@usesigil/kit 0.16.0 → 0.18.0

package/dist/policy/compute-policy-preview-digest.js

@@ -0,0 +1,373 @@
+/**
+ * TA-19 — Canonical policy preview digest (SDK side).
+ *
+ * Mirrors `programs/sigil/src/utils/policy_digest.rs` exactly. The SDK computes
+ * this off-chain, the owner signs `queue_policy_update` / `initialize_vault`
+ * with the digest as an arg, and the on-chain handler recomputes it from the
+ * resulting policy state. If the two digests do not match the handler rejects
+ * with `PolicyPreviewMismatch` (6080).
+ *
+ * Defense rationale:
+ *   - Sequence: SDK builds policy fields → SDK computes digest → owner signs
+ *     the transaction (digest is in the instruction data, signed alongside).
+ *   - On-chain handler reads the policy fields from the args, re-computes the
+ *     same digest, and asserts equality.
+ *   - The only ways the two digests can diverge are: (a) an owner blind-signed
+ *     mutated fields that the SDK never told them about; (b) a rogue program
+ *     tampered with the pending PDA between queue and apply (a future
+ *     discriminator-collision attack). Both cases reject — the owner sees a
+ *     mismatch error rather than silently committing.
+ *
+ * CANONICAL ENCODING (FIXED — DO NOT REORDER). Positions are the live byte
+ * order — see PER_FIELD_FIXED_SIZES below, the single source of truth that a
+ * module-load assertion pins against POLICY_PREVIEW_FIELD_COUNT:
+ *   1. daily_spending_cap_usd: u64 LE (8 bytes)
+ *   2. max_transaction_size_usd: u64 LE (8 bytes)
+ *   3. max_slippage_bps: u16 LE (2 bytes)
+ *   4. developer_fee_rate: u16 LE (2 bytes) — PEN-CROSS-6 (Phase 2 close-up)
+ *   5. protocol_mode: u8 (1 byte)
+ *   6. protocols: Vec<Pubkey> = u32 LE length (4 bytes) ++ each Pubkey 32 bytes
+ *   7. destination_mode: u8 (1 byte)
+ *   8. allowed_destinations: Vec<Pubkey> = u32 LE length (4 bytes) ++ each Pubkey 32 bytes
+ *   9. timelock_duration: u64 LE (8 bytes)
+ *   10. session_expiry_seconds: u64 LE (8 bytes)
+ *   11. observe_only: bool as 1 byte (0 or 1)
+ *   12. has_post_assertions: u8 (1 byte) — M1-04 removed the former
+ *       has_constraints byte (digest-version bump); positions renumbered down.
+ *   13. created_at_slot: u64 LE (8 bytes) — PEN-CROSS-2 (Phase 2 close-up)
+ *   14. operating_hours: u32 LE (4 bytes) — TA-05 (Phase 3 pre-exec)
+ *   15. auto_promote_grays: bool as 1 byte (0/1) — TA-07 (Phase 3 pre-exec)
+ *   16. auto_revoke_threshold: u8 (1 byte) — TA-17 (Phase 3 pre-exec)
+ *   17. stable_balance_floor: u64 LE (8 bytes) — TA-12 (Phase 5 post-exec)
+ *   18. per_recipient_daily_cap_usd: u64 LE (8 bytes) — TA-14 (Phase 5 post-exec)
+ *   19. cosign_required: bool (1 byte 0/1) — G6 (audit 2026-05-18 cosign opt-in)
+ *   20. agent_set_hash: [u8; 32] — Phase 8 PEN-CROSS-1 (audit 2026-05-19)
+ *   21. cosign_session_pubkey: Pubkey (32 bytes) — D-5 (audit 2026-05-19, F-RP3-1)
+ *   22. operator_grant_delay_seconds: u64 LE (8 bytes) — F-Q6 (2026-06-02)
+ *   23. has_protocol_caps: bool as 1 byte (0/1) — M-1 (audit 2026-06-11)
+ *   24. protocol_caps: u32 LE length (4 bytes) ++ each cap u64 LE (8 bytes) — M-1
+ *
+ * Phase 3 append-only additions (TA-05/07/17): operating_hours,
+ * auto_promote_grays, auto_revoke_threshold are appended at positions 15-17
+ * to preserve the 14-field prefix (F-14 APPEND-ONLY rule).
+ *
+ * Phase 5 append-only additions (TA-12/TA-14): stable_balance_floor at
+ * position 17, per_recipient_daily_cap_usd at position 18. Both bound by
+ * TA-19 so silent SDK / pending-PDA mutations can't bypass the owner's
+ * signed digest.
+ *
+ * G6 append-only addition (audit 2026-05-18 cosign opt-in): cosign_required
+ * at position 19 (1 byte, 0/1). Owner's choice to opt into TA-09 cosign
+ * enforcement is part of the signed policy — a compromised SDK cannot
+ * silently disable cosign between owner approval and on-chain landing.
+ * Disabling cosign on a live policy where this is true is itself an
+ * elevated mutation per `queue_policy_update` (one-way ratchet).
+ *
+ * Phase 8 PEN-CROSS-1 append-only addition (Council ISC-66/A8/A9): the
+ * `agent_set_hash` at position 20 binds the EXISTING agent set into the
+ * signed digest. SHA-256 over Borsh of `Vec<(Pubkey, u8 capability)>`
+ * sorted by pubkey ascending. Closes the silent-insertion vector where
+ * a phished-owner `register_agent(capability=OPERATOR)` would otherwise
+ * grant operator-class without diverging the digest from the last value
+ * the owner signed. Empty Vec produces a deterministic 32-byte hash
+ * (`EMPTY_AGENT_SET_HASH` — SHA-256 of [0x00,0x00,0x00,0x00]).
+ *
+ * D-5 append-only addition (audit 2026-05-19, F-RP3-1): the
+ * `cosign_session_pubkey` at position 21 binds the owner's chosen
+ * reactivate-time cosigner pubkey into the signed digest. The
+ * `reactivate_vault` handler reads this pubkey at runtime and requires
+ * a matching `is_signer == true` entry in `remaining_accounts` whenever
+ * the operation grafts a new agent at `FULL_CAPABILITY`. A tampered SDK
+ * cannot silently flip the gate between owner approval and on-chain
+ * landing — the digest mismatch closes that gap. Default
+ * `Pubkey::default()` (32 zero bytes) means the gate is OFF; owners
+ * opt in via `queue_policy_update`.
+ *
+ * The `destination_graylist: Vec<(Pubkey, i64)>` is intentionally NOT in
+ * the digest. Graylist entries are derived/ephemeral — they auto-populate
+ * when the owner adds a destination via queue_policy_update, and they
+ * only delay an already-signed allowlist entry. Promoting via
+ * promote_graylist_destination only accelerates the existing unlock — it
+ * cannot widen the allowlist. The owner-signed digest already binds the
+ * destination allowlist (position 8).
+ *
+ * Total bounded by MAX_ALLOWED_PROTOCOLS=10 + MAX_ALLOWED_DESTINATIONS=10 at
+ * 32 bytes each + fixed scalars ≈ 700 bytes worst case.
+ */
+import { base58Decode32 as base58Decode, sha256, writeU16Le, writeU32Le, writeU64Le, digestsEqual as canonicalDigestsEqual, } from "../canonical-encode.js";
+// Base58 decode + sha256 + cursor writers now live in `../canonical-encode.ts`
+// so the AL3 SealInput intent digest (`seal/intent-digest.ts`, Phase 9
+// Batch I) can reuse them. The shared module guarantees byte-identical
+// output for both TA-19 and AL3 — silent encoder drift between the two
+// would defeat the cross-impl Rust↔TS hash invariant.
+// ── §RP-2 L-NEW-1 forward-looking ratchet (audit 2026-05-19) ────────────────
+//
+// Mirrors the Rust-side `POLICY_PREVIEW_FIELD_COUNT` const-assert at
+// `programs/sigil/src/utils/policy_digest.rs:143` and the destructuring
+// test in `field_count_invariant`. The Rust defenses are exhaustive
+// (compile-time struct destructuring catches "field added but encoder
+// not updated"), but the TS encoder is a plain procedural write loop —
+// adding a 21st field to `PolicyPreviewFields` here AND bumping
+// `POLICY_PREVIEW_FIELD_COUNT` to 21 still passes the build if the
+// developer forgets to write the encoding line.
+//
+// `PER_FIELD_FIXED_SIZES` is a 1:1 array of the FIXED-WIDTH byte cost
+// of each canonical field (excluding the variable per-element 32-byte
+// pubkey appendages for protocols + allowed_destinations). The
+// `EXPECTED_FIXED_SIZE` derived sum + the runtime assertion against
+// the encoded buffer's length forces the developer to update this
+// table AND the encoder in lockstep. Silent bypass is closed.
+//
+// To add a field: (1) extend `PolicyPreviewFields` (2) extend
+// `PER_FIELD_FIXED_SIZES` with the new field's fixed byte cost (3)
+// bump `POLICY_PREVIEW_FIELD_COUNT` (4) write the encoder line. The
+// `assert_field_count_in_lockstep` IIFE catches step-skips at module
+// load.
+/** Mirrors `policy_digest.rs::POLICY_PREVIEW_FIELD_COUNT`.
+ *  M1-04: was 22; has_constraints removed (digest-version bump).
+ *  F-Q6 (2026-06-02): 21 → 22, binds operator_grant_delay_seconds.
+ *  M-1 (2026-06-11): 22 → 24, binds has_protocol_caps (23) + protocol_caps (24). */
+export const POLICY_PREVIEW_FIELD_COUNT = 24;
+/**
+ * Phase 8 PEN-CROSS-1 (Council ISC-141): SHA-256 of the Borsh-encoded
+ * empty `Vec<(Pubkey, u8)>` — i.e. SHA-256 of [0x00, 0x00, 0x00, 0x00].
+ * Deterministic; pinned across Rust (`policy_digest.rs::EMPTY_AGENT_SET_HASH`)
+ * and TypeScript (this constant). Used by `computePolicyPreviewDigest`
+ * when the caller omits `agentSetHash` (legacy fixture path).
+ */
+export const EMPTY_AGENT_SET_HASH = (() => {
+    const empty = new Uint8Array(4); // u32 LE length prefix = 0
+    return sha256(empty);
+})();
+/**
+ * Compute the canonical `agent_set_hash` from a list of agents. SHA-256
+ * over Borsh of `Vec<(Pubkey, u8 capability)>` sorted by pubkey ascending.
+ * Mirrors `policy_digest.rs::compute_agent_set_hash` byte-for-byte.
+ *
+ * Pass the result into `computePolicyPreviewDigest({ ...fields, agentSetHash })`.
+ *
+ * @throws if any pubkey doesn't base58-decode to 32 bytes
+ */
+export function computeAgentSetHash(agents) {
+    // Decode + project to (rawBytes, capability) tuples.
+    const decoded = agents.map((a) => ({
+        raw: base58Decode(a.pubkey),
+        capability: a.capability & 0xff,
+    }));
+    // Sort by pubkey ascending — byte-wise lex order matches Solana's
+    // `Pubkey::cmp` (just a [u8;32] comparison).
+    decoded.sort((a, b) => {
+        for (let i = 0; i < 32; i++) {
+            if (a.raw[i] < b.raw[i])
+                return -1;
+            if (a.raw[i] > b.raw[i])
+                return 1;
+        }
+        return 0;
+    });
+    // Borsh encode: u32 LE length prefix + each (Pubkey: 32 bytes, capability: 1 byte).
+    // Per-entry size = 33 bytes; total = 4 + decoded.length * 33.
+    const buf = new Uint8Array(4 + decoded.length * 33);
+    new DataView(buf.buffer, buf.byteOffset, 4).setUint32(0, decoded.length, true);
+    let off = 4;
+    for (const e of decoded) {
+        buf.set(e.raw, off);
+        off += 32;
+        buf[off++] = e.capability;
+    }
+    return sha256(buf);
+}
+/**
+ * Fixed-width byte cost per canonical field. Variable parts (the
+ * per-element 32-byte pubkey appendages of protocols and
+ * allowed_destinations) are NOT included — those are accounted for
+ * separately at encode time. Indices map 1:1 to the canonical fields
+ * listed in the module header.
+ */
+const PER_FIELD_FIXED_SIZES = [
+    8, // 1.  daily_spending_cap_usd       (u64 LE)
+    8, // 2.  max_transaction_size_usd     (u64 LE)
+    2, // 3.  max_slippage_bps             (u16 LE)
+    2, // 4.  developer_fee_rate           (u16 LE)  PEN-CROSS-6
+    1, // 5.  protocol_mode                (u8)
+    4, // 6.  protocols                    (u32 LE length prefix; pubkeys variable)
+    1, // 7.  destination_mode             (u8)
+    4, // 8.  allowed_destinations         (u32 LE length prefix; pubkeys variable)
+    8, // 9.  timelock_duration            (u64 LE)
+    8, // 10. session_expiry_seconds       (u64 LE)
+    1, // 11. observe_only                 (bool as u8)
+    // M1-04: field 12 has_constraints REMOVED (digest-version bump); renumbered below.
+    1, // 12. has_post_assertions          (u8)
+    8, // 13. created_at_slot              (u64 LE) PEN-CROSS-2
+    4, // 14. operating_hours              (u32 LE) TA-05
+    1, // 15. auto_promote_grays           (bool as u8) TA-07
+    1, // 16. auto_revoke_threshold        (u8) TA-17
+    8, // 17. stable_balance_floor         (u64 LE) TA-12
+    8, // 18. per_recipient_daily_cap_usd  (u64 LE) TA-14
+    1, // 19. cosign_required              (bool as u8) G6
+    32, // 20. agent_set_hash              ([u8;32]) Phase 8 PEN-CROSS-1
+    32, // 21. cosign_session_pubkey       (Pubkey)  D-5 (audit 2026-05-19, F-RP3-1)
+    8, // 22. operator_grant_delay_seconds (u64 LE)  F-Q6 (2026-06-02)
+    1, // 23. has_protocol_caps            (bool as u8)  M-1 (2026-06-11)
+    4, // 24. protocol_caps                (u32 LE length prefix; u64 caps variable)  M-1
+];
+/** Derived sum — must match the encoder's `fixedSize` exactly. */
+const EXPECTED_FIXED_SIZE = PER_FIELD_FIXED_SIZES.reduce((a, b) => a + b, 0);
+// Module-load assertion: enforce that PER_FIELD_FIXED_SIZES.length and
+// POLICY_PREVIEW_FIELD_COUNT diverge → throw at import time. Catches a
+// developer who bumps the count without updating the table (or vice
+// versa). Cheap one-time cost, runs once per process.
+(function assert_field_count_in_lockstep() {
+    if (PER_FIELD_FIXED_SIZES.length !== POLICY_PREVIEW_FIELD_COUNT) {
+        throw new Error(`§RP-2 L-NEW-1 (TA-19 ratchet): PER_FIELD_FIXED_SIZES.length=${PER_FIELD_FIXED_SIZES.length} ` +
+            `diverges from POLICY_PREVIEW_FIELD_COUNT=${POLICY_PREVIEW_FIELD_COUNT}. ` +
+            "Either add the missing field's byte cost to PER_FIELD_FIXED_SIZES, " +
+            "or update POLICY_PREVIEW_FIELD_COUNT, in the SAME commit. " +
+            "Silent diverge would bypass TA-19 (PEN-7 class).");
+    }
+})();
+// ── Encoders ─────────────────────────────────────────────────────────────────
+//
+// Cursor writers (writeU8 / writeU16Le / writeU32Le / writeU64Le / writeBool)
+// now live in `../canonical-encode.ts` and are imported at the top of this
+// file. The hand-rolled versions previously here were byte-identical.
+/**
+ * Compute the canonical SHA-256 of the policy preview fields.
+ *
+ * Returns a 32-byte Uint8Array. Identical to the on-chain helper
+ * `compute_policy_preview_digest` for the same input.
+ *
+ * @throws if any pubkey doesn't base58-decode to exactly 32 bytes
+ * @throws if a u64 is negative or out of range
+ */
+export function computePolicyPreviewDigest(fields) {
+    // Pre-size: 8+8+2+1 + 4+32*10 + 1 + 4+32*10 + 8+8+1+1+1 = ~684 bytes worst case
+    const protocols = fields.protocols;
+    const dests = fields.allowedDestinations;
+    // Decode pubkeys first so any error surfaces with a useful message before
+    // we start the hash walk.
+    const protoBytes = protocols.map((p) => base58Decode(p));
+    const destBytes = dests.map((p) => base58Decode(p));
+    // §RP-2 L-NEW-1: fixedSize is now derived from the PER_FIELD_FIXED_SIZES
+    // table above (must equal POLICY_PREVIEW_FIELD_COUNT entries). The inline
+    // "8 + 8 + ..." literal was the original hand-summed form — a 21st-field
+    // bug would silently bypass it. The table-driven form forces the
+    // developer to update both the table AND the encoder body when adding
+    // a field (the offset assertion at the bottom catches the inconsistency).
+    const fixedSize = EXPECTED_FIXED_SIZE;
+    // M-1 (2026-06-11): + each protocol_cap (u64 = 8 bytes); the u32 length
+    // prefix is already counted in PER_FIELD_FIXED_SIZES (field 24 = 4).
+    const variableSize = protoBytes.length * 32 +
+        destBytes.length * 32 +
+        (fields.protocolCaps?.length ?? 0) * 8;
+    const buf = new Uint8Array(fixedSize + variableSize);
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    let off = 0;
+    off = writeU64Le(view, off, fields.dailySpendingCapUsd);
+    off = writeU64Le(view, off, fields.maxTransactionSizeUsd);
+    off = writeU16Le(view, off, fields.maxSlippageBps);
+    // PEN-CROSS-6: developer_fee_rate at position 4 of canonical encoding.
+    off = writeU16Le(view, off, fields.developerFeeRate);
+    buf[off++] = fields.protocolMode;
+    off = writeU32Le(view, off, protoBytes.length);
+    for (const pk of protoBytes) {
+        buf.set(pk, off);
+        off += 32;
+    }
+    buf[off++] = fields.destinationMode;
+    off = writeU32Le(view, off, destBytes.length);
+    for (const pk of destBytes) {
+        buf.set(pk, off);
+        off += 32;
+    }
+    off = writeU64Le(view, off, fields.timelockDuration);
+    off = writeU64Le(view, off, fields.sessionExpirySeconds);
+    buf[off++] = fields.observeOnly ? 1 : 0;
+    // M1-04: has_constraints byte removed (digest-version bump).
+    buf[off++] = fields.hasPostAssertions;
+    // PEN-CROSS-2: created_at_slot at position 13 of canonical encoding.
+    off = writeU64Le(view, off, fields.createdAtSlot);
+    // TA-05 (Phase 3): operating_hours at position 14 of canonical encoding.
+    // Default 0 when omitted by legacy callers; production SDK consumers
+    // should pass 0xFFFFFF explicitly via `initializeVault`/`queuePolicyUpdate`.
+    off = writeU32Le(view, off, fields.operatingHours ?? 0);
+    // TA-07 (Phase 3): auto_promote_grays at position 15.
+    buf[off++] = fields.autoPromoteGrays ? 1 : 0;
+    // TA-17 (Phase 3): auto_revoke_threshold at position 16.
+    buf[off++] = fields.autoRevokeThreshold ?? 0;
+    // TA-12 (Phase 5): stable_balance_floor at position 17.
+    off = writeU64Le(view, off, fields.stableBalanceFloor ?? 0n);
+    // TA-14 (Phase 5): per_recipient_daily_cap_usd at position 18.
+    off = writeU64Le(view, off, fields.perRecipientDailyCapUsd ?? 0n);
+    // G6 (audit 2026-05-18 cosign opt-in): cosign_required at position 19.
+    buf[off++] = fields.cosignRequired ? 1 : 0;
+    // Phase 8 PEN-CROSS-1: agent_set_hash at position 20. Default
+    // EMPTY_AGENT_SET_HASH so legacy callers (no agents) continue to
+    // produce a canonical digest without explicit setup.
+    const agentSetHash = fields.agentSetHash ?? EMPTY_AGENT_SET_HASH;
+    if (agentSetHash.length !== 32) {
+        throw new Error(`agentSetHash must be exactly 32 bytes, got ${agentSetHash.length}`);
+    }
+    buf.set(agentSetHash, off);
+    off += 32;
+    // D-5 (audit 2026-05-19, F-RP3-1): cosign_session_pubkey at position
+    // 22. Default `Pubkey::default()` (32 zero bytes) so legacy callers
+    // that don't opt into the reactivate-cosign gate continue to produce
+    // the canonical digest. Owner opt-in passes a base58 string OR a
+    // 32-byte Uint8Array; the encoder normalises both into the canonical
+    // 32-byte buffer.
+    const cosignSessionRaw = fields.cosignSessionPubkey;
+    let cosignSessionBytes;
+    if (cosignSessionRaw === undefined) {
+        cosignSessionBytes = new Uint8Array(32); // Pubkey::default()
+    }
+    else if (cosignSessionRaw instanceof Uint8Array) {
+        cosignSessionBytes = cosignSessionRaw;
+    }
+    else {
+        cosignSessionBytes = base58Decode(cosignSessionRaw);
+    }
+    if (cosignSessionBytes.length !== 32) {
+        throw new Error(`cosignSessionPubkey must decode to exactly 32 bytes, got ${cosignSessionBytes.length}`);
+    }
+    buf.set(cosignSessionBytes, off);
+    off += 32;
+    // F-Q6 (2026-06-02): operator_grant_delay_seconds at position 22 (u64 LE).
+    // Default 0n so legacy callers that don't configure a delay continue to
+    // produce the canonical digest. Owner opts in via queue_policy_update.
+    off = writeU64Le(view, off, fields.operatorGrantDelaySeconds ?? 0n);
+    // 23. has_protocol_caps: bool as u8 — M-1 (2026-06-11). Parity with the Rust
+    // encoder + the cosign digest (position 8).
+    buf[off++] = fields.hasProtocolCaps ? 1 : 0;
+    // 24. protocol_caps: u32 LE length prefix ++ each cap u64 LE — M-1, parity with
+    // the `protocols` Vec pattern above + the cosign digest (position 9).
+    const protocolCaps = fields.protocolCaps ?? [];
+    off = writeU32Le(view, off, protocolCaps.length);
+    for (const cap of protocolCaps) {
+        off = writeU64Le(view, off, cap);
+    }
+    // §RP-2 L-NEW-1 forward-looking ratchet: the encoder MUST write
+    // exactly `fixedSize + variableSize` bytes. `fixedSize` is now
+    // derived from the PER_FIELD_FIXED_SIZES table (which is asserted
+    // at module load to be 1:1 with POLICY_PREVIEW_FIELD_COUNT). A
+    // future engineer who adds a 21st field MUST update both the table
+    // AND the encoder body — if they update only the table (bumping
+    // EXPECTED_FIXED_SIZE) but forget to write the encoder line, this
+    // assertion fires with a clear mismatch. If they update only the
+    // encoder line, the SAME assertion fires (the buffer was too small
+    // and the OOB write at line `buf[off++] = ...` already threw).
+    if (off !== buf.length) {
+        throw new Error(`computePolicyPreviewDigest: encoded ${off} bytes, expected ${buf.length}. ` +
+            `If you added a field to PolicyPreviewFields, update PER_FIELD_FIXED_SIZES + ` +
+            `POLICY_PREVIEW_FIELD_COUNT AND write the encoder line in the SAME commit.`);
+    }
+    return sha256(buf);
+}
+/**
+ * Equivalent of `Buffer.equals` for two `Uint8Array` digests. Re-exported
+ * from `../canonical-encode.ts` (constant-time XOR-accumulate; no early
+ * exit) so callers that previously imported it from this module continue
+ * to work after Batch C.
+ */
+export const digestsEqual = canonicalDigestsEqual;
+//# sourceMappingURL=compute-policy-preview-digest.js.map

package/dist/policy/compute-policy-preview-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-policy-preview-digest.js","sourceRoot":"","sources":["../../src/policy/compute-policy-preview-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAGH,OAAO,EACL,cAAc,IAAI,YAAY,EAC9B,MAAM,EACN,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,IAAI,qBAAqB,GACtC,MAAM,wBAAwB,CAAC;AA6IhC,+EAA+E;AAC/E,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,sDAAsD;AAEtD,+EAA+E;AAC/E,EAAE;AACF,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,gEAAgE;AAChE,mEAAmE;AACnE,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,+DAA+D;AAC/D,oEAAoE;AACpE,kEAAkE;AAClE,8DAA8D;AAC9D,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,QAAQ;AAER;;;oFAGoF;AACpF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAe,CAAC,GAAG,EAAE;IACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAuE;IAEvE,qDAAqD;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,MAAgB,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,IAAI;KAChC,CAAC,CAAC,CAAC;IACJ,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE;gBAAE,OAAO,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE;gBAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,oFAAoF;IACpF,8DAA8D;IAC9D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC,EACD,OAAO,CAAC,MAAM,EACd,IAAI,CACL,CAAC;IACF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpB,GAAG,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG;IAC5B,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wCAAwC;IAC3C,CAAC,EAAE,4EAA4E;IAC/E,CAAC,EAAE,wCAAwC;IAC3C,CAAC,EAAE,4EAA4E;IAC/E,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,4CAA4C;IAC/C,CAAC,EAAE,gDAAgD;IACnD,mFAAmF;IACnF,CAAC,EAAE,wCAAwC;IAC3C,CAAC,EAAE,wDAAwD;IAC3D,CAAC,EAAE,kDAAkD;IACrD,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,8CAA8C;IACjD,CAAC,EAAE,kDAAkD;IACrD,CAAC,EAAE,kDAAkD;IACrD,CAAC,EAAE,mDAAmD;IACtD,EAAE,EAAE,gEAAgE;IACpE,EAAE,EAAE,4EAA4E;IAChF,CAAC,EAAE,+DAA+D;IAClE,CAAC,EAAE,kEAAkE;IACrE,CAAC,EAAE,kFAAkF;CAC7E,CAAC;AAEX,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAE7E,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,sDAAsD;AACtD,CAAC,SAAS,8BAA8B;IACtC,IAAI,qBAAqB,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,+DAA+D,qBAAqB,CAAC,MAAM,GAAG;YAC5F,4CAA4C,0BAA0B,IAAI;YAC1E,qEAAqE;YACrE,4DAA4D;YAC5D,kDAAkD,CACrD,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,sEAAsE;AAEtE;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA2B;IAE3B,gFAAgF;IAChF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACzC,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IAE9D,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,iEAAiE;IACjE,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,mBAAmB,CAAC;IACtC,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,YAAY,GAChB,UAAU,CAAC,MAAM,GAAG,EAAE;QACtB,SAAS,CAAC,MAAM,GAAG,EAAE;QACrB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxD,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,uEAAuE;IACvE,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjB,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;IACpC,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjB,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,6DAA6D;IAC7D,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;IACtC,qEAAqE;IACrE,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAClD,yEAAyE;IACzE,qEAAqE;IACrE,6EAA6E;IAC7E,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;IACxD,sDAAsD;IACtD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,yDAAyD;IACzD,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,mBAAmB,IAAI,CAAC,CAAC;IAC7C,wDAAwD;IACxD,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC7D,+DAA+D;IAC/D,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAClE,uEAAuE;IACvE,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,8DAA8D;IAC9D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACjE,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,8CAA8C,YAAY,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3B,GAAG,IAAI,EAAE,CAAC;IACV,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,kBAAkB;IAClB,MAAM,gBAAgB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACpD,IAAI,kBAA8B,CAAC;IACnC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,kBAAkB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;IAC/D,CAAC;SAAM,IAAI,gBAAgB,YAAY,UAAU,EAAE,CAAC;QAClD,kBAAkB,GAAG,gBAAgB,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,kBAAkB,GAAG,YAAY,CAAC,gBAA0B,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,kBAAkB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,4DAA4D,kBAAkB,CAAC,MAAM,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACjC,GAAG,IAAI,EAAE,CAAC;IACV,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACpE,6EAA6E;IAC7E,4CAA4C;IAC5C,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IAC/C,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,gEAAgE;IAChE,+DAA+D;IAC/D,kEAAkE;IAClE,+DAA+D;IAC/D,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,oBAAoB,GAAG,CAAC,MAAM,IAAI;YAC1E,8EAA8E;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC"}

package/dist/policy-attestation.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Policy attestation reader — Phase 9 Batch E (ISC-19..21).
+ *
+ * `getLatestPolicyAttestation` resolves the current on-chain PolicyConfig
+ * for a vault and returns the decoded view. Sigil's "attestation" model:
+ * every policy mutation runs through `queue_policy_update` →
+ * `apply_pending_policy` (the timelock-gated apply), and the resulting
+ * `PolicyConfig` PDA is the cryptographic attestation that "the owner
+ * approved these rules at timestamp T" — anchored by the `policy_version`
+ * monotonic counter + the canonical `policy_preview_digest` field (TA-19).
+ *
+ * Returns the current policy state. Callers that need to inspect a
+ * pending-but-not-yet-applied policy should call
+ * `fetchPendingPolicyUpdate` separately (different PDA, different
+ * decoder; not exported here because pending state isn't an attestation
+ * — it's a proposal).
+ */
+import type { Rpc, SolanaRpcApi } from "@solana/kit";
+import type { Address } from "./kit-adapter.js";
+import { type PolicyConfig } from "./generated/accounts/policyConfig.js";
+/**
+ * Result shape of {@link getLatestPolicyAttestation}.
+ *
+ * `attestation` is the decoded policy. `policyConfigPda` is the address
+ * we read from (caller can use it to deep-link to a dashboard view).
+ * `policyVersion` is hoisted from `attestation.policyVersion` for
+ * convenience — it's the field UI surfaces always need.
+ */
+export interface PolicyAttestation {
+    attestation: PolicyConfig;
+    policyConfigPda: Address;
+    policyVersion: number | bigint;
+}
+/**
+ * Fetch + decode the live `PolicyConfig` PDA for a vault.
+ *
+ * @example
+ * ```ts
+ * const result = await getLatestPolicyAttestation(rpc, policyConfigPda);
+ * console.log(
+ *   `Vault is on policy version ${result.policyVersion} ` +
+ *   `with daily cap $${result.attestation.dailySpendingCapUsd / 1_000_000n}.`,
+ * );
+ * ```
+ *
+ * @throws if the PDA does not exist (vault not initialized) — caller is
+ *   responsible for surfacing the `policy-not-found` UX. Kit's RPC layer
+ *   throws via `@solana/kit`'s `fetchEncodedAccount`-style error.
+ */
+export declare function getLatestPolicyAttestation(rpc: Rpc<SolanaRpcApi>, policyConfigPda: Address): Promise<PolicyAttestation>;
+//# sourceMappingURL=policy-attestation.d.ts.map

package/dist/policy-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-attestation.d.ts","sourceRoot":"","sources":["../src/policy-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,sCAAsC,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,YAAY,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EACtB,eAAe,EAAE,OAAO,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAO5B"}

package/dist/policy-attestation.js

@@ -0,0 +1,43 @@
+/**
+ * Policy attestation reader — Phase 9 Batch E (ISC-19..21).
+ *
+ * `getLatestPolicyAttestation` resolves the current on-chain PolicyConfig
+ * for a vault and returns the decoded view. Sigil's "attestation" model:
+ * every policy mutation runs through `queue_policy_update` →
+ * `apply_pending_policy` (the timelock-gated apply), and the resulting
+ * `PolicyConfig` PDA is the cryptographic attestation that "the owner
+ * approved these rules at timestamp T" — anchored by the `policy_version`
+ * monotonic counter + the canonical `policy_preview_digest` field (TA-19).
+ *
+ * Returns the current policy state. Callers that need to inspect a
+ * pending-but-not-yet-applied policy should call
+ * `fetchPendingPolicyUpdate` separately (different PDA, different
+ * decoder; not exported here because pending state isn't an attestation
+ * — it's a proposal).
+ */
+import { fetchPolicyConfig, } from "./generated/accounts/policyConfig.js";
+/**
+ * Fetch + decode the live `PolicyConfig` PDA for a vault.
+ *
+ * @example
+ * ```ts
+ * const result = await getLatestPolicyAttestation(rpc, policyConfigPda);
+ * console.log(
+ *   `Vault is on policy version ${result.policyVersion} ` +
+ *   `with daily cap $${result.attestation.dailySpendingCapUsd / 1_000_000n}.`,
+ * );
+ * ```
+ *
+ * @throws if the PDA does not exist (vault not initialized) — caller is
+ *   responsible for surfacing the `policy-not-found` UX. Kit's RPC layer
+ *   throws via `@solana/kit`'s `fetchEncodedAccount`-style error.
+ */
+export async function getLatestPolicyAttestation(rpc, policyConfigPda) {
+    const account = await fetchPolicyConfig(rpc, policyConfigPda);
+    return {
+        attestation: account.data,
+        policyConfigPda,
+        policyVersion: account.data.policyVersion,
+    };
+}
+//# sourceMappingURL=policy-attestation.js.map

package/dist/policy-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-attestation.js","sourceRoot":"","sources":["../src/policy-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EACL,iBAAiB,GAElB,MAAM,sCAAsC,CAAC;AAgB9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAsB,EACtB,eAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9D,OAAO;QACL,WAAW,EAAE,OAAO,CAAC,IAAI;QACzB,eAAe;QACf,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa;KAC1C,CAAC;AACJ,CAAC"}

package/dist/preview-create-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-create-vault.d.ts","sourceRoot":"","sources":["../src/preview-create-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,6BAA6B,EAC7B,kBAAkB,EAClB,GAAG,EACH,YAAY,EACb,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAQL,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AA0EpB;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,cAAc,GACd,cAAc,GACd,mBAAmB,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IACjE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,YAAY,CAAC,YAAY,CAAC;QAC1B,YAAY,CAAC,cAAc,CAAC;QAC5B,YAAY,CAAC,cAAc,CAAC;QAC5B,YAAY,CAAC,mBAAmB,CAAC;KAClC,CAAC;IACF,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC/C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0DAA0D;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,SAAS,OAAO,EAAE,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,6BAA6B,CAAC;CAC9D;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA2K7B;AAkUD;;;GAGG;AACH,YAAY,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"preview-create-vault.d.ts","sourceRoot":"","sources":["../src/preview-create-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,6BAA6B,EAC7B,kBAAkB,EAClB,GAAG,EACH,YAAY,EACb,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAQL,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AA+FpB;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,cAAc,GACd,cAAc,GACd,mBAAmB,CAAC;AAExB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY;IACjE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS;QACzB,YAAY,CAAC,YAAY,CAAC;QAC1B,YAAY,CAAC,cAAc,CAAC;QAC5B,YAAY,CAAC,cAAc,CAAC;QAC5B,YAAY,CAAC,mBAAmB,CAAC;KAClC,CAAC;IACF,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC/C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,0DAA0D;IAC1D,QAAQ,CAAC,mBAAmB,EAAE,SAAS,OAAO,EAAE,CAAC;IACjD,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACzE;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,6BAA6B,CAAC;CAC9D;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA2K7B;AAkUD;;;GAGG;AACH,YAAY,EAAE,OAAO,EAAE,CAAC"}

package/dist/preview-create-vault.js

@@ -57,36 +57,57 @@ import { SigilSdkDomainError } from "./errors/sdk.js";
 import { SIGIL_ERROR__SDK__INVALID_PARAMS } from "./errors/codes.js";
 // ─── On-chain account sizes (verified against programs/sigil/src/state/*.rs) ─
 /**
- * `AgentVault::SIZE` from `programs/sigil/src/state/vault.rs`.
+ * `AgentVault::SIZE` from `programs/sigil/src/state/vault.rs:135-152`.
  * Layout: 8 disc + 32 owner + 8 vault_id + 4 vec_prefix + (49 * 10) agents
  *       + 32 fee_destination + 1 status + 1 bump + 8 created_at
- *       + 8 total_transactions + 8 total_volume + 1 active_escrow_count
+ *       + 8 total_transactions + 8 total_volume
  *       + 8 total_fees_collected + 8 total_deposited_usd + 8 total_withdrawn_usd
- *       + 8 total_failed_transactions + 1 active_sessions = 634.
+ *       + 8 total_failed_transactions + 1 active_sessions
+ *       + 1 observe_only [Phase 2 TA-19] + 8 frozen_at_timestamp + 1 freeze_reason
+ *       + 1 owner_type [F-Q6] + 32 vault_authority [Phase 8 LBL-01] = 676.
+ *   (Was 634 — stale: it predated the Phase-8 fields frozen_at_timestamp +
+ *    freeze_reason + vault_authority (+41) and F-Q6 owner_type (+1); corrected
+ *    to the rent-exact 676 here.)
  */
-const AGENT_VAULT_SIZE = 634;
+const AGENT_VAULT_SIZE = 676;
 /**
- * `PolicyConfig::SIZE` from `programs/sigil/src/state/policy.rs`.
+ * `PolicyConfig::SIZE` from `programs/sigil/src/state/policy.rs:323-350`.
  * Layout: 8 disc + 32 vault + 8 daily_cap + 8 max_tx + 1 protocol_mode
- *       + (4 + 32*10) protocols + 2 dev_fee + 2 slippage + 8 timelock
- *       + (4 + 32*10) allowed_destinations + 1 has_constraints
- *       + 1 has_pending_policy + 1 has_protocol_caps
+ *       + (4 + 32*10) protocols + 2 dev_fee + 2 max_slippage_bps
+ *       + 8 session_window + (4 + 32*10) allowed_destinations
+ *       + 1 has_pending_policy + 1 has_protocol_caps [M1-04 removed has_constraints]
  *       + (4 + 8*10) protocol_caps + 8 session_expiry + 1 bump
- *       + 8 policy_version + 1 has_post_assertions = 822.
+ *       + 8 policy_version + 1 has_post_assertions + 1 destination_mode
+ *       + 32 policy_preview_digest [TA-19 Phase 2]
+ *       + 8 created_at_slot [PEN-CROSS-2]
+ *       + 4 operating_hours [TA-05 Phase 3]
+ *       + (4 + 40*10) destination_graylist [TA-07 Phase 3]
+ *       + 1 auto_promote_grays [TA-07] + 1 auto_revoke_threshold [TA-17]
+ *       + 8 stable_balance_floor [TA-12 Phase 5]
+ *       + 8 per_recipient_daily_cap_usd [TA-14 Phase 5]
+ *       + 1 cosign_required [G6 audit 2026-05-18]
+ *       + 32 cosign_session_pubkey [D-5 audit 2026-05-19, F-RP3-1]
+ *       + 8 operator_grant_delay_seconds [F-Q6 2026-06-02] = 1,329.
+ *   (Was 1,322 pre-F-Q6 — that value double-counted the M1-04-removed
+ *    has_constraints byte; corrected to the rent-exact 1,329 here.)
  */
-const POLICY_CONFIG_SIZE = 822;
+const POLICY_CONFIG_SIZE = 1_329;
 /**
- * `SpendTracker::SIZE` from `programs/sigil/src/state/tracker.rs`.
+ * `SpendTracker::SIZE` from `programs/sigil/src/state/tracker.rs:200-214`.
  * Layout: 8 disc + 32 vault + (16 * 144) buckets + (48 * 10) protocol_counters
- *       + 8 last_write_epoch + 1 bump + 7 padding = 2840.
+ *       + 8 last_write_epoch + 1 bump + 7 padding
+ *       + (48 * 10) per_recipient [TA-14 Phase 5]
+ *       + 1 per_recipient_count + 7 _padding_recipient = 3,328.
  */
-const SPEND_TRACKER_SIZE = 2_840;
+const SPEND_TRACKER_SIZE = 3_328;
 /**
- * `AgentSpendOverlay::SIZE` from `programs/sigil/src/state/agent_spend_overlay.rs`.
+ * `AgentSpendOverlay::SIZE` from `programs/sigil/src/state/agent_spend_overlay.rs:114-123`.
  * Layout: 8 disc + 32 vault + (232 * 10) entries + 1 bump + 7 padding
- *       + (8 * 10) lifetime_spend + (8 * 10) lifetime_tx_count = 2528.
+ *       + (8 * 10) lifetime_spend + (8 * 10) lifetime_tx_count
+ *       + (8 * 10) cooldown_seconds [TA-06 Phase 3]
+ *       + (8 * 10) last_action_unix [TA-06 Phase 3] = 2,688.
  */
-const AGENT_SPEND_OVERLAY_SIZE = 2_528;
+const AGENT_SPEND_OVERLAY_SIZE = 2_688;
 /** Default priority fee when caller doesn't supply one. Conservative. */
 const DEFAULT_PRIORITY_FEE_MICRO_LAMPORTS = 10_000;
 /** `1_000_000_000` lamports per SOL. */