@usesigil/kit 0.1.0

package/dist/shield.js

@@ -0,0 +1,701 @@
+/**
+ * Shield — Kit-native Client-Side Policy Enforcement (Defense-in-Depth)
+ *
+ * Wraps instruction signing with spending limits, rate limits,
+ * program allowlists, and custom checks.
+ *
+ * IMPORTANT: Shield is a CLIENT-SIDE advisory layer, NOT a security boundary.
+ * The on-chain program (validate_and_authorize + finalize_session) provides the
+ * hard enforcement of spending caps, permissions, and protocol allowlists.
+ * Shield reduces blast radius by catching violations before signing, but callers
+ * CAN bypass Shield by using the underlying TransactionSigner directly.
+ * This is by design — Shield prevents accidents, on-chain prevents catastrophe.
+ *
+ * State (spending counters, velocity limits) is in-memory and resets on process
+ * restart. Use syncFromOnChain() to re-sync with the authoritative on-chain state.
+ */
+import { getBase64EncodedWireTransaction } from "@solana/kit";
+import { analyzeInstructions, } from "./inspector.js";
+import { resolvePolicies, } from "./policies.js";
+import { simulateBeforeSend } from "./simulation.js";
+import { SIGIL_PROGRAM_ADDRESS } from "./generated/programs/sigil.js";
+import { VALIDATE_AND_AUTHORIZE_DISCRIMINATOR } from "./generated/instructions/validateAndAuthorize.js";
+import { FINALIZE_SESSION_DISCRIMINATOR } from "./generated/instructions/finalizeSession.js";
+import { resolveVaultState, } from "./state-resolver.js";
+import { isStablecoinMint, validateNetwork } from "./types.js";
+export class ShieldDeniedError extends Error {
+    violations;
+    code;
+    constructor(violations, code) {
+        const msgs = violations.map((v) => v.message).join("; ");
+        super(`Shield denied: ${msgs}`);
+        this.violations = violations;
+        this.name = "ShieldDeniedError";
+        this.code = code;
+    }
+}
+export class ShieldState {
+    spendEntries = [];
+    txEntries = [];
+    // On-chain sync state
+    _resolvedState = null;
+    _localUsdAdditions = 0n;
+    _network = null;
+    // S-7: Mutual exclusivity tracking
+    _enforceUsed = false;
+    getSpendInWindow(mint, windowMs) {
+        const cutoff = Date.now() - windowMs;
+        return this.spendEntries
+            .filter((e) => e.mint === mint && e.timestamp >= cutoff)
+            .reduce((sum, e) => sum + e.amount, 0n);
+    }
+    getTotalSpendInWindow(windowMs) {
+        const cutoff = Date.now() - windowMs;
+        return this.spendEntries
+            .filter((e) => e.timestamp >= cutoff)
+            .reduce((sum, e) => sum + e.amount, 0n);
+    }
+    getTransactionCountInWindow(windowMs) {
+        const cutoff = Date.now() - windowMs;
+        return this.txEntries.filter((e) => e.timestamp >= cutoff).length;
+    }
+    recordSpend(mint, amount) {
+        this.spendEntries.push({ mint, amount, timestamp: Date.now() });
+        this.prune();
+    }
+    recordTransaction() {
+        this.txEntries.push({ timestamp: Date.now() });
+        this.prune();
+    }
+    /** Prune stale entries when arrays exceed threshold. */
+    prune() {
+        const PRUNE_THRESHOLD = 10_000;
+        if (this.spendEntries.length > PRUNE_THRESHOLD) {
+            const cutoff = Date.now() - 86_400_000;
+            this.spendEntries = this.spendEntries.filter((e) => e.timestamp >= cutoff);
+        }
+        if (this.txEntries.length > PRUNE_THRESHOLD) {
+            const cutoff = Date.now() - 86_400_000;
+            this.txEntries = this.txEntries.filter((e) => e.timestamp >= cutoff);
+        }
+    }
+    /** Sync spending baseline from on-chain state. Resets local additions. */
+    syncFromOnChain(state, network) {
+        this._resolvedState = state;
+        this._localUsdAdditions = 0n;
+        if (network !== undefined) {
+            this._network = network;
+        }
+    }
+    /** Record local USD spend (optimistic addition on top of on-chain baseline). */
+    recordUsdSpend(amount) {
+        this._localUsdAdditions += amount;
+    }
+    /** Effective 24h global spend: on-chain baseline + local additions. */
+    getEffectiveGlobalSpent24h() {
+        if (!this._resolvedState)
+            return this._localUsdAdditions;
+        return this._resolvedState.globalBudget.spent24h + this._localUsdAdditions;
+    }
+    /** Effective 24h remaining against on-chain cap. Returns null if not synced. */
+    getEffectiveGlobalRemaining() {
+        if (!this._resolvedState)
+            return null;
+        const cap = this._resolvedState.globalBudget.cap;
+        const spent = this.getEffectiveGlobalSpent24h();
+        return spent < cap ? cap - spent : 0n;
+    }
+    /** Resolved on-chain state, or null if never synced. */
+    get resolvedState() {
+        return this._resolvedState;
+    }
+    /** Local USD additions since last sync. */
+    get localUsdAdditions() {
+        return this._localUsdAdditions;
+    }
+    /** Network configured during sync. Null if never synced with network. */
+    get network() {
+        return this._network;
+    }
+    /** Effective 24h agent spend: on-chain baseline + local additions. Null if no agent budget. */
+    getEffectiveAgentSpent24h() {
+        if (!this._resolvedState?.agentBudget)
+            return null;
+        return this._resolvedState.agentBudget.spent24h + this._localUsdAdditions;
+    }
+    /** Effective 24h remaining against agent cap. Null if no agent budget or not synced. */
+    getEffectiveAgentRemaining() {
+        if (!this._resolvedState?.agentBudget)
+            return null;
+        const cap = this._resolvedState.agentBudget.cap;
+        const spent = this._resolvedState.agentBudget.spent24h + this._localUsdAdditions;
+        return spent < cap ? cap - spent : 0n;
+    }
+    /** S-7: Whether enforce() has been called on this state. */
+    get enforceUsed() {
+        return this._enforceUsed;
+    }
+    /** S-7: Mark that enforce() was used. */
+    markEnforceUsed() {
+        this._enforceUsed = true;
+    }
+    checkpoint() {
+        return {
+            spendEntries: [...this.spendEntries],
+            txEntries: [...this.txEntries],
+            resolvedState: this._resolvedState,
+            localUsdAdditions: this._localUsdAdditions,
+            network: this._network,
+            enforceUsed: this._enforceUsed,
+        };
+    }
+    rollback(cp) {
+        this.spendEntries = [...cp.spendEntries];
+        this.txEntries = [...cp.txEntries];
+        this._resolvedState = cp.resolvedState;
+        this._localUsdAdditions = cp.localUsdAdditions;
+        this._network = cp.network;
+        this._enforceUsed = cp.enforceUsed;
+    }
+    reset() {
+        this.spendEntries = [];
+        this.txEntries = [];
+        this._resolvedState = null;
+        this._localUsdAdditions = 0n;
+        this._network = null;
+        this._enforceUsed = false;
+    }
+}
+// ─── Policy Evaluation ──────────────────────────────────────────────────────
+/**
+ * Evaluate a set of instructions against resolved policies.
+ * When state has on-chain sync, also checks vault/agent caps (requires network).
+ */
+export function evaluateInstructions(instructions, signerAddress, resolved, state, network) {
+    if (network)
+        validateNetwork(network);
+    const violations = [];
+    const analysis = analyzeInstructions(instructions, signerAddress);
+    // 1. Program allowlist check
+    if (resolved.blockUnknownPrograms && resolved.allowedProtocols) {
+        for (const pid of analysis.programIds) {
+            if (!SYSTEM_PROGRAMS.has(pid) && !resolved.allowedProtocols.has(pid)) {
+                violations.push({
+                    rule: "program_allowlist",
+                    message: `Program ${pid} is not in the allowed list`,
+                    suggestion: "Use a protocol that is explicitly allowed by the policy",
+                });
+            }
+        }
+    }
+    // 2. Spend limit check
+    if (resolved.spendLimits) {
+        for (const limit of resolved.spendLimits) {
+            const windowMs = limit.windowMs ?? 86_400_000;
+            const currentSpend = state.getSpendInWindow(limit.mint, windowMs);
+            const txSpend = analysis.tokenTransfers
+                .filter((t) => t.authority === signerAddress &&
+                (t.mint === limit.mint || t.mint === null))
+                .reduce((sum, t) => sum + t.amount, 0n);
+            if (currentSpend + txSpend > limit.amount) {
+                violations.push({
+                    rule: "spend_limit",
+                    message: `Spend limit exceeded for ${limit.mint}: ${currentSpend + txSpend} > ${limit.amount}`,
+                    suggestion: "Reduce the transaction amount or wait for the rolling window to reset",
+                });
+            }
+        }
+    }
+    // 3. Rate limit check
+    if (resolved.rateLimit) {
+        const count = state.getTransactionCountInWindow(resolved.rateLimit.windowMs);
+        if (count >= resolved.rateLimit.maxTransactions) {
+            violations.push({
+                rule: "rate_limit",
+                message: `Rate limit exceeded: ${count}/${resolved.rateLimit.maxTransactions} transactions in window`,
+                suggestion: "Wait before sending more transactions",
+            });
+        }
+    }
+    // 4. Custom check
+    if (resolved.customCheck) {
+        const customAnalysis = {
+            programIds: analysis.programIds,
+            transfers: analysis.tokenTransfers.map((t) => ({
+                mint: (t.mint ?? ""),
+                amount: t.amount,
+                direction: (t.authority === signerAddress ? "outgoing" : "unknown"),
+                destination: t.destination,
+            })),
+            estimatedValueLamports: analysis.estimatedValue,
+        };
+        const customResult = resolved.customCheck(customAnalysis);
+        if (!customResult.allowed) {
+            violations.push({
+                rule: "custom",
+                message: customResult.reason ?? "Custom policy check failed",
+            });
+        }
+    }
+    // 5. On-chain vault/agent cap check (when synced)
+    const effectiveNetwork = network ?? state.network;
+    if (state.resolvedState && effectiveNetwork) {
+        const rs = state.resolvedState;
+        const stablecoinUsdAmount = computeStablecoinUsd(analysis.tokenTransfers, signerAddress, effectiveNetwork);
+        if (stablecoinUsdAmount > 0n) {
+            // Transaction size
+            if (stablecoinUsdAmount > rs.maxTransactionUsd) {
+                violations.push({
+                    rule: "on_chain_tx_size",
+                    message: `Transaction ${stablecoinUsdAmount} exceeds max ${rs.maxTransactionUsd}`,
+                    suggestion: "Reduce the transaction amount",
+                });
+            }
+            // Global vault cap
+            const effectiveGlobalSpent = state.getEffectiveGlobalSpent24h();
+            if (effectiveGlobalSpent + stablecoinUsdAmount > rs.globalBudget.cap) {
+                violations.push({
+                    rule: "on_chain_vault_cap",
+                    message: `Would exceed on-chain daily cap: ${effectiveGlobalSpent + stablecoinUsdAmount} > ${rs.globalBudget.cap}`,
+                    suggestion: "Reduce amount or wait for the 24h window to roll",
+                });
+            }
+            // Per-agent cap
+            const effectiveAgentSpent = state.getEffectiveAgentSpent24h();
+            if (effectiveAgentSpent !== null && rs.agentBudget) {
+                if (effectiveAgentSpent + stablecoinUsdAmount > rs.agentBudget.cap) {
+                    violations.push({
+                        rule: "on_chain_agent_cap",
+                        message: `Would exceed agent spend limit: ${effectiveAgentSpent + stablecoinUsdAmount} > ${rs.agentBudget.cap}`,
+                        suggestion: "Reduce amount or wait",
+                    });
+                }
+            }
+        }
+    }
+    return { violations, analysis };
+}
+const SYSTEM_PROGRAMS = new Set([
+    "11111111111111111111111111111111",
+    "ComputeBudget111111111111111111111111111111",
+    "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL",
+]);
+/**
+ * Sum USD value of outgoing stablecoin transfers only.
+ * Plain Transfer instructions have mint=null — skip those.
+ * On-chain uses stablecoin identity: USDC/USDT amount / 10^6 = USD.
+ */
+function computeStablecoinUsd(transfers, signerAddress, network) {
+    return transfers
+        .filter((t) => t.authority === signerAddress &&
+        t.mint !== null &&
+        isStablecoinMint(t.mint, network))
+        .reduce((sum, t) => sum + t.amount, 0n);
+}
+/**
+ * Create a Kit-native shield context for client-side policy enforcement.
+ *
+ * Unlike the web3.js shield() which wraps wallet signing,
+ * this works at the instruction level:
+ * - check() validates instructions without side effects
+ * - enforce() validates and records, throwing on violation
+ */
+export function shield(policies, options) {
+    let resolved = resolvePolicies(policies);
+    const state = new ShieldState();
+    let paused = false;
+    const syncConfig = options?.onChainSync;
+    if (syncConfig)
+        validateNetwork(syncConfig.network);
+    const stalenessThreshold = options?.stalenessWarnThresholdSec ?? 300;
+    // S-1: Warn when no onChainSync — spend tracking is ephemeral
+    if (!syncConfig) {
+        console.warn("[Shield] No onChainSync configured — spend tracking is client-side only " +
+            "and will reset on process restart.");
+    }
+    return {
+        check(instructions, signerAddress) {
+            if (paused) {
+                return {
+                    allowed: false,
+                    violations: [
+                        {
+                            rule: "paused",
+                            message: "Shield is paused — all operations blocked until resume()",
+                            suggestion: "Call resume() to re-enable",
+                        },
+                    ],
+                };
+            }
+            // S-2: Staleness warning
+            _warnIfStale(state, stalenessThreshold);
+            const { violations } = evaluateInstructions(instructions, signerAddress, resolved, state, syncConfig?.network);
+            return { allowed: violations.length === 0, violations };
+        },
+        enforce(instructions, signerAddress) {
+            if (paused) {
+                const error = new ShieldDeniedError([
+                    {
+                        rule: "paused",
+                        message: "Shield is paused — all operations blocked until resume()",
+                        suggestion: "Call resume() to re-enable",
+                    },
+                ]);
+                options?.onDenied?.(error);
+                throw error;
+            }
+            // S-2: Staleness warning
+            _warnIfStale(state, stalenessThreshold);
+            const { violations, analysis } = evaluateInstructions(instructions, signerAddress, resolved, state, syncConfig?.network);
+            if (violations.length > 0) {
+                const error = new ShieldDeniedError(violations);
+                options?.onDenied?.(error);
+                throw error;
+            }
+            // Record the transaction — reuse analysis from evaluateInstructions
+            for (const transfer of analysis.tokenTransfers) {
+                if (transfer.authority === signerAddress) {
+                    state.recordSpend(transfer.mint ?? "", transfer.amount);
+                }
+            }
+            state.recordTransaction();
+            // Record aggregate stablecoin USD for on-chain cap tracking
+            if (state.resolvedState && syncConfig) {
+                const stablecoinUsd = computeStablecoinUsd(analysis.tokenTransfers, signerAddress, syncConfig.network);
+                if (stablecoinUsd > 0n) {
+                    state.recordUsdSpend(stablecoinUsd);
+                }
+            }
+            // S-7: Mark that enforce() was used
+            state.markEnforceUsed();
+            options?.onApproved?.();
+        },
+        get resolvedPolicies() {
+            return resolved;
+        },
+        get isPaused() {
+            return paused;
+        },
+        updatePolicies(newPolicies) {
+            resolved = resolvePolicies(newPolicies);
+            options?.onPolicyUpdate?.(newPolicies);
+        },
+        resetState() {
+            state.reset();
+        },
+        pause() {
+            paused = true;
+            options?.onPause?.();
+        },
+        resume() {
+            paused = false;
+            options?.onResume?.();
+        },
+        getSpendingSummary() {
+            const tokens = (resolved.spendLimits ?? []).map((limit) => {
+                const windowMs = limit.windowMs ?? 86_400_000;
+                const spent = state.getSpendInWindow(limit.mint, windowMs);
+                const remaining = limit.amount > spent ? limit.amount - spent : 0n;
+                return {
+                    mint: limit.mint,
+                    spent,
+                    limit: limit.amount,
+                    remaining,
+                    windowMs,
+                };
+            });
+            const rl = resolved.rateLimit ?? {
+                maxTransactions: 60,
+                windowMs: 3_600_000,
+            };
+            const txCount = state.getTransactionCountInWindow(rl.windowMs);
+            const rs = state.resolvedState;
+            const onChain = rs
+                ? {
+                    globalSpent24h: state.getEffectiveGlobalSpent24h(),
+                    globalCap: rs.globalBudget.cap,
+                    globalRemaining: state.getEffectiveGlobalRemaining() ?? 0n,
+                    agentSpent24h: state.getEffectiveAgentSpent24h(),
+                    agentCap: rs.agentBudget?.cap ?? null,
+                    agentRemaining: state.getEffectiveAgentRemaining(),
+                    maxTransactionUsd: rs.maxTransactionUsd,
+                    localAdditions: state.localUsdAdditions,
+                    syncedAt: rs.resolvedAtTimestamp,
+                }
+                : undefined;
+            return {
+                tokens,
+                rateLimit: {
+                    count: txCount,
+                    limit: rl.maxTransactions,
+                    remaining: Math.max(0, rl.maxTransactions - txCount),
+                    windowMs: rl.windowMs,
+                },
+                isPaused: paused,
+                onChain,
+            };
+        },
+        async sync() {
+            if (!syncConfig) {
+                throw new Error("Cannot sync: onChainSync not configured in ShieldOptions");
+            }
+            const resolved = await resolveVaultState(syncConfig.rpc, syncConfig.vaultAddress, syncConfig.agentAddress);
+            state.syncFromOnChain(resolved, syncConfig.network);
+        },
+        get hasOnChainSync() {
+            return syncConfig !== undefined;
+        },
+        get state() {
+            return state;
+        },
+    };
+}
+/**
+ * Create a TransactionSigner that enforces a 5-property pre-sign gate.
+ *
+ * Intercepts every signing call and runs:
+ *   1. Intent-TX correspondence (SOFT — logs warning)
+ *   2. Velocity ceiling (HARD — throws)
+ *   3. Simulation liveness (HARD — throws)
+ *   4. Instruction allowlist via ShieldedContext (HARD — throws)
+ *   5. Session binding (SOFT — logs warning)
+ *
+ * On pass, delegates to the baseSigner. On HARD fail, throws ShieldDeniedError.
+ *
+ * @param baseSigner - The underlying TransactionSigner to delegate to
+ * @param shieldCtx - ShieldedContext providing policy evaluation and state
+ * @param options - Optional configuration for each property
+ */
+export function createShieldedSigner(baseSigner, shieldCtx, options) {
+    return {
+        address: baseSigner.address,
+        async modifyAndSignTransactions(txs) {
+            for (const tx of txs) {
+                const instructions = _extractInstructionsFromCompiled(tx, options?.altCache);
+                // Property 2: Velocity ceiling (HARD)
+                if (options?.velocityThresholds) {
+                    checkVelocityCeiling(shieldCtx.state, instructions, baseSigner.address, options.velocityThresholds);
+                }
+                // Property 3: Simulation liveness (HARD)
+                if (options?.rpc && !options?.skipSimulation) {
+                    let wireBase64;
+                    try {
+                        wireBase64 = getBase64EncodedWireTransaction(tx);
+                    }
+                    catch (encodeErr) {
+                        // Fail-closed: if we can't encode the TX, block signing
+                        throw new ShieldDeniedError([
+                            {
+                                rule: "simulation",
+                                message: `Cannot encode transaction for simulation: ${encodeErr instanceof Error ? encodeErr.message : "unknown error"}`,
+                                suggestion: "Ensure the transaction is properly formed",
+                            },
+                        ]);
+                    }
+                    const result = await simulateBeforeSend(options.rpc, wireBase64);
+                    if (!result.success) {
+                        throw new ShieldDeniedError([
+                            {
+                                rule: "simulation",
+                                message: `Simulation failed: ${result.error?.message ?? "unknown error"}`,
+                                suggestion: result.error?.suggestion ?? "Check transaction validity",
+                            },
+                        ]);
+                    }
+                }
+                // Property 4: Instruction allowlist (HARD)
+                const checkResult = shieldCtx.check(instructions, baseSigner.address);
+                if (!checkResult.allowed) {
+                    throw new ShieldDeniedError(checkResult.violations);
+                }
+                // Property 5: Session binding (severity controlled by S-4)
+                if (options?.sessionContext) {
+                    checkSessionBinding(tx, SIGIL_PROGRAM_ADDRESS, options?.sessionBindingSeverity ?? "hard");
+                }
+                // S-7: Warn about double-counting risk if enforce() was already used
+                if (shieldCtx.state.enforceUsed) {
+                    console.warn("[ShieldedSigner] enforce() was already called on this ShieldState — " +
+                        "using ShieldedSigner after enforce() may double-count spending");
+                }
+                // All checks passed — record spend and transaction in shared state
+                const analysis = analyzeInstructions(instructions, baseSigner.address);
+                for (const transfer of analysis.tokenTransfers) {
+                    if (transfer.authority === baseSigner.address) {
+                        shieldCtx.state.recordSpend(transfer.mint ?? "", transfer.amount);
+                    }
+                }
+                shieldCtx.state.recordTransaction();
+                // Record aggregate stablecoin USD for on-chain cap tracking
+                if (shieldCtx.state.resolvedState && shieldCtx.state.network) {
+                    const stablecoinUsd = computeStablecoinUsd(analysis.tokenTransfers, baseSigner.address, shieldCtx.state.network);
+                    if (stablecoinUsd > 0n) {
+                        shieldCtx.state.recordUsdSpend(stablecoinUsd);
+                    }
+                }
+            }
+            // Delegate to base signer
+            const signer = baseSigner;
+            if (signer.modifyAndSignTransactions) {
+                return signer.modifyAndSignTransactions(txs);
+            }
+            else if (signer.signTransactions) {
+                const sigs = await signer.signTransactions(txs);
+                return txs.map((tx, i) => ({
+                    ...tx,
+                    signatures: { ...tx.signatures, ...sigs[i] },
+                }));
+            }
+            throw new Error("Unsupported signer type: must implement signTransactions or modifyAndSignTransactions");
+        },
+    };
+}
+// ─── Internal Helpers ────────────────────────────────────────────────────────
+/**
+ * Extract InspectableInstruction[] from a compiled transaction object.
+ * Resolves program addresses from staticAccounts[programAddressIndex].
+ * When ALTs are used, resolves ALT-compressed account indices via AltCache.
+ *
+ * Exported as _extractInstructionsFromCompiled for direct testing.
+ */
+export function _extractInstructionsFromCompiled(tx, altCache, warnings) {
+    const msg = tx.compiledMessage;
+    if (!msg?.staticAccounts?.length || !msg?.instructions?.length) {
+        return [];
+    }
+    // Build combined account table: static + ALT-resolved
+    let accountTable = [...msg.staticAccounts];
+    if (msg.addressTableLookups?.length && altCache) {
+        // S-3: Resolve ALT index with bounds check, accumulating warnings on OOB
+        const resolveAltIndex = (idx, resolved) => {
+            if (idx < resolved.length)
+                return resolved[idx];
+            warnings?.push(`ALT index ${idx} out of bounds (table has ${resolved.length} entries) — account substituted with system program for analysis`);
+            return "11111111111111111111111111111111";
+        };
+        // Two-pass ordering: Solana compiled messages order ALL writables from
+        // ALL lookups first, then ALL readonlys from ALL lookups.
+        // Pass 1: ALL writables from ALL lookups (in lookup order)
+        for (const lookup of msg.addressTableLookups) {
+            const resolved = altCache.getCachedAddresses(lookup.lookupTableAddress);
+            if (resolved) {
+                for (const idx of lookup.writableIndexes ?? []) {
+                    accountTable.push(resolveAltIndex(idx, resolved));
+                }
+            }
+        }
+        // Pass 2: ALL readonlys from ALL lookups
+        for (const lookup of msg.addressTableLookups) {
+            const resolved = altCache.getCachedAddresses(lookup.lookupTableAddress);
+            if (resolved) {
+                for (const idx of lookup.readonlyIndexes ?? []) {
+                    accountTable.push(resolveAltIndex(idx, resolved));
+                }
+            }
+        }
+    }
+    else if (msg.addressTableLookups?.length) {
+        console.warn("[ShieldedSigner] ALT-compressed accounts cannot be resolved without AltCache");
+    }
+    return msg.instructions.map((ix) => ({
+        programAddress: accountTable[ix.programAddressIndex],
+        accounts: (ix.accountIndices ?? []).map((i) => ({
+            address: accountTable[i],
+        })),
+        data: ix.data ? new Uint8Array(ix.data) : new Uint8Array(),
+    }));
+}
+/**
+ * Property 2: Check velocity ceilings. HARD — throws ShieldDeniedError.
+ */
+function checkVelocityCeiling(state, instructions, signerAddress, thresholds) {
+    if (thresholds.maxTxPerHour !== undefined) {
+        const count = state.getTransactionCountInWindow(3_600_000);
+        if (count >= thresholds.maxTxPerHour) {
+            throw new ShieldDeniedError([
+                {
+                    rule: "velocity_ceiling",
+                    message: `Transaction rate ${count}/${thresholds.maxTxPerHour} per hour exceeded`,
+                    suggestion: "Wait before sending more transactions",
+                },
+            ]);
+        }
+    }
+    if (thresholds.maxUsdPerHour !== undefined) {
+        const analysis = analyzeInstructions(instructions, signerAddress);
+        const currentSpend = state.getTotalSpendInWindow(3_600_000);
+        const projectedSpend = currentSpend + analysis.estimatedValue;
+        if (projectedSpend > thresholds.maxUsdPerHour) {
+            throw new ShieldDeniedError([
+                {
+                    rule: "velocity_ceiling",
+                    message: `Hourly USD spend ${projectedSpend} exceeds ceiling ${thresholds.maxUsdPerHour}`,
+                    suggestion: "Reduce transaction amounts or wait for the window to reset",
+                },
+            ]);
+        }
+    }
+}
+/**
+ * Property 5: Check session binding (validate+finalize sandwich).
+ * S-4: severity controls behavior — 'hard' throws, 'soft' warns.
+ */
+function checkSessionBinding(tx, programAddress, severity = "hard") {
+    const msg = tx.compiledMessage;
+    if (!msg?.staticAccounts?.length || !msg?.instructions?.length) {
+        const message = "[ShieldedSigner] Cannot verify session binding: no compiled message";
+        if (severity === "hard") {
+            throw new ShieldDeniedError([{ rule: "session_binding", message }]);
+        }
+        console.warn(message);
+        return;
+    }
+    const sigilIxs = msg.instructions.filter((ix) => msg.staticAccounts[ix.programAddressIndex] === programAddress);
+    if (sigilIxs.length === 0) {
+        const message = "[ShieldedSigner] No Sigil instructions found in transaction";
+        if (severity === "hard") {
+            throw new ShieldDeniedError([{ rule: "session_binding", message }]);
+        }
+        console.warn(message);
+        return;
+    }
+    const firstData = sigilIxs[0].data;
+    const lastData = sigilIxs[sigilIxs.length - 1].data;
+    const hasValidate = firstData &&
+        firstData.length >= 8 &&
+        matchesDiscriminator(firstData, VALIDATE_AND_AUTHORIZE_DISCRIMINATOR);
+    const hasFinalize = lastData &&
+        lastData.length >= 8 &&
+        matchesDiscriminator(lastData, FINALIZE_SESSION_DISCRIMINATOR);
+    if (!hasValidate || !hasFinalize) {
+        const message = `[ShieldedSigner] Session binding incomplete: validate=${!!hasValidate}, finalize=${!!hasFinalize}`;
+        if (severity === "hard") {
+            throw new ShieldDeniedError([{ rule: "session_binding", message }]);
+        }
+        console.warn(message);
+    }
+}
+/**
+ * S-2: Warn when resolved state is stale (older than threshold).
+ */
+function _warnIfStale(state, thresholdSec) {
+    if (!state.resolvedState)
+        return;
+    const age = Math.floor(Date.now() / 1000) -
+        Number(state.resolvedState.resolvedAtTimestamp);
+    if (age > thresholdSec) {
+        console.warn(`[Shield] Resolved state is ${age}s old (threshold: ${thresholdSec}s) — call sync() for fresh data`);
+    }
+}
+/**
+ * Compare first N bytes of data against a discriminator.
+ */
+function matchesDiscriminator(data, disc) {
+    if (data.length < disc.length)
+        return false;
+    for (let i = 0; i < disc.length; i++) {
+        if (data[i] !== disc[i])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=shield.js.map