@dstoken-solana/rwa-rbac 0.3.0 → 0.4.0

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { PublicKey, SystemProgram } from '@solana/web3.js';
 import { utils, Program, BN } from '@coral-xyz/anchor';
 import { TOKEN_2022_PROGRAM_ID, getAssociatedTokenAddressSync, ASSOCIATED_TOKEN_PROGRAM_ID } from '@solana/spl-token';
-import { getCreateAssetControllerIx, getAssetControllerPda, assetControllerProgramId, getAssetControllerEventAuthority, getIdentityRegistryPda, getIssueTokensIx, getTrackerAccountPda, getPolicyEnginePda, policyEngineProgramId, getIdentityAccountPda, getWalletIdentityAccountPda, getFreezeTokenIx, getThawTokenIx, getRevokeTokensIx, getCloseMintIx, getUpdateInterestBearingMintRateIx, getSeizeTokensIx, identityRegistryProgramId, getExtraMetasListPda, getPolicyEngineEventAuthority, getIdentityRegistryEventAuthority, getIdentityAccount, getIdentityRegistryProgram, getPolicyEngineProgram, RwaClient } from '@dstoken-solana/rwa-token-sdk';
+import { getCreateAssetControllerIx, getAssetControllerPda, assetControllerProgramId, getAssetControllerEventAuthority, getIdentityRegistryPda, getIssueTokensIx, getTrackerAccountPda, getPolicyEnginePda, policyEngineProgramId, getIdentityAccountPda, getWalletIdentityAccountPda, getFreezeTokenIx, getThawTokenIx, getRevokeTokensIx, getUpdateInterestBearingMintRateIx, getSeizeTokensIx, identityRegistryProgramId, getExtraMetasListPda, getPolicyEngineEventAuthority, getIdentityRegistryEventAuthority, getIdentityAccount, getIdentityRegistryProgram, RwaClient } from '@dstoken-solana/rwa-token-sdk';
 
 const IMR_PROGRAM = new PublicKey("D2V7wTBbNCKgYwirgRUnSmc2QyKnHSVmRotWJ4rz8Jp9");
 const RBAC_PROGRAM = new PublicKey("3g6fUgMsJQhjPUYxNjEU5PyzGf8DerbDx8p5Qh4yMnRR");
@@ -86,8 +86,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -174,8 +173,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -237,6 +235,7 @@ var instructions$1 = [
 			},
 			{
 				name: "asset_access_controller",
+				writable: true,
 				relations: [
 					"user_role",
 					"authorized_user_role"
@@ -331,8 +330,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -392,8 +390,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -463,8 +460,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -524,8 +520,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -585,8 +580,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -666,8 +660,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -723,8 +716,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -745,63 +737,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "close_mint_account",
-		discriminator: [
-			14,
-			121,
-			72,
-			246,
-			96,
-			224,
-			42,
-			162
-		],
-		accounts: [
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				writable: true,
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "asset_controller_program",
-				address: "7tXjmbkZVY3Gmg9kDBebcNXT1yC5pyoxxXVLwdbv9tvP"
-			},
-			{
-				name: "asset_mint",
-				writable: true
-			},
-			{
-				name: "asset_controller"
-			},
-			{
-				name: "token_program",
-				address: "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "create_controller",
 		discriminator: [
@@ -830,8 +765,8 @@ var instructions$1 = [
 				pda: {
 					seeds: [
 						{
-							kind: "arg",
-							path: "unique_seed"
+							kind: "account",
+							path: "asset_mint"
 						},
 						{
 							kind: "const",
@@ -862,6 +797,53 @@ var instructions$1 = [
 					]
 				}
 			},
+			{
+				name: "asset_access_controller_authority",
+				pda: {
+					seeds: [
+						{
+							kind: "account",
+							path: "asset_access_controller"
+						}
+					]
+				}
+			},
+			{
+				name: "asset_controller",
+				writable: true
+			},
+			{
+				name: "asset_mint",
+				writable: true,
+				signer: true
+			},
+			{
+				name: "extra_metas_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_account",
+				writable: true
+			},
+			{
+				name: "identity_registry_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "identity_registry_program"
+			},
+			{
+				name: "asset_controller_program"
+			},
+			{
+				name: "asset_controller_event_authority"
+			},
+			{
+				name: "token_program"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -869,8 +851,8 @@ var instructions$1 = [
 		],
 		args: [
 			{
-				name: "unique_seed",
-				type: "pubkey"
+				name: "cpi_data",
+				type: "bytes"
 			}
 		]
 	},
@@ -909,8 +891,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -927,6 +908,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -996,6 +987,10 @@ var instructions$1 = [
 			{
 				name: "allowed_medici_ixs",
 				type: "u64"
+			},
+			{
+				name: "is_master_role",
+				type: "bool"
 			}
 		]
 	},
@@ -1074,8 +1069,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1136,8 +1130,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1201,8 +1194,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1267,8 +1259,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1416,8 +1407,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1442,6 +1432,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority_identity_metadata_registry"
 			},
@@ -1495,8 +1495,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1518,6 +1517,16 @@ var instructions$1 = [
 			},
 			{
 				name: "identity_owner"
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
@@ -1562,8 +1571,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1601,6 +1609,9 @@ var instructions$1 = [
 			},
 			{
 				name: "event_authority_identity_registry"
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
@@ -1641,8 +1652,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1726,8 +1736,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1870,8 +1879,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1962,8 +1970,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2033,8 +2040,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2120,8 +2126,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2190,8 +2195,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2285,8 +2289,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2453,6 +2456,31 @@ var errors$1 = [
 		code: 6007,
 		name: "IllegalOperation",
 		msg: "Illegal operation"
+	},
+	{
+		code: 6008,
+		name: "InvalidFlags",
+		msg: "Invalid flag bits"
+	},
+	{
+		code: 6009,
+		name: "CannotEmptyMasterRole",
+		msg: "Cannot empty master role of users"
+	},
+	{
+		code: 6010,
+		name: "CannotVoidAuthority",
+		msg: "Cannot void authority"
+	},
+	{
+		code: 6011,
+		name: "InvalidMasterRole",
+		msg: "Invalid master role"
+	},
+	{
+		code: 6012,
+		name: "CannotDeleteMasterRole",
+		msg: "Cannot delete master role"
 	}
 ];
 var types$1 = [
@@ -2483,9 +2511,9 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "unique_seed",
+					name: "asset_mint",
 					docs: [
-						"Unique seed used for creating this account."
+						"Asset mint that is going to be managed by this controller."
 					],
 					type: "pubkey"
 				},
@@ -2496,6 +2524,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "has_master_role",
+					docs: [
+						"Whether a master role exists."
+					],
+					type: "bool"
+				},
 				{
 					name: "lut_address",
 					docs: [
@@ -2530,7 +2565,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2560,7 +2595,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2606,6 +2641,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "is_master_role",
+					docs: [
+						"If true, this is the master role."
+					],
+					type: "bool"
+				},
 				{
 					name: "users",
 					docs: [
@@ -2969,6 +3011,16 @@ var instructions = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -3091,6 +3143,9 @@ var instructions = [
 			{
 				name: "event_authority_identity_registry"
 			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority",
 				pda: {
@@ -3545,33 +3600,32 @@ var MediciFlags;
     MediciFlags[MediciFlags["FREEZE_TOKEN_ACCOUNT"] = 4] = "FREEZE_TOKEN_ACCOUNT";
     MediciFlags[MediciFlags["ISSUE_TOKENS"] = 8] = "ISSUE_TOKENS";
     MediciFlags[MediciFlags["REVOKE_TOKENS"] = 16] = "REVOKE_TOKENS";
-    MediciFlags[MediciFlags["CLOSE_MINT_ACCOUNT"] = 32] = "CLOSE_MINT_ACCOUNT";
-    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 64] = "UPDATE_INTEREST_BEARING_MINT_RATE";
-    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 128] = "ATTACH_TO_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 256] = "CREATE_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 512] = "DETACH_FROM_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["ADD_LEVELS"] = 1024] = "ADD_LEVELS";
-    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 2048] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 4096] = "REGISTER_INVESTOR";
-    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 8192] = "REMOVE_LEVELS";
-    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 16384] = "REMOVE_INVESTOR";
-    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 32768] = "EDIT_IDENTITY_METADATA";
-    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 65536] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 131072] = "ATTACH_WALLET_TO_IDENTITY";
-    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 262144] = "DETACH_WALLET_FROM_IDENTITY";
-    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 524288] = "SEIZE_TOKENS";
-    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 1048576] = "CREATE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 2097152] = "CREATE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 4194304] = "CLOSE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 8388608] = "ADD_TOKEN_LOCK";
-    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 16777216] = "REMOVE_TOKEN_LOCK";
-    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 33554432] = "CHANGE_COUNTERS";
-    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 67108864] = "CHANGE_COUNTER_LIMITS";
-    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 134217728] = "CHANGE_COUNTRY";
-    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 268435456] = "CHANGE_MAPPING";
-    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 536870912] = "CHANGE_ISSUANCE_POLICIES";
-    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 1073741824] = "REMOVE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ALL"] = 2147483647] = "ALL";
+    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 32] = "UPDATE_INTEREST_BEARING_MINT_RATE";
+    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 64] = "ATTACH_TO_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 128] = "CREATE_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 256] = "DETACH_FROM_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["ADD_LEVELS"] = 512] = "ADD_LEVELS";
+    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 1024] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 2048] = "REGISTER_INVESTOR";
+    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 4096] = "REMOVE_LEVELS";
+    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 8192] = "REMOVE_INVESTOR";
+    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 16384] = "EDIT_IDENTITY_METADATA";
+    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 32768] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 65536] = "ATTACH_WALLET_TO_IDENTITY";
+    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 131072] = "DETACH_WALLET_FROM_IDENTITY";
+    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 262144] = "SEIZE_TOKENS";
+    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 524288] = "CREATE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 1048576] = "CREATE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 2097152] = "CLOSE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 4194304] = "ADD_TOKEN_LOCK";
+    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 8388608] = "REMOVE_TOKEN_LOCK";
+    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 16777216] = "CHANGE_COUNTERS";
+    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 33554432] = "CHANGE_COUNTER_LIMITS";
+    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 67108864] = "CHANGE_COUNTRY";
+    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 134217728] = "CHANGE_MAPPING";
+    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 268435456] = "CHANGE_ISSUANCE_POLICIES";
+    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 536870912] = "REMOVE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ALL"] = 1073741823] = "ALL";
 })(MediciFlags || (MediciFlags = {}));
 
 /******************************************************************************
@@ -3626,7 +3680,7 @@ class AssetController {
      * Update the asset controller's metadata.
      * @param args - {@link UpdateAssetMetadataArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to update the asset controller's metadata.
      * */
     updateAssetMetadata(args, assetAccessController, authorizedUserRole) {
@@ -3655,7 +3709,7 @@ class AssetController {
      * Asynchronously generates instructions to issue tokens and lock tokens according to issuance policy.
      * @param args - {@link IssueTokensWithLockArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      */
     issueTokenIxns(args, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -3716,7 +3770,7 @@ class AssetController {
      * Asynchronously generates instruction to freeze a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to freeze.
      */
     freezeTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3744,7 +3798,7 @@ class AssetController {
      * Asynchronously generates instruction to thaw a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to thaw.
      */
     thawTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3774,11 +3828,11 @@ class AssetController {
      * @param args - {@link RevokeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @param investorId - Optional investorId. Required if user is not an investor.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
      * @returns A Promise that resolves to the instructions to revoke.
      */
-    revokeTokenIxn(args, signer, assetAccessController, investorId, authorizedUserRole) {
+    revokeTokenIxn(args, signer, assetAccessController, authorizedUserRole, investorId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args.wallet) {
                 throw new Error("Use wallet arg for wallet to revoke tokens from.");
@@ -3787,7 +3841,9 @@ class AssetController {
             args.owner = args.wallet;
             const revokeIx = yield getRevokeTokensIx(args, this.rwaClient.provider);
             const identityRegistry = getIdentityRegistryPda(args.assetMint);
-            const investorPda = investorId ? deriveInvestorPda(investorId, identityRegistry) : null;
+            const investorPda = investorId
+                ? deriveInvestorPda(investorId, identityRegistry)
+                : null;
             const ixData = revokeIx.data;
             const assetController = getAssetControllerPda(args.assetMint);
             const revokeTokenAccount = getAssociatedTokenAddressSync(new PublicKey(args.assetMint), new PublicKey(args.wallet), false, TOKEN_2022_PROGRAM_ID);
@@ -3816,37 +3872,11 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instruction to close mint.
-     * @param args - {@link CloseMintArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instruction to close mint.
-     */
-    closeMintIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const closeIx = yield getCloseMintIx(args, this.rwaClient.provider);
-            const ixData = closeIx.data;
-            return this.rbacProgram.methods
-                .closeMintAccount(ixData)
-                .accountsStrict({
-                user: args.signer,
-                controllerAuthority: args.authority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                assetControllerProgram: assetControllerProgramId,
-                assetMint: args.assetMint,
-                assetController: getAssetControllerPda(args.assetMint),
-                tokenProgram: TOKEN_2022_PROGRAM_ID,
-            })
-                .instruction();
-        });
-    }
     /**
      * Asynchronously generates instruction to update mint interest rate.
      * @param args - {@link UpdateInterestBearingMintRateArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to update mint interest rate.
      */
     updateInterestBearingMintRateIxn(args, assetAccessController, authorizedUserRole) {
@@ -3874,7 +3904,7 @@ class AssetController {
      * @param args - {@link SeizeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to seize.
      */
     seizeTokensIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
@@ -3972,7 +4002,7 @@ class PolicyEngine {
      * @param args - {@link AttachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to attach a policy.
      * */
     attachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4000,7 +4030,7 @@ class PolicyEngine {
      * @param args - {@link DetachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to detach a policy.
      * */
     detachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4028,7 +4058,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters.
      * */
     changeCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4056,7 +4086,7 @@ class PolicyEngine {
      * @param args - {@link SetCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to set the counter values.
      * */
     setCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4083,7 +4113,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCounterLimitsArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters limits.
      * */
     changeCounterLimits(args, signer, assetAccessController, authorizedUserRole) {
@@ -4111,7 +4141,7 @@ class PolicyEngine {
      * @param args - {@link ChangeMappingArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeMapping(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4137,7 +4167,7 @@ class PolicyEngine {
      * @param args - {@link ChangeIssuancePoliciesArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeIssuancePolicies(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4221,7 +4251,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4231,7 +4261,6 @@ class IdentityRegistry {
             const { ixs } = yield this.rwaClient.identityRegistry.setupUserIxns(args);
             const returnIxs = [];
             const identityAccountIx = ixs[0];
-            const trackerAccountIx = ixs[1];
             const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
             const identityAccount = getIdentityAccountPda(args.assetMint, args.owner);
             returnIxs.push(yield this.rbacProgram.methods
@@ -4248,9 +4277,11 @@ class IdentityRegistry {
                 walletIdentity: getWalletIdentityAccountPda(args.assetMint, args.owner),
                 systemProgram: SystemProgram.programId,
                 eventAuthority: getIdentityRegistryEventAuthority(),
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction());
-            returnIxs.push(trackerAccountIx);
             return {
                 ixs: returnIxs,
                 signers: [],
@@ -4262,7 +4293,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4287,6 +4318,9 @@ class IdentityRegistry {
                 walletIdentity: getWalletIdentityAccountPda(args.assetMint, args.owner),
                 eventAuthority: getIdentityRegistryEventAuthority(),
                 identityOwner: identityAccount.owner,
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction();
             return returnIx;
@@ -4296,7 +4330,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to attach wallet to identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to attach wallet.
      * */
     attachWalletToIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4344,7 +4378,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to detach wallet from identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to detach wallet.
      * */
     detachWalletFromIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4425,7 +4459,7 @@ class IdentityMetadataRegistry {
      * @param args - {@link SetupInvestorArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup an investor.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4454,6 +4488,9 @@ class IdentityMetadataRegistry {
                 eventAuthority: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
                 program: identityRegistryProgramId,
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
+                assetMint: assetMintKey,
             })
                 .instruction();
             returnIxs.push(yield this.rbacProgram.methods
@@ -4473,21 +4510,9 @@ class IdentityMetadataRegistry {
                 systemProgram: SystemProgram.programId,
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
-            })
-                .instruction());
-            const policyProgram = getPolicyEngineProgram(this.imrProgram.provider);
-            const trackerAccount = PublicKey.findProgramAddressSync([assetMintKey.toBuffer(), identityAccount.toBuffer()], policyProgram.programId)[0];
-            returnIxs.push(yield policyProgram.methods
-                .createTrackerAccount()
-                .accountsStrict({
-                payer: args.payer,
-                trackerAccount,
-                systemProgram: SystemProgram.programId,
-                program: policyProgram.programId,
+                policyEngineProgram: policyEngineProgramId,
+                trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
                 assetMint: assetMintKey,
-                eventAuthority: getPolicyEngineEventAuthority(),
-                identityRegistry,
-                identityAccount,
             })
                 .instruction());
             if (args.levels.length > 1) {
@@ -4512,7 +4537,7 @@ class IdentityMetadataRegistry {
      * Asynchronously add levels to investor.
      * @param args - {@link AddLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to add levels.
      * */
     addLevels(args, assetAccessController, authorizedUserRole) {
@@ -4570,7 +4595,7 @@ class IdentityMetadataRegistry {
      * Asynchronously change country for the Investor.
      * @param args - {@link ChangeCountryArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the country.
      * */
     changeCountry(args, assetAccessController, authorizedUserRole) {
@@ -4623,7 +4648,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove levels from an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove levels.
      * */
     removeLevels(args, assetAccessController, authorizedUserRole) {
@@ -4678,7 +4703,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove an investor.
      * */
     removeInvestor(args, assetAccessController, authorizedUserRole) {
@@ -4705,6 +4730,7 @@ class IdentityMetadataRegistry {
                 trackerAccount: getTrackerAccountPda(args.assetMint, investor.toString()),
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: getIdentityRegistryEventAuthority(),
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -4776,13 +4802,36 @@ class RwaRbacClient {
      */
     createAssetAccessControllerIxn(args) {
         return __awaiter(this, void 0, void 0, function* () {
+            const assetAccessController = deriveAssetAccessControllerPda(args.assetMint);
+            const assetAccessControllerAuthority = deriveControllerAuthorityPda(assetAccessController);
+            const cpiInstruction = yield this.assetController.setupNewRegistry({
+                decimals: args.decimals,
+                authority: assetAccessControllerAuthority.toString(),
+                name: args.name,
+                uri: args.uri,
+                symbol: args.symbol,
+                interestRate: args.interestRate,
+                assetMint: args.assetMint.toString(),
+                payer: args.payer.toString(),
+            });
             return this.rbacProgram.methods
-                .createController(args.uniqueSeed)
+                .createController(cpiInstruction.data)
                 .accountsStrict({
                 payer: args.payer,
                 admin: args.admin,
-                assetAccessController: deriveAssetAccessControllerPda(args.uniqueSeed),
+                assetAccessController,
+                assetAccessControllerAuthority,
+                assetMint: args.assetMint,
+                assetController: cpiInstruction.keys[2].pubkey,
+                extraMetasAccount: cpiInstruction.keys[4].pubkey,
+                policyEngineAccount: cpiInstruction.keys[5].pubkey,
+                identityRegistryAccount: cpiInstruction.keys[6].pubkey,
+                policyEngineProgram: cpiInstruction.keys[7].pubkey,
+                identityRegistryProgram: cpiInstruction.keys[8].pubkey,
+                assetControllerProgram: cpiInstruction.programId,
+                tokenProgram: TOKEN_2022_PROGRAM_ID,
                 systemProgram: SystemProgram.programId,
+                assetControllerEventAuthority: getAssetControllerEventAuthority(),
             })
                 .instruction();
         });
@@ -4813,7 +4862,7 @@ class RwaRbacClient {
             // Fetch controller to get next UserRole id.
             const controller = yield this.rbacProgram.account.assetAccessController.fetch(args.assetAccessController);
             return this.rbacProgram.methods
-                .createUserRole(args.name, new BN(args.allowedAdminIxs), new BN(args.allowedMediciIxs))
+                .createUserRole(args.name, new BN(args.allowedAdminIxs), new BN(args.allowedMediciIxs), args.isMasterRole || false)
                 .accountsStrict({
                 payer: args.payer,
                 user: args.user,