from the breach type. */
+    reason: string;
+    /** The contract the action called; the zero address for a breach found by `reconcile`. */
+    target: Address;
+    /** The function called (4-byte selector). */
+    selector: Hex;
+    /** Value lost, in USD with 6 decimals (0 when blocked). */
+    lossUsd6: bigint;
+    /** Enforce mode stopped the action: nothing moved. */
+    blocked: boolean;
+}
+/** Why the vault records a breach of this type, in plain words. */
+export declare function breachReason(type: BreachType): string;
+/** What the vault's events say about one `execute`: whether the call ran, and what it recorded. */
+export interface ExecuteOutcome {
+    /** The call ran (an `Executed` event). False when Enforce mode blocked it or a freeze skipped it. */
+    executed: boolean;
+    breaches: VaultBreach[];
+    /** The vault froze during this action. */
+    froze: boolean;
+}
+/** Reads the outcome of `execute` from its logs; only logs emitted by `vault` count. */
+export declare function readExecuteOutcome(vault: Address, logs: readonly Log[]): ExecuteOutcome;
+/**
+ * What the vault would do with an action, from simulating `execute` against the chain's
+ * current state: the contract's own checks, not a copy of them.
+ */
+export interface DryRunResult {
+    /** The action would run and the vault would record no breach. */
+    ok: boolean;
+    /** The call would run. False when Enforce mode would block it or a freeze would skip it. */
+    executed: boolean;
+    /** Enforce mode would stop it (the attempt is still recorded as a breach). */
+    blocked: boolean;
+    /** The breach this action would cause, if any (an earlier unexplained outflow comes first). */
+    breach?: VaultBreach;
+    /** Every breach the vault would record, in order. */
+    breaches: VaultBreach[];
+    /** The vault would freeze. */
+    wouldFreeze: boolean;
+}
+export declare function toDryRunResult(outcome: ExecuteOutcome): DryRunResult;
+//# sourceMappingURL=breaches.d.ts.map

package/dist/breaches.js

@@ -0,0 +1,57 @@
+import { breachTypeFromCode, mandateVaultAbi } from "@bondedhq/shared";
+import { isAddressEqual, parseEventLogs } from "viem";
+const REASONS = {
+    T1_UNAUTHORIZED_TARGET: "the mandate doesn't allow calling this contract or function",
+    T1_UNAUTHORIZED_APPROVAL: "the mandate doesn't allow approving this spender",
+    T1_UNAUTHORIZED_TRANSFER: "the recipient is neither the vault nor one of the mandate's destinations",
+    T1_DEFERRED: "the vault's balances dropped earlier without an action that explains it",
+    T2_LIMIT: "the action goes over the mandate's per-trade or daily limit",
+    T3_ASSET: "the action loses more value than the mandate's slippage allows (e.g. a honeypot or lookalike token)",
+};
+/** Why the vault records a breach of this type, in plain words. */
+export function breachReason(type) {
+    return REASONS[type];
+}
+/** Reads the outcome of `execute` from its logs; only logs emitted by `vault` count. */
+export function readExecuteOutcome(vault, logs) {
+    const own = logs.filter((log) => isAddressEqual(log.address, vault));
+    const events = parseEventLogs({
+        abi: mandateVaultAbi,
+        logs: own,
+        eventName: ["Executed", "BreachRecorded", "Frozen"],
+    });
+    const breaches = [];
+    let executed = false;
+    let froze = false;
+    for (const event of events) {
+        if (event.eventName === "Executed")
+            executed = true;
+        else if (event.eventName === "Frozen")
+            froze = true;
+        else {
+            const type = breachTypeFromCode(event.args.breachType);
+            breaches.push({
+                id: event.args.breachId,
+                type,
+                reason: breachReason(type),
+                target: event.args.target,
+                selector: event.args.selector,
+                lossUsd6: event.args.lossUsd6,
+                blocked: event.args.blocked,
+            });
+        }
+    }
+    return { executed, breaches, froze };
+}
+export function toDryRunResult(outcome) {
+    const own = outcome.breaches.find((b) => b.type !== "T1_DEFERRED") ?? outcome.breaches[0];
+    return {
+        ok: outcome.executed && outcome.breaches.length === 0,
+        executed: outcome.executed,
+        blocked: outcome.breaches.some((b) => b.blocked),
+        ...(own ? { breach: own } : {}),
+        breaches: outcome.breaches,
+        wouldFreeze: outcome.froze,
+    };
+}
+//# sourceMappingURL=breaches.js.map

package/dist/done.d.ts

@@ -0,0 +1,14 @@
+import type { DoneRequest } from "@bondedhq/shared";
+/**
+ * Tells the gateway the agent is finished: `POST {done}` with an optional final message and the
+ * agent's own model usage (tokens, cost), which Bonded uses to estimate what a full rating costs
+ * you. Exiting the process (runner) or the deadline also ends the episode.
+ */
+export declare function finishEpisode(episode: {
+    endpoints: {
+        done: string;
+    };
+}, body?: DoneRequest, options?: {
+    fetch?: typeof fetch;
+}): Promise<void>;
+//# sourceMappingURL=done.d.ts.map

package/dist/done.js

@@ -0,0 +1,16 @@
+import { BondedError } from "./errors.js";
+/**
+ * Tells the gateway the agent is finished: `POST {done}` with an optional final message and the
+ * agent's own model usage (tokens, cost), which Bonded uses to estimate what a full rating costs
+ * you. Exiting the process (runner) or the deadline also ends the episode.
+ */
+export async function finishEpisode(episode, body = {}, options = {}) {
+    const response = await (options.fetch ?? fetch)(episode.endpoints.done, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw new BondedError("EPISODE_DONE", `the gateway refused /done: HTTP ${response.status} ${(await response.text()).slice(0, 200)}`);
+}
+//# sourceMappingURL=done.js.map

package/dist/eliza.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The parts of ElizaOS's plugin interface this plugin uses, written out so the SDK doesn't
+ * import @elizaos/core: its type declarations only resolve with `moduleResolution: "bundler"`.
+ * test/eliza-types.ts checks against the real types that a plugin built here is an ElizaOS
+ * `Plugin` (run by `pnpm typecheck`).
+ */
+export interface ElizaMemory {
+    content: {
+        text?: string;
+    };
+}
+export interface ElizaState {
+    text?: string;
+}
+export interface ElizaRuntime {
+    useModel(modelType: "OBJECT_SMALL", params: {
+        prompt: string;
+    }): Promise<unknown>;
+}
+type ElizaCallback = (response: {
+    text?: string;
+    actions?: string[];
+}) => Promise<unknown>;
+export interface ElizaActionResult {
+    success: boolean;
+    text?: string;
+    data?: Record<string, unknown>;
+    error?: string | Error;
+}
+export interface ElizaAction {
+    [key: string]: unknown;
+    name: string;
+    similes?: string[];
+    description: string;
+    validate: (runtime: ElizaRuntime, message: ElizaMemory, state?: ElizaState) => Promise<boolean>;
+    handler: (runtime: ElizaRuntime, message: ElizaMemory, state?: ElizaState, options?: {
+        [key: string]: unknown;
+    }, callback?: ElizaCallback) => Promise<ElizaActionResult>;
+}
+export interface ElizaProvider {
+    name: string;
+    description?: string;
+    get: (runtime: ElizaRuntime, message: ElizaMemory, state: ElizaState) => Promise<{
+        text?: string;
+        values?: Record<string, unknown>;
+        data?: Record<string, unknown>;
+    }>;
+}
+export interface ElizaPlugin {
+    name: string;
+    description: string;
+    actions: ElizaAction[];
+    providers: ElizaProvider[];
+    /** Runs when the runtime registers the plugin, before it reads `actions` and `providers`. */
+    init?: (config: Record<string, string>, runtime: unknown) => Promise<void>;
+}
+import { type SentinelGuardOptions, type TokenInfo } from "./guarded.js";
+import { type BondedEpisode } from "./episode.js";
+import { type EpisodeTools } from "./mcp.js";
+import type { BondedVault } from "./vault.js";
+export interface BondedElizaOptions {
+    /** The vault, with the agent key to send from (and a `router` for swaps). */
+    vault: BondedVault;
+    /** Tokens the agent may name by symbol. Others must be given by address. */
+    tokens?: readonly TokenInfo[];
+    /**
+     * Dry-run each action first and refuse a predicted breach. On by default: an LLM-driven
+     * agent should not knowingly breach. The vault judges either way.
+     */
+    guard?: boolean;
+    /** Ask Sentinel before each action, with the conversation as the untrusted input. */
+    sentinel?: SentinelGuardOptions;
+    /**
+     * Rating mode. With `"auto"` (the default), when the process is running a Bonded episode
+     * (`isBondedEpisode()`: the runner set `BONDED_*` variables), the plugin swaps its actions for
+     * the episode's, when the runtime registers it: see `bondedEpisodePlugin`. `"off"` keeps the
+     * vault actions always.
+     */
+    rating?: "auto" | "off";
+}
+/** The action names this plugin adds. */
+export declare const BONDED_ACTIONS: readonly ["BONDED_SWAP", "BONDED_TRANSFER", "BONDED_APPROVE"];
+/**
+ * An ElizaOS plugin: `BONDED_SWAP`, `BONDED_TRANSFER` and `BONDED_APPROVE` act through the
+ * agent's Mandate Vault, and the `BONDED_VAULT` provider tells the agent the vault's state.
+ *
+ * Each action takes its parameters from `options.parameters` when the caller passes them, or
+ * asks the runtime's `OBJECT_SMALL` model to read them from the conversation. Amounts are whole
+ * tokens ("12.5"). By default each action is dry-run against the vault first and refused if the
+ * vault would record a breach; with `sentinel`, Sentinel is asked too, with the conversation as
+ * what the agent read.
+ */
+export declare function bondedPlugin(options: BondedElizaOptions): ElizaPlugin;
+export interface BondedEpisodeElizaOptions {
+    /** The episode. Default: the one the runner set up (`fromBondedEnv`). */
+    episode?: BondedEpisode;
+    /** An existing connection to the episode's tools (otherwise one is made at `init`). */
+    tools?: EpisodeTools;
+    /** Chain mode: dry-run each vault action first (default true), as `bondedPlugin` does. */
+    guard?: boolean;
+}
+/**
+ * Rating mode for ElizaOS: a plugin whose actions are the episode's tools, so an Eliza agent is
+ * rated with the same character and model it runs in production. Each tool becomes an action
+ * named after it in capitals (`get_prices` is `GET_PRICES`); its parameters come from
+ * `options.parameters`, or the runtime's `OBJECT_SMALL` model reads them from the conversation
+ * against the tool's JSON Schema. The `BONDED_TASK` provider gives the agent the episode's task.
+ *
+ * In tools mode the writes (`SWAP`, `TRANSFER`, `APPROVE`) are tools too. In chain mode only the
+ * reads are, and the plugin adds `BONDED_SWAP`, `BONDED_TRANSFER` and `BONDED_APPROVE` on the
+ * episode vault, signed with the episode's session key (`episodeVault`).
+ *
+ * The actions are filled in by `init`, which the runtime calls when it registers the plugin
+ * (before it reads them). `bondedPlugin` does this by itself while an episode is running.
+ */
+export declare function bondedEpisodePlugin(options?: BondedEpisodeElizaOptions): ElizaPlugin;
+export {};
+//# sourceMappingURL=eliza.d.ts.map