chore(deps): update solana requirement from <0.40,>=0.36.0 to >=0.36.0,<0.41

.env.example

@@ -1,8 +1,8 @@
-# BridgeNode SDK (.env template) — copy to .env (NEVER commit to git)
+# BridgeNode SDK (.env template) — copy to .env (NEVER commit to git, §8.3)
 
-# REQUIRED — agent's Solana wallet private key (base58) for payments.
-# The SDK uses BRIDGENODE_WALLET_KEY (agent's wallet); do not mix it up
-# with the server-side BRIDGENODE_WALLET_PRIVATE.
+# REQUIRED — agent's Solana wallet private key (base58) for payments (§8.4:
+# the SDK uses BRIDGENODE_WALLET_KEY — agent's wallet; the server uses another,
+# BRIDGENODE_WALLET_PRIVATE — do not mix them up)
 BRIDGENODE_WALLET_KEY=
 
 # Optional:

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install deps
+        run: pip install -e .[dev]
+      - name: Run tests
+        run: pytest tests/ -q

AGENTS.md

@@ -0,0 +1,33 @@
+# AGENTS.md
+
+BridgeNode Python SDK (`bridgenode-llm`). AI inference for AI agents — no API keys, pay per request with Solana USDC via x402.
+
+## Commands
+
+- `pip install -e .` — install in editable mode
+- `pip install -e ".[dev]"` — install with dev deps (pytest)
+- `pytest` — run tests
+- `python -m build` — build sdist + wheel
+
+## Structure
+
+- `bridgenode_llm/` — source (entry: `bridgenode_llm/__init__.py`)
+- `tests/` — tests
+- `dist/` — build output (GENERATED — never edit by hand)
+- `pyproject.toml` — package metadata (name, version, keywords, license)
+
+## Conventions
+
+- Python ≥3.11; type hints throughout
+- Follow existing patterns in `bridgenode_llm/client.py`
+- Keep public exports in `bridgenode_llm/__init__.py` — it's the package API surface
+
+## Rules
+
+- ✅ Always: run `pytest` before committing
+- ✅ Add tests for new behavior in `tests/`
+- ✅ Version bumps live in BOTH `pyproject.toml` AND `bridgenode_llm/__init__.py`
+- 🚫 Never: commit `.env` or any secrets (wallet keys!)
+- 🚫 Never: edit files in `dist/` (regenerated by build)
+- 🚫 Never: hardcode API keys or URLs in code — use `.env`
+- 🚫 License is MIT-0 (MIT No Attribution) — never change it

README.md

@@ -4,6 +4,8 @@
 [![Downloads](https://img.shields.io/pypi/dm/bridgenode-llm.svg)](https://pypi.org/project/bridgenode-llm/)
 [![License: MIT-0](https://img.shields.io/badge/License-MIT--0-yellow.svg)](https://opensource.org/license/mit-0/)
 [![Python versions](https://img.shields.io/pypi/pyversions/bridgenode-llm.svg)](https://pypi.org/project/bridgenode-llm/)
+[![CI](https://img.shields.io/github/actions/workflow/status/bridgenode-ai/bridgenode-sdk-python/ci.yml)](https://github.com/bridgenode-ai/bridgenode-sdk-python/actions)
+[![BridgeNode on x402-list](https://x402-list.com/badge/bridgenode.svg)](https://x402-list.com/services/bridgenode?utm_source=badge&utm_medium=referral&utm_campaign=embed)
 
 BridgeNode Python SDK — AI inference for AI agents, no API keys. Pay per request with **Solana USDC via x402**. The payment handshake is fully automatic, and fees are sponsored — the agent needs no SOL.
 
@@ -17,6 +19,18 @@ BridgeNode Python SDK — AI inference for AI agents, no API keys. Pay per reque
 - **Smart routing** — `mode: auto / eco / premium` (model selection per prompt complexity)
 - **MCP support** — BridgeNode is also available as an MCP server
 
+## BridgeNode vs traditional APIs
+
+| | BridgeNode | Traditional AI APIs |
+|---|---|---|
+| Sign-up | None | Account + verification |
+| API key | Not needed | Required (leak risk) |
+| Billing | Pay-per-request (USDC) | Subscription / prepaid credits |
+| Setup | Wallet only | SDK + key + quotas |
+| Fees | Gas sponsored | Network fees on you |
+| Spending control | Fail-closed caps | Account-level limits |
+| Identity | Wallet signature (SIWX) | API key |
+
 ## Installation
 
 ```bash
@@ -72,6 +86,31 @@ BRIDGENODE_WALLET_KEY=...
 - Python ≥ 3.11
 - A Solana wallet with a USDC token account (ATA)
 
+## FAQ
+
+**Do agents need SOL?** No — fees are sponsored. The agent pays only the USDC request amount.
+
+**Is there an API key?** No. Your wallet signature is the identity (SIWX); payment is the access.
+
+**What happens if the spending cap is exceeded?** The request is blocked before signing — fail-closed, no payment is made.
+
+**Which models are available?** See https://bridgenode.cc/v1/models (live list with prices).
+
+**How is the payment receipt verified?** Every response includes a receipt; the SDK verifies its signature, network, payer and amount — invalid receipts raise `BridgenodeError`.
+
+**Can I use this in CI / headless agents?** Yes — no browser, no keys, just a wallet private key in env.
+
+## Related packages
+
+The BridgeNode toolkit on PyPI:
+
+- `bridgenode-llm` — Python SDK (this package): https://pypi.org/project/bridgenode-llm
+- `bridgenode-cli` — command-line interface: https://pypi.org/project/bridgenode-cli
+- `bridgenode` — full toolkit (SDK + CLI): https://pypi.org/project/bridgenode
+- `bridgenode-sdk` — SDK alias package: https://pypi.org/project/bridgenode-sdk
+- `bridgenode-mcp` — MCP server package: https://pypi.org/project/bridgenode-mcp
+- `bridgenode-skill` — agent skill package: https://pypi.org/project/bridgenode-skill
+
 ## Links
 
 - Website: https://bridgenode.cc

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+BridgeNode is an agent-to-agent (A2A) platform. If you discover a security vulnerability, please report it privately:
+
+- **Email:** eli.BNx@proton.me
+
+Please do **not** open a public issue for security vulnerabilities.
+
+## Supported Versions
+
+| Version | Supported |
+|---|---|
+| latest | ✅ |
+
+## Security Practices
+
+- No API keys or registration required — payments via x402 (HTTP 402) with Solana USDC
+- Wallet keys live only in `.env` — never committed
+- Dependencies are audited regularly (pip-audit / npm audit)
+- License: MIT-0 (MIT No Attribution)

bridgenode_llm/__init__.py

@@ -1,11 +1,11 @@
-"""bridgenode_llm — BridgeNode Python SDK (, ).
+"""bridgenode_llm — BridgeNode Python SDK (§8.4, fix.md 4.2).
 
 LLMClient: automatic x402 V2 handshake (402 → partial TX → PAYMENT-SIGNATURE
 → 200). Key from `.env` (`BRIDGENODE_WALLET_KEY`) — no arguments, no
-interactive prompts ().
+interactive prompts (§8.4).
 """
 
 from .client import BRIDGENODE_BASE_URL, BridgenodeError, LLMClient
 
 __all__ = ["LLMClient", "BridgenodeError", "BRIDGENODE_BASE_URL"]
-__version__ = "0.2.7"
+__version__ = "0.2.16"