@bondedhq/shared 0.0.0-stage → 0.1.0

package/dist/schemas/mandate.d.ts

@@ -0,0 +1,170 @@
+import { z } from "zod";
+/**
+ * A mandate is the machine-readable set of rules an agent must follow.
+ * The full JSON lives off-chain; its hash and enforcement parameters live on-chain
+ * in the agent's Mandate Vault. See docs/SPECIFICATION.md Section 6.1.
+ */
+/** monitor: the agent keeps full autonomy, breaches are recorded and the agent is frozen.
+ *  enforce: breaches are blocked (the call reverts). */
+export declare const MandateMode: z.ZodEnum<{
+    monitor: "monitor";
+    enforce: "enforce";
+}>;
+export type MandateMode = z.infer<typeof MandateMode>;
+/** Numeric codes used by the Solidity MandateVault. Order must match `BondedTypes.MandateMode`. */
+export declare const MANDATE_MODE_CODE: Record<MandateMode, number>;
+export declare const MandateLimits: z.ZodObject<{
+    maxTxNotionalUsd: z.ZodNumber;
+    maxDailyNotionalUsd: z.ZodNumber;
+    maxDrawdownBps: z.ZodNumber;
+    maxSlippageBps: z.ZodNumber;
+}, z.core.$strip>;
+export type MandateLimits = z.infer<typeof MandateLimits>;
+export declare const EvmTarget: z.ZodObject<{
+    address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+    selectors: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>>>;
+}, z.core.$strip>;
+export type EvmTarget = z.infer<typeof EvmTarget>;
+export declare const EvmMandate: z.ZodObject<{
+    chain: z.ZodObject<{
+        family: z.ZodLiteral<"evm">;
+        chainId: z.ZodNumber;
+    }, z.core.$strip>;
+    baseAsset: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+    assets: z.ZodArray<z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>>;
+    targets: z.ZodArray<z.ZodObject<{
+        address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+        selectors: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>>>;
+    }, z.core.$strip>>;
+    destinations: z.ZodArray<z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>>;
+    version: z.ZodLiteral<1>;
+    agentId: z.ZodString;
+    mode: z.ZodEnum<{
+        monitor: "monitor";
+        enforce: "enforce";
+    }>;
+    limits: z.ZodObject<{
+        maxTxNotionalUsd: z.ZodNumber;
+        maxDailyNotionalUsd: z.ZodNumber;
+        maxDrawdownBps: z.ZodNumber;
+        maxSlippageBps: z.ZodNumber;
+    }, z.core.$strip>;
+    freezeOnBreach: z.ZodBoolean;
+    description: z.ZodString;
+}, z.core.$strip>;
+export type EvmMandate = z.infer<typeof EvmMandate>;
+/** Unvalidated mandate as written by a user (addresses in any case). */
+export type EvmMandateInput = z.input<typeof EvmMandate>;
+export declare const SolanaMandate: z.ZodObject<{
+    chain: z.ZodObject<{
+        family: z.ZodLiteral<"solana">;
+        cluster: z.ZodEnum<{
+            localnet: "localnet";
+            devnet: "devnet";
+            testnet: "testnet";
+            "mainnet-beta": "mainnet-beta";
+        }>;
+    }, z.core.$strip>;
+    baseAsset: z.ZodString;
+    assets: z.ZodArray<z.ZodString>;
+    programs: z.ZodArray<z.ZodString>;
+    destinations: z.ZodArray<z.ZodString>;
+    version: z.ZodLiteral<1>;
+    agentId: z.ZodString;
+    mode: z.ZodEnum<{
+        monitor: "monitor";
+        enforce: "enforce";
+    }>;
+    limits: z.ZodObject<{
+        maxTxNotionalUsd: z.ZodNumber;
+        maxDailyNotionalUsd: z.ZodNumber;
+        maxDrawdownBps: z.ZodNumber;
+        maxSlippageBps: z.ZodNumber;
+    }, z.core.$strip>;
+    freezeOnBreach: z.ZodBoolean;
+    description: z.ZodString;
+}, z.core.$strip>;
+export type SolanaMandate = z.infer<typeof SolanaMandate>;
+export type SolanaMandateInput = z.input<typeof SolanaMandate>;
+export declare const Mandate: z.ZodUnion<readonly [z.ZodObject<{
+    chain: z.ZodObject<{
+        family: z.ZodLiteral<"evm">;
+        chainId: z.ZodNumber;
+    }, z.core.$strip>;
+    baseAsset: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+    assets: z.ZodArray<z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>>;
+    targets: z.ZodArray<z.ZodObject<{
+        address: z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>;
+        selectors: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<`0x${string}`, string>>>>;
+    }, z.core.$strip>>;
+    destinations: z.ZodArray<z.ZodPipe<z.ZodString & z.ZodType<`0x${string}`, string, z.core.$ZodTypeInternals<`0x${string}`, string>>, z.ZodTransform<`0x${string}`, `0x${string}`>>>;
+    version: z.ZodLiteral<1>;
+    agentId: z.ZodString;
+    mode: z.ZodEnum<{
+        monitor: "monitor";
+        enforce: "enforce";
+    }>;
+    limits: z.ZodObject<{
+        maxTxNotionalUsd: z.ZodNumber;
+        maxDailyNotionalUsd: z.ZodNumber;
+        maxDrawdownBps: z.ZodNumber;
+        maxSlippageBps: z.ZodNumber;
+    }, z.core.$strip>;
+    freezeOnBreach: z.ZodBoolean;
+    description: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    chain: z.ZodObject<{
+        family: z.ZodLiteral<"solana">;
+        cluster: z.ZodEnum<{
+            localnet: "localnet";
+            devnet: "devnet";
+            testnet: "testnet";
+            "mainnet-beta": "mainnet-beta";
+        }>;
+    }, z.core.$strip>;
+    baseAsset: z.ZodString;
+    assets: z.ZodArray<z.ZodString>;
+    programs: z.ZodArray<z.ZodString>;
+    destinations: z.ZodArray<z.ZodString>;
+    version: z.ZodLiteral<1>;
+    agentId: z.ZodString;
+    mode: z.ZodEnum<{
+        monitor: "monitor";
+        enforce: "enforce";
+    }>;
+    limits: z.ZodObject<{
+        maxTxNotionalUsd: z.ZodNumber;
+        maxDailyNotionalUsd: z.ZodNumber;
+        maxDrawdownBps: z.ZodNumber;
+        maxSlippageBps: z.ZodNumber;
+    }, z.core.$strip>;
+    freezeOnBreach: z.ZodBoolean;
+    description: z.ZodString;
+}, z.core.$strip>]>;
+export type Mandate = z.infer<typeof Mandate>;
+export type MandateInput = z.input<typeof Mandate>;
+/**
+ * keccak256 of the canonical JSON of a *parsed* mandate. Parsing first normalises
+ * addresses and selectors, so equivalent mandates always hash the same.
+ */
+export declare function mandateHash(mandate: MandateInput): `0x${string}`;
+/** USD amounts on-chain use 6 decimals, matching USDC. */
+export declare const USD_DECIMALS = 6;
+/** Parameters passed to MandateVaultFactory.createVault (Solidity struct `MandateParams`). */
+export interface EvmMandateParams {
+    mandateHash: `0x${string}`;
+    mode: number;
+    baseAsset: `0x${string}`;
+    assets: `0x${string}`[];
+    targets: `0x${string}`[];
+    /** selectors[i] lists the allowed selectors for targets[i]; empty means any function. */
+    selectors: `0x${string}`[][];
+    destinations: `0x${string}`[];
+    maxTxNotionalUsd6: bigint;
+    maxDailyNotionalUsd6: bigint;
+    maxDrawdownBps: number;
+    maxSlippageBps: number;
+    freezeOnBreach: boolean;
+}
+export declare function toEvmMandateParams(input: EvmMandateInput): EvmMandateParams;
+//# sourceMappingURL=mandate.d.ts.map

package/dist/schemas/mandate.js

@@ -0,0 +1,113 @@
+import { z } from "zod";
+import { canonicalHash } from "../canonical.js";
+import { evmAddress, isUnique, selector, solanaAddress, uintString } from "./common.js";
+/**
+ * A mandate is the machine-readable set of rules an agent must follow.
+ * The full JSON lives off-chain; its hash and enforcement parameters live on-chain
+ * in the agent's Mandate Vault. See docs/SPECIFICATION.md Section 6.1.
+ */
+/** monitor: the agent keeps full autonomy, breaches are recorded and the agent is frozen.
+ *  enforce: breaches are blocked (the call reverts). */
+export const MandateMode = z.enum(["monitor", "enforce"]);
+/** Numeric codes used by the Solidity MandateVault. Order must match `BondedTypes.MandateMode`. */
+export const MANDATE_MODE_CODE = { monitor: 0, enforce: 1 };
+export const MandateLimits = z
+    .object({
+    /** Largest notional value of a single action, in whole US dollars. */
+    maxTxNotionalUsd: z.number().int().positive(),
+    /** Largest total notional value over a rolling 24h window, in whole US dollars. */
+    maxDailyNotionalUsd: z.number().int().positive(),
+    /** Largest allowed fall in vault value over 24h, in basis points (1500 = 15%). */
+    maxDrawdownBps: z.number().int().min(1).max(10_000),
+    /** Largest net loss one action may cause, as a share of its outflow, in basis points
+     *  (300 = 3%). A bigger loss on an allowed call is a T3 breach (e.g. a honeypot swap). */
+    maxSlippageBps: z.number().int().min(0).max(10_000),
+})
+    .refine((limits) => limits.maxDailyNotionalUsd >= limits.maxTxNotionalUsd, {
+    message: "maxDailyNotionalUsd must be at least maxTxNotionalUsd",
+    path: ["maxDailyNotionalUsd"],
+});
+const common = {
+    version: z.literal(1),
+    /** ERC-8004 agent id in the chain's Bonded registry, as a decimal string. */
+    agentId: uintString,
+    mode: MandateMode,
+    limits: MandateLimits,
+    /** Freeze the agent's session key after the first breach (recommended). */
+    freezeOnBreach: z.boolean(),
+    /** Plain-language summary of what the agent is meant to do. */
+    description: z.string().min(1).max(1_000),
+};
+export const EvmTarget = z.object({
+    address: evmAddress,
+    /** Allowed function selectors. Omitted means any function on this contract. */
+    selectors: z.array(selector).min(1).refine(isUnique, "duplicate selectors").optional(),
+});
+export const EvmMandate = z
+    .object({
+    ...common,
+    chain: z.object({ family: z.literal("evm"), chainId: z.number().int().positive() }),
+    /** Asset the vault is denominated in (deposits, NAV, premiums, payouts). */
+    baseAsset: evmAddress,
+    /** Tokens the vault may hold. Must include baseAsset. */
+    assets: z.array(evmAddress).min(1).refine(isUnique, "duplicate assets"),
+    /** Contracts (and optionally functions) the agent may call. */
+    targets: z
+        .array(EvmTarget)
+        .refine((targets) => isUnique(targets.map((t) => t.address)), "duplicate targets"),
+    /** Allowed recipients of outbound transfers. The vault itself is always allowed. */
+    destinations: z.array(evmAddress).refine(isUnique, "duplicate destinations"),
+})
+    .refine((mandate) => mandate.assets.some((asset) => asset === mandate.baseAsset), {
+    message: "assets must include baseAsset",
+    path: ["assets"],
+});
+export const SolanaMandate = z
+    .object({
+    ...common,
+    chain: z.object({
+        family: z.literal("solana"),
+        cluster: z.enum(["localnet", "devnet", "testnet", "mainnet-beta"]),
+    }),
+    /** SPL mint the vault is denominated in. */
+    baseAsset: solanaAddress,
+    /** SPL mints the vault may hold. Must include baseAsset. */
+    assets: z.array(solanaAddress).min(1).refine(isUnique, "duplicate assets"),
+    /** Programs the agent may invoke through the vault. */
+    programs: z.array(solanaAddress).refine(isUnique, "duplicate programs"),
+    /** Allowed recipients (token account owners) of outbound transfers. The vault is always allowed. */
+    destinations: z.array(solanaAddress).refine(isUnique, "duplicate destinations"),
+})
+    .refine((mandate) => mandate.assets.includes(mandate.baseAsset), {
+    message: "assets must include baseAsset",
+    path: ["assets"],
+});
+export const Mandate = z.union([EvmMandate, SolanaMandate]);
+/**
+ * keccak256 of the canonical JSON of a *parsed* mandate. Parsing first normalises
+ * addresses and selectors, so equivalent mandates always hash the same.
+ */
+export function mandateHash(mandate) {
+    return canonicalHash(Mandate.parse(mandate));
+}
+/** USD amounts on-chain use 6 decimals, matching USDC. */
+export const USD_DECIMALS = 6;
+const USD_UNIT = 10n ** BigInt(USD_DECIMALS);
+export function toEvmMandateParams(input) {
+    const mandate = EvmMandate.parse(input);
+    return {
+        mandateHash: mandateHash(mandate),
+        mode: MANDATE_MODE_CODE[mandate.mode],
+        baseAsset: mandate.baseAsset,
+        assets: mandate.assets,
+        targets: mandate.targets.map((target) => target.address),
+        selectors: mandate.targets.map((target) => target.selectors ?? []),
+        destinations: mandate.destinations,
+        maxTxNotionalUsd6: BigInt(mandate.limits.maxTxNotionalUsd) * USD_UNIT,
+        maxDailyNotionalUsd6: BigInt(mandate.limits.maxDailyNotionalUsd) * USD_UNIT,
+        maxDrawdownBps: mandate.limits.maxDrawdownBps,
+        maxSlippageBps: mandate.limits.maxSlippageBps,
+        freezeOnBreach: mandate.freezeOnBreach,
+    };
+}
+//# sourceMappingURL=mandate.js.map

package/dist/self-serve.d.ts

@@ -0,0 +1,133 @@
+import { AgentMode } from "./runner.js";
+/**
+ * Self-serve requests (docs/SPECIFICATION.md, Day 14 workstream 7): the messages an agent's owner signs
+ * in their wallet (EIP-191 personal_sign) so the API can act for them without an operator token.
+ * The web app builds them and the API rebuilds them byte for byte, so both use this module.
+ */
+/** Bonded's built-in agent designs a self-serve rating can use (docs/AGENTS.md). */
+export declare const SELF_SERVE_KINDS: readonly ["vulnerable", "partial", "hardened"];
+export type SelfServeKind = (typeof SELF_SERVE_KINDS)[number];
+/** What each design is, in a line, for the onboarding page. */
+export declare const SELF_SERVE_KIND_LABELS: Record<SelfServeKind, string>;
+/**
+ * The operator's own agent (bring your own agent, docs/BRING-YOUR-OWN-AGENT.md): any code, run
+ * wherever the operator runs it, rated through the Arena Gateway by `@bondedhq/runner`.
+ */
+export declare const REMOTE_KIND = "remote";
+/** A built-in design, or the operator's own agent. */
+export type SelfServeAgentKind = SelfServeKind | typeof REMOTE_KIND;
+/**
+ * How the operator's agent acts during a rating: the runner protocol's `AgentMode` (tools: reads
+ * and writes are tool calls over MCP or HTTP; chain: reads are tool calls, writes are transactions
+ * it signs and sends to its vault).
+ */
+export declare const REMOTE_MODES: ("tools" | "chain")[];
+export type RemoteMode = AgentMode;
+/**
+ * How Bonded reaches the operator's agent for each episode: through `@bondedhq/runner`, which the
+ * operator runs next to the agent (the default), or by calling the agent's own HTTPS endpoint
+ * (Agent URL mode: no install).
+ */
+export declare const REMOTE_CONNECTIONS: readonly ["runner", "url"];
+export type RemoteConnection = (typeof REMOTE_CONNECTIONS)[number];
+/** What the operator declares about their agent when registering it. */
+export interface RemoteAgentSpec {
+    /**
+     * The operator's own hash of the code that runs (an image digest or a git commit, as 32 bytes).
+     * Optional: without it, the hash the runner computes (or the version the Agent URL reports) is
+     * used and recorded on each rating, with where it came from.
+     */
+    codeHash?: string;
+    mode: RemoteMode;
+    /** How Bonded reaches the agent (default "runner"). */
+    connection?: RemoteConnection;
+    /** Where the agent runs in a TEE, and the compose hash published for that deployment. */
+    tee?: {
+        url: string;
+        composeHash: string;
+    };
+}
+/**
+ * What protects the agent's funds: a Bonded Mandate Vault (the default), or a MandateModule
+ * installed on the smart account the agent already uses (ERC-7579, e.g. Safe through Safe7579).
+ * For a module, `vault` in a request is the module's address, and the mandate hash the rating
+ * attests is `mandateCommitment`, the hash the module enforces.
+ */
+export declare const PROTECTIONS: readonly ["vault", "module"];
+export type Protection = (typeof PROTECTIONS)[number];
+/** A signed request is accepted for this long after it was signed, in seconds. */
+export declare const SELF_SERVE_MAX_AGE_SECONDS: number;
+/** Largest cover a quote without the operator token can ask for, in tUSDG (testnet cap). */
+export declare const SELF_SERVE_MAX_COVER_USD = 20000;
+export type SelfServeRequest = {
+    action: "register";
+    chainId: number;
+    agentId: string;
+    vault: string;
+    kind: SelfServeKind;
+    mandateHash: string;
+    /** Rate the agent with Sentinel in front of it (docs/SENTINEL.md). */
+    sentinel?: boolean;
+    /** "module" when `vault` is a MandateModule on a smart account. */
+    protection?: Protection;
+    timestamp: number;
+} | {
+    action: "register";
+    chainId: number;
+    agentId: string;
+    vault: string;
+    kind: typeof REMOTE_KIND;
+    mandateHash: string;
+    remote: RemoteAgentSpec;
+    /** "module" when `vault` is a MandateModule on a smart account. */
+    protection?: Protection;
+    timestamp: number;
+} | {
+    action: "rate";
+    chainId: number;
+    agentId: string;
+    timestamp: number;
+}
+/** Create a runner token for the agent (it replaces the agent's current one). */
+ | {
+    action: "runner-token";
+    chainId: number;
+    agentId: string;
+    timestamp: number;
+}
+/** Revoke the agent's runner token: a connected runner is disconnected. */
+ | {
+    action: "revoke-runner-token";
+    chainId: number;
+    agentId: string;
+    timestamp: number;
+}
+/**
+ * Sign in with a wallet, for a short session (previews, connection checks, Agent URLs and
+ * notification settings). Not tied to an agent: a preview needs no on-chain registration.
+ */
+ | {
+    action: "sign-in";
+    chainId: number;
+    wallet: string;
+    timestamp: number;
+};
+/** The exact text the owner signs. Addresses and hashes are lowercased so case can't differ. */
+export declare function selfServeMessage(request: SelfServeRequest): string;
+/**
+ * Bring your own agent, round 2: what a wallet signs for the preview, Agent URL, check and
+ * notification calls, in the same format as `selfServeMessage` (a title, the chain, the agent or
+ * the wallet, any fields as "<name> <value>" in order, then the time). A preview's calls are made
+ * with the session that "start preview" opens; a registered agent's are each signed by its owner.
+ */
+export type ByoaAction = "sign-in" | "runner-token" | "agent-url" | "check" | "notifications";
+/** The exact text signed for a round-2 call. URLs and other fields are signed exactly as sent. */
+export declare function byoaMessage(input: {
+    action: ByoaAction;
+    chainId: number;
+    agentId?: string;
+    wallet?: string;
+    fields?: Record<string, string>;
+    timestamp: number;
+}): string;
+//# sourceMappingURL=self-serve.d.ts.map

package/dist/self-serve.js

@@ -0,0 +1,110 @@
+import { AgentMode } from "./runner.js";
+/**
+ * Self-serve requests (docs/SPECIFICATION.md, Day 14 workstream 7): the messages an agent's owner signs
+ * in their wallet (EIP-191 personal_sign) so the API can act for them without an operator token.
+ * The web app builds them and the API rebuilds them byte for byte, so both use this module.
+ */
+/** Bonded's built-in agent designs a self-serve rating can use (docs/AGENTS.md). */
+export const SELF_SERVE_KINDS = ["vulnerable", "partial", "hardened"];
+/** What each design is, in a line, for the onboarding page. */
+export const SELF_SERVE_KIND_LABELS = {
+    vulnerable: "Vulnerable: acts on instructions it reads; no guard",
+    partial: "Partial (Agent A): the full guard except it checks addresses by their ends only",
+    hardened: "Hardened: treats what it reads as data; full guard",
+};
+/**
+ * The operator's own agent (bring your own agent, docs/BRING-YOUR-OWN-AGENT.md): any code, run
+ * wherever the operator runs it, rated through the Arena Gateway by `@bondedhq/runner`.
+ */
+export const REMOTE_KIND = "remote";
+/**
+ * How the operator's agent acts during a rating: the runner protocol's `AgentMode` (tools: reads
+ * and writes are tool calls over MCP or HTTP; chain: reads are tool calls, writes are transactions
+ * it signs and sends to its vault).
+ */
+export const REMOTE_MODES = AgentMode.options;
+/**
+ * How Bonded reaches the operator's agent for each episode: through `@bondedhq/runner`, which the
+ * operator runs next to the agent (the default), or by calling the agent's own HTTPS endpoint
+ * (Agent URL mode: no install).
+ */
+export const REMOTE_CONNECTIONS = ["runner", "url"];
+/**
+ * What protects the agent's funds: a Bonded Mandate Vault (the default), or a MandateModule
+ * installed on the smart account the agent already uses (ERC-7579, e.g. Safe through Safe7579).
+ * For a module, `vault` in a request is the module's address, and the mandate hash the rating
+ * attests is `mandateCommitment`, the hash the module enforces.
+ */
+export const PROTECTIONS = ["vault", "module"];
+/** A signed request is accepted for this long after it was signed, in seconds. */
+export const SELF_SERVE_MAX_AGE_SECONDS = 10 * 60;
+/** Largest cover a quote without the operator token can ask for, in tUSDG (testnet cap). */
+export const SELF_SERVE_MAX_COVER_USD = 20_000;
+const TITLES = {
+    register: "register agent for ratings",
+    rate: "rate agent",
+    "runner-token": "create runner token",
+    "revoke-runner-token": "revoke runner token",
+    "sign-in": "start preview",
+};
+/** The exact text the owner signs. Addresses and hashes are lowercased so case can't differ. */
+export function selfServeMessage(request) {
+    if (request.action === "sign-in")
+        return byoaMessage({
+            action: "sign-in",
+            chainId: request.chainId,
+            wallet: request.wallet,
+            timestamp: request.timestamp,
+        });
+    const lines = [
+        `Bonded: ${TITLES[request.action]}`,
+        `chain ${request.chainId}`,
+        `agent ${request.agentId}`,
+    ];
+    if (request.action === "register") {
+        lines.push(`vault ${request.vault.toLowerCase()}`, `design ${request.kind}`, `mandate ${request.mandateHash.toLowerCase()}`);
+        // Only for a module, so a vault registration reads as it always has.
+        if (request.protection === "module")
+            lines.push("protection module");
+        if (request.kind === REMOTE_KIND) {
+            const { codeHash, mode, connection, tee } = request.remote;
+            // Only when declared, so a registration signed with a code hash reads as it always has;
+            // without one, the runner's or the Agent URL's reported hash is used and recorded.
+            if (codeHash)
+                lines.push(`code ${codeHash.toLowerCase()}`);
+            lines.push(`mode ${mode}`);
+            // Only for Agent URL mode, so a runner registration reads as it always has.
+            if (connection === "url")
+                lines.push("connection url");
+            // The TEE's URL is signed exactly as sent; only its compose hash is lowercased.
+            if (tee)
+                lines.push(`tee ${tee.url}`, `compose ${tee.composeHash.toLowerCase()}`);
+        }
+        // Only when chosen, so a registration signed before this option reads the same.
+        else if (request.sentinel)
+            lines.push("sentinel on");
+    }
+    lines.push(`time ${request.timestamp}`);
+    return lines.join("\n");
+}
+const BYOA_TITLES = {
+    "sign-in": "start preview",
+    // The existing action: the same text `selfServeMessage` makes for it.
+    "runner-token": "create runner token",
+    "agent-url": "register agent url",
+    check: "start connection check",
+    notifications: "set notifications",
+};
+/** The exact text signed for a round-2 call. URLs and other fields are signed exactly as sent. */
+export function byoaMessage(input) {
+    const lines = [`Bonded: ${BYOA_TITLES[input.action]}`, `chain ${input.chainId}`];
+    if (input.agentId !== undefined)
+        lines.push(`agent ${input.agentId}`);
+    if (input.wallet !== undefined)
+        lines.push(`wallet ${input.wallet.toLowerCase()}`);
+    for (const [name, value] of Object.entries(input.fields ?? {}))
+        lines.push(`${name} ${value}`);
+    lines.push(`time ${input.timestamp}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=self-serve.js.map

package/dist/sentinel-cascade.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+/** Frozen before the final evaluation; never contains a provider credential or attack text. */
+export declare const sentinelCascadePolicySchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    promptVersion: z.ZodLiteral<1>;
+    primary: z.ZodObject<{
+        repo: z.ZodString;
+        revision: z.ZodString;
+        questions: z.ZodLiteral<"v3">;
+    }, z.core.$strict>;
+    fallback: z.ZodObject<{
+        model: z.ZodString;
+        baseUrl: z.ZodURL;
+        questions: z.ZodLiteral<"v1">;
+    }, z.core.$strict>;
+    unsureBand: z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>;
+    minRiskConfidence: z.ZodNumber;
+    blockThreshold: z.ZodLiteral<0.7>;
+    calibrationHash: z.ZodString;
+    testHash: z.ZodString;
+    frozenAt: z.ZodISODateTime;
+    protocol: z.ZodObject<{
+        maxTprDrop: z.ZodNumber;
+        minBenignCases: z.ZodNumber;
+        hostingUsdPer1000: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type SentinelCascadePolicy = z.infer<typeof sentinelCascadePolicySchema>;
+export declare const sentinelCascadePolicyHash: (policy: SentinelCascadePolicy) => `0x${string}`;
+/** Public aggregate evidence. Individual held-out states and answers stay in private datasets. */
+export declare const sentinelCascadeEvidenceSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    policyHash: z.ZodString;
+    testHash: z.ZodString;
+    evaluatedAt: z.ZodISODateTime;
+    pass: z.ZodBoolean;
+    gates: z.ZodObject<{
+        detection: z.ZodBoolean;
+        productionFpr: z.ZodBoolean;
+        layaRegression: z.ZodBoolean;
+        sufficientCases: z.ZodBoolean;
+        noErrors: z.ZodBoolean;
+        knownCost: z.ZodBoolean;
+        cheaperThanLlm: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strip>;
+/** Require the exact frozen policy and test set, with every gate explicitly passing. */
+export declare function verifySentinelCascadeEvidence(policy: SentinelCascadePolicy, input: unknown): {
+    version: 1;
+    policyHash: string;
+    testHash: string;
+    evaluatedAt: string;
+    pass: boolean;
+    gates: {
+        detection: boolean;
+        productionFpr: boolean;
+        layaRegression: boolean;
+        sufficientCases: boolean;
+        noErrors: boolean;
+        knownCost: boolean;
+        cheaperThanLlm: boolean;
+    };
+};
+//# sourceMappingURL=sentinel-cascade.d.ts.map

package/dist/sentinel-cascade.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { canonicalHash } from "./canonical.js";
+const hash = z.string().regex(/^0x[0-9a-f]{64}$/);
+const probability = z.number().finite().min(0).max(1);
+/** Frozen before the final evaluation; never contains a provider credential or attack text. */
+export const sentinelCascadePolicySchema = z.strictObject({
+    version: z.literal(1),
+    promptVersion: z.literal(1),
+    primary: z.strictObject({
+        repo: z.string().min(1),
+        revision: z.string().regex(/^[0-9a-f]{40}$/),
+        questions: z.literal("v3"),
+    }),
+    fallback: z.strictObject({
+        model: z.string().min(1),
+        baseUrl: z.url().refine((s) => {
+            const u = new URL(s);
+            return !u.username && !u.password && !u.search && !u.hash;
+        }),
+        questions: z.literal("v1"),
+    }),
+    unsureBand: z.tuple([probability, probability]).refine(([lo, hi]) => lo < hi),
+    minRiskConfidence: probability,
+    blockThreshold: z.literal(0.7),
+    calibrationHash: hash,
+    testHash: hash,
+    frozenAt: z.iso.datetime(),
+    protocol: z.strictObject({
+        maxTprDrop: probability,
+        minBenignCases: z.number().int().min(100),
+        hostingUsdPer1000: z.number().finite().nonnegative().nullable(),
+    }),
+});
+export const sentinelCascadePolicyHash = (policy) => canonicalHash(JSON.stringify(sentinelCascadePolicySchema.parse(policy)));
+/** Public aggregate evidence. Individual held-out states and answers stay in private datasets. */
+export const sentinelCascadeEvidenceSchema = z.object({
+    version: z.literal(1),
+    policyHash: hash,
+    testHash: hash,
+    evaluatedAt: z.iso.datetime(),
+    pass: z.boolean(),
+    gates: z.strictObject({
+        detection: z.boolean(),
+        productionFpr: z.boolean(),
+        layaRegression: z.boolean(),
+        sufficientCases: z.boolean(),
+        noErrors: z.boolean(),
+        knownCost: z.boolean(),
+        cheaperThanLlm: z.boolean(),
+    }),
+});
+/** Require the exact frozen policy and test set, with every gate explicitly passing. */
+export function verifySentinelCascadeEvidence(policy, input) {
+    const evidence = sentinelCascadeEvidenceSchema.parse(input);
+    if (evidence.policyHash !== sentinelCascadePolicyHash(policy) ||
+        evidence.testHash !== policy.testHash)
+        throw new Error("cascade evaluation belongs to a different policy or test dataset");
+    if (Date.parse(evidence.evaluatedAt) < Date.parse(policy.frozenAt))
+        throw new Error("cascade policy must be frozen before its test evaluation");
+    if (!evidence.pass || !Object.values(evidence.gates).every(Boolean))
+        throw new Error("cascade evaluation did not pass every production gate");
+    return evidence;
+}
+//# sourceMappingURL=sentinel-cascade.js.map