@usesigil/kit 0.15.0 → 0.17.0

package/dist/resolve-accounts.js

@@ -24,13 +24,66 @@ function seedU64Le(value) {
 function seedU8(value) {
     return new Uint8Array([value]);
 }
-export async function getVaultPDA(owner, vaultId, programAddress = SIGIL_PROGRAM_ADDRESS) {
+/**
+ * Derive the AgentVault PDA from its on-chain seeds.
+ *
+ * **Important — post Phase 8 LBL-01:** the on-chain seed is
+ * `vault.vault_authority`, not the current `vault.owner`. The two are
+ * IDENTICAL at `initialize_vault` time (the handler writes
+ * `vault.vault_authority = owner.key()`), so at vault creation a caller
+ * may legitimately pass the initial owner here. After an
+ * `accept_ownership_transfer` the two diverge: `vault.owner` becomes the
+ * new owner while `vault.vault_authority` stays pinned to the original
+ * owner — and the on-chain PDA address is unchanged.
+ *
+ * If you are deriving a PDA for a vault that has (or might have) been
+ * ownership-transferred, prefer {@link getVaultPdaFromState} which reads
+ * `vault_authority` directly from on-chain state. Passing the current
+ * `owner` here for a transferred vault produces the WRONG address and
+ * silently returns a PDA that does not exist on-chain.
+ *
+ * @param vaultAuthority — the immutable seed-key. At `initialize_vault`
+ *   time this is the same as `owner`; thereafter callers must read it
+ *   from `AgentVault.vault_authority`.
+ * @param vaultId — the same `u64` passed to `initialize_vault`.
+ * @param programAddress — defaults to the canonical Sigil program id.
+ *
+ * @deprecated NH-4 close (Bucket 2 re-audit 2026-05-21): the parameter
+ *   was renamed `owner → vaultAuthority` in 0.16.0 to make the LBL-01
+ *   contract explicit at the type level. Direct callers that historically
+ *   passed `vault.owner` will now silently derive the WRONG PDA for any
+ *   ownership-transferred vault. Use {@link getVaultPdaFromState} which
+ *   takes a `{ vaultAuthority, vaultId }` shape — the field name forces
+ *   the caller to read the immutable seed from on-chain state rather
+ *   than assume `owner == vault_authority`. This function stays for
+ *   pre-LBL-01 backward compatibility (init-time call sites where the
+ *   two are equal by construction) and will be removed in v0.18.
+ */
+export async function getVaultPDA(vaultAuthority, vaultId, programAddress = SIGIL_PROGRAM_ADDRESS) {
     const [pda, bump] = await getProgramDerivedAddress({
         programAddress,
-        seeds: [seedString("vault"), seedAddress(owner), seedU64Le(vaultId)],
+        seeds: [
+            seedString("vault"),
+            seedAddress(vaultAuthority),
+            seedU64Le(vaultId),
+        ],
     });
     return [pda, bump];
 }
+/**
+ * Derive the AgentVault PDA from on-chain state.
+ *
+ * **Use this AFTER an ownership transfer.** Reads `vault.vault_authority`
+ * (the immutable Phase 8 LBL-01 seed-key) instead of the current
+ * `vault.owner`, which would resolve to the wrong PDA once
+ * `accept_ownership_transfer` has run.
+ *
+ * Equivalent to calling `getVaultPDA(vault.vaultAuthority, vault.vaultId)`,
+ * but the dedicated name documents the intent at the call site.
+ */
+export async function getVaultPdaFromState(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
+    return getVaultPDA(vault.vaultAuthority, vault.vaultId, programAddress);
+}
 export async function getPolicyPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
     const [pda, bump] = await getProgramDerivedAddress({
         programAddress,
@@ -64,18 +117,7 @@ export async function getPendingPolicyPDA(vault, programAddress = SIGIL_PROGRAM_
     });
     return [pda, bump];
 }
-export async function getEscrowPDA(sourceVault, destinationVault, escrowId, programAddress = SIGIL_PROGRAM_ADDRESS) {
-    const [pda, bump] = await getProgramDerivedAddress({
-        programAddress,
-        seeds: [
-            seedString("escrow"),
-            seedAddress(sourceVault),
-            seedAddress(destinationVault),
-            seedU64Le(escrowId),
-        ],
-    });
-    return [pda, bump];
-}
+// getEscrowPDA REMOVED in v2 revamp Stage 1 (escrow feature deleted).
 export async function getAgentOverlayPDA(vault, shardIndex = 0, programAddress = SIGIL_PROGRAM_ADDRESS) {
     const [pda, bump] = await getProgramDerivedAddress({
         programAddress,
@@ -83,29 +125,27 @@ export async function getAgentOverlayPDA(vault, shardIndex = 0, programAddress =
     });
     return [pda, bump];
 }
-export async function getConstraintsPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
-    const [pda, bump] = await getProgramDerivedAddress({
-        programAddress,
-        seeds: [seedString("constraints"), seedAddress(vault)],
-    });
-    return [pda, bump];
-}
-export async function getPendingConstraintsPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
+/**
+ * Phase 7 — derive PDA for `AuditLogSuccess` at `[b"audit_success", vault]`.
+ * Allocated at vault creation, written by every mutating instruction that
+ * lands on the success path. Closed at `close_vault`.
+ */
+export async function getAuditLogSuccessPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
     const [pda, bump] = await getProgramDerivedAddress({
         programAddress,
-        seeds: [seedString("pending_constraints"), seedAddress(vault)],
+        seeds: [seedString("audit_success"), seedAddress(vault)],
     });
     return [pda, bump];
 }
 /**
- * Derive PDA for pending CLOSE constraints (queue_close_constraints).
- * Seed: "pending_close_constraints" — NOT the same as "pending_constraints" (which is for updates).
- * See close_vault.rs:127.
+ * Phase 7 — derive PDA for `AuditLogRejected` at `[b"audit_rejected", vault]`.
+ * Audit #2 F-19 split: keeps rejected-finalize bursts out of the success
+ * buffer's blast radius.
  */
-export async function getPendingCloseConstraintsPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
+export async function getAuditLogRejectedPDA(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
     const [pda, bump] = await getProgramDerivedAddress({
         programAddress,
-        seeds: [seedString("pending_close_constraints"), seedAddress(vault)],
+        seeds: [seedString("audit_rejected"), seedAddress(vault)],
     });
     return [pda, bump];
 }
@@ -123,10 +163,6 @@ export async function resolveAccounts(input, programAddress = SIGIL_PROGRAM_ADDR
         trackerPda,
         sessionPda,
     };
-    if (input.hasConstraints) {
-        const [constraintsPda] = await getConstraintsPDA(input.vault, programAddress);
-        result.constraintsPda = constraintsPda;
-    }
     return result;
 }
 //# sourceMappingURL=resolve-accounts.js.map

package/dist/resolve-accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-accounts.js","sourceRoot":"","sources":["../src/resolve-accounts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,gFAAgF;AAEhF,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;AACpC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAItC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAc,EACd,OAAe,EACf,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,KAAc,EACd,SAAkB,EAClB,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE;YACL,UAAU,CAAC,SAAS,CAAC;YACrB,WAAW,CAAC,KAAK,CAAC;YAClB,WAAW,CAAC,KAAK,CAAC;YAClB,WAAW,CAAC,SAAS,CAAC;SACvB;KACF,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAoB,EACpB,gBAAyB,EACzB,QAAgB,EAChB,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE;YACL,UAAU,CAAC,QAAQ,CAAC;YACpB,WAAW,CAAC,WAAW,CAAC;YACxB,WAAW,CAAC,gBAAgB,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC;SACpB;KACF,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,aAAqB,CAAC,EACtB,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KACvD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KACrE,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAsBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA2B,EAC3B,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,aAAa,CACtC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,cAAc,CACf,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS;QACT,UAAU;QACV,UAAU;KACX,CAAC;IAEF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,iBAAiB,CAC9C,KAAK,CAAC,KAAK,EACX,cAAc,CACf,CAAC;QACF,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"resolve-accounts.js","sourceRoot":"","sources":["../src/resolve-accounts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAoBtE,gFAAgF;AAEhF,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;AACpC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAItC,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,cAAuB,EACvB,OAAe,EACf,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE;YACL,UAAU,CAAC,OAAO,CAAC;YACnB,WAAW,CAAC,cAAc,CAAC;YAC3B,SAAS,CAAC,OAAO,CAAC;SACnB;KACF,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAyB,EACzB,iBAA0B,qBAAqB;IAE/C,OAAO,WAAW,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAc,EACd,KAAc,EACd,SAAkB,EAClB,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE;YACL,UAAU,CAAC,SAAS,CAAC;YACrB,WAAW,CAAC,KAAK,CAAC;YAClB,WAAW,CAAC,KAAK,CAAC;YAClB,WAAW,CAAC,SAAS,CAAC;SACvB;KACF,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,sEAAsE;AAEtE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,aAAqB,CAAC,EACtB,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,wBAAwB,CAAC;QACjD,cAAc;QACd,KAAK,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrB,CAAC;AAoBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA2B,EAC3B,iBAA0B,qBAAqB;IAE/C,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACpE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,aAAa,CACtC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,cAAc,CACf,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS;QACT,UAAU;QACV,UAAU;KACX,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rpc-helpers.d.ts

@@ -17,6 +17,14 @@ export interface SendAndConfirmOptions {
     pollIntervalMs?: number;
     /** Confirmation commitment. Default: "confirmed" */
     commitment?: Commitment;
+    /**
+     * Skip preflight simulation. Default: false. Required for slot-bound
+     * transactions (e.g. initialize_vault's PEN-CROSS-2 digest): preflight
+     * simulates at the CURRENT slot, which mismatches a digest bound to a FUTURE
+     * execution slot and rejects with PolicyPreviewMismatch before the tx ever
+     * lands. Sending unsimulated lets it execute at the bound slot.
+     */
+    skipPreflight?: boolean;
 }
 /**
  * Get (or create) the blockhash cache scoped to a specific RPC client.
@@ -57,10 +65,28 @@ export declare class BlockhashCache {
     private refresh;
 }
 /**
- * Sign a compiled transaction and encode to base64 wire format.
+ * Sign a COMPILED transaction and encode it to base64 wire format.
+ *
+ * `signer` may be either kind of Kit transaction signer, and the two kinds
+ * have DIFFERENT return contracts:
+ *
+ *   - A `TransactionModifyingSigner` (`modifyAndSignTransactions`) returns the
+ *     fully-formed signed transaction object directly.
+ *   - A `TransactionPartialSigner` — which includes every `@solana/kit`
+ *     `KeyPairSigner` — returns a `SignatureDictionary`
+ *     (`Record<Address, SignatureBytes>`), NOT a transaction. That dictionary
+ *     must be MERGED into the compiled transaction's `signatures` map to yield
+ *     a sendable transaction.
  *
- * Handles Kit's TransactionSigner interface which may expose
- * `modifyAndSignTransactions` or `signTransactions` (both accept/return arrays).
+ * The previous implementation called `signTransactions([tx])` and fed
+ * `results[0]` straight to `getBase64EncodedWireTransaction`. For a partial
+ * signer that `results[0]` is a signature dictionary with no `messageBytes`,
+ * so the encoder threw `Cannot read properties of undefined (reading
+ * 'length')`. Delegating to Kit's `signTransactionWithSigners` fixes this: it
+ * categorizes the signer, applies modifying signers then partial signers
+ * (merging their `SignatureDictionary` into `transaction.signatures`), and
+ * asserts the result is fully signed — returning a `SendableTransaction` that
+ * still carries `messageBytes` for the encoder.
  *
  * @returns Base64-encoded wire transaction ready for sendTransaction RPC.
  */

package/dist/rpc-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-helpers.d.ts","sourceRoot":"","sources":["../src/rpc-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,GAAG,EACH,YAAY,EACZ,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAoB1B,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAsBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,cAAc,CAOxE;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,KAAK,CAAC,EAAE,MAAM;IAI1B;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD;;OAEG;IACH,UAAU,IAAI,IAAI;YAKJ,OAAO;CAgBtB;AAID;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,4BAA4B,CAAC,CA0BvC;AAID;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EACtB,kBAAkB,EAAE,4BAA4B,EAChD,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CA2DjB"}
+{"version":3,"file":"rpc-helpers.d.ts","sourceRoot":"","sources":["../src/rpc-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,GAAG,EACH,YAAY,EACZ,UAAU,EACV,4BAA4B,EAC5B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAuB1B,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAsBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,cAAc,CAOxE;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,KAAK,CAAC,EAAE,MAAM;IAI1B;;OAEG;IACG,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD;;OAEG;IACH,UAAU,IAAI,IAAI;YAKJ,OAAO;CAgBtB;AAID;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,iBAAiB,EACzB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAiDvC;AAID;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EACtB,kBAAkB,EAAE,4BAA4B,EAChD,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAiEjB"}

package/dist/rpc-helpers.js

@@ -5,7 +5,7 @@
  * - signAndEncode: Sign a compiled TX + encode to base64 wire format
  * - sendAndConfirmTransaction: Send + poll getSignatureStatuses
  */
-import { getBase64EncodedWireTransaction } from "./kit-adapter.js";
+import { getBase64EncodedWireTransaction, signTransactionWithSigners, } from "./kit-adapter.js";
 import { SigilSdkDomainError } from "./errors/sdk.js";
 import { SigilRpcError } from "./errors/rpc.js";
 import { SIGIL_ERROR__SDK__SIGNER_INVALID, SIGIL_ERROR__SDK__SIGNATURE_INVALID, SIGIL_ERROR__RPC__TX_FAILED, SIGIL_ERROR__RPC__CONFIRMATION_TIMEOUT, } from "./errors/codes.js";
@@ -95,24 +95,59 @@ export class BlockhashCache {
 }
 // ─── signAndEncode ───────────────────────────────────────────────────────────
 /**
- * Sign a compiled transaction and encode to base64 wire format.
+ * Sign a COMPILED transaction and encode it to base64 wire format.
  *
- * Handles Kit's TransactionSigner interface which may expose
- * `modifyAndSignTransactions` or `signTransactions` (both accept/return arrays).
+ * `signer` may be either kind of Kit transaction signer, and the two kinds
+ * have DIFFERENT return contracts:
+ *
+ *   - A `TransactionModifyingSigner` (`modifyAndSignTransactions`) returns the
+ *     fully-formed signed transaction object directly.
+ *   - A `TransactionPartialSigner` — which includes every `@solana/kit`
+ *     `KeyPairSigner` — returns a `SignatureDictionary`
+ *     (`Record<Address, SignatureBytes>`), NOT a transaction. That dictionary
+ *     must be MERGED into the compiled transaction's `signatures` map to yield
+ *     a sendable transaction.
+ *
+ * The previous implementation called `signTransactions([tx])` and fed
+ * `results[0]` straight to `getBase64EncodedWireTransaction`. For a partial
+ * signer that `results[0]` is a signature dictionary with no `messageBytes`,
+ * so the encoder threw `Cannot read properties of undefined (reading
+ * 'length')`. Delegating to Kit's `signTransactionWithSigners` fixes this: it
+ * categorizes the signer, applies modifying signers then partial signers
+ * (merging their `SignatureDictionary` into `transaction.signatures`), and
+ * asserts the result is fully signed — returning a `SendableTransaction` that
+ * still carries `messageBytes` for the encoder.
  *
  * @returns Base64-encoded wire transaction ready for sendTransaction RPC.
  */
 export async function signAndEncode(signer, compiledTx) {
+    // Preserve the prior interface guard: a signer that implements NEITHER
+    // partial- nor modifying-signing is rejected up front with the same domain
+    // error/code as before (rather than surfacing as a raw Kit SolanaError from
+    // inside signTransactionWithSigners, which would filter the signer out and
+    // fail later on a missing-signatures assertion).
     const signerTyped = signer;
-    const signFn = signerTyped.modifyAndSignTransactions ?? signerTyped.signTransactions;
-    if (typeof signFn !== "function") {
+    const hasSignMethod = typeof signerTyped.modifyAndSignTransactions === "function" ||
+        typeof signerTyped.signTransactions === "function";
+    if (!hasSignMethod) {
         throw new SigilSdkDomainError(SIGIL_ERROR__SDK__SIGNER_INVALID, "Signer must implement signTransactions() or modifyAndSignTransactions()", { context: { reason: "missing-sign-method" } });
     }
-    const results = await signFn.call(signerTyped, [compiledTx]);
-    if (!Array.isArray(results) || results.length === 0) {
-        throw new SigilSdkDomainError(SIGIL_ERROR__SDK__SIGNATURE_INVALID, "signTransactions returned invalid result: expected non-empty array", { context: { reason: "empty-or-non-array" } });
+    let signedTx;
+    try {
+        // Handles BOTH signer kinds: modifying signers transform the tx, partial
+        // signers (KeyPairSigner) get their SignatureDictionary merged into
+        // `compiledTx.signatures`. Asserts full-signedness before returning.
+        // `signer` is the broad `TransactionSigner` union; the guard above already
+        // confirmed it is a partial- or modifying-signer (the only kinds
+        // signTransactionWithSigners accepts), so narrow it for the call.
+        signedTx = await signTransactionWithSigners([signer], compiledTx);
+    }
+    catch (err) {
+        // A signer that produced no/partial signatures (e.g. wrong signer for this
+        // fee payer) surfaces here as a Kit signatures-missing assertion. Map it to
+        // the established domain error/code so callers' error handling is unchanged.
+        throw new SigilSdkDomainError(SIGIL_ERROR__SDK__SIGNATURE_INVALID, `signAndEncode: failed to produce a fully-signed transaction: ${err instanceof Error ? err.message : String(err)}`, { context: { reason: "sign-failed" } });
     }
-    const [signedTx] = results;
     return getBase64EncodedWireTransaction(signedTx);
 }
 // ─── sendAndConfirmTransaction ──────────────────────────────────────────────
@@ -128,7 +163,7 @@ export async function sendAndConfirmTransaction(rpc, encodedTransaction, options
     const signature = await rpc
         .sendTransaction(encodedTransaction, {
         encoding: "base64",
-        skipPreflight: false,
+        skipPreflight: options?.skipPreflight ?? false,
         preflightCommitment: commitment,
     })
         .send();
@@ -142,7 +177,11 @@ export async function sendAndConfirmTransaction(rpc, encodedTransaction, options
             const status = statuses[0];
             // Check for error
             if (status.err) {
-                throw new SigilRpcError(SIGIL_ERROR__RPC__TX_FAILED, `Transaction ${signature} failed: ${JSON.stringify(status.err)}`, { context: { signature: signature } });
+                // status.err carries Kit's BigInt-typed fields (e.g. u64 indices), so a
+                // plain JSON.stringify throws "Do not know how to serialize a BigInt"
+                // and MASKS the real on-chain error. Serialize BigInts as strings.
+                const errJson = JSON.stringify(status.err, (_k, v) => typeof v === "bigint" ? v.toString() : v);
+                throw new SigilRpcError(SIGIL_ERROR__RPC__TX_FAILED, `Transaction ${signature} failed: ${errJson}`, { context: { signature: signature } });
             }
             // Check for sufficient confirmation
             const level = status.confirmationStatus;

package/dist/rpc-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-helpers.js","sourceRoot":"","sources":["../src/rpc-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,gCAAgC,EAChC,mCAAmC,EACnC,2BAA2B,EAC3B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAwB3B,+EAA+E;AAE/E,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,IAAI,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;QAC7B,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,MAAM,GAAqB,IAAI,CAAC;IAChC,SAAS,GAAG,CAAC,CAAC;IACL,KAAK,CAAS;IAE/B,YAAY,KAAc;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,wBAAwB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,GAAsB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAsB;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG;aACrB,kBAAkB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aAC/C,IAAI,EAAE,CAAC;QAEV,MAAM,KAAK,GAAG,MAAM,CAAC,KAGpB,CAAC;QACF,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,UAAmB;IAEnB,MAAM,WAAW,GAAG,MAGnB,CAAC;IACF,MAAM,MAAM,GACV,WAAW,CAAC,yBAAyB,IAAI,WAAW,CAAC,gBAAgB,CAAC;IACxE,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,yEAAyE,EACzE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,EACnC,oEAAoE,EACpE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC3B,OAAO,+BAA+B,CACpC,QAAiE,CAClE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAsB,EACtB,kBAAgD,EAChD,OAA+B;IAE/B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,KAAK,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAC;IAEtD,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,GAAG;SACxB,eAAe,CAAC,kBAAkB,EAAE;QACnC,QAAQ,EAAE,QAAiB;QAC3B,aAAa,EAAE,KAAK;QACpB,mBAAmB,EAAE,UAAU;KAChC,CAAC;SACD,IAAI,EAAE,CAAC;IAEV,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,KAAK,GAAG,cAAc,CAAC;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExE,MAAM,QAAQ,GACZ,YAGD,CAAC,KAAK,CAAC;QACR,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3B,kBAAkB;YAClB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,MAAM,IAAI,aAAa,CACrB,2BAA2B,EAC3B,eAAe,SAAS,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAChE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAmB,EAAE,EAAE,CAChD,CAAC;YACJ,CAAC;YAED,oCAAoC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACxC,IACE,KAAK,KAAK,WAAW;gBACrB,KAAK,KAAK,WAAW;gBACrB,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,CAAC,EACrD,CAAC;gBACD,OAAO,SAAmB,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,aAAa,CACrB,sCAAsC,EACtC,eAAe,SAAS,iCAAiC,SAAS,IAAI,EACtE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAmB,EAAE,SAAS,EAAE,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"rpc-helpers.js","sourceRoot":"","sources":["../src/rpc-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,gCAAgC,EAChC,mCAAmC,EACnC,2BAA2B,EAC3B,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAgC3B,+EAA+E;AAE/E,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAqC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,IAAI,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;QAC7B,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,cAAc;IACjB,MAAM,GAAqB,IAAI,CAAC;IAChC,SAAS,GAAG,CAAC,CAAC;IACL,KAAK,CAAS;IAE/B,YAAY,KAAc;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,wBAAwB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,GAAsB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAsB;QAC1C,MAAM,MAAM,GAAG,MAAM,GAAG;aACrB,kBAAkB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aAC/C,IAAI,EAAE,CAAC;QAEV,MAAM,KAAK,GAAG,MAAM,CAAC,KAGpB,CAAC;QACF,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAyB,EACzB,UAAmB;IAEnB,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iDAAiD;IACjD,MAAM,WAAW,GAAG,MAGnB,CAAC;IACF,MAAM,aAAa,GACjB,OAAO,WAAW,CAAC,yBAAyB,KAAK,UAAU;QAC3D,OAAO,WAAW,CAAC,gBAAgB,KAAK,UAAU,CAAC;IACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,yEAAyE,EACzE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,QAAgE,CAAC;IACrE,IAAI,CAAC;QACH,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,2EAA2E;QAC3E,iEAAiE;QACjE,kEAAkE;QAClE,QAAQ,GAAG,MAAM,0BAA0B,CACzC,CAAC,MAAM,CAAqD,EAC5D,UAA8D,CAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,EACnC,gEACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,EACF,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CACpC,QAAiE,CAClE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAsB,EACtB,kBAAgD,EAChD,OAA+B;IAE/B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;IAC/C,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,KAAK,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAC;IAEtD,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,GAAG;SACxB,eAAe,CAAC,kBAAkB,EAAE;QACnC,QAAQ,EAAE,QAAiB;QAC3B,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,KAAK;QAC9C,mBAAmB,EAAE,UAAU;KAChC,CAAC;SACD,IAAI,EAAE,CAAC;IAEV,wBAAwB;IACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,KAAK,GAAG,cAAc,CAAC;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAExE,MAAM,QAAQ,GACZ,YAGD,CAAC,KAAK,CAAC;QACR,IAAI,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE3B,kBAAkB;YAClB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,wEAAwE;gBACxE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CACnD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;gBACF,MAAM,IAAI,aAAa,CACrB,2BAA2B,EAC3B,eAAe,SAAS,YAAY,OAAO,EAAE,EAC7C,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAmB,EAAE,EAAE,CAChD,CAAC;YACJ,CAAC;YAED,oCAAoC;YACpC,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,CAAC;YACxC,IACE,KAAK,KAAK,WAAW;gBACrB,KAAK,KAAK,WAAW;gBACrB,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,CAAC,EACrD,CAAC;gBACD,OAAO,SAAmB,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,aAAa,CACrB,sCAAsC,EACtC,eAAe,SAAS,iCAAiC,SAAS,IAAI,EACtE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAmB,EAAE,SAAS,EAAE,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/seal/intent-digest.d.ts

@@ -0,0 +1,195 @@
+/**
+ * AL3 — `computeSealInputDigest()` per-call intent digest.
+ * Phase 9 Batch I (ISC-69..76, 143, 148, 150, 153, 155).
+ *
+ * SHA-256 over a canonical Borsh-style encoding of the SealInput envelope
+ * (vault, agent identity, mint, amount, target protocol, network, sealed
+ * instructions). Mirrors the discipline of TA-19's `policy_preview_digest`
+ * (`sdk/kit/src/policy/compute-policy-preview-digest.ts`) — same primitive
+ * (SHA-256 via the shared `canonical-encode.ts` helper), same APPEND-ONLY
+ * field ordering, same byte-equal cross-runtime test fixture pattern.
+ *
+ * **What this defends against**
+ * TA-19 binds the POLICY STATE the owner approved (allowlists, caps,
+ * cosign flag, agent set hash). It does NOT bind the specific call the
+ * agent is making — a compromised agent can still propose a transfer to
+ * an attacker-controlled but still-allowlisted recipient, or reorder
+ * instruction account metas to swap a destination, and the policy
+ * checks all pass. AL3 closes that gap: the owner approves a SPECIFIC
+ * intent (recipient, amount, mint, ix shape) in the preview UI, the SDK
+ * hashes that intent into a 32-byte digest, and `executeSeal` rejects
+ * if the bundle assembled at submit time produces a different digest.
+ *
+ * **Canonical encoding (FIXED — DO NOT REORDER)**
+ *
+ *   1. intent_version: u8 = 1                          (1 byte, reserved
+ *                                                       for future format
+ *                                                       evolution per
+ *                                                       Council ISC-155)
+ *   2. network_id: u8                                  (1 byte; 0=devnet,
+ *                                                       1=mainnet — binds
+ *                                                       AL4 isMainnet so
+ *                                                       a mainnet bundle
+ *                                                       can't be replayed
+ *                                                       through a devnet
+ *                                                       preview)
+ *   3. vault: Pubkey                                   (32 bytes)
+ *   4. agent: Pubkey                                   (32 bytes —
+ *                                                       agent IDENTITY,
+ *                                                       not signer)
+ *   5. token_mint: Pubkey                              (32 bytes)
+ *   6. amount: u64 LE                                  (8 bytes)
+ *   7. target_protocol: Pubkey                         (32 bytes; system
+ *                                                       program if the
+ *                                                       caller omitted
+ *                                                       targetProtocol)
+ *   8. instructions: Vec<Ix>                           (u32 LE length ++
+ *                                                       each ix below)
+ *
+ *   Each ix:
+ *     a. program_address: Pubkey                       (32 bytes)
+ *     b. accounts: Vec<(address: Pubkey, role: u8)>    (u32 LE length ++
+ *                                                       each 33-byte
+ *                                                       entry)
+ *     c. data: Vec<u8>                                 (u32 LE length ++
+ *                                                       data bytes)
+ *
+ * **Discipline guardrails**
+ *
+ * - NEVER `JSON.stringify` the input. Object property iteration order is
+ *   not stable across engines and silent reorderings would invalidate
+ *   the digest invariant. The canonical encoder walks fields explicitly.
+ * - 32-byte pubkey comparisons use `Buffer.compare` on raw bytes (NOT
+ *   base58 lexicographic) so the byte ordering matches Solana's
+ *   `Pubkey::cmp` exactly. Council ISC-150 flagged this as a critical
+ *   bug class — base58 lex doesn't preserve the canonical byte ordering
+ *   when leading-zero counts differ.
+ * - Account meta order is preserved as supplied. Reordering metas — even
+ *   identical pubkeys — produces a different digest. This is the load-
+ *   bearing protection against "swap recipient slots" attacks.
+ * - `intent_version: u8 = 1` at position 1 reserves the discriminant
+ *   for future format upgrades. A v2 SealInput format would write
+ *   `intent_version: 2` and the on-chain verifier could route to the
+ *   correct decoder by reading the first byte.
+ *
+ * **Canonical input contract (load-bearing)**
+ *
+ * `seal()` hashes the **pre-rewrite, post-filter** DeFi instructions:
+ *
+ *   1. ComputeBudget program ixs are NOT in the input (wallet adapters
+ *      may prepend their own; the user-approved intent shouldn't pin
+ *      a specific budget). `seal()` filters these out via
+ *      `params.instructions.filter(ix => ix.programAddress !== COMPUTE_BUDGET_PROGRAM)`
+ *      before computing the digest.
+ *   2. Top-level System program ixs are NOT in the input (`isProtocolAllowed`
+ *      would reject them anyway; `seal()` strips them in the same filter).
+ *   3. Agent-ATA → vault-ATA rewrites happen AFTER the digest is
+ *      computed. The digest reflects what the USER APPROVED (agent
+ *      ATAs), not what the SDK SUBMITTED (vault ATAs). Any future
+ *      on-chain verifier MUST receive the pre-rewrite projection as
+ *      an explicit argument; re-deriving from the submitted tx bytes
+ *      is impossible.
+ *   4. `outputStablecoinAccount` and `additionalAtaReplacements` from
+ *      `SealParams` are NOT bound by the digest in 0.16.x — they are
+ *      caller-supplied overrides that materially change downstream
+ *      ATA flow. Phase 9 Batch M §RP flagged this as a HIGH gap. A
+ *      preview UI that wants tight intent binding MUST refuse any
+ *      `SealParams` carrying these overrides until 0.16.1 hashes them
+ *      into the canonical encoding.
+ *
+ * Any re-implementation that wants to verify a digest produced by
+ * `seal()` MUST apply the same filter + use the pre-rewrite ix list.
+ */
+import type { Address, Instruction } from "../kit-adapter.js";
+/**
+ * Network discriminant used at canonical position 2. Devnet and mainnet
+ * are the two values bound by the digest; testnet and localnet are
+ * coerced to devnet for digest purposes (the cap/allowlist contract is
+ * the same on all non-mainnet networks).
+ *
+ * @internal The numeric discriminants are an encoding detail of the
+ * canonical digest layout. Callers should pass `network: "devnet" |
+ * "mainnet"` to {@link computeSealInputDigest} and let the encoder map
+ * to the wire value. Consumers wanting a CAIP-2 string for cross-system
+ * binding should use `CAIP2_SOLANA_*` from `../caip2-network.js`.
+ */
+export declare const NETWORK_ID_DEVNET: 0;
+/** @internal See {@link NETWORK_ID_DEVNET}. */
+export declare const NETWORK_ID_MAINNET: 1;
+/**
+ * Inputs to {@link computeSealInputDigest}. A narrower projection of
+ * `SealParams` containing only the binding fields.
+ *
+ * `targetProtocol` is optional; when omitted, the system program ID
+ * (`11111111111111111111111111111111`) is encoded at canonical position
+ * 7. The on-chain verifier MUST mirror this default to keep the digest
+ * stable.
+ */
+export interface SealIntentInput {
+    vault: Address | string;
+    /**
+     * Agent identity pubkey. In V2 (Phase 9) the agent identity IS the
+     * signer address — `params.agent.address` from `seal()`. If a future
+     * V3 multi-sig flow ever separates signer from identity, this field
+     * MUST carry the IDENTITY (the address that was registered in the
+     * vault's agent list), not the signer.
+     */
+    agent: Address | string;
+    tokenMint: Address | string;
+    amount: bigint;
+    targetProtocol?: Address | string;
+    network: "devnet" | "mainnet";
+    instructions: readonly Pick<Instruction, "programAddress" | "accounts" | "data">[];
+}
+/**
+ * Compute the canonical AL3 intent digest over a `SealIntentInput`.
+ *
+ * @returns 32-byte SHA-256 digest. Stable across Node, Bun, and the
+ * browser (Phase 9 Batch L hex fixtures lock this down).
+ *
+ * @throws if any pubkey doesn't base58-decode to exactly 32 bytes, if
+ *   `amount` is negative, or if `network` isn't `"devnet"` or `"mainnet"`.
+ */
+export declare function computeSealInputDigest(input: SealIntentInput): Uint8Array;
+/**
+ * Inputs to {@link computeScalarIntentDigest} — the on-chain-verifiable
+ * SCALAR subset of {@link SealIntentInput}.
+ *
+ * Drops the `instructions` array because the on-chain verifier does not
+ * (yet) recompute the full ix-bound digest — that requires the ATA-rewrite
+ * mapping table to cross the seal()/validate_and_authorize boundary, which
+ * is v0.17+ work. The scalar subset binds the recipient/amount/mint/protocol
+ * fields the user approves in the preview UI; ix-data tamper is still
+ * gated by R-1..R-4 + TA-12 + TA-14 post-execution invariants.
+ */
+export interface ScalarIntentInput {
+    vault: Address | string;
+    agent: Address | string;
+    tokenMint: Address | string;
+    amount: bigint;
+    targetProtocol?: Address | string;
+    network: "devnet" | "mainnet";
+}
+/**
+ * Compute the canonical scalar AL3 intent digest (D-1 + D-6 close, Bucket
+ * 2 2026-05-21).
+ *
+ * SHA-256 over: `b"SIG1" || u8(2) || u8(network_id) || vault || agent ||
+ * token_mint || u64_le(amount) || target_protocol`. Total 142 bytes.
+ *
+ * The on-chain verifier at `programs/sigil/src/utils/intent_digest.rs`
+ * recomputes this same digest from `validate_and_authorize`'s typed
+ * arguments and rejects bundle execution on byte-equal mismatch
+ * (`ErrIntentDigestMismatch` code 6102). Network discriminant is derived
+ * on-chain from the program's build feature; the caller does NOT pin it
+ * — the encoder here just writes the byte the caller's wallet computed,
+ * and Rust verifies the byte matches its own network. Wrong-network
+ * digests fail by construction.
+ *
+ * @returns 32-byte SHA-256 digest, byte-equal to the Rust verifier output.
+ *
+ * @throws if any pubkey doesn't base58-decode to 32 bytes, if `amount`
+ *   is negative, or if `network` isn't `"devnet"` or `"mainnet"`.
+ */
+export declare function computeScalarIntentDigest(input: ScalarIntentInput): Uint8Array;
+//# sourceMappingURL=intent-digest.d.ts.map

package/dist/seal/intent-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-digest.d.ts","sourceRoot":"","sources":["../../src/seal/intent-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAe9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAG,CAAU,CAAC;AAC5C,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,CAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,YAAY,EAAE,SAAS,IAAI,CACzB,WAAW,EACX,gBAAgB,GAAG,UAAU,GAAG,MAAM,CACvC,EAAE,CAAC;CACL;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA8LzE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,GACvB,UAAU,CA4EZ"}