@usesigil/kit 0.16.0 → 0.18.0

package/dist/policy/compute-cosign-digest.js

@@ -0,0 +1,318 @@
+/**
+ * TA-09 — Canonical cosign digest (SDK side).
+ *
+ * Mirrors `programs/sigil/src/utils/cosign_digest.rs` exactly. The SDK
+ * computes this off-chain, the owner+cosigner sign `queue_policy_update` with
+ * the cosign session pubkey as an arg. The on-chain handler:
+ *   1. At queue time, recomputes the digest from the resulting pending args +
+ *      the cosign session pubkey and stores it on `PendingPolicyUpdate`.
+ *   2. At apply time, recomputes it AGAIN from the persisted pending args and
+ *      asserts byte-equality. Any tamper of pending args between queue and
+ *      apply (e.g. a future discriminator-collision attack on the pending PDA)
+ *      produces a digest mismatch and a hard reject (`ErrCosignRequired`,
+ *      6089).
+ *
+ * The cosign digest is INTENTIONALLY narrower than TA-19 `policy_preview_digest`:
+ * only the FIELDS that participate in "elevated mutation" detection are in
+ * scope. Non-elevated fields (developer_fee_rate, max_slippage_bps,
+ * session_expiry_seconds, timelock_duration narrowing, protocol_mode,
+ * destination_mode, operating_hours, etc.) do NOT require cosign and are NOT
+ * bound by THIS digest — they are still bound by TA-19
+ * `policy_preview_digest` at queue time.
+ *
+ * Round 2 B4 F-1 fix (audit 2026-05-19): the cosign-digest binding now
+ * extends to all G3 + G6 elevation triggers that were previously NOT bound:
+ *   - `stable_balance_floor` (G3)            — LOWERING weakens custody
+ *   - `per_recipient_daily_cap_usd` (G3)     — RAISING widens spend
+ *   - `has_protocol_caps` (G3)               — disabling protocol caps
+ *   - `protocol_caps` (G3)                   — shrinking individual caps
+ *   - `cosign_required` (G6)                 — disabling cosign one-way
+ * Without this binding, a tampered SDK or discriminator-collision attack
+ * could mutate the pending PDA between queue and apply on those triggers
+ * without producing a cosign-digest mismatch (TA-19's policy_preview_digest
+ * binds them at the *policy* level but the cosign-binding promise is "the
+ * session signature covers the SAME pending args the owner signed").
+ *
+ * CANONICAL ENCODING (FIXED — DO NOT REORDER, APPEND-ONLY):
+ *   1. cosign_session: Pubkey (32 bytes raw)
+ *   2. daily_spending_cap_usd: Option<u64>
+ *        - tag: 1 byte (0=None, 1=Some)
+ *        - payload (if Some): u64 LE (8 bytes)
+ *   3. max_transaction_amount_usd: Option<u64>
+ *        - same shape as #2
+ *   4. allowed_destinations: Option<Vec<Pubkey>>
+ *        - tag: 1 byte (0=None, 1=Some)
+ *        - payload (if Some): u32 LE length (4 bytes) ++ each Pubkey 32 bytes
+ *   5. protocols: Option<Vec<Pubkey>>
+ *        - same shape as #4
+ *   6. stable_balance_floor: Option<u64>        (B4 F-1)
+ *        - same shape as #2
+ *   7. per_recipient_daily_cap_usd: Option<u64> (B4 F-1)
+ *        - same shape as #2
+ *   8. has_protocol_caps: Option<bool>          (B4 F-1)
+ *        - tag: 1 byte (0=None, 1=Some)
+ *        - payload (if Some): 1 byte (0/1)
+ *   9. protocol_caps: Option<Vec<u64>>          (B4 F-1)
+ *        - tag: 1 byte (0=None, 1=Some)
+ *        - payload (if Some): u32 LE length (4 bytes) ++ each u64 8 bytes LE
+ *  10. cosign_required: Option<bool>            (B4 F-1)
+ *        - same shape as #8
+ *
+ * Total bounded by MAX_ALLOWED_PROTOCOLS=10 + MAX_ALLOWED_DESTINATIONS=10 at
+ * 32 bytes each + MAX_PROTOCOL_CAPS=10 * 8 + fixed scalars ≈ 805 bytes worst
+ * case.
+ *
+ * Forward-compat note: per the on-chain comment, the canonical encoding here
+ * is APPEND-ONLY — new fields land at the END to preserve replayable digests
+ * for in-flight pending PDAs across upgrades.
+ */
+import { createHash } from "node:crypto";
+// ── Base58 decode (inlined to avoid circular SDK imports) ────────────────────
+//
+// Solana pubkeys are base58 strings; we need the raw 32 bytes. The SDK has
+// other base58 helpers downstream, but to avoid circular imports we inline a
+// small decoder. Same alphabet/logic as `compute-policy-preview-digest.ts`.
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+const BASE58_INDEX = (() => {
+    const r = Object.create(null);
+    for (let i = 0; i < BASE58_ALPHABET.length; i++) {
+        r[BASE58_ALPHABET[i]] = i;
+    }
+    return r;
+})();
+function base58Decode(s) {
+    if (s.length === 0) {
+        throw new Error("base58Decode: empty input");
+    }
+    let leadingZeros = 0;
+    while (leadingZeros < s.length && s[leadingZeros] === "1") {
+        leadingZeros++;
+    }
+    const bytes = [];
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        const v = BASE58_INDEX[c];
+        if (v === undefined) {
+            throw new Error(`base58Decode: invalid char '${c}'`);
+        }
+        let carry = v;
+        for (let j = 0; j < bytes.length; j++) {
+            carry += bytes[j] * 58;
+            bytes[j] = carry & 0xff;
+            carry >>>= 8;
+        }
+        while (carry > 0) {
+            bytes.push(carry & 0xff);
+            carry >>>= 8;
+        }
+    }
+    const out = new Uint8Array(leadingZeros + bytes.length);
+    for (let i = 0; i < bytes.length; i++) {
+        out[leadingZeros + (bytes.length - 1 - i)] = bytes[i];
+    }
+    if (out.length !== 32) {
+        throw new Error(`base58Decode: expected 32-byte pubkey, got ${out.length} bytes`);
+    }
+    return out;
+}
+// ── Encoders ─────────────────────────────────────────────────────────────────
+function writeU64Le(view, offset, v) {
+    view.setBigUint64(offset, v, true);
+    return offset + 8;
+}
+function writeU32Le(view, offset, v) {
+    view.setUint32(offset, v, true);
+    return offset + 4;
+}
+/**
+ * Compute the canonical SHA-256 of the cosign digest fields.
+ *
+ * Returns a 32-byte `Uint8Array`. Identical to the on-chain helper
+ * `compute_cosign_digest` for the same input.
+ *
+ * Used by `cosign-helper.buildCosignBundle()` to produce the digest the
+ * on-chain handler will re-validate at queue + apply time.
+ *
+ * @throws if any pubkey doesn't base58-decode to exactly 32 bytes
+ * @throws if a u64 is negative or out of range
+ */
+export function computeCosignDigest(fields) {
+    const sessionBytes = base58Decode(fields.cosignSession);
+    // Normalise Option semantics: undefined → null (Option::None).
+    const dailyCap = fields.dailySpendingCapUsd === undefined
+        ? null
+        : fields.dailySpendingCapUsd;
+    const maxTx = fields.maxTransactionAmountUsd === undefined
+        ? null
+        : fields.maxTransactionAmountUsd;
+    const dests = fields.allowedDestinations === undefined
+        ? null
+        : fields.allowedDestinations;
+    const protos = fields.protocols === undefined ? null : fields.protocols;
+    // Round 2 B4 F-1: same undefined-vs-null normalisation for the 5 new
+    // fields. The discriminator byte is load-bearing — `undefined` /
+    // `null` BOTH map to Option::None (tag 0). `false`, `true`, or `0n`
+    // map to Option::Some.
+    const stableFloor = fields.stableBalanceFloor === undefined ? null : fields.stableBalanceFloor;
+    const perRecipCap = fields.perRecipientDailyCapUsd === undefined
+        ? null
+        : fields.perRecipientDailyCapUsd;
+    const hasProtoCaps = fields.hasProtocolCaps === undefined ? null : fields.hasProtocolCaps;
+    const protoCaps = fields.protocolCaps === undefined ? null : fields.protocolCaps;
+    const cosignReq = fields.cosignRequired === undefined ? null : fields.cosignRequired;
+    // Pre-decode pubkeys so any error surfaces with a useful message BEFORE we
+    // start the hash walk.
+    const destBytes = dests === null ? null : dests.map((p) => base58Decode(p));
+    const protoBytes = protos === null ? null : protos.map((p) => base58Decode(p));
+    // Pre-size: 32 (session) + (1+8) for each Option<u64> (positions 2, 3, 6, 7)
+    // + (1 + 4 + 32*N) for each Option<Vec<Pubkey>> (positions 4, 5)
+    // + (1 + 1) for each Option<bool> (positions 8, 10)
+    // + (1 + 4 + 8*N) for Option<Vec<u64>> (position 9)
+    // Worst case ~805 bytes.
+    const fixedSize = 32 + // cosign_session
+        1 + // daily tag
+        (dailyCap !== null ? 8 : 0) +
+        1 + // max_tx tag
+        (maxTx !== null ? 8 : 0) +
+        1 + // destinations tag
+        (destBytes !== null ? 4 + destBytes.length * 32 : 0) +
+        1 + // protocols tag
+        (protoBytes !== null ? 4 + protoBytes.length * 32 : 0) +
+        1 + // stable_balance_floor tag (B4 F-1)
+        (stableFloor !== null ? 8 : 0) +
+        1 + // per_recipient_daily_cap_usd tag (B4 F-1)
+        (perRecipCap !== null ? 8 : 0) +
+        1 + // has_protocol_caps tag (B4 F-1)
+        (hasProtoCaps !== null ? 1 : 0) +
+        1 + // protocol_caps tag (B4 F-1)
+        (protoCaps !== null ? 4 + protoCaps.length * 8 : 0) +
+        1 + // cosign_required tag (B4 F-1)
+        (cosignReq !== null ? 1 : 0);
+    const buf = new Uint8Array(fixedSize);
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    let off = 0;
+    // 1. cosign_session pubkey (32 bytes raw)
+    buf.set(sessionBytes, off);
+    off += 32;
+    // 2. daily_spending_cap_usd Option<u64>
+    if (dailyCap === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU64Le(view, off, dailyCap);
+    }
+    // 3. max_transaction_amount_usd Option<u64>
+    if (maxTx === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU64Le(view, off, maxTx);
+    }
+    // 4. allowed_destinations Option<Vec<Pubkey>>
+    if (destBytes === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU32Le(view, off, destBytes.length);
+        for (const pk of destBytes) {
+            buf.set(pk, off);
+            off += 32;
+        }
+    }
+    // 5. protocols Option<Vec<Pubkey>>
+    if (protoBytes === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU32Le(view, off, protoBytes.length);
+        for (const pk of protoBytes) {
+            buf.set(pk, off);
+            off += 32;
+        }
+    }
+    // Round 2 B4 F-1 (2026-05-19): APPEND-ONLY extension binding 5 new
+    // elevation triggers. Mirrors `compute_cosign_digest` in
+    // `programs/sigil/src/utils/cosign_digest.rs` lines 195-241. All
+    // encoded as Option<…> with the load-bearing tag byte (None vs
+    // Some(0) MUST produce distinct digests).
+    // 6. stable_balance_floor Option<u64>
+    if (stableFloor === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU64Le(view, off, stableFloor);
+    }
+    // 7. per_recipient_daily_cap_usd Option<u64>
+    if (perRecipCap === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU64Le(view, off, perRecipCap);
+    }
+    // 8. has_protocol_caps Option<bool>. Bool encoded as 1 byte (0/1).
+    if (hasProtoCaps === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        buf[off++] = hasProtoCaps ? 1 : 0;
+    }
+    // 9. protocol_caps Option<Vec<u64>>. Each cap is 8 bytes LE.
+    if (protoCaps === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        off = writeU32Le(view, off, protoCaps.length);
+        for (const c of protoCaps) {
+            off = writeU64Le(view, off, c);
+        }
+    }
+    // 10. cosign_required Option<bool>. Bool encoded as 1 byte (0/1).
+    if (cosignReq === null) {
+        buf[off++] = 0;
+    }
+    else {
+        buf[off++] = 1;
+        buf[off++] = cosignReq ? 1 : 0;
+    }
+    // Defensive: assert we wrote exactly what we sized.
+    if (off !== buf.length) {
+        throw new Error(`computeCosignDigest: encoded ${off} bytes, expected ${buf.length}`);
+    }
+    return new Uint8Array(createHash("sha256").update(buf).digest());
+}
+/** Equivalent of `Buffer.equals` for two `Uint8Array` digests.
+ *
+ * M-8 audit fix (2026-05-19): constant-time comparison. Previously this
+ * helper early-returned on the first mismatched byte, which leaks
+ * length-prefix information about the matching prefix via timing
+ * channels. Cosign digests are not classically time-attack-sensitive
+ * (they're produced and consumed locally), but constant-time is the
+ * defensive default. Both equal-length and unequal-length paths now run
+ * to completion before returning.
+ */
+export function cosignDigestsEqual(a, b) {
+    // Length comparison is deliberately the FIRST check and the only
+    // early-return: comparing a length mismatch in constant time is
+    // mathematically impossible (the longer array's tail bytes never
+    // exist), and leaking the length prefix is harmless — the caller
+    // controls both digest sources.
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        // XOR-accumulate. `diff` ends at 0 iff every byte pair matched;
+        // any single mismatch sets some bit in `diff` permanently. No
+        // early exit on mismatch → constant time per length.
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=compute-cosign-digest.js.map

package/dist/policy/compute-cosign-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-cosign-digest.js","sourceRoot":"","sources":["../../src/policy/compute-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuGzC,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAE5E,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAC/D,MAAM,YAAY,GAA2B,CAAC,GAAG,EAAE;IACjD,MAAM,CAAC,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,YAAY,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,QAAQ,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAC;IAElE,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,KAAK,GACT,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,KAAK,GACT,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,WAAW,GACf,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAC7E,MAAM,WAAW,GACf,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,YAAY,GAChB,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IACvE,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IACjE,MAAM,SAAS,GACb,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IAErE,2EAA2E;IAC3E,uBAAuB;IACvB,MAAM,SAAS,GACb,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IAExE,6EAA6E;IAC7E,iEAAiE;IACjE,oDAAoD;IACpD,oDAAoD;IACpD,yBAAyB;IACzB,MAAM,SAAS,GACb,EAAE,GAAG,iBAAiB;QACtB,CAAC,GAAG,YAAY;QAChB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,GAAG,aAAa;QACjB,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,GAAG,mBAAmB;QACvB,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,gBAAgB;QACpB,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,GAAG,oCAAoC;QACxC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,2CAA2C;QAC/C,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,iCAAiC;QACrC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,GAAG,6BAA6B;QACjC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,GAAG,+BAA+B;QACnC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3B,GAAG,IAAI,EAAE,CAAC;IAEV,wCAAwC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,yDAAyD;IACzD,iEAAiE;IACjE,+DAA+D;IAC/D,0CAA0C;IAE1C,sCAAsC;IACtC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,mEAAmE;IACnE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,oDAAoD;IACpD,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAa,EAAE,CAAa;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,gCAAgC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,gEAAgE;QAChE,8DAA8D;QAC9D,qDAAqD;QACrD,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/policy/compute-policy-preview-digest.d.ts

@@ -0,0 +1,279 @@
+/**
+ * TA-19 — Canonical policy preview digest (SDK side).
+ *
+ * Mirrors `programs/sigil/src/utils/policy_digest.rs` exactly. The SDK computes
+ * this off-chain, the owner signs `queue_policy_update` / `initialize_vault`
+ * with the digest as an arg, and the on-chain handler recomputes it from the
+ * resulting policy state. If the two digests do not match the handler rejects
+ * with `PolicyPreviewMismatch` (6080).
+ *
+ * Defense rationale:
+ *   - Sequence: SDK builds policy fields → SDK computes digest → owner signs
+ *     the transaction (digest is in the instruction data, signed alongside).
+ *   - On-chain handler reads the policy fields from the args, re-computes the
+ *     same digest, and asserts equality.
+ *   - The only ways the two digests can diverge are: (a) an owner blind-signed
+ *     mutated fields that the SDK never told them about; (b) a rogue program
+ *     tampered with the pending PDA between queue and apply (a future
+ *     discriminator-collision attack). Both cases reject — the owner sees a
+ *     mismatch error rather than silently committing.
+ *
+ * CANONICAL ENCODING (FIXED — DO NOT REORDER). Positions are the live byte
+ * order — see PER_FIELD_FIXED_SIZES below, the single source of truth that a
+ * module-load assertion pins against POLICY_PREVIEW_FIELD_COUNT:
+ *   1. daily_spending_cap_usd: u64 LE (8 bytes)
+ *   2. max_transaction_size_usd: u64 LE (8 bytes)
+ *   3. max_slippage_bps: u16 LE (2 bytes)
+ *   4. developer_fee_rate: u16 LE (2 bytes) — PEN-CROSS-6 (Phase 2 close-up)
+ *   5. protocol_mode: u8 (1 byte)
+ *   6. protocols: Vec<Pubkey> = u32 LE length (4 bytes) ++ each Pubkey 32 bytes
+ *   7. destination_mode: u8 (1 byte)
+ *   8. allowed_destinations: Vec<Pubkey> = u32 LE length (4 bytes) ++ each Pubkey 32 bytes
+ *   9. timelock_duration: u64 LE (8 bytes)
+ *   10. session_expiry_seconds: u64 LE (8 bytes)
+ *   11. observe_only: bool as 1 byte (0 or 1)
+ *   12. has_post_assertions: u8 (1 byte) — M1-04 removed the former
+ *       has_constraints byte (digest-version bump); positions renumbered down.
+ *   13. created_at_slot: u64 LE (8 bytes) — PEN-CROSS-2 (Phase 2 close-up)
+ *   14. operating_hours: u32 LE (4 bytes) — TA-05 (Phase 3 pre-exec)
+ *   15. auto_promote_grays: bool as 1 byte (0/1) — TA-07 (Phase 3 pre-exec)
+ *   16. auto_revoke_threshold: u8 (1 byte) — TA-17 (Phase 3 pre-exec)
+ *   17. stable_balance_floor: u64 LE (8 bytes) — TA-12 (Phase 5 post-exec)
+ *   18. per_recipient_daily_cap_usd: u64 LE (8 bytes) — TA-14 (Phase 5 post-exec)
+ *   19. cosign_required: bool (1 byte 0/1) — G6 (audit 2026-05-18 cosign opt-in)
+ *   20. agent_set_hash: [u8; 32] — Phase 8 PEN-CROSS-1 (audit 2026-05-19)
+ *   21. cosign_session_pubkey: Pubkey (32 bytes) — D-5 (audit 2026-05-19, F-RP3-1)
+ *   22. operator_grant_delay_seconds: u64 LE (8 bytes) — F-Q6 (2026-06-02)
+ *   23. has_protocol_caps: bool as 1 byte (0/1) — M-1 (audit 2026-06-11)
+ *   24. protocol_caps: u32 LE length (4 bytes) ++ each cap u64 LE (8 bytes) — M-1
+ *
+ * Phase 3 append-only additions (TA-05/07/17): operating_hours,
+ * auto_promote_grays, auto_revoke_threshold are appended at positions 15-17
+ * to preserve the 14-field prefix (F-14 APPEND-ONLY rule).
+ *
+ * Phase 5 append-only additions (TA-12/TA-14): stable_balance_floor at
+ * position 17, per_recipient_daily_cap_usd at position 18. Both bound by
+ * TA-19 so silent SDK / pending-PDA mutations can't bypass the owner's
+ * signed digest.
+ *
+ * G6 append-only addition (audit 2026-05-18 cosign opt-in): cosign_required
+ * at position 19 (1 byte, 0/1). Owner's choice to opt into TA-09 cosign
+ * enforcement is part of the signed policy — a compromised SDK cannot
+ * silently disable cosign between owner approval and on-chain landing.
+ * Disabling cosign on a live policy where this is true is itself an
+ * elevated mutation per `queue_policy_update` (one-way ratchet).
+ *
+ * Phase 8 PEN-CROSS-1 append-only addition (Council ISC-66/A8/A9): the
+ * `agent_set_hash` at position 20 binds the EXISTING agent set into the
+ * signed digest. SHA-256 over Borsh of `Vec<(Pubkey, u8 capability)>`
+ * sorted by pubkey ascending. Closes the silent-insertion vector where
+ * a phished-owner `register_agent(capability=OPERATOR)` would otherwise
+ * grant operator-class without diverging the digest from the last value
+ * the owner signed. Empty Vec produces a deterministic 32-byte hash
+ * (`EMPTY_AGENT_SET_HASH` — SHA-256 of [0x00,0x00,0x00,0x00]).
+ *
+ * D-5 append-only addition (audit 2026-05-19, F-RP3-1): the
+ * `cosign_session_pubkey` at position 21 binds the owner's chosen
+ * reactivate-time cosigner pubkey into the signed digest. The
+ * `reactivate_vault` handler reads this pubkey at runtime and requires
+ * a matching `is_signer == true` entry in `remaining_accounts` whenever
+ * the operation grafts a new agent at `FULL_CAPABILITY`. A tampered SDK
+ * cannot silently flip the gate between owner approval and on-chain
+ * landing — the digest mismatch closes that gap. Default
+ * `Pubkey::default()` (32 zero bytes) means the gate is OFF; owners
+ * opt in via `queue_policy_update`.
+ *
+ * The `destination_graylist: Vec<(Pubkey, i64)>` is intentionally NOT in
+ * the digest. Graylist entries are derived/ephemeral — they auto-populate
+ * when the owner adds a destination via queue_policy_update, and they
+ * only delay an already-signed allowlist entry. Promoting via
+ * promote_graylist_destination only accelerates the existing unlock — it
+ * cannot widen the allowlist. The owner-signed digest already binds the
+ * destination allowlist (position 8).
+ *
+ * Total bounded by MAX_ALLOWED_PROTOCOLS=10 + MAX_ALLOWED_DESTINATIONS=10 at
+ * 32 bytes each + fixed scalars ≈ 700 bytes worst case.
+ */
+import type { Address } from "../kit-adapter.js";
+import { digestsEqual as canonicalDigestsEqual } from "../canonical-encode.js";
+/**
+ * Canonical preview-fields shape. Matches the on-chain `PolicyPreviewFields`
+ * struct in `programs/sigil/src/utils/policy_digest.rs` exactly.
+ */
+export interface PolicyPreviewFields {
+    /** $ × 1e6 (USDC/USDT decimals). e.g. $500 = 500_000_000n. */
+    dailySpendingCapUsd: bigint;
+    /** $ × 1e6. */
+    maxTransactionSizeUsd: bigint;
+    /** Basis points (0-5000). */
+    maxSlippageBps: number;
+    /**
+     * Developer fee rate (rate / 1,000,000). Bound by the owner-signed digest
+     * since PEN-CROSS-6 (Phase 2 close-up). 0..=MAX_DEVELOPER_FEE_RATE (500).
+     */
+    developerFeeRate: number;
+    /** 1 = ALLOWLIST (Phase 2 Option A). Other values rejected on-chain. */
+    protocolMode: number;
+    /** Up to MAX_ALLOWED_PROTOCOLS (10) base58-encoded program IDs. */
+    protocols: readonly (Address | string)[];
+    /** 0 = RESTRICTED (Phase 2 Option A). Other values rejected on-chain. */
+    destinationMode: number;
+    /** Up to MAX_ALLOWED_DESTINATIONS (10) base58-encoded wallet pubkeys. */
+    allowedDestinations: readonly (Address | string)[];
+    /** Timelock duration in seconds (>= MIN_TIMELOCK_DURATION=1800). */
+    timelockDuration: bigint;
+    /** Owner-configurable session expiry (0 = use default 30s). */
+    sessionExpirySeconds: bigint;
+    /** TA-19: observe-only kill switch (rejects all validate_and_authorize). */
+    observeOnly: boolean;
+    /** Whether post-execution assertions are configured (0 = no, non-zero = yes). */
+    hasPostAssertions: number;
+    /**
+     * PEN-CROSS-2 (Phase 2 close-up): the slot at which `initialize_vault`
+     * minted the live policy. Bound by TA-19 at position 13. Closes the
+     * close+reinit replay window.
+     */
+    createdAtSlot: bigint;
+    /**
+     * TA-05 (Phase 3): 24-bit UTC operating-hours bitmask. Bit `n` (0..=23)
+     * set → the vault permits spending at UTC hour `n`. Default 0 when
+     * omitted by legacy callers (preserves existing test fixtures). Production
+     * SDK consumers should pass 0xFFFFFF (all 24h enabled) explicitly.
+     * Upper 8 bits MUST be zero — on-chain handler rejects with
+     * `ErrOutsideOperatingHours` (6084) if violated. Bound at position 14
+     * of the canonical encoding.
+     */
+    operatingHours?: number;
+    /**
+     * TA-07 (Phase 3): owner-side toggle to bypass the 24h graylist friction
+     * for newly-added destinations. Default false (friction enforced).
+     * Bound by TA-19 at canonical position 15 so silent flips can't change
+     * the friction model.
+     */
+    autoPromoteGrays?: boolean;
+    /**
+     * TA-17 (Phase 3): consecutive-failure threshold for agent auto-revoke.
+     * Range 3..=20. Default 0 (legacy callers — but on-chain handler now
+     * requires this to be in [3, 20] at policy-write time). Bound at
+     * canonical position 16.
+     */
+    autoRevokeThreshold?: number;
+    /**
+     * TA-12 (Phase 5 post-exec): owner-chosen hard reserve on combined
+     * USDC+USDT vault balance, asserted at every `finalize_session`
+     * spending path completion. 6-decimal USDC face value (e.g.
+     * `$100 = 100_000_000n`). Default 0 (no reserve — preserves existing
+     * vault behavior). Bound at canonical position 17.
+     */
+    stableBalanceFloor?: bigint;
+    /**
+     * TA-14 (Phase 5 post-exec): owner-chosen rolling 24h per-recipient
+     * outflow cap. 6-decimal USDC face value. Default 0 (no per-recipient
+     * cap — preserves existing vault behavior). Bound at canonical
+     * position 18.
+     */
+    perRecipientDailyCapUsd?: bigint;
+    /**
+     * G6 (audit 2026-05-18 cosign opt-in): owner-chosen opt-in to TA-09
+     * cosign enforcement on elevated mutations. Default false (low-friction
+     * — preserves existing vault behavior; owner-signature-only flow on
+     * elevated mutations). When true, the `queue_policy_update` handler's
+     * 7-trigger elevation gate (raises caps, expands allowlists, weakens
+     * floor / per-recipient / protocol caps) requires a cosign session.
+     * Disabling cosign on a live policy where this is true is itself an
+     * elevated mutation (one-way ratchet). Bound at canonical position 19.
+     */
+    cosignRequired?: boolean;
+    /**
+     * Phase 8 PEN-CROSS-1 (Council ISC-66/A8/A9): SHA-256 over Borsh of
+     * `Vec<(pubkey, u8 capability)>` sorted by pubkey ascending. Pass the
+     * result of `computeAgentSetHash(...)` over the live vault's agent set
+     * (use empty array for a freshly-initialized vault). Empty vault produces
+     * the deterministic `EMPTY_AGENT_SET_HASH` value. Bound at canonical
+     * position 20. Optional with default `EMPTY_AGENT_SET_HASH` so legacy
+     * fixtures (no agents) continue to compute the canonical digest.
+     */
+    agentSetHash?: Uint8Array;
+    /**
+     * D-5 (audit 2026-05-19, F-RP3-1): the owner-chosen reactivate-time
+     * cosigner pubkey. Default `Pubkey::default()` (zero pubkey, encoded
+     * as 32 zero bytes) when omitted, matching the on-chain init state
+     * where the gate is disabled. Owners opt in by passing a non-default
+     * pubkey via `queue_policy_update` (the SDK helper here mirrors that
+     * value into the digest). Bound at canonical position 21.
+     *
+     * Type: base58 string (e.g. an Address) OR a 32-byte raw Uint8Array.
+     * The encoder accepts both shapes for parity with the protocols /
+     * allowedDestinations fields.
+     */
+    cosignSessionPubkey?: Address | string | Uint8Array;
+    /**
+     * F-Q6 (2026-06-02): owner-configured delay (in seconds) before an OPERATOR
+     * capability grant takes effect. Default 0n when omitted (matching the
+     * on-chain init default). An owner-set security control gating OPERATOR
+     * seating — bound by TA-19 at canonical position 22 so a tampered SDK or
+     * pending-PDA mutation cannot silently lower it between owner approval and
+     * on-chain landing. Owners change it only via the timelocked
+     * `queue_policy_update` path.
+     */
+    operatorGrantDelaySeconds?: bigint;
+    /**
+     * M-1 (audit 2026-06-11): owner's per-protocol-caps master switch. Bound at
+     * canonical position 23 (default false when omitted, matching the on-chain
+     * init/legacy state). Mirrors the cosign digest's order (hasProtocolCaps
+     * before protocolCaps). Closes the gap where a tampered SDK could flip the
+     * caps switch without the owner's signed preview detecting it.
+     */
+    hasProtocolCaps?: boolean;
+    /**
+     * M-1 (audit 2026-06-11): owner's per-protocol rolling-24h spend caps,
+     * aligned 1:1 with `protocols` (≤ 10). Bound at canonical position 24 as a
+     * u32 LE length prefix ++ each cap as u64 LE (mirrors the `protocols` Vec
+     * pattern). Default [] when omitted.
+     */
+    protocolCaps?: readonly bigint[];
+}
+/** Mirrors `policy_digest.rs::POLICY_PREVIEW_FIELD_COUNT`.
+ *  M1-04: was 22; has_constraints removed (digest-version bump).
+ *  F-Q6 (2026-06-02): 21 → 22, binds operator_grant_delay_seconds.
+ *  M-1 (2026-06-11): 22 → 24, binds has_protocol_caps (23) + protocol_caps (24). */
+export declare const POLICY_PREVIEW_FIELD_COUNT = 24;
+/**
+ * Phase 8 PEN-CROSS-1 (Council ISC-141): SHA-256 of the Borsh-encoded
+ * empty `Vec<(Pubkey, u8)>` — i.e. SHA-256 of [0x00, 0x00, 0x00, 0x00].
+ * Deterministic; pinned across Rust (`policy_digest.rs::EMPTY_AGENT_SET_HASH`)
+ * and TypeScript (this constant). Used by `computePolicyPreviewDigest`
+ * when the caller omits `agentSetHash` (legacy fixture path).
+ */
+export declare const EMPTY_AGENT_SET_HASH: Uint8Array;
+/**
+ * Compute the canonical `agent_set_hash` from a list of agents. SHA-256
+ * over Borsh of `Vec<(Pubkey, u8 capability)>` sorted by pubkey ascending.
+ * Mirrors `policy_digest.rs::compute_agent_set_hash` byte-for-byte.
+ *
+ * Pass the result into `computePolicyPreviewDigest({ ...fields, agentSetHash })`.
+ *
+ * @throws if any pubkey doesn't base58-decode to 32 bytes
+ */
+export declare function computeAgentSetHash(agents: ReadonlyArray<{
+    pubkey: Address | string;
+    capability: number;
+}>): Uint8Array;
+/**
+ * Compute the canonical SHA-256 of the policy preview fields.
+ *
+ * Returns a 32-byte Uint8Array. Identical to the on-chain helper
+ * `compute_policy_preview_digest` for the same input.
+ *
+ * @throws if any pubkey doesn't base58-decode to exactly 32 bytes
+ * @throws if a u64 is negative or out of range
+ */
+export declare function computePolicyPreviewDigest(fields: PolicyPreviewFields): Uint8Array;
+/**
+ * Equivalent of `Buffer.equals` for two `Uint8Array` digests. Re-exported
+ * from `../canonical-encode.ts` (constant-time XOR-accumulate; no early
+ * exit) so callers that previously imported it from this module continue
+ * to work after Batch C.
+ */
+export declare const digestsEqual: typeof canonicalDigestsEqual;
+//# sourceMappingURL=compute-policy-preview-digest.d.ts.map

package/dist/policy/compute-policy-preview-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-policy-preview-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-policy-preview-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAML,YAAY,IAAI,qBAAqB,EACtC,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,6BAA6B;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACzC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,mBAAmB,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACnD,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAC;IAErB,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAgCD;;;oFAGoF;AACpF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAG/B,CAAC;AAEL;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,UAAU,CA8BZ;AA8DD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,mBAAmB,GAC1B,UAAU,CAmIZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,8BAAwB,CAAC"}