@bondedhq/sdk 0.0.0-stage → 0.1.0

package/dist/mcp.js

@@ -0,0 +1,111 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { BondedError } from "./errors.js";
+import { finishEpisode } from "./done.js";
+import { fromBondedEnv } from "./episode.js";
+export { isBondedEpisode } from "./episode.js";
+export { finishEpisode } from "./done.js";
+/**
+ * Connects to the episode's MCP endpoint and lists its tools. With no argument it reads the
+ * episode from the runner's `BONDED_*` variables (`fromBondedEnv`); in Agent URL mode pass the
+ * episode your handler received.
+ *
+ * ```ts
+ * const episode = await connectEpisodeTools();
+ * for (const tool of episode.tools) console.log(tool.name, tool.inputSchema);
+ * const prices = await episode.callTool("get_prices");
+ * await episode.done({ finalMessage: "bought tNVDA" });
+ * ```
+ */
+export async function connectEpisodeTools(episode = fromBondedEnv(), options = {}) {
+    const http = options.fetch ?? fetch;
+    const client = new Client({ name: options.clientName ?? "bonded-sdk", version: "1" });
+    const transport = new StreamableHTTPClientTransport(new URL(episode.endpoints.mcp), {
+        fetch: http,
+    });
+    try {
+        await client.connect(transport);
+    }
+    catch (error) {
+        throw new BondedError("EPISODE_TOOLS", `couldn't connect to the episode's MCP endpoint: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    options.signal?.addEventListener("abort", () => void client.close(), { once: true });
+    const callTool = async (name, args = {}) => {
+        const result = await client.callTool({ name, arguments: args });
+        return readResult(result);
+    };
+    const listed = await client.listTools();
+    const tools = listed.tools.map((t) => ({
+        name: t.name,
+        description: t.description ?? "",
+        inputSchema: { ...t.inputSchema, type: "object" },
+        call: (args) => callTool(t.name, args),
+    }));
+    return {
+        client,
+        tools,
+        listTools: () => client.listTools(),
+        callTool,
+        done: (body) => finishEpisode(episode, body, { fetch: http }),
+        close: () => client.close(),
+    };
+}
+/** The Arena's `ToolResult`, from MCP's structured content when present, else the text. */
+function readResult(result) {
+    const content = Array.isArray(result.content) ? result.content : [];
+    const text = content
+        .filter((c) => c.type === "text")
+        .map((c) => c.text)
+        .join("\n");
+    const structured = result.structuredContent;
+    if (structured && typeof structured.ok === "boolean")
+        return structured.ok
+            ? { ok: true, output: structured.output, text }
+            : { ok: false, error: structured.error, text: structured.error };
+    if (result.isError)
+        return { ok: false, error: text, text };
+    let output = text;
+    try {
+        output = JSON.parse(text);
+    }
+    catch {
+        // Plain text output.
+    }
+    return { ok: true, output, text };
+}
+/** The text a string-returning framework (LangChain, AgentKit) gives its model. */
+export function resultText(result) {
+    return result.ok ? result.text : `Error: ${result.error}`;
+}
+/** Tools from a connection, or a fresh connection to the episode. */
+export async function resolveTools(from) {
+    if (from && "callTool" in from && "tools" in from)
+        return from;
+    return connectEpisodeTools(from ?? fromBondedEnv());
+}
+/** The `mcp-remote` bridge, pinned, for MCP clients that only start local (stdio) servers. */
+export const MCP_REMOTE_PACKAGE = "mcp-remote@0.14.3";
+/**
+ * The `mcpServers` block an MCP-aware agent accepts, pointing at this episode's MCP endpoint.
+ * The URL carries the episode's capability and stops working when the episode ends, so write the
+ * config afresh for every episode (e.g. at the start of the runner's agent command):
+ *
+ * ```sh
+ * bonded-runner --command 'bonded-mcp-config > .mcp.json && my-agent --mcp-config .mcp.json'
+ * ```
+ */
+export function mcpConfig(episode = fromBondedEnv(), options = {}) {
+    const url = episode.endpoints.mcp;
+    const style = options.style ?? "http";
+    const entry = style === "stdio"
+        ? { command: "npx", args: ["-y", MCP_REMOTE_PACKAGE, url] }
+        : style === "url"
+            ? { url }
+            : { type: "http", url };
+    return { mcpServers: { [options.name ?? "bonded-episode"]: entry } };
+}
+/** `mcpConfig` as pretty-printed JSON, ready to write to a file. */
+export function mcpConfigJson(episode = fromBondedEnv(), options = {}) {
+    return `${JSON.stringify(mcpConfig(episode, options), null, 2)}\n`;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/module.d.ts

@@ -0,0 +1,37 @@
+import { type ContractReader, type EvmMandate, type EvmMandateRules, type ModuleAccountType, type ModuleInstallPlan } from "@bondedhq/shared";
+import type { Address } from "viem";
+export type { ModuleAccountType, ModuleInstallPlan };
+/**
+ * Approvals a module can't see: before installing (and while installed), list the account's
+ * allowances to the mandate's targets for tokens the mandate doesn't cover, and revoke them.
+ * See `checkUnprotectedAllowances` in @bondedhq/shared.
+ */
+export { checkUnprotectedAllowances, deploymentTokens, unprotectedAllowancesWarning, type AllowanceCheck, type AllowanceFinding, type TokenRef, } from "@bondedhq/shared";
+export interface InstallMandateModuleInput {
+    /** MandateModuleFactory (`moduleFactory` in the deployment file). */
+    moduleFactory: Address;
+    /** The smart account to protect; it sends the batch, so it becomes the module's account. */
+    account: Address;
+    /** "safe7579" for a Safe with Safe7579; "erc7579" for an account like the reference one. */
+    accountType: ModuleAccountType;
+    /** The mandate in plain rules (dollars, percentages), as for `buildMandate`. */
+    rules: EvmMandateRules;
+    /** The agent's session key: the only key that can call the module's `execute`. */
+    agent: Address;
+    /** Can freeze, unfreeze and rotate the agent; must own the agent id to buy cover. */
+    guardian: Address;
+}
+/**
+ * Everything a smart account needs to put an agent's mandate on itself in one transaction:
+ * create its MandateModule through the factory, and install it as executor (type 2) and hook
+ * (type 4). Nothing is sent: the account's owner sends `plan.calls` as a Safe MultiSend from
+ * the Safe, or `plan.execute.data` to an ERC-7579 account (e.g. as a user operation).
+ *
+ * Returns the plan with the module's address (predicted by the factory) and the mandate JSON to
+ * keep; `plan.params.mandateHash` is the on-chain commitment that ratings and quotes use. Then
+ * use `new BondedVault({ vault: plan.module, ... })` from the agent's side.
+ */
+export declare function installMandateModule(client: ContractReader, input: InstallMandateModuleInput): Promise<ModuleInstallPlan & {
+    mandate: EvmMandate;
+}>;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.js

@@ -0,0 +1,32 @@
+import { prepareModuleInstall, } from "@bondedhq/shared";
+import { buildMandate } from "./mandate.js";
+/**
+ * Approvals a module can't see: before installing (and while installed), list the account's
+ * allowances to the mandate's targets for tokens the mandate doesn't cover, and revoke them.
+ * See `checkUnprotectedAllowances` in @bondedhq/shared.
+ */
+export { checkUnprotectedAllowances, deploymentTokens, unprotectedAllowancesWarning, } from "@bondedhq/shared";
+/**
+ * Everything a smart account needs to put an agent's mandate on itself in one transaction:
+ * create its MandateModule through the factory, and install it as executor (type 2) and hook
+ * (type 4). Nothing is sent: the account's owner sends `plan.calls` as a Safe MultiSend from
+ * the Safe, or `plan.execute.data` to an ERC-7579 account (e.g. as a user operation).
+ *
+ * Returns the plan with the module's address (predicted by the factory) and the mandate JSON to
+ * keep; `plan.params.mandateHash` is the on-chain commitment that ratings and quotes use. Then
+ * use `new BondedVault({ vault: plan.module, ... })` from the agent's side.
+ */
+export async function installMandateModule(client, input) {
+    const { mandate, params } = buildMandate(input.rules, { for: "module" });
+    const plan = await prepareModuleInstall(client, {
+        moduleFactory: input.moduleFactory,
+        account: input.account,
+        params,
+        agent: input.agent,
+        guardian: input.guardian,
+        agentId: BigInt(input.rules.agentId),
+        accountType: input.accountType,
+    });
+    return { ...plan, mandate };
+}
+//# sourceMappingURL=module.js.map

package/dist/revert.d.ts

@@ -0,0 +1,12 @@
+import { type Address } from "viem";
+/**
+ * Turns a reverted `execute` into the SDK's typed errors: the vault's or module's own errors
+ * (wrong key, frozen, not installed, calling itself) by name, anything else as the target call
+ * failing. Other errors (network, nonce) are returned unchanged.
+ */
+export declare function vaultRevertError(error: unknown, context: {
+    vault: Address;
+    target: Address;
+    signer?: Address | undefined;
+}): unknown;
+//# sourceMappingURL=revert.d.ts.map

package/dist/revert.js

@@ -0,0 +1,71 @@
+import { mandateModuleAbi, mandateVaultAbi } from "@bondedhq/shared";
+import { decodeErrorResult, isHex, parseAbi } from "viem";
+import { BondedError, CallRevertedError, NotAgentError, VaultFrozenError } from "./errors.js";
+/**
+ * Every error `execute` can revert with: the vault's and the module's own, and the error an
+ * ERC-7579 account (Safe7579, the reference account) raises when the module's call fails.
+ */
+const REVERT_ABI = [
+    ...mandateVaultAbi.filter((item) => item.type === "error"),
+    ...mandateModuleAbi.filter((item) => item.type === "error"),
+    ...parseAbi(["error ExecutionFailed()"]),
+];
+/**
+ * Turns a reverted `execute` into the SDK's typed errors: the vault's or module's own errors
+ * (wrong key, frozen, not installed, calling itself) by name, anything else as the target call
+ * failing. Other errors (network, nonce) are returned unchanged.
+ */
+export function vaultRevertError(error, context) {
+    const revert = findRevert(error);
+    if (!revert)
+        return error;
+    switch (revert.errorName) {
+        case "NotAgent":
+            return new NotAgentError(context.vault, context.signer, { cause: error });
+        case "AgentFrozen":
+            return new VaultFrozenError(context.vault, undefined, undefined, { cause: error });
+        case "CannotCallVault":
+            return new BondedError("INVALID_ACTION", "the vault can't call itself", { cause: error });
+        case "CannotCallAccount":
+        case "CannotCallModule":
+            return new BondedError("INVALID_ACTION", "the module can't call its own account or itself (that could change the account's setup)", { cause: error });
+        case "NotInstalled":
+            return new BondedError("MODULE_NOT_INSTALLED", `module ${context.vault} isn't installed on its account; the account's owner installs it as an executor (and hook)`, { cause: error });
+        case "ExecutionFailed":
+            return new CallRevertedError(`the account's call to ${context.target} failed (the account reports ExecutionFailed without the reason); nothing changed`, revert.raw, { cause: error });
+    }
+    const why = revert.reason ?? revert.errorName ?? revert.signature;
+    return new CallRevertedError(`the call to ${context.target} reverted${why ? `: ${why}` : ""}; nothing changed`, revert.raw, { cause: error });
+}
+/** Errors are matched by name, not instanceof: clients may come from another copy of viem. */
+function findRevert(error) {
+    const chain = [];
+    for (let e = error, depth = 0; e instanceof Error && depth < 20; e = e.cause, depth++)
+        chain.push(e);
+    const reverted = chain.find((e) => e.name === "ContractFunctionRevertedError");
+    // The revert data: on viem's decoded error, or on a lower error when it was decoded without
+    // the vault's ABI (e.g. by another library estimating gas).
+    const raw = reverted?.raw ??
+        chain
+            .map((e) => e.data)
+            .find((d) => typeof d === "string" && isHex(d) && d.length >= 10);
+    if (raw && raw.length >= 10) {
+        try {
+            // viem also decodes the built-in Error(string) and Panic(uint256).
+            const decoded = decodeErrorResult({ abi: REVERT_ABI, data: raw });
+            const reason = decoded.errorName === "Error" ? String(decoded.args?.[0]) : undefined;
+            return { errorName: decoded.errorName, reason, raw };
+        }
+        catch {
+            return { reason: reverted?.reason, raw, signature: raw.slice(0, 10) };
+        }
+    }
+    if (reverted)
+        return {
+            errorName: reverted.data?.errorName,
+            reason: reverted.reason,
+            signature: reverted.signature,
+        };
+    return undefined;
+}
+//# sourceMappingURL=revert.js.map

package/dist/sentinel.d.ts

@@ -0,0 +1,43 @@
+import { type SentinelInput } from "@bondedhq/shared";
+import type { Address, Hex, SignableMessage } from "viem";
+import { type SentinelVerdict } from "./errors.js";
+export type { SentinelInput, SentinelVerdict };
+/** Signs EIP-191 messages with the vault's agent key. A viem `LocalAccount` is one. */
+export interface MessageSigner {
+    signMessage(args: {
+        message: SignableMessage;
+    }): Promise<Hex>;
+}
+export interface SentinelCheckRequest {
+    /** The Bonded API, e.g. https://api.bonded.example (no trailing path). */
+    apiUrl: string;
+    /** The chain the vault is on; part of the signed message. */
+    chainId: number;
+    /** The agent's id in the Bonded registry. */
+    agentId: bigint | number | string;
+    vault: Address;
+    /** The mandate in plain words (`describeMandate` writes one). At most 4,000 characters. */
+    mandate: string;
+    /** What the agent wants to do: a tool name and its arguments as strings. */
+    proposedAction: {
+        tool: string;
+        args: Record<string, string>;
+    };
+    /** What the agent read from outside before deciding (emails, posts, tool output). At most 20. */
+    untrustedInputs?: readonly SentinelInput[];
+    /** The vault's agent key: the API only answers checks signed by it. */
+    account: MessageSigner;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+    /** Unix seconds to sign; defaults to now. The API accepts a check for 120 seconds. */
+    timestamp?: number;
+}
+/**
+ * Asks Bonded Sentinel whether a proposed action looks driven by what the agent read rather
+ * than by its mandate. Signs the request with the agent key, as the API requires.
+ *
+ * Advisory only: the vault's breach log, not Sentinel, decides claims and ratings. Throws
+ * `SentinelError` when the API refuses or can't answer (it returns 503 while Sentinel is down).
+ */
+export declare function checkWithSentinel(request: SentinelCheckRequest): Promise<SentinelVerdict>;
+//# sourceMappingURL=sentinel.d.ts.map

package/dist/sentinel.js

@@ -0,0 +1,94 @@
+import { SENTINEL_INPUT_CHARS, sentinelCheckDigest, sentinelCheckMessage, } from "@bondedhq/shared";
+import { z } from "zod";
+import { BondedError, SentinelError } from "./errors.js";
+const verdictSchema = z.object({
+    blocked: z.boolean(),
+    manipulated: z.number(),
+    injection: z.number(),
+    blockThreshold: z.number(),
+    model: z.string(),
+    latencyMs: z.number(),
+    advice: z.string(),
+});
+/** The API's limits on a check (apps/api/src/sentinel.ts), checked here for clearer errors. */
+const LIMITS = { mandate: 4_000, tool: 64, args: 20, argKey: 64, argValue: 2_000, inputs: 20 };
+/**
+ * Asks Bonded Sentinel whether a proposed action looks driven by what the agent read rather
+ * than by its mandate. Signs the request with the agent key, as the API requires.
+ *
+ * Advisory only: the vault's breach log, not Sentinel, decides claims and ratings. Throws
+ * `SentinelError` when the API refuses or can't answer (it returns 503 while Sentinel is down).
+ */
+export async function checkWithSentinel(request) {
+    const body = {
+        mandate: request.mandate,
+        proposedAction: request.proposedAction,
+        // Sentinel only sees the first SENTINEL_INPUT_CHARS of each input; the API rejects more.
+        untrustedInputs: (request.untrustedInputs ?? []).map((input) => ({
+            tool: input.tool,
+            output: input.output.slice(0, SENTINEL_INPUT_CHARS),
+        })),
+    };
+    checkLimits(body);
+    const agentId = request.agentId.toString();
+    const timestamp = request.timestamp ?? Math.floor(Date.now() / 1000);
+    const signature = await request.account.signMessage({
+        message: sentinelCheckMessage({
+            chainId: request.chainId,
+            agentId,
+            vault: request.vault,
+            digest: sentinelCheckDigest(body),
+            timestamp,
+        }),
+    });
+    const url = `${request.apiUrl.replace(/\/+$/, "")}/sentinel/check`;
+    let response;
+    try {
+        response = await (request.fetch ?? fetch)(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ agentId, vault: request.vault, timestamp, signature, ...body }),
+            ...(request.signal ? { signal: request.signal } : {}),
+        });
+    }
+    catch (error) {
+        throw new SentinelError(`couldn't reach ${url}: ${error.message}`, undefined, {
+            cause: error,
+        });
+    }
+    const json = await response.json().catch(() => undefined);
+    if (!response.ok) {
+        const message = json && typeof json === "object" && "error" in json && typeof json.error === "string"
+            ? json.error
+            : response.statusText || "no reason given";
+        throw new SentinelError(`Sentinel check refused (${response.status}): ${message}`, response.status);
+    }
+    const verdict = verdictSchema.safeParse(json);
+    if (!verdict.success)
+        throw new SentinelError(`unexpected answer from ${url}`, response.status, {
+            cause: verdict.error,
+        });
+    return verdict.data;
+}
+function checkLimits(body) {
+    const fail = (what) => {
+        throw new BondedError("SENTINEL_REQUEST_TOO_LARGE", `Sentinel check: ${what}`);
+    };
+    if (body.mandate.length === 0 || body.mandate.length > LIMITS.mandate)
+        fail(`the mandate must be 1 to ${LIMITS.mandate} characters`);
+    const { tool, args } = body.proposedAction;
+    if (tool.length === 0 || tool.length > LIMITS.tool)
+        fail(`the tool name must be 1 to ${LIMITS.tool} characters`);
+    const entries = Object.entries(args);
+    if (entries.length > LIMITS.args)
+        fail(`at most ${LIMITS.args} arguments`);
+    for (const [key, value] of entries)
+        if (key.length > LIMITS.argKey || value.length > LIMITS.argValue)
+            fail(`argument ${key.slice(0, 20)} is too long`);
+    if (body.untrustedInputs.length > LIMITS.inputs)
+        fail(`at most ${LIMITS.inputs} untrusted inputs; send the ones read for this action`);
+    for (const input of body.untrustedInputs)
+        if (input.tool.length === 0 || input.tool.length > LIMITS.tool)
+            fail(`each input's tool name must be 1 to ${LIMITS.tool} characters`);
+}
+//# sourceMappingURL=sentinel.js.map

package/dist/signature.d.ts

@@ -0,0 +1,34 @@
+export declare const SIGNATURE_HEADER = "bonded-signature";
+export declare const TIMESTAMP_HEADER = "bonded-timestamp";
+/** How far a request's timestamp may be from the agent's clock, either way. */
+export declare const SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * Signs a body as Bonded does: the two headers to send with it. For testing your endpoint
+ * locally; Bonded signs real calls itself.
+ */
+export declare function signBondedRequest(secret: string, body: string, timestamp?: number): Promise<{
+    "bonded-timestamp": string;
+    "bonded-signature": string;
+}>;
+export type SignatureCheck = {
+    ok: true;
+    timestamp: number;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Checks a request's signature only: the timestamp is within `toleranceSeconds` of now and one of
+ * the header's `v1=` signatures is the body's HMAC under `secret` (or one of several secrets).
+ * It doesn't look at the body or check for replays; `createBondedHandler` does both.
+ */
+export declare function verifyBondedSignature(input: {
+    secret: string | string[];
+    body: string;
+    timestamp: string | null | undefined;
+    signature: string | null | undefined;
+    /** Unix seconds. Default: now. */
+    now?: number;
+    toleranceSeconds?: number;
+}): Promise<SignatureCheck>;
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.js

@@ -0,0 +1,52 @@
+/**
+ * Agent URL request signatures: how an agent knows a request really comes from Bonded.
+ *
+ * Bonded signs every call to an Agent URL with the agent's secret:
+ * - `bonded-timestamp`: unix seconds;
+ * - `bonded-signature`: `v1=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>` (up to four,
+ *   comma-separated, while a secret is rotated).
+ *
+ * The scheme lives in @bondedhq/shared (`@bondedhq/shared/agent-url`, which the gateway signs with);
+ * these are the SDK's names for it. Web Crypto only, so it runs in Node, Bun, Deno, Cloudflare
+ * Workers and edge runtimes, and the comparison is Web Crypto's constant-time HMAC verify.
+ */
+import { AGENT_URL_SIGNATURE_HEADER, AGENT_URL_TIMESTAMP_HEADER, AGENT_URL_TOLERANCE_SECONDS, signAgentUrlRequest, verifyAgentUrlRequest, } from "@bondedhq/shared/agent-url";
+export const SIGNATURE_HEADER = AGENT_URL_SIGNATURE_HEADER;
+export const TIMESTAMP_HEADER = AGENT_URL_TIMESTAMP_HEADER;
+/** How far a request's timestamp may be from the agent's clock, either way. */
+export const SIGNATURE_TOLERANCE_SECONDS = AGENT_URL_TOLERANCE_SECONDS;
+/**
+ * Signs a body as Bonded does: the two headers to send with it. For testing your endpoint
+ * locally; Bonded signs real calls itself.
+ */
+export async function signBondedRequest(secret, body, timestamp = Math.floor(Date.now() / 1000)) {
+    const headers = await signAgentUrlRequest(secret, body, timestamp * 1000);
+    return {
+        "bonded-timestamp": headers[TIMESTAMP_HEADER],
+        "bonded-signature": headers[SIGNATURE_HEADER],
+    };
+}
+/**
+ * Checks a request's signature only: the timestamp is within `toleranceSeconds` of now and one of
+ * the header's `v1=` signatures is the body's HMAC under `secret` (or one of several secrets).
+ * It doesn't look at the body or check for replays; `createBondedHandler` does both.
+ */
+export async function verifyBondedSignature(input) {
+    const result = await verifyAgentUrlRequest({
+        secret: input.secret,
+        body: input.body,
+        headers: {
+            [TIMESTAMP_HEADER]: input.timestamp ?? undefined,
+            [SIGNATURE_HEADER]: input.signature ?? undefined,
+        },
+        ...(input.now !== undefined ? { nowMs: input.now * 1000 } : {}),
+        ...(input.toleranceSeconds !== undefined ? { toleranceSeconds: input.toleranceSeconds } : {}),
+    });
+    if (result.ok)
+        return { ok: true, timestamp: result.timestamp };
+    // 400 means the signature matched but the body isn't one of Bonded's messages.
+    if (result.status === 400)
+        return { ok: true, timestamp: Number(input.timestamp) };
+    return { ok: false, reason: result.reason };
+}
+//# sourceMappingURL=signature.js.map

package/dist/solana-agent-kit.d.ts

@@ -0,0 +1,141 @@
+import { type BreachEvent, type VaultAccount } from "@bondedhq/solana";
+import { type AddressLookupTableAccount, type Connection, PublicKey, type Transaction, TransactionInstruction, VersionedTransaction } from "@solana/web3.js";
+import type { Action, SolanaAgentKit } from "solana-agent-kit";
+import { BondedError } from "./errors.js";
+/**
+ * Bonded's Solana vault (`bonded_vault`) for Solana Agent Kit. What the program checks (its
+ * `classify`), and so what this plugin can do:
+ *
+ * - The called program must be on the vault's allowlist (T1 target).
+ * - SPL `Transfer`/`TransferChecked` must go to a token account the vault owns (T1 transfer).
+ *   There is no destination allowlist on Solana: any transfer out of the vault is a breach.
+ * - `Approve`, `ApproveChecked`, `SetAuthority` and `CloseAccount` are never allowed.
+ * - The net base-asset outflow of one call must not exceed the vault's limit (T2).
+ * - No T3 (price) check yet, and no 24h limit.
+ *
+ * One instruction per `execute`, called by CPI with the vault as signer, so CPI depth and the
+ * compute budget limit what can run (Jupiter multi-hop routes may not fit).
+ */
+/** A breach the vault recorded (or would record), from its `BreachRecorded` event. */
+export type SolanaVaultBreach = BreachEvent;
+/** What a vault action did. Monitor mode lets breaches through: check `breaches`. */
+export interface SolanaActionResult {
+    signature: string;
+    breaches: SolanaVaultBreach[];
+}
+/** What the vault would do with an instruction, from simulating `execute`. */
+export interface SolanaDryRunResult {
+    /** The vault would run it and record no breach. */
+    ok: boolean;
+    /** Enforce mode would stop it. */
+    blocked: boolean;
+    breach?: SolanaVaultBreach;
+    breaches: SolanaVaultBreach[];
+}
+/** An error from the Solana vault, with the breach when the vault recorded one. */
+export declare class SolanaVaultError extends BondedError {
+    readonly breach?: SolanaVaultBreach | undefined;
+    readonly signature?: string | undefined;
+    readonly name = "SolanaVaultError";
+    constructor(code: string, message: string, breach?: SolanaVaultBreach | undefined, signature?: string | undefined, options?: {
+        cause?: unknown;
+    });
+}
+/** Signs transactions as the vault's agent key. Solana Agent Kit's wallets are this. */
+export interface SolanaSigner {
+    publicKey: PublicKey;
+    signTransaction<T extends Transaction | VersionedTransaction>(transaction: T): Promise<T>;
+}
+/** Builds a swap where the vault owns the tokens, e.g. from Jupiter's swap-instructions API. */
+export type SolanaSwapBuilder = (params: {
+    vault: PublicKey;
+    inputMint: PublicKey;
+    outputMint: PublicKey;
+    /** In `inputMint` base units. */
+    amount: bigint;
+    slippageBps: number;
+}) => Promise<{
+    /** The swap, with the vault as the token authority. It runs inside the vault's `execute`. */
+    instruction: TransactionInstruction;
+    /** Instructions the agent key runs first, outside the vault (e.g. creating token accounts). */
+    setup?: TransactionInstruction[];
+    lookupTables?: AddressLookupTableAccount[];
+}>;
+/** The associated token account of `owner` for `mint` (the vault, a PDA, included). */
+export declare function associatedTokenAddress(owner: PublicKey, mint: PublicKey): PublicKey;
+/**
+ * A Bonded vault on Solana, from the agent's side. Every action is the vault program's
+ * `execute`, signed by the agent key.
+ */
+export declare class SolanaBondedVault {
+    readonly connection: Connection;
+    readonly agent: SolanaSigner;
+    readonly address: PublicKey;
+    constructor(connection: Connection, vault: PublicKey | string, agent: SolanaSigner);
+    status(): Promise<VaultAccount>;
+    /**
+     * Send `amount` (base units) of `mint` from the vault to `to`'s associated token account,
+     * creating it (paid by the agent key) if it doesn't exist. Only a transfer to the vault's own
+     * account keeps to the mandate on Solana.
+     */
+    transfer(params: {
+        mint: PublicKey;
+        to: PublicKey;
+        amount: bigint;
+    }): Promise<SolanaActionResult>;
+    /** Runs `inner` through the vault's `execute`, after any `setup` the agent key runs itself. */
+    execute(inner: TransactionInstruction, setup?: TransactionInstruction[], lookupTables?: AddressLookupTableAccount[]): Promise<SolanaActionResult>;
+    /** What the vault would do with `inner`: simulates `execute` against the cluster's state. */
+    dryRun(inner: TransactionInstruction, setup?: TransactionInstruction[], lookupTables?: AddressLookupTableAccount[]): Promise<SolanaDryRunResult>;
+    /**
+     * The SPL `TransferChecked` the vault would sign for `transfer`, and the account creation the
+     * agent key runs first if needed. Pass both to `dryRun` to preview a transfer.
+     */
+    transferPlan(params: {
+        mint: PublicKey;
+        to: PublicKey;
+        amount: bigint;
+    }): Promise<{
+        instruction: TransactionInstruction;
+        setup: TransactionInstruction[];
+    }>;
+    private build;
+    /** Names the vault program's error when the failure is one, e.g. a frozen vault. */
+    private programError;
+}
+export interface BondedSolanaPluginOptions {
+    /** The vault account (the PDA from `address.vault(guardian, agentId)`). */
+    vault: PublicKey | string;
+    /** Simulate each action first and refuse a predicted breach. Default false: the vault judges. */
+    guard?: boolean;
+    /** Enables `BONDED_VAULT_SWAP`; without it the plugin has no swap. */
+    swap?: SolanaSwapBuilder;
+}
+/**
+ * A Solana Agent Kit plugin whose transfer and swap go through a Bonded vault. The kit's wallet
+ * must be the vault's agent key. Methods (`agent.methods.*`) take base units; actions take whole
+ * units, as an LLM writes them.
+ */
+export declare function bondedVaultPlugin(options: BondedSolanaPluginOptions): {
+    name: string;
+    methods: {
+        /** The vault's account: mode, frozen, allowed programs, limit and breach log. */
+        bondedVaultStatus: (agent: SolanaAgentKit) => Promise<VaultAccount>;
+        bondedVaultTransfer: (agent: SolanaAgentKit, params: {
+            mint: PublicKey;
+            to: PublicKey;
+            amount: bigint;
+        }) => Promise<SolanaActionResult>;
+        bondedVaultSwap: (agent: SolanaAgentKit, params: {
+            inputMint: PublicKey;
+            outputMint: PublicKey;
+            amount: bigint;
+            slippageBps?: number;
+        }) => Promise<SolanaActionResult>;
+        /** Any instruction with the vault as signer, through `execute`. */
+        bondedVaultExecute: (agent: SolanaAgentKit, instruction: TransactionInstruction) => Promise<SolanaActionResult>;
+    };
+    actions: Action[];
+    initialize: () => void;
+};
+//# sourceMappingURL=solana-agent-kit.d.ts.map