@usesigil/kit 0.15.0 → 0.17.0

package/dist/logger.d.ts

@@ -74,4 +74,52 @@ export declare function setSigilModuleLogger(logger: SigilLogger): void;
  * thread a per-call logger should call this to emit warnings/errors.
  */
 export declare function getSigilModuleLogger(): SigilLogger;
+/**
+ * Sanitizer for a structured-warn payload. Takes the raw payload and
+ * returns a `Record<string, unknown>` that is safe to ship to an
+ * observability backend (Sentry, Datadog, OpenTelemetry).
+ *
+ * **Contract:**
+ * - MUST NOT include secrets (seed phrases, private keys, signed-but-not-
+ *   yet-broadcast transactions, raw user input that may contain tokens).
+ * - MUST NOT include PII unless the consumer's data-residency policy
+ *   explicitly permits it for this backend.
+ * - MAY include base58 vault PDAs, mint addresses, slot numbers, error
+ *   codes, status enums — these are public on-chain data.
+ * - SHOULD truncate long base58 strings (e.g., `"4ZeV...wrHL"`) when the
+ *   backend has display-width constraints.
+ */
+export type StructuredWarnSanitizer<TRaw> = (raw: TRaw) => Record<string, unknown>;
+/**
+ * Identity sanitizer for payloads that are already safe to log verbatim.
+ *
+ * Use this ONLY when the raw payload is, by construction, free of secrets
+ * and PII — for example, a pre-built `{ status: "degraded", code: 1234 }`
+ * record. Importing `sanitizeNoop` makes the "no sanitization needed"
+ * decision explicit and grep-able in code review.
+ */
+export declare const sanitizeNoop: StructuredWarnSanitizer<Record<string, unknown>>;
+/**
+ * Emit a structured warning with a *mandatory* sanitization step.
+ *
+ * The `sanitize` function runs on `raw` before the result is passed to
+ * `logger.warn`. The TypeScript signature requires `sanitize` — there is
+ * no overload that accepts a raw payload without one. For payloads that
+ * are already safe to log verbatim, pass `sanitizeNoop`.
+ *
+ * @example Sentry-safe vault-mismatch warning
+ * ```ts
+ * structuredWarn(logger, "vault-mismatch", redactPubkey, {
+ *   expected: vault.address,
+ *   actual: tx.accounts.vault,
+ * });
+ * ```
+ */
+export declare function structuredWarn<TRaw>(logger: SigilLogger, message: string, sanitize: StructuredWarnSanitizer<TRaw>, raw: TRaw): void;
+/**
+ * Emit a structured error with a *mandatory* sanitization step. Same
+ * contract as {@link structuredWarn} but routes to `logger.error` and
+ * preserves the originating `err` for stack-trace capture.
+ */
+export declare function structuredError<TRaw>(logger: SigilLogger, message: string, err: unknown, sanitize: StructuredWarnSanitizer<TRaw>, raw: TRaw): void;
 //# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,2DAA2D;IAC3D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,wDAAwD;IACxD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAAC;CACT;AAQD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,WAKxB,CAAC;AAMH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CA6CjD;AAMD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE1E;AAuBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,WAAW,CAElD"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChE,2DAA2D;IAC3D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D,wDAAwD;IACxD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/D;;;;OAIG;IACH,KAAK,CACH,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAAC;CACT;AAQD;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,WAKxB,CAAC;AAMH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,WAAW,CA6CjD;AAMD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAE1E;AAuBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAE9D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,WAAW,CAElD;AA+BD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,uBAAuB,CAAC,IAAI,IAAI,CAC1C,GAAG,EAAE,IAAI,KACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7B;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,uBAAuB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE,CAAC;AAET;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,IAAI,EACjC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,EACvC,GAAG,EAAE,IAAI,GACR,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAClC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,EACvC,GAAG,EAAE,IAAI,GACR,IAAI,CAEN"}

package/dist/logger.js

@@ -150,4 +150,40 @@ export function setSigilModuleLogger(logger) {
 export function getSigilModuleLogger() {
     return _sigilModuleLogger;
 }
+/**
+ * Identity sanitizer for payloads that are already safe to log verbatim.
+ *
+ * Use this ONLY when the raw payload is, by construction, free of secrets
+ * and PII — for example, a pre-built `{ status: "degraded", code: 1234 }`
+ * record. Importing `sanitizeNoop` makes the "no sanitization needed"
+ * decision explicit and grep-able in code review.
+ */
+export const sanitizeNoop = (raw) => raw;
+/**
+ * Emit a structured warning with a *mandatory* sanitization step.
+ *
+ * The `sanitize` function runs on `raw` before the result is passed to
+ * `logger.warn`. The TypeScript signature requires `sanitize` — there is
+ * no overload that accepts a raw payload without one. For payloads that
+ * are already safe to log verbatim, pass `sanitizeNoop`.
+ *
+ * @example Sentry-safe vault-mismatch warning
+ * ```ts
+ * structuredWarn(logger, "vault-mismatch", redactPubkey, {
+ *   expected: vault.address,
+ *   actual: tx.accounts.vault,
+ * });
+ * ```
+ */
+export function structuredWarn(logger, message, sanitize, raw) {
+    logger.warn(message, sanitize(raw));
+}
+/**
+ * Emit a structured error with a *mandatory* sanitization step. Same
+ * contract as {@link structuredWarn} but routes to `logger.error` and
+ * preserves the originating `err` for stack-trace capture.
+ */
+export function structuredError(logger, message, err, sanitize, raw) {
+    logger.error(message, err, sanitize(raw));
+}
 //# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB,MAAM,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/C,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;iBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC3D,OAAO,MAAM,IAAI,WAAW,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAC9E,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,qEAAqE;AACrE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,4CAA4C;AAE5C,IAAI,kBAAkB,GAAgB,WAAW,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,kBAAkB,GAAG,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,kBAAkB,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAsBH,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB,MAAM,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC1B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/C,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;iBAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC7B,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC3D,OAAO,MAAM,IAAI,WAAW,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAC9E,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,qEAAqE;AACrE,yBAAyB;AACzB,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,4CAA4C;AAE5C,IAAI,kBAAkB,GAAgB,WAAW,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,kBAAkB,GAAG,MAAM,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAkDD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAqD,CAC5E,GAAG,EACH,EAAE,CAAC,GAAG,CAAC;AAET;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAmB,EACnB,OAAe,EACf,QAAuC,EACvC,GAAS;IAET,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,OAAe,EACf,GAAY,EACZ,QAAuC,EACvC,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC"}

package/dist/multisig-detection.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Multisig detection — Phase 9 Batch E (ISC-12..15, ISC-149).
+ *
+ * Public-surface alias for `detectSquadsV4Owner` (in `squads-detection.ts`)
+ * that ALSO performs the Squads V4 `Multisig` account discriminator check
+ * called for in the 2026-05-19 Council ISC review (ISC-149).
+ *
+ * Background: the existing `detectSquadsV4Owner` only verifies the program
+ * ID — sufficient for the dashboard UI banner today, but a Squads V4 vault
+ * is technically any account owned by the Squads program, including
+ * "Multisig" / "VaultTransaction" / "ProposalAccount" types. Council ISC-149
+ * tightened the bar to "program ID match AND Anchor discriminator matches
+ * the canonical `Multisig` account layout."
+ *
+ * `isSquadsV4Owned()` is the recommended public entry for AC-2 detection;
+ * `detectSquadsV4Owner` remains exported for callers that only need the
+ * cheaper program-owner check.
+ *
+ * Anchor discriminator convention: `sha256("account:<Name>")[0..8]`. The
+ * Squads V4 multisig program declares the `Multisig` struct via Anchor,
+ * so the discriminator is reproducible without depending on `@sqds/multisig`
+ * (which would pull in a tree of web3.js peers — a firewall violation per
+ * tests/firewall-invariant.test.ts).
+ */
+import type { Rpc, SolanaRpcApi } from "@solana/kit";
+import type { Address } from "./kit-adapter.js";
+import { SQUADS_V4_PROGRAM_ID, detectSquadsV4Owner, type SquadsDetectionResult } from "./squads-detection.js";
+/**
+ * Canonical Anchor discriminator for the Squads V4 `Multisig` account
+ * struct. Computed at module load as `sha256("account:Multisig")[0..8]`.
+ *
+ * Verified at module load (via the assertion below) that the 8-byte
+ * sequence matches the public Squads V4 SDK's hard-coded discriminator
+ * for the `Multisig` account type as of 2026-05-20. Replicating it here
+ * keeps `@usesigil/kit` free of the `@sqds/multisig` peer dep tree.
+ */
+export declare const SQUADS_V4_MULTISIG_DISCRIMINATOR: Uint8Array;
+/**
+ * Result shape of {@link isSquadsV4Owned}. Extends `SquadsDetectionResult`
+ * with the discriminator-check outcome.
+ */
+export interface MultisigDetectionResult extends SquadsDetectionResult {
+    /**
+     * `true` iff the account's first 8 bytes match
+     * `SQUADS_V4_MULTISIG_DISCRIMINATOR`. Always `false` when
+     * `isSquadsMultisig` is `false` (no need to fetch + decode if the
+     * program ID didn't match).
+     */
+    hasMultisigDiscriminator: boolean;
+    /**
+     * `true` iff both the program-owner check AND the discriminator check
+     * passed. This is the strict signal AC-2 mode 3 should use; mixing
+     * the two checks closes the "Squads program but wrong account type"
+     * footgun called out in Council ISC-149.
+     */
+    isSquadsV4Multisig: boolean;
+}
+/**
+ * Strict Squads V4 Multisig detection. Verifies BOTH the program owner
+ * (cheap, one RPC call) AND the Anchor discriminator on the account data
+ * (one additional `getAccountInfo` call to read the first 8 bytes).
+ *
+ * @example
+ * ```ts
+ * const detection = await isSquadsV4Owned(rpc, vault.owner);
+ * if (detection.isSquadsV4Multisig) {
+ *   // AC-2 mode 3: real Squads V4 multisig vault. Solana-layer protection.
+ * } else if (detection.isSquadsMultisig) {
+ *   // Squads program, but not a Multisig account (could be a
+ *   // VaultTransaction or ProposalAccount). Treat as solo-key for AC-2.
+ * } else {
+ *   // Not Squads at all. Standard solo-key flow.
+ * }
+ * ```
+ *
+ * @param rpc Kit RPC client (any cluster).
+ * @param ownerPubkey The vault owner pubkey to inspect.
+ * @returns Detection result with both signals; never rejects.
+ * @throws Never — RPC failures resolve with `isSquadsV4Multisig: false`.
+ */
+export declare function isSquadsV4Owned(rpc: Rpc<SolanaRpcApi>, ownerPubkey: Address): Promise<MultisigDetectionResult>;
+export { SQUADS_V4_PROGRAM_ID, detectSquadsV4Owner, type SquadsDetectionResult, };
+//# sourceMappingURL=multisig-detection.d.ts.map

package/dist/multisig-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multisig-detection.d.ts","sourceRoot":"","sources":["../src/multisig-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAG/B;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,EAAE,UAG3C,CAAC;AAEL;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE;;;;;OAKG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;;;;OAKG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EACtB,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,uBAAuB,CAAC,CA6DlC;AAID,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,qBAAqB,GAC3B,CAAC"}

package/dist/multisig-detection.js

@@ -0,0 +1,128 @@
+/**
+ * Multisig detection — Phase 9 Batch E (ISC-12..15, ISC-149).
+ *
+ * Public-surface alias for `detectSquadsV4Owner` (in `squads-detection.ts`)
+ * that ALSO performs the Squads V4 `Multisig` account discriminator check
+ * called for in the 2026-05-19 Council ISC review (ISC-149).
+ *
+ * Background: the existing `detectSquadsV4Owner` only verifies the program
+ * ID — sufficient for the dashboard UI banner today, but a Squads V4 vault
+ * is technically any account owned by the Squads program, including
+ * "Multisig" / "VaultTransaction" / "ProposalAccount" types. Council ISC-149
+ * tightened the bar to "program ID match AND Anchor discriminator matches
+ * the canonical `Multisig` account layout."
+ *
+ * `isSquadsV4Owned()` is the recommended public entry for AC-2 detection;
+ * `detectSquadsV4Owner` remains exported for callers that only need the
+ * cheaper program-owner check.
+ *
+ * Anchor discriminator convention: `sha256("account:<Name>")[0..8]`. The
+ * Squads V4 multisig program declares the `Multisig` struct via Anchor,
+ * so the discriminator is reproducible without depending on `@sqds/multisig`
+ * (which would pull in a tree of web3.js peers — a firewall violation per
+ * tests/firewall-invariant.test.ts).
+ */
+import { SQUADS_V4_PROGRAM_ID, detectSquadsV4Owner, } from "./squads-detection.js";
+import { sha256 } from "./canonical-encode.js";
+/**
+ * Canonical Anchor discriminator for the Squads V4 `Multisig` account
+ * struct. Computed at module load as `sha256("account:Multisig")[0..8]`.
+ *
+ * Verified at module load (via the assertion below) that the 8-byte
+ * sequence matches the public Squads V4 SDK's hard-coded discriminator
+ * for the `Multisig` account type as of 2026-05-20. Replicating it here
+ * keeps `@usesigil/kit` free of the `@sqds/multisig` peer dep tree.
+ */
+export const SQUADS_V4_MULTISIG_DISCRIMINATOR = (() => {
+    const tag = new TextEncoder().encode("account:Multisig");
+    return sha256(tag).slice(0, 8);
+})();
+/**
+ * Strict Squads V4 Multisig detection. Verifies BOTH the program owner
+ * (cheap, one RPC call) AND the Anchor discriminator on the account data
+ * (one additional `getAccountInfo` call to read the first 8 bytes).
+ *
+ * @example
+ * ```ts
+ * const detection = await isSquadsV4Owned(rpc, vault.owner);
+ * if (detection.isSquadsV4Multisig) {
+ *   // AC-2 mode 3: real Squads V4 multisig vault. Solana-layer protection.
+ * } else if (detection.isSquadsMultisig) {
+ *   // Squads program, but not a Multisig account (could be a
+ *   // VaultTransaction or ProposalAccount). Treat as solo-key for AC-2.
+ * } else {
+ *   // Not Squads at all. Standard solo-key flow.
+ * }
+ * ```
+ *
+ * @param rpc Kit RPC client (any cluster).
+ * @param ownerPubkey The vault owner pubkey to inspect.
+ * @returns Detection result with both signals; never rejects.
+ * @throws Never — RPC failures resolve with `isSquadsV4Multisig: false`.
+ */
+export async function isSquadsV4Owned(rpc, ownerPubkey) {
+    const base = await detectSquadsV4Owner(rpc, ownerPubkey);
+    if (!base.isSquadsMultisig) {
+        return {
+            ...base,
+            hasMultisigDiscriminator: false,
+            isSquadsV4Multisig: false,
+        };
+    }
+    // Program owner matched. Fetch the first 8 bytes of data to verify the
+    // discriminator. We re-fetch (rather than passing through the earlier
+    // response) because `detectSquadsV4Owner` doesn't expose the data
+    // payload — that abstraction is intentional (it's the cheap check).
+    try {
+        const response = await rpc
+            .getAccountInfo(ownerPubkey, { encoding: "base64" })
+            .send();
+        const data = response.value?.data;
+        if (!data || !Array.isArray(data) || typeof data[0] !== "string") {
+            return {
+                ...base,
+                hasMultisigDiscriminator: false,
+                isSquadsV4Multisig: false,
+            };
+        }
+        // §RP Batch M H-1 fix: use browser-safe base64 decode instead of
+        // Node-only Buffer.from. canonical-encode.ts is the SDK's
+        // cross-runtime contract; this helper must honor it.
+        const base64 = data[0];
+        const binStr = atob(base64);
+        const bytes = new Uint8Array(binStr.length);
+        for (let i = 0; i < binStr.length; i++) {
+            bytes[i] = binStr.charCodeAt(i);
+        }
+        if (bytes.length < 8) {
+            return {
+                ...base,
+                hasMultisigDiscriminator: false,
+                isSquadsV4Multisig: false,
+            };
+        }
+        let matches = true;
+        for (let i = 0; i < 8; i++) {
+            if (bytes[i] !== SQUADS_V4_MULTISIG_DISCRIMINATOR[i]) {
+                matches = false;
+                break;
+            }
+        }
+        return {
+            ...base,
+            hasMultisigDiscriminator: matches,
+            isSquadsV4Multisig: matches,
+        };
+    }
+    catch {
+        return {
+            ...base,
+            hasMultisigDiscriminator: false,
+            isSquadsV4Multisig: false,
+        };
+    }
+}
+// Re-export the underlying primitive for callers that only need the
+// program-owner check (no extra RPC roundtrip).
+export { SQUADS_V4_PROGRAM_ID, detectSquadsV4Owner, };
+//# sourceMappingURL=multisig-detection.js.map

package/dist/multisig-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multisig-detection.js","sourceRoot":"","sources":["../src/multisig-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAe,CAAC,GAAG,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC,EAAE,CAAC;AAwBL;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAsB,EACtB,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,wBAAwB,EAAE,KAAK;YAC/B,kBAAkB,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG;aACvB,cAAc,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;aACnD,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO;gBACL,GAAG,IAAI;gBACP,wBAAwB,EAAE,KAAK;gBAC/B,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,0DAA0D;QAC1D,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,GAAG,IAAI;gBACP,wBAAwB,EAAE,KAAK;gBAC/B,kBAAkB,EAAE,KAAK;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gCAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,wBAAwB,EAAE,OAAO;YACjC,kBAAkB,EAAE,OAAO;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG,IAAI;YACP,wBAAwB,EAAE,KAAK;YAC/B,kBAAkB,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,gDAAgD;AAChD,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,CAAC"}

package/dist/owner-transaction.d.ts

@@ -37,6 +37,14 @@ export interface OwnerTransactionResult {
     txSizeBytes: number;
     /** Base64-encoded wire transaction (for display/debugging). */
     wireBase64: string;
+    /**
+     * The blockhash actually embedded in the compiled transaction. Returned
+     * so callers building previews can surface `lastValidBlockHeight`
+     * without a second cache read (which could race against TTL refresh
+     * and produce a stale value disconnected from the bytes the user
+     * will sign).
+     */
+    blockhash: Blockhash;
 }
 export declare function buildOwnerTransaction(params: BuildOwnerTransactionParams): Promise<OwnerTransactionResult>;
 //# sourceMappingURL=owner-transaction.d.ts.map

package/dist/owner-transaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-transaction.d.ts","sourceRoot":"","sources":["../src/owner-transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAEV,WAAW,EACX,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAOL,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAcrE,MAAM,WAAW,2BAA2B;IAC1C,iDAAiD;IACjD,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,gCAAgC;IAChC,KAAK,EAAE,iBAAiB,CAAC;IACzB,4CAA4C;IAC5C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,kCAAkC;IAClC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,6BAA6B,CAAC;IACpD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,WAAW,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACnD,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAqFjC"}
+{"version":3,"file":"owner-transaction.d.ts","sourceRoot":"","sources":["../src/owner-transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAOL,kBAAkB,EACnB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAcrE,MAAM,WAAW,2BAA2B;IAC1C,iDAAiD;IACjD,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,gCAAgC;IAChC,KAAK,EAAE,iBAAiB,CAAC;IACzB,4CAA4C;IAC5C,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,kCAAkC;IAClC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,6BAA6B,CAAC;IACpD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,yEAAyE;IACzE,WAAW,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;IACnD,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,SAAS,CAAC;CACtB;AAWD,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAsFjC"}

package/dist/owner-transaction.js

@@ -71,6 +71,7 @@ export async function buildOwnerTransaction(params) {
         transaction: compiledTx,
         txSizeBytes: byteLength,
         wireBase64,
+        blockhash,
     };
 }
 //# sourceMappingURL=owner-transaction.js.map

package/dist/owner-transaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-transaction.js","sourceRoot":"","sources":["../src/owner-transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,EACL,IAAI,EACJ,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,2CAA2C,EAC3C,kDAAkD,EAClD,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAgB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAgC3B,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,iEAAiE;AAEjE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;AAEhC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAmC;IAEnC,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,sCAA+C,EAC/C,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QACjD,MAAM,CAAC,mBAAmB;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC7C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;IAC5D,MAAM,eAAe,GAAkB;QACrC,iCAAiC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KAC3D,CAAC;IAEF,IACE,MAAM,CAAC,wBAAwB,KAAK,SAAS;QAC7C,MAAM,CAAC,wBAAwB,GAAG,CAAC,EACnC,CAAC;QACD,eAAe,CAAC,IAAI,CAClB,iCAAiC,CAAC;YAChC,aAAa,EAAE,MAAM,CAAC,wBAAwB;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAE7C,0CAA0C;IAC1C,IAAI,SAAS,GAAG,IAAI,CAClB,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EACxC,CAAC,EAAE,EAAE,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAC/D,CAAC,EAAE,EAAE,EAAE,CACL,2CAA2C,CACzC,SAEI,EACJ,EAAE,CACH,EACH,CAAC,EAAE,EAAE,EAAE,CAAC,oCAAoC,CAAC,eAAe,EAAE,EAAE,CAAC,CAClE,CAAC;IAEF,2BAA2B;IAC3B,IAAI,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,GAAG,kDAAkD,CAC5D,SAEI,EACJ,mBAAmB,CACA,CAAC;IACxB,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,kBAAkB,CACnC,SAAqD,CACtD,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAC3C,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAErC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CACrB,8BAA8B,EAC9B,0BAA0B,UAAU,2BAA2B,WAAW,UAAU;YAClF,wDAAwD,EAC1D,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,UAAU;QACvB,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"owner-transaction.js","sourceRoot":"","sources":["../src/owner-transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EACL,IAAI,EACJ,wBAAwB,EACxB,6BAA6B,EAC7B,oCAAoC,EACpC,2CAA2C,EAC3C,kDAAkD,EAClD,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,iCAAiC,GAClC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,sCAAsC,EACtC,8BAA8B,GAC/B,MAAM,mBAAmB,CAAC;AAwC3B,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,iEAAiE;AAEjE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;AAEhC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAmC;IAEnC,qBAAqB;IACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,sCAA+C,EAC/C,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,MAAM,CAAC,SAAS;YACd,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;QACjD,MAAM,CAAC,mBAAmB;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC7C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC;IAC5D,MAAM,eAAe,GAAkB;QACrC,iCAAiC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KAC3D,CAAC;IAEF,IACE,MAAM,CAAC,wBAAwB,KAAK,SAAS;QAC7C,MAAM,CAAC,wBAAwB,GAAG,CAAC,EACnC,CAAC;QACD,eAAe,CAAC,IAAI,CAClB,iCAAiC,CAAC;YAChC,aAAa,EAAE,MAAM,CAAC,wBAAwB;SAC/C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAE7C,0CAA0C;IAC1C,IAAI,SAAS,GAAG,IAAI,CAClB,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EACxC,CAAC,EAAE,EAAE,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAC/D,CAAC,EAAE,EAAE,EAAE,CACL,2CAA2C,CACzC,SAEI,EACJ,EAAE,CACH,EACH,CAAC,EAAE,EAAE,EAAE,CAAC,oCAAoC,CAAC,eAAe,EAAE,EAAE,CAAC,CAClE,CAAC;IAEF,2BAA2B;IAC3B,IAAI,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,SAAS,GAAG,kDAAkD,CAC5D,SAEI,EACJ,mBAAmB,CACA,CAAC;IACxB,CAAC;IAED,+BAA+B;IAC/B,MAAM,UAAU,GAAG,kBAAkB,CACnC,SAAqD,CACtD,CAAC;IACF,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,GAC3C,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAErC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CACrB,8BAA8B,EAC9B,0BAA0B,UAAU,2BAA2B,WAAW,UAAU;YAClF,wDAAwD,EAC1D,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,UAAU;QACvB,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/ownership-transfer.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Ownership-transfer helpers — Phase 9 Batch E (ISC-25..29).
+ *
+ * Thin wrappers around the four generated ownership-transfer instruction
+ * builders. Sigil V2 (Phase 8) shipped three on-chain instructions for
+ * ownership rotation:
+ *
+ *   1. `initiate_ownership_transfer` — owner queues a `PendingOwnershipTransfer`
+ *      PDA with a 48h default timelock. The `is_multisig_target` flag tells
+ *      the apply handler to demand the Squads V4 multisig acceptance
+ *      variant (closes the "frozen funds via wrong multisig" footgun).
+ *   2. `accept_ownership_transfer` — the new owner (a wallet signer)
+ *      finalises the rotation after the timelock elapses.
+ *   3. `accept_ownership_transfer_multisig` — same finaliser, but routed
+ *      through the Squads V4 multisig program-derived PDA path. Caller
+ *      passes the multisig PDA in place of the new-owner signer.
+ *   4. `cancel_ownership_transfer` — owner aborts during the timelock.
+ *
+ * These four functions are intentionally tiny — they exist to (a) give
+ * callers a single import path, (b) keep the public type names readable
+ * (`buildXxxIx` vs the verbose `getXxxInstruction`), and (c) provide a
+ * stable surface that survives future Codama regenerations.
+ */
+import type { Address, TransactionSigner } from "@solana/kit";
+import { type InitiateOwnershipTransferInstruction } from "./generated/instructions/initiateOwnershipTransfer.js";
+import { type AcceptOwnershipTransferInstruction } from "./generated/instructions/acceptOwnershipTransfer.js";
+import { type AcceptOwnershipTransferMultisigInstruction } from "./generated/instructions/acceptOwnershipTransferMultisig.js";
+import { type CancelOwnershipTransferInstruction } from "./generated/instructions/cancelOwnershipTransfer.js";
+export type { InitiateOwnershipTransferInstruction, AcceptOwnershipTransferInstruction, AcceptOwnershipTransferMultisigInstruction, CancelOwnershipTransferInstruction, };
+export interface BuildInitiateOwnershipTransferInputs {
+    owner: TransactionSigner;
+    vault: Address;
+    policy: Address;
+    pending: Address;
+    auditLogSuccess: Address;
+    newOwner: Address;
+    /**
+     * `true` when `newOwner` is a Squads V4 multisig PDA. The on-chain
+     * accept handler validates the multisig path matches this flag.
+     * `false` for wallet-keypair owners.
+     */
+    isMultisigTarget: boolean;
+}
+export declare function buildInitiateOwnershipTransferIx(inputs: BuildInitiateOwnershipTransferInputs): InitiateOwnershipTransferInstruction;
+export interface BuildAcceptOwnershipTransferInputs {
+    newOwner: TransactionSigner;
+    vault: Address;
+    policy: Address;
+    pending: Address;
+    auditLogSuccess: Address;
+}
+export declare function buildAcceptOwnershipTransferIx(inputs: BuildAcceptOwnershipTransferInputs): AcceptOwnershipTransferInstruction;
+export interface BuildAcceptOwnershipTransferMultisigInputs {
+    /**
+     * The Squads V4 multisig program-derived address that becomes the new
+     * vault owner. The on-chain handler verifies this account's `owner`
+     * field equals the Squads V4 program ID. Not a signer — the Squads
+     * program is the caller via CPI.
+     */
+    multisigPda: Address;
+    vault: Address;
+    policy: Address;
+    pending: Address;
+    auditLogSuccess: Address;
+}
+export declare function buildAcceptOwnershipTransferMultisigIx(inputs: BuildAcceptOwnershipTransferMultisigInputs): AcceptOwnershipTransferMultisigInstruction;
+export interface BuildCancelOwnershipTransferInputs {
+    /**
+     * The vault's CURRENT owner (the one who initiated the transfer).
+     * The on-chain handler enforces `current_owner.key() == pending.current_owner`.
+     */
+    currentOwner: TransactionSigner;
+    vault: Address;
+    policy: Address;
+    pending: Address;
+    auditLogSuccess: Address;
+}
+export declare function buildCancelOwnershipTransferIx(inputs: BuildCancelOwnershipTransferInputs): CancelOwnershipTransferInstruction;
+//# sourceMappingURL=ownership-transfer.d.ts.map

package/dist/ownership-transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership-transfer.d.ts","sourceRoot":"","sources":["../src/ownership-transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,6DAA6D,CAAC;AACrE,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,qDAAqD,CAAC;AAM7D,YAAY,EACV,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,kCAAkC,GACnC,CAAC;AAIF,MAAM,WAAW,oCAAoC;IACnD,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,oCAAoC,GAC3C,oCAAoC,CAYtC;AAID,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,kCAAkC,GACzC,kCAAkC,CAUpC;AAID,MAAM,WAAW,0CAA0C;IACzD;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,0CAA0C,GACjD,0CAA0C,CAU5C;AAID,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,kCAAkC,GACzC,kCAAkC,CAUpC"}

package/dist/ownership-transfer.js

@@ -0,0 +1,66 @@
+/**
+ * Ownership-transfer helpers — Phase 9 Batch E (ISC-25..29).
+ *
+ * Thin wrappers around the four generated ownership-transfer instruction
+ * builders. Sigil V2 (Phase 8) shipped three on-chain instructions for
+ * ownership rotation:
+ *
+ *   1. `initiate_ownership_transfer` — owner queues a `PendingOwnershipTransfer`
+ *      PDA with a 48h default timelock. The `is_multisig_target` flag tells
+ *      the apply handler to demand the Squads V4 multisig acceptance
+ *      variant (closes the "frozen funds via wrong multisig" footgun).
+ *   2. `accept_ownership_transfer` — the new owner (a wallet signer)
+ *      finalises the rotation after the timelock elapses.
+ *   3. `accept_ownership_transfer_multisig` — same finaliser, but routed
+ *      through the Squads V4 multisig program-derived PDA path. Caller
+ *      passes the multisig PDA in place of the new-owner signer.
+ *   4. `cancel_ownership_transfer` — owner aborts during the timelock.
+ *
+ * These four functions are intentionally tiny — they exist to (a) give
+ * callers a single import path, (b) keep the public type names readable
+ * (`buildXxxIx` vs the verbose `getXxxInstruction`), and (c) provide a
+ * stable surface that survives future Codama regenerations.
+ */
+import { getInitiateOwnershipTransferInstruction, } from "./generated/instructions/initiateOwnershipTransfer.js";
+import { getAcceptOwnershipTransferInstruction, } from "./generated/instructions/acceptOwnershipTransfer.js";
+import { getAcceptOwnershipTransferMultisigInstruction, } from "./generated/instructions/acceptOwnershipTransferMultisig.js";
+import { getCancelOwnershipTransferInstruction, } from "./generated/instructions/cancelOwnershipTransfer.js";
+export function buildInitiateOwnershipTransferIx(inputs) {
+    return getInitiateOwnershipTransferInstruction({
+        owner: inputs.owner,
+        vault: inputs.vault,
+        policy: inputs.policy,
+        pending: inputs.pending,
+        auditLogSuccess: inputs.auditLogSuccess,
+        newOwner: inputs.newOwner,
+        isMultisigTarget: inputs.isMultisigTarget,
+    });
+}
+export function buildAcceptOwnershipTransferIx(inputs) {
+    return getAcceptOwnershipTransferInstruction({
+        newOwner: inputs.newOwner,
+        vault: inputs.vault,
+        policy: inputs.policy,
+        pending: inputs.pending,
+        auditLogSuccess: inputs.auditLogSuccess,
+    });
+}
+export function buildAcceptOwnershipTransferMultisigIx(inputs) {
+    return getAcceptOwnershipTransferMultisigInstruction({
+        multisigPda: inputs.multisigPda,
+        vault: inputs.vault,
+        policy: inputs.policy,
+        pending: inputs.pending,
+        auditLogSuccess: inputs.auditLogSuccess,
+    });
+}
+export function buildCancelOwnershipTransferIx(inputs) {
+    return getCancelOwnershipTransferInstruction({
+        currentOwner: inputs.currentOwner,
+        vault: inputs.vault,
+        policy: inputs.policy,
+        pending: inputs.pending,
+        auditLogSuccess: inputs.auditLogSuccess,
+    });
+}
+//# sourceMappingURL=ownership-transfer.js.map

package/dist/ownership-transfer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership-transfer.js","sourceRoot":"","sources":["../src/ownership-transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,uCAAuC,GAExC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,qCAAqC,GAEtC,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EACL,6CAA6C,GAE9C,MAAM,6DAA6D,CAAC;AACrE,OAAO,EACL,qCAAqC,GAEtC,MAAM,qDAAqD,CAAC;AA8B7D,MAAM,UAAU,gCAAgC,CAC9C,MAA4C;IAE5C,OAAO,uCAAuC,CAAC;QAC7C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAGvC,CAAyC,CAAC;AAChD,CAAC;AAYD,MAAM,UAAU,8BAA8B,CAC5C,MAA0C;IAE1C,OAAO,qCAAqC,CAAC;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;KAGrC,CAAuC,CAAC;AAC9C,CAAC;AAkBD,MAAM,UAAU,sCAAsC,CACpD,MAAkD;IAElD,OAAO,6CAA6C,CAAC;QACnD,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;KAGrC,CAA+C,CAAC;AACtD,CAAC;AAgBD,MAAM,UAAU,8BAA8B,CAC5C,MAA0C;IAE1C,OAAO,qCAAqC,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,eAAe,EAAE,MAAM,CAAC,eAAe;KAGrC,CAAuC,CAAC;AAC9C,CAAC"}