@dstoken-solana/rwa-rbac 0.3.0 → 0.4.0

package/dist/index.js

@@ -90,8 +90,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -178,8 +177,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -241,6 +239,7 @@ var instructions$1 = [
 			},
 			{
 				name: "asset_access_controller",
+				writable: true,
 				relations: [
 					"user_role",
 					"authorized_user_role"
@@ -335,8 +334,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -396,8 +394,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -467,8 +464,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -528,8 +524,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -589,8 +584,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -670,8 +664,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -727,8 +720,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -749,63 +741,6 @@ var instructions$1 = [
 			}
 		]
 	},
-	{
-		name: "close_mint_account",
-		discriminator: [
-			14,
-			121,
-			72,
-			246,
-			96,
-			224,
-			42,
-			162
-		],
-		accounts: [
-			{
-				name: "user",
-				signer: true
-			},
-			{
-				name: "controller_authority",
-				writable: true,
-				relations: [
-					"asset_access_controller"
-				]
-			},
-			{
-				name: "asset_access_controller",
-				relations: [
-					"authorized_user_role"
-				]
-			},
-			{
-				name: "authorized_user_role",
-				optional: true
-			},
-			{
-				name: "asset_controller_program",
-				address: "7tXjmbkZVY3Gmg9kDBebcNXT1yC5pyoxxXVLwdbv9tvP"
-			},
-			{
-				name: "asset_mint",
-				writable: true
-			},
-			{
-				name: "asset_controller"
-			},
-			{
-				name: "token_program",
-				address: "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
-			}
-		],
-		args: [
-			{
-				name: "cpi_data",
-				type: "bytes"
-			}
-		]
-	},
 	{
 		name: "create_controller",
 		discriminator: [
@@ -834,8 +769,8 @@ var instructions$1 = [
 				pda: {
 					seeds: [
 						{
-							kind: "arg",
-							path: "unique_seed"
+							kind: "account",
+							path: "asset_mint"
 						},
 						{
 							kind: "const",
@@ -866,6 +801,53 @@ var instructions$1 = [
 					]
 				}
 			},
+			{
+				name: "asset_access_controller_authority",
+				pda: {
+					seeds: [
+						{
+							kind: "account",
+							path: "asset_access_controller"
+						}
+					]
+				}
+			},
+			{
+				name: "asset_controller",
+				writable: true
+			},
+			{
+				name: "asset_mint",
+				writable: true,
+				signer: true
+			},
+			{
+				name: "extra_metas_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_account",
+				writable: true
+			},
+			{
+				name: "identity_registry_account",
+				writable: true
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "identity_registry_program"
+			},
+			{
+				name: "asset_controller_program"
+			},
+			{
+				name: "asset_controller_event_authority"
+			},
+			{
+				name: "token_program"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -873,8 +855,8 @@ var instructions$1 = [
 		],
 		args: [
 			{
-				name: "unique_seed",
-				type: "pubkey"
+				name: "cpi_data",
+				type: "bytes"
 			}
 		]
 	},
@@ -913,8 +895,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -931,6 +912,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -1000,6 +991,10 @@ var instructions$1 = [
 			{
 				name: "allowed_medici_ixs",
 				type: "u64"
+			},
+			{
+				name: "is_master_role",
+				type: "bool"
 			}
 		]
 	},
@@ -1078,8 +1073,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1140,8 +1134,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1205,8 +1198,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1271,8 +1263,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1420,8 +1411,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1446,6 +1436,16 @@ var instructions$1 = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority_identity_metadata_registry"
 			},
@@ -1499,8 +1499,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_registry_program",
@@ -1522,6 +1521,16 @@ var instructions$1 = [
 			},
 			{
 				name: "identity_owner"
+			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
@@ -1566,8 +1575,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1605,6 +1613,9 @@ var instructions$1 = [
 			},
 			{
 				name: "event_authority_identity_registry"
+			},
+			{
+				name: "asset_mint"
 			}
 		],
 		args: [
@@ -1645,8 +1656,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "identity_metadata_registry_program",
@@ -1730,8 +1740,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -1874,8 +1883,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -1966,8 +1974,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2037,8 +2044,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "policy_engine_program",
@@ -2124,8 +2130,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2194,8 +2199,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2289,8 +2293,7 @@ var instructions$1 = [
 				]
 			},
 			{
-				name: "authorized_user_role",
-				optional: true
+				name: "authorized_user_role"
 			},
 			{
 				name: "asset_controller_program",
@@ -2457,6 +2460,31 @@ var errors$1 = [
 		code: 6007,
 		name: "IllegalOperation",
 		msg: "Illegal operation"
+	},
+	{
+		code: 6008,
+		name: "InvalidFlags",
+		msg: "Invalid flag bits"
+	},
+	{
+		code: 6009,
+		name: "CannotEmptyMasterRole",
+		msg: "Cannot empty master role of users"
+	},
+	{
+		code: 6010,
+		name: "CannotVoidAuthority",
+		msg: "Cannot void authority"
+	},
+	{
+		code: 6011,
+		name: "InvalidMasterRole",
+		msg: "Invalid master role"
+	},
+	{
+		code: 6012,
+		name: "CannotDeleteMasterRole",
+		msg: "Cannot delete master role"
 	}
 ];
 var types$1 = [
@@ -2487,9 +2515,9 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "unique_seed",
+					name: "asset_mint",
 					docs: [
-						"Unique seed used for creating this account."
+						"Asset mint that is going to be managed by this controller."
 					],
 					type: "pubkey"
 				},
@@ -2500,6 +2528,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "has_master_role",
+					docs: [
+						"Whether a master role exists."
+					],
+					type: "bool"
+				},
 				{
 					name: "lut_address",
 					docs: [
@@ -2534,7 +2569,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2564,7 +2599,7 @@ var types$1 = [
 					type: "pubkey"
 				},
 				{
-					name: "seed",
+					name: "asset_mint",
 					type: "pubkey"
 				}
 			]
@@ -2610,6 +2645,13 @@ var types$1 = [
 					],
 					type: "u64"
 				},
+				{
+					name: "is_master_role",
+					docs: [
+						"If true, this is the master role."
+					],
+					type: "bool"
+				},
 				{
 					name: "users",
 					docs: [
@@ -2973,6 +3015,16 @@ var instructions = [
 				name: "wallet_identity",
 				writable: true
 			},
+			{
+				name: "policy_engine_program"
+			},
+			{
+				name: "tracker_account",
+				writable: true
+			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "system_program",
 				address: "11111111111111111111111111111111"
@@ -3095,6 +3147,9 @@ var instructions = [
 			{
 				name: "event_authority_identity_registry"
 			},
+			{
+				name: "asset_mint"
+			},
 			{
 				name: "event_authority",
 				pda: {
@@ -3549,33 +3604,32 @@ exports.MediciFlags = void 0;
     MediciFlags[MediciFlags["FREEZE_TOKEN_ACCOUNT"] = 4] = "FREEZE_TOKEN_ACCOUNT";
     MediciFlags[MediciFlags["ISSUE_TOKENS"] = 8] = "ISSUE_TOKENS";
     MediciFlags[MediciFlags["REVOKE_TOKENS"] = 16] = "REVOKE_TOKENS";
-    MediciFlags[MediciFlags["CLOSE_MINT_ACCOUNT"] = 32] = "CLOSE_MINT_ACCOUNT";
-    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 64] = "UPDATE_INTEREST_BEARING_MINT_RATE";
-    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 128] = "ATTACH_TO_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 256] = "CREATE_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 512] = "DETACH_FROM_POLICY_ACCOUNT";
-    MediciFlags[MediciFlags["ADD_LEVELS"] = 1024] = "ADD_LEVELS";
-    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 2048] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 4096] = "REGISTER_INVESTOR";
-    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 8192] = "REMOVE_LEVELS";
-    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 16384] = "REMOVE_INVESTOR";
-    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 32768] = "EDIT_IDENTITY_METADATA";
-    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 65536] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 131072] = "ATTACH_WALLET_TO_IDENTITY";
-    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 262144] = "DETACH_WALLET_FROM_IDENTITY";
-    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 524288] = "SEIZE_TOKENS";
-    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 1048576] = "CREATE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 2097152] = "CREATE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 4194304] = "CLOSE_INVESTOR_LOCKS";
-    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 8388608] = "ADD_TOKEN_LOCK";
-    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 16777216] = "REMOVE_TOKEN_LOCK";
-    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 33554432] = "CHANGE_COUNTERS";
-    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 67108864] = "CHANGE_COUNTER_LIMITS";
-    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 134217728] = "CHANGE_COUNTRY";
-    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 268435456] = "CHANGE_MAPPING";
-    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 536870912] = "CHANGE_ISSUANCE_POLICIES";
-    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 1073741824] = "REMOVE_IDENTITY_ACCOUNT";
-    MediciFlags[MediciFlags["ALL"] = 2147483647] = "ALL";
+    MediciFlags[MediciFlags["UPDATE_INTEREST_BEARING_MINT_RATE"] = 32] = "UPDATE_INTEREST_BEARING_MINT_RATE";
+    MediciFlags[MediciFlags["ATTACH_TO_POLICY_ACCOUNT"] = 64] = "ATTACH_TO_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_POLICY_ACCOUNT"] = 128] = "CREATE_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["DETACH_FROM_POLICY_ACCOUNT"] = 256] = "DETACH_FROM_POLICY_ACCOUNT";
+    MediciFlags[MediciFlags["ADD_LEVELS"] = 512] = "ADD_LEVELS";
+    MediciFlags[MediciFlags["ADD_LEVEL_TO_IDENTITY_ACCOUNT"] = 1024] = "ADD_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["REGISTER_INVESTOR"] = 2048] = "REGISTER_INVESTOR";
+    MediciFlags[MediciFlags["REMOVE_LEVELS"] = 4096] = "REMOVE_LEVELS";
+    MediciFlags[MediciFlags["REMOVE_INVESTOR"] = 8192] = "REMOVE_INVESTOR";
+    MediciFlags[MediciFlags["EDIT_IDENTITY_METADATA"] = 16384] = "EDIT_IDENTITY_METADATA";
+    MediciFlags[MediciFlags["REFRESH_LEVEL_TO_IDENTITY_ACCOUNT"] = 32768] = "REFRESH_LEVEL_TO_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ATTACH_WALLET_TO_IDENTITY"] = 65536] = "ATTACH_WALLET_TO_IDENTITY";
+    MediciFlags[MediciFlags["DETACH_WALLET_FROM_IDENTITY"] = 131072] = "DETACH_WALLET_FROM_IDENTITY";
+    MediciFlags[MediciFlags["SEIZE_TOKENS"] = 262144] = "SEIZE_TOKENS";
+    MediciFlags[MediciFlags["CREATE_IDENTITY_ACCOUNT"] = 524288] = "CREATE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["CREATE_INVESTOR_LOCKS"] = 1048576] = "CREATE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["CLOSE_INVESTOR_LOCKS"] = 2097152] = "CLOSE_INVESTOR_LOCKS";
+    MediciFlags[MediciFlags["ADD_TOKEN_LOCK"] = 4194304] = "ADD_TOKEN_LOCK";
+    MediciFlags[MediciFlags["REMOVE_TOKEN_LOCK"] = 8388608] = "REMOVE_TOKEN_LOCK";
+    MediciFlags[MediciFlags["CHANGE_COUNTERS"] = 16777216] = "CHANGE_COUNTERS";
+    MediciFlags[MediciFlags["CHANGE_COUNTER_LIMITS"] = 33554432] = "CHANGE_COUNTER_LIMITS";
+    MediciFlags[MediciFlags["CHANGE_COUNTRY"] = 67108864] = "CHANGE_COUNTRY";
+    MediciFlags[MediciFlags["CHANGE_MAPPING"] = 134217728] = "CHANGE_MAPPING";
+    MediciFlags[MediciFlags["CHANGE_ISSUANCE_POLICIES"] = 268435456] = "CHANGE_ISSUANCE_POLICIES";
+    MediciFlags[MediciFlags["REMOVE_IDENTITY_ACCOUNT"] = 536870912] = "REMOVE_IDENTITY_ACCOUNT";
+    MediciFlags[MediciFlags["ALL"] = 1073741823] = "ALL";
 })(exports.MediciFlags || (exports.MediciFlags = {}));
 
 /******************************************************************************
@@ -3630,7 +3684,7 @@ class AssetController {
      * Update the asset controller's metadata.
      * @param args - {@link UpdateAssetMetadataArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to update the asset controller's metadata.
      * */
     updateAssetMetadata(args, assetAccessController, authorizedUserRole) {
@@ -3659,7 +3713,7 @@ class AssetController {
      * Asynchronously generates instructions to issue tokens and lock tokens according to issuance policy.
      * @param args - {@link IssueTokensWithLockArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      */
     issueTokenIxns(args, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -3720,7 +3774,7 @@ class AssetController {
      * Asynchronously generates instruction to freeze a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to freeze.
      */
     freezeTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3748,7 +3802,7 @@ class AssetController {
      * Asynchronously generates instruction to thaw a token account.
      * @param args - {@link FreezeTokenArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to thaw.
      */
     thawTokenIxn(args, assetAccessController, authorizedUserRole) {
@@ -3778,11 +3832,11 @@ class AssetController {
      * @param args - {@link RevokeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @param investorId - Optional investorId. Required if user is not an investor.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
      * @returns A Promise that resolves to the instructions to revoke.
      */
-    revokeTokenIxn(args, signer, assetAccessController, investorId, authorizedUserRole) {
+    revokeTokenIxn(args, signer, assetAccessController, authorizedUserRole, investorId) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args.wallet) {
                 throw new Error("Use wallet arg for wallet to revoke tokens from.");
@@ -3791,7 +3845,9 @@ class AssetController {
             args.owner = args.wallet;
             const revokeIx = yield rwaTokenSdk.getRevokeTokensIx(args, this.rwaClient.provider);
             const identityRegistry = rwaTokenSdk.getIdentityRegistryPda(args.assetMint);
-            const investorPda = investorId ? deriveInvestorPda(investorId, identityRegistry) : null;
+            const investorPda = investorId
+                ? deriveInvestorPda(investorId, identityRegistry)
+                : null;
             const ixData = revokeIx.data;
             const assetController = rwaTokenSdk.getAssetControllerPda(args.assetMint);
             const revokeTokenAccount = splToken.getAssociatedTokenAddressSync(new web3_js.PublicKey(args.assetMint), new web3_js.PublicKey(args.wallet), false, splToken.TOKEN_2022_PROGRAM_ID);
@@ -3820,37 +3876,11 @@ class AssetController {
                 .instruction();
         });
     }
-    /**
-     * Asynchronously generates instruction to close mint.
-     * @param args - {@link CloseMintArgs}
-     * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
-     * @returns A Promise that resolves to the instruction to close mint.
-     */
-    closeMintIxn(args, assetAccessController, authorizedUserRole) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const closeIx = yield rwaTokenSdk.getCloseMintIx(args, this.rwaClient.provider);
-            const ixData = closeIx.data;
-            return this.rbacProgram.methods
-                .closeMintAccount(ixData)
-                .accountsStrict({
-                user: args.signer,
-                controllerAuthority: args.authority,
-                assetAccessController,
-                authorizedUserRole: authorizedUserRole || null,
-                assetControllerProgram: rwaTokenSdk.assetControllerProgramId,
-                assetMint: args.assetMint,
-                assetController: rwaTokenSdk.getAssetControllerPda(args.assetMint),
-                tokenProgram: splToken.TOKEN_2022_PROGRAM_ID,
-            })
-                .instruction();
-        });
-    }
     /**
      * Asynchronously generates instruction to update mint interest rate.
      * @param args - {@link UpdateInterestBearingMintRateArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to update mint interest rate.
      */
     updateInterestBearingMintRateIxn(args, assetAccessController, authorizedUserRole) {
@@ -3878,7 +3908,7 @@ class AssetController {
      * @param args - {@link SeizeTokensArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instruction to seize.
      */
     seizeTokensIxn(args, investorId, signer, assetAccessController, authorizedUserRole) {
@@ -3976,7 +4006,7 @@ class PolicyEngine {
      * @param args - {@link AttachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to attach a policy.
      * */
     attachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4004,7 +4034,7 @@ class PolicyEngine {
      * @param args - {@link DetachPolicyArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to detach a policy.
      * */
     detachPolicy(args, signer, assetAccessController, authorizedUserRole) {
@@ -4032,7 +4062,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters.
      * */
     changeCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4060,7 +4090,7 @@ class PolicyEngine {
      * @param args - {@link SetCountersArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to set the counter values.
      * */
     setCounters(args, signer, assetAccessController, authorizedUserRole) {
@@ -4087,7 +4117,7 @@ class PolicyEngine {
      * @param args - {@link ChangeCounterLimitsArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the counters limits.
      * */
     changeCounterLimits(args, signer, assetAccessController, authorizedUserRole) {
@@ -4115,7 +4145,7 @@ class PolicyEngine {
      * @param args - {@link ChangeMappingArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeMapping(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4141,7 +4171,7 @@ class PolicyEngine {
      * @param args - {@link ChangeIssuancePoliciesArgs}
      * @param signer - User signer public key.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * */
     changeIssuancePolicies(args, signer, assetAccessController, authorizedUserRole) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4225,7 +4255,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4235,7 +4265,6 @@ class IdentityRegistry {
             const { ixs } = yield this.rwaClient.identityRegistry.setupUserIxns(args);
             const returnIxs = [];
             const identityAccountIx = ixs[0];
-            const trackerAccountIx = ixs[1];
             const controllerAuthority = deriveControllerAuthorityPda(assetAccessController);
             const identityAccount = rwaTokenSdk.getIdentityAccountPda(args.assetMint, args.owner);
             returnIxs.push(yield this.rbacProgram.methods
@@ -4252,9 +4281,11 @@ class IdentityRegistry {
                 walletIdentity: rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.owner),
                 systemProgram: web3_js.SystemProgram.programId,
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction());
-            returnIxs.push(trackerAccountIx);
             return {
                 ixs: returnIxs,
                 signers: [],
@@ -4266,7 +4297,7 @@ class IdentityRegistry {
      * @param args - {@link SetupUserArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup a user.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4291,6 +4322,9 @@ class IdentityRegistry {
                 walletIdentity: rwaTokenSdk.getWalletIdentityAccountPda(args.assetMint, args.owner),
                 eventAuthority: rwaTokenSdk.getIdentityRegistryEventAuthority(),
                 identityOwner: identityAccount.owner,
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, args.owner),
+                assetMint: args.assetMint,
             })
                 .instruction();
             return returnIx;
@@ -4300,7 +4334,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to attach wallet to identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to attach wallet.
      * */
     attachWalletToIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4348,7 +4382,7 @@ class IdentityRegistry {
      * Asynchronously generates instruction to detach wallet from identity.
      * @param args - {@link AttachDetachWalletArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to detach wallet.
      * */
     detachWalletFromIdentityIxn(args, assetAccessController, authorizedUserRole) {
@@ -4429,7 +4463,7 @@ class IdentityMetadataRegistry {
      * @param args - {@link SetupInvestorArgs}
      * @param authority - RBAC AssetAccessController ControllerAuthority.
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to setup an investor.
      *
      * It is required for at least a single user to be setup before issuing tokens.
@@ -4458,6 +4492,9 @@ class IdentityMetadataRegistry {
                 eventAuthority: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
                 program: rwaTokenSdk.identityRegistryProgramId,
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
+                assetMint: assetMintKey,
             })
                 .instruction();
             returnIxs.push(yield this.rbacProgram.methods
@@ -4477,21 +4514,9 @@ class IdentityMetadataRegistry {
                 systemProgram: web3_js.SystemProgram.programId,
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
-            })
-                .instruction());
-            const policyProgram = rwaTokenSdk.getPolicyEngineProgram(this.imrProgram.provider);
-            const trackerAccount = web3_js.PublicKey.findProgramAddressSync([assetMintKey.toBuffer(), identityAccount.toBuffer()], policyProgram.programId)[0];
-            returnIxs.push(yield policyProgram.methods
-                .createTrackerAccount()
-                .accountsStrict({
-                payer: args.payer,
-                trackerAccount,
-                systemProgram: web3_js.SystemProgram.programId,
-                program: policyProgram.programId,
+                policyEngineProgram: rwaTokenSdk.policyEngineProgramId,
+                trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
                 assetMint: assetMintKey,
-                eventAuthority: rwaTokenSdk.getPolicyEngineEventAuthority(),
-                identityRegistry,
-                identityAccount,
             })
                 .instruction());
             if (args.levels.length > 1) {
@@ -4516,7 +4541,7 @@ class IdentityMetadataRegistry {
      * Asynchronously add levels to investor.
      * @param args - {@link AddLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to add levels.
      * */
     addLevels(args, assetAccessController, authorizedUserRole) {
@@ -4574,7 +4599,7 @@ class IdentityMetadataRegistry {
      * Asynchronously change country for the Investor.
      * @param args - {@link ChangeCountryArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to change the country.
      * */
     changeCountry(args, assetAccessController, authorizedUserRole) {
@@ -4627,7 +4652,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove levels from an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove levels.
      * */
     removeLevels(args, assetAccessController, authorizedUserRole) {
@@ -4682,7 +4707,7 @@ class IdentityMetadataRegistry {
      * Asynchronously remove an investor.
      * @param args - {@link RemoveLevelsArgs}
      * @param assetAccessController - RBAC AssetAccessController account.
-     * @param authorizedUserRole - Optional UserRole account. Required if user is not an admin.
+     * @param authorizedUserRole - UserRole authorized to invoke instruction.
      * @returns A Promise that resolves to the instructions to remove an investor.
      * */
     removeInvestor(args, assetAccessController, authorizedUserRole) {
@@ -4709,6 +4734,7 @@ class IdentityMetadataRegistry {
                 trackerAccount: rwaTokenSdk.getTrackerAccountPda(args.assetMint, investor.toString()),
                 eventAuthorityIdentityMetadataRegistry: getEventAuthority(IMR_PROGRAM),
                 eventAuthorityIdentityRegistry: rwaTokenSdk.getIdentityRegistryEventAuthority(),
+                assetMint: args.assetMint,
             })
                 .instruction();
         });
@@ -4780,13 +4806,36 @@ class RwaRbacClient {
      */
     createAssetAccessControllerIxn(args) {
         return __awaiter(this, void 0, void 0, function* () {
+            const assetAccessController = deriveAssetAccessControllerPda(args.assetMint);
+            const assetAccessControllerAuthority = deriveControllerAuthorityPda(assetAccessController);
+            const cpiInstruction = yield this.assetController.setupNewRegistry({
+                decimals: args.decimals,
+                authority: assetAccessControllerAuthority.toString(),
+                name: args.name,
+                uri: args.uri,
+                symbol: args.symbol,
+                interestRate: args.interestRate,
+                assetMint: args.assetMint.toString(),
+                payer: args.payer.toString(),
+            });
             return this.rbacProgram.methods
-                .createController(args.uniqueSeed)
+                .createController(cpiInstruction.data)
                 .accountsStrict({
                 payer: args.payer,
                 admin: args.admin,
-                assetAccessController: deriveAssetAccessControllerPda(args.uniqueSeed),
+                assetAccessController,
+                assetAccessControllerAuthority,
+                assetMint: args.assetMint,
+                assetController: cpiInstruction.keys[2].pubkey,
+                extraMetasAccount: cpiInstruction.keys[4].pubkey,
+                policyEngineAccount: cpiInstruction.keys[5].pubkey,
+                identityRegistryAccount: cpiInstruction.keys[6].pubkey,
+                policyEngineProgram: cpiInstruction.keys[7].pubkey,
+                identityRegistryProgram: cpiInstruction.keys[8].pubkey,
+                assetControllerProgram: cpiInstruction.programId,
+                tokenProgram: splToken.TOKEN_2022_PROGRAM_ID,
                 systemProgram: web3_js.SystemProgram.programId,
+                assetControllerEventAuthority: rwaTokenSdk.getAssetControllerEventAuthority(),
             })
                 .instruction();
         });
@@ -4817,7 +4866,7 @@ class RwaRbacClient {
             // Fetch controller to get next UserRole id.
             const controller = yield this.rbacProgram.account.assetAccessController.fetch(args.assetAccessController);
             return this.rbacProgram.methods
-                .createUserRole(args.name, new anchor.BN(args.allowedAdminIxs), new anchor.BN(args.allowedMediciIxs))
+                .createUserRole(args.name, new anchor.BN(args.allowedAdminIxs), new anchor.BN(args.allowedMediciIxs), args.isMasterRole || false)
                 .accountsStrict({
                 payer: args.payer,
                 user: args.user,