@usesigil/kit 0.16.0 → 0.18.0

package/dist/create-vault.js

@@ -5,10 +5,11 @@
  * transaction composition, signing, and sending.
  */
 import { getInitializeVaultInstructionAsync } from "./generated/instructions/initializeVault.js";
-import { getRegisterAgentInstruction } from "./generated/instructions/registerAgent.js";
+import { getRegisterAgentInstructionAsync } from "./generated/instructions/registerAgent.js";
 import { getVaultPDA, getPolicyPDA, getAgentOverlayPDA, } from "./resolve-accounts.js";
 import { findNextVaultId } from "./inscribe.js";
 import { FULL_PERMISSIONS, toInstruction, } from "./types.js";
+import { computePolicyPreviewDigest } from "./policy/compute-policy-preview-digest.js";
 import { buildOwnerTransaction } from "./owner-transaction.js";
 import { signAndEncode, sendAndConfirmTransaction } from "./rpc-helpers.js";
 import { SigilSdkDomainError } from "./errors/sdk.js";
@@ -88,12 +89,15 @@ export async function createVault(options) {
     //   - maxTransactionSizeUsd defaults to dailySpendingCapUsd (caller's
     //     explicit cap becomes the per-tx ceiling unless narrower)
     //   - feeDestination defaults to the owner's key (same principal)
-    //   - protocols=[] + protocolMode=0 means "all protocols allowed" —
-    //     this is a policy decision, not a silent reduction
+    //   - protocolMode defaults to ALLOWLIST (1) — the ONLY mode the V2 program
+    //     accepts. Phase 2 Option A deleted the permissive ALL (0) / DENYLIST
+    //     modes; `initialize_vault.rs:125` hard-rejects any mode != 1. The old
+    //     default of 0 ("all protocols allowed") built an init the deployed
+    //     program reverts on, so it is corrected here.
     const maxTransactionSizeUsd = options.maxTransactionSizeUsd ?? options.dailySpendingCapUsd;
     const feeDestination = options.feeDestination ?? options.owner.address;
     const protocols = options.protocols ?? [];
-    const protocolMode = options.protocolMode ?? 0;
+    const protocolMode = options.protocolMode ?? 1;
     // Step 4: Build initializeVault instruction
     //
     // `protocolCaps`: forward caller-supplied caps if provided; otherwise
@@ -104,6 +108,89 @@ export async function createVault(options) {
     const protocolCaps = options.protocolCaps !== undefined
         ? options.protocolCaps
         : protocols.map(() => 0n);
+    const allowedDestinations = options.allowedDestinations ?? [];
+    const observeOnly = options.observeOnly ?? false;
+    // F-11 (initialize_vault.rs:190): an ACTIVE (non-observe_only) vault MUST
+    // carry at least one protocol OR destination on its allowlist, else the
+    // program rejects with `ActiveVaultRequiresAllowlist` (6073) — a vault that
+    // allows nothing is silently inert. Fail fast in the SDK with an actionable
+    // message rather than letting the owner-signed init revert on-chain.
+    if (!observeOnly &&
+        protocols.length === 0 &&
+        allowedDestinations.length === 0) {
+        throw new SigilSdkDomainError(SIGIL_ERROR__SDK__INVALID_PARAMS, "createVault: an active (non-observeOnly) vault must allowlist at least " +
+            "one protocol or destination — otherwise the on-chain program rejects " +
+            "it as inert (ActiveVaultRequiresAllowlist, 6073). Pass `protocols` " +
+            "and/or `allowedDestinations`, or set `observeOnly: true`.", {
+            context: {
+                field: "protocols/allowedDestinations",
+                received: { protocolMode, protocols: 0, allowedDestinations: 0 },
+            },
+        });
+    }
+    // PEN-CROSS-2 (Phase 2 close-up): the on-chain `initialize_vault` handler
+    // captures `Clock::get()?.slot` at handler entry and binds it into the
+    // canonical digest. The SDK must encode that same slot in the digest the
+    // owner signs. We use the RPC's current slot — typically off by 0-1 from
+    // the slot the handler executes in. If a slot rollover lands between
+    // `getSlot()` and execution, the user sees a recoverable
+    // `PolicyPreviewMismatch` and the SDK consumer retries with a fresh slot.
+    //
+    // Callers can override `createdAtSlot` for tests / fixtures that don't have
+    // a live RPC. Production submission paths should let this RPC-fetch run.
+    const createdAtSlot = options.createdAtSlot ??
+        (await options.rpc.getSlot({ commitment: "confirmed" }).send());
+    // Phase 2 TA-19: compute the canonical policy-preview digest off-chain.
+    // The on-chain `initialize_vault` handler recomputes this from the resulting
+    // policy state and rejects with `PolicyPreviewMismatch` if they differ.
+    // session_expiry_seconds is always 0 at init (uses default); has_constraints
+    // + has_post_assertions are always 0 at init (constraints are created later).
+    const previewDigest = computePolicyPreviewDigest({
+        dailySpendingCapUsd: options.dailySpendingCapUsd,
+        maxTransactionSizeUsd,
+        maxSlippageBps: options.maxSlippageBps ?? 100,
+        // PEN-CROSS-6: developer_fee_rate is bound by the digest. Mirror the
+        // same default the ix arg uses below to keep digest and storage in sync.
+        developerFeeRate: options.developerFeeRate ?? 0,
+        protocolMode,
+        protocols,
+        destinationMode: 0, // Phase 2 Option A: RESTRICTED is the only valid value
+        allowedDestinations,
+        timelockDuration: BigInt(options.timelockDuration),
+        sessionExpirySeconds: 0n,
+        observeOnly,
+        hasPostAssertions: 0,
+        // PEN-CROSS-2: defends against close+reinit replay.
+        createdAtSlot,
+        // TA-05 (Phase 3): default to all-24h enabled when caller doesn't
+        // narrow. Owner-facing config surface for narrowing lives at the
+        // dashboard-side mutation (not exposed via createVault yet).
+        operatingHours: options.operatingHours ?? 0x00ffffff,
+        // TA-07 (Phase 3): default to enforce 24h friction (auto_promote off).
+        autoPromoteGrays: options.autoPromoteGrays ?? false,
+        // TA-17 (Phase 3): default auto-revoke threshold of 5 — matches the
+        // on-chain default constant. Range 3..=20 enforced by the handler.
+        autoRevokeThreshold: options.autoRevokeThreshold ?? 5,
+        // TA-12 (Phase 5): stable balance floor — hard reserve under which spending
+        // is rejected at finalize. Default 0 = no floor enforcement. Bound by digest.
+        stableBalanceFloor: options.stableBalanceFloor ?? 0n,
+        // TA-14 (Phase 5): per-recipient daily cap. Default 0 = unlimited per recipient
+        // (still bounded by the global daily cap). Bound by digest.
+        perRecipientDailyCapUsd: options.perRecipientDailyCapUsd ?? 0n,
+        // G6 (audit 2026-05-18 cosign opt-in): default false (low-friction).
+        // Owners explicitly opt in by passing true. Bound by TA-19 at position 20.
+        cosignRequired: options.cosignRequired ?? false,
+        // M-1 (audit 2026-06-11): bind per-protocol caps (positions 23-24). The
+        // `protocolCaps` value below is exactly what goes on the wire to
+        // `initialize_vault`, which derives `has_protocol_caps = !is_empty()` and
+        // stores the slice verbatim (initialize_vault.rs:256-257). Mirror that
+        // derivation here so the owner-signed digest matches the on-chain
+        // recompute. NOTE: the default path fills `protocolCaps` with all-zeros of
+        // length === protocols.length (non-empty), so `has_protocol_caps` is TRUE
+        // for any vault with ≥1 protocol — the length test below mirrors that.
+        hasProtocolCaps: protocolCaps.length > 0,
+        protocolCaps,
+    });
     const initializeVaultIx = await getInitializeVaultInstructionAsync({
         owner: options.owner,
         agentSpendOverlay: agentOverlayAddress,
@@ -116,13 +203,27 @@ export async function createVault(options) {
         developerFeeRate: options.developerFeeRate ?? 0,
         maxSlippageBps: options.maxSlippageBps ?? 100,
         timelockDuration: options.timelockDuration,
-        allowedDestinations: options.allowedDestinations ?? [],
+        allowedDestinations,
         protocolCaps,
+        observeOnly,
+        operatingHours: options.operatingHours ?? 0x00ffffff,
+        autoPromoteGrays: options.autoPromoteGrays ?? false,
+        autoRevokeThreshold: options.autoRevokeThreshold ?? 5,
+        stableBalanceFloor: options.stableBalanceFloor ?? 0n,
+        perRecipientDailyCapUsd: options.perRecipientDailyCapUsd ?? 0n,
+        // G6 (audit 2026-05-18 cosign opt-in): default false at construction.
+        // The arg + the digest above are computed against the same value so
+        // the on-chain `initialize_vault` digest assertion passes.
+        cosignRequired: options.cosignRequired ?? false,
+        previewDigest,
     });
-    // Step 5: Build registerAgent instruction
-    const registerAgentIx = getRegisterAgentInstruction({
+    // Step 5: Build registerAgent instruction.
+    //   PEN-CROSS-5 (Phase 4 absorption): policy now required for
+    //   policy_version bump.
+    const registerAgentIx = await getRegisterAgentInstructionAsync({
         owner: options.owner,
         vault: vaultAddress,
+        policy: policyAddress,
         agentSpendOverlay: agentOverlayAddress,
         agent: options.agent.address,
         capability: Number(options.permissions ?? FULL_PERMISSIONS),

package/dist/create-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-vault.js","sourceRoot":"","sources":["../src/create-vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,OAAO,EACL,WAAW,EACX,YAAY,EACZ,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AA+EhF,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B;IAE3B,yBAAyB;IACzB,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,EACvC,0CAA0C;YACxC,+EAA+E,EACjF;YACE,OAAO,EAAE;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;aAC7B;SACF,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,2CAA2C;IAC3C,IACE,OAAO,OAAO,CAAC,gBAAgB,KAAK,WAAW;QAC/C,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,EAC5C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,gEAAgE;YAC9D,oEAAoE;YACpE,mDAAmD,EACrD,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,IACE,OAAO,OAAO,CAAC,mBAAmB,KAAK,WAAW;QAClD,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ,EAC/C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,mEAAmE;YACjE,4DAA4D;YAC5D,qBAAqB,EACvB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,IACE,OAAO,OAAO,CAAC,gBAAgB,KAAK,WAAW;QAC/C,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,EAC5C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,gEAAgE;YAC9D,6DAA6D;YAC7D,qCAAqC,EACvC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,uCAAuC;IACvC,yBAAyB,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC,mBAAmB;QAC1C,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,OAAO,CAAC,gBAAgB;KACtC,CAAC,CAAC;IAEH,oDAAoD;IACpD,EAAE;IACF,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,8DAA8D;IAC9D,yDAAyD;IACzD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,EACpC,sBAAsB,GAAG,8CAA8C;gBACrE,8DAA8D;gBAC9D,uEAAuE;gBACvE,uEAAuE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,sBAAsB;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAExE,8DAA8D;IAC9D,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,uDAAuD;IACvD,sEAAsE;IACtE,+DAA+D;IAC/D,kEAAkE;IAClE,oEAAoE;IACpE,wDAAwD;IACxD,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,OAAO,CAAC,YAAY;QACtB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAE9B,MAAM,iBAAiB,GAAG,MAAM,kCAAkC,CAAC;QACjE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,iBAAiB,EAAE,mBAAmB;QACtC,cAAc;QACd,OAAO;QACP,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB;QACrB,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAC/C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,GAAG;QAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE;QACtD,YAAY;KACb,CAAC,CAAC;IAEH,0CAA0C;IAC1C,MAAM,eAAe,GAAG,2BAA2B,CAAC;QAClD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,YAAY;QACnB,iBAAiB,EAAE,mBAAmB;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC5B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC3D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,OAAO;QACP,aAAa;QACb,mBAAmB;QACnB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QACnD,eAAe,EAAE,aAAa,CAAC,eAAe,CAAC;KAChD,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,OAAO,CAAC,GAAG,EACX,OAAO,EACP,OAAO,CAAC,cAAc,CACvB,CAAC;IAEF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"create-vault.js","sourceRoot":"","sources":["../src/create-vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AACjG,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EACL,WAAW,EACX,YAAY,EACZ,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,aAAa,GAGd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AA8KhF,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B;IAE3B,yBAAyB;IACzB,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,EACvC,0CAA0C;YACxC,+EAA+E,EACjF;YACE,OAAO,EAAE;gBACP,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;aAC7B;SACF,CACF,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,2CAA2C;IAC3C,IACE,OAAO,OAAO,CAAC,gBAAgB,KAAK,WAAW;QAC/C,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,EAC5C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,gEAAgE;YAC9D,oEAAoE;YACpE,mDAAmD,EACrD,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAC3C,CAAC;IACJ,CAAC;IACD,IACE,OAAO,OAAO,CAAC,mBAAmB,KAAK,WAAW;QAClD,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ,EAC/C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,mEAAmE;YACjE,4DAA4D;YAC5D,qBAAqB,EACvB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,IACE,OAAO,OAAO,CAAC,gBAAgB,KAAK,WAAW;QAC/C,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,EAC5C,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,gEAAgE;YAC9D,6DAA6D;YAC7D,qCAAqC,EACvC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAC3C,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,mEAAmE;IACnE,uCAAuC;IACvC,yBAAyB,CAAC;QACxB,aAAa,EAAE,OAAO,CAAC,mBAAmB;QAC1C,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,OAAO,CAAC,gBAAgB;KACtC,CAAC,CAAC;IAEH,oDAAoD;IACpD,EAAE;IACF,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,8DAA8D;IAC9D,yDAAyD;IACzD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;QAChC,IAAI,GAAG,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAC3B,oCAAoC,EACpC,sBAAsB,GAAG,8CAA8C;gBACrE,8DAA8D;gBAC9D,uEAAuE;gBACvE,uEAAuE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAE9D,sBAAsB;IACtB,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,CAAC,mBAAmB,CAAC,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAExE,8DAA8D;IAC9D,EAAE;IACF,wEAAwE;IACxE,oEAAoE;IACpE,uDAAuD;IACvD,sEAAsE;IACtE,+DAA+D;IAC/D,kEAAkE;IAClE,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAE/C,4CAA4C;IAC5C,EAAE;IACF,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS;QAChC,CAAC,CAAC,OAAO,CAAC,YAAY;QACtB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAE9B,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,qEAAqE;IACrE,IACE,CAAC,WAAW;QACZ,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,yEAAyE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,2DAA2D,EAC7D;YACE,OAAO,EAAE;gBACP,KAAK,EAAE,+BAA+B;gBACtC,QAAQ,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE;aACjE;SACF,CACF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,yDAAyD;IACzD,0EAA0E;IAC1E,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa;QACrB,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,wEAAwE;IACxE,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB;QACrB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,GAAG;QAC7C,qEAAqE;QACrE,yEAAyE;QACzE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAC/C,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,CAAC,EAAE,uDAAuD;QAC3E,mBAAmB;QACnB,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAClD,oBAAoB,EAAE,EAAE;QACxB,WAAW;QACX,iBAAiB,EAAE,CAAC;QACpB,oDAAoD;QACpD,aAAa;QACb,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,UAAU;QACpD,uEAAuE;QACvE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,oEAAoE;QACpE,mEAAmE;QACnE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,CAAC;QACrD,4EAA4E;QAC5E,8EAA8E;QAC9E,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE;QACpD,gFAAgF;QAChF,4DAA4D;QAC5D,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;QAC9D,qEAAqE;QACrE,2EAA2E;QAC3E,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;QAC/C,wEAAwE;QACxE,iEAAiE;QACjE,0EAA0E;QAC1E,uEAAuE;QACvE,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,eAAe,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC;QACxC,YAAY;KACb,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM,kCAAkC,CAAC;QACjE,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,iBAAiB,EAAE,mBAAmB;QACtC,cAAc;QACd,OAAO;QACP,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,qBAAqB;QACrB,YAAY;QACZ,SAAS;QACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAC/C,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,GAAG;QAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,mBAAmB;QACnB,YAAY;QACZ,WAAW;QACX,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,UAAU;QACpD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE;QACpD,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,EAAE;QAC9D,sEAAsE;QACtE,oEAAoE;QACpE,2DAA2D;QAC3D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;QAC/C,aAAa;KACd,CAAC,CAAC;IAEH,2CAA2C;IAC3C,8DAA8D;IAC9D,yBAAyB;IACzB,MAAM,eAAe,GAAG,MAAM,gCAAgC,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE,mBAAmB;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC5B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC;QAC3D,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,OAAO;QACP,aAAa;QACb,mBAAmB;QACnB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QACnD,eAAe,EAAE,aAAa,CAAC,eAAe,CAAC;KAChD,CAAC;AACJ,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC;QAChE,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;KAC3D,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAC/C,OAAO,CAAC,GAAG,EACX,OAAO,EACP,OAAO,CAAC,cAAc,CACvB,CAAC;IAEF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}

package/dist/dashboard/close-vault.d.ts

@@ -0,0 +1,110 @@
+/**
+ * close-vault helpers — pending-PDA enumeration for the close_vault path.
+ *
+ * Companion to the `close_vault` drain logic in
+ * `programs/sigil/src/instructions/close_vault.rs`: enumerates the pending
+ * PDAs (pending_owner, pending_agent_grant) the handler drains.
+ *
+ * Why this lives in its own file
+ * ─────────────────────────────
+ * The user-facing `closeVault` builder lives in `mutations.ts` (a
+ * generously-sized file). CH-3 is concurrently editing `mutations.ts`,
+ * so CH-2 keeps its surface minimal here: pure PDA enumeration helpers
+ * plus the canonical drain order. CH-3 imports
+ * {@link enumerateExistingPendingPdasForClose} (or the individual
+ * derivation helpers) when wiring the new account into the
+ * `remainingAccounts` list.
+ *
+ * On-chain ordering invariant
+ * ───────────────────────────
+ * close_vault.rs (HEAD 321a8fb3 + CH-2):
+ *
+ *   1. `pending_policy`              [b"pending_policy", vault]            — MUST be slot 0 when present (close_vault.rs unconditionally reads `remaining_accounts.first()`)
+ *   2. `pending_agent_perms`         [b"pending_agent_perms", vault, agent] — one per registered agent
+ *   3. `pending_owner`               [b"pending_owner", vault]
+ *   4. `pending_agent_grant`         [b"pending_agent_grant", vault]
+ *
+ * (M1-04b: the pending_close_constraints + pending_constraints drains were
+ * removed — the constraints engine is gone, those PDAs can never exist.)
+ *
+ * The Rust drain loops use `start_idx` (= 1 if `policy.has_pending_policy`,
+ * else 0) — a single static offset, not an incrementing cursor. So drains
+ * 2-4 all scan the same trailing window and match by pubkey. The order of
+ * items 2-4 in `remaining_accounts` does not matter functionally, but
+ * {@link CLOSE_VAULT_PENDING_PDA_ORDER} pins the canonical layout for
+ * review-grep + future audit symmetry.
+ *
+ * Behavior on RPC failure
+ * ───────────────────────
+ * {@link enumerateExistingPendingPdasForClose} treats RPC `getAccountInfo`
+ * failures as "absent": the close TX still goes through, the on-chain
+ * handler silently skips any drain block whose PDA isn't passed (since
+ * `lamports() > 0` is the guard). This matches the existing
+ * `mutations.ts::closeVault` behavior for `pending_policy` +
+ * `pending_agent_perms`. A transient RPC
+ * outage therefore degrades to "rent stays orphaned, vault still closes"
+ * — never to "close TX rejects".
+ */
+import { type Address, type Rpc, type SolanaRpcApi, AccountRole } from "../kit-adapter.js";
+/**
+ * Canonical layout pins for `close_vault` remaining_accounts.
+ *
+ * Mirrors the drain blocks in `programs/sigil/src/instructions/close_vault.rs`
+ * (HEAD 321a8fb3 + CH-2). The Rust loops match by pubkey within
+ * `remaining_accounts.iter().skip(start_idx)` so items 2-6 are
+ * positionally interchangeable, but callers SHOULD append in this order
+ * to keep audit-trail diffs reviewable.
+ */
+export declare const CLOSE_VAULT_PENDING_PDA_ORDER: readonly ["pending_policy", "pending_agent_perms", "pending_owner", "pending_agent_grant"];
+/**
+ * Derive the `PendingOwnershipTransfer` PDA for a vault.
+ * Seeds: `[b"pending_owner", vault]`
+ *
+ * Drained by `close_vault.rs:187-203` (SFH-01 fix, audit 2026-05-19).
+ */
+export declare function findPendingOwnerPda(vault: Address, programAddress?: Address): Promise<Address>;
+/**
+ * Derive the `PendingAgentGrant` PDA for a vault.
+ * Seeds: `[b"pending_agent_grant", vault]`
+ *
+ * Drained by `close_vault.rs:215-231` (SFH-01 fix, audit 2026-05-19).
+ */
+export declare function findPendingAgentGrantPda(vault: Address, programAddress?: Address): Promise<Address>;
+/**
+ * One entry in the close_vault remaining_accounts list — wraps a single
+ * pending PDA pubkey alongside the role bit the on-chain drain block
+ * requires (always `WRITABLE`, since the lamports + assign + resize
+ * mutations need write access).
+ */
+export interface CloseVaultPendingAccount {
+    /** Stable identifier for logs / audit diffs. Mirrors
+     * {@link CLOSE_VAULT_PENDING_PDA_ORDER}. */
+    readonly kind: (typeof CLOSE_VAULT_PENDING_PDA_ORDER)[number];
+    /** PDA address. */
+    readonly address: Address;
+    /** Always WRITABLE — the drain block transfers lamports + reassigns. */
+    readonly role: AccountRole.WRITABLE;
+}
+/**
+ * Enumerate the **SFH-01** pending PDAs (pending_owner, pending_agent_grant)
+ * that currently hold rent on-chain for a given vault.
+ *
+ * This helper is the load-bearing piece of the close-vault drain companion:
+ * the `closeVault` builder in `mutations.ts` appends the returned entries to
+ * the existing `pending_policy` + `pending_agent_perms` list to ensure every
+ * drainable PDA is covered.
+ *
+ * Failure mode: RPC errors on individual PDAs are logged via the Sigil
+ * module logger and treated as "absent" — the close TX still proceeds,
+ * but the missed PDA's rent stays orphaned (same compromise as the
+ * existing `mutations.ts::closeVault` handles for the other drains).
+ *
+ * HH-1 close (audit 2026-05-23): the optional `onRpcError` callback lets
+ * callers (e.g. `mutations.ts::closeVault`) escalate the visibility of
+ * an enumeration failure beyond the module logger — emit an
+ * ERROR-level log line with vault context, throw, or display a UI
+ * warning. Without the callback the existing best-effort drain
+ * semantic is preserved (warn-and-continue).
+ */
+export declare function enumerateExistingPendingPdasForClose(rpc: Rpc<SolanaRpcApi>, vault: Address, programAddress?: Address, onRpcError?: (kind: CloseVaultPendingAccount["kind"], address: Address, cause: unknown) => void): Promise<readonly CloseVaultPendingAccount[]>;
+//# sourceMappingURL=close-vault.d.ts.map

package/dist/dashboard/close-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"close-vault.d.ts","sourceRoot":"","sources":["../../src/dashboard/close-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,WAAW,EAGZ,MAAM,mBAAmB,CAAC;AAa3B;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,4FAKhC,CAAC;AAIX;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,OAAO,EACd,cAAc,GAAE,OAA+B,GAC9C,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,OAAO,EACd,cAAc,GAAE,OAA+B,GAC9C,OAAO,CAAC,OAAO,CAAC,CAOlB;AAID;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC;gDAC4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,oCAAoC,CACxD,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EACtB,KAAK,EAAE,OAAO,EACd,cAAc,GAAE,OAA+B,EAC/C,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,EACtC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,OAAO,KACX,IAAI,GACR,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAwD9C"}

package/dist/dashboard/close-vault.js

@@ -0,0 +1,165 @@
+/**
+ * close-vault helpers — pending-PDA enumeration for the close_vault path.
+ *
+ * Companion to the `close_vault` drain logic in
+ * `programs/sigil/src/instructions/close_vault.rs`: enumerates the pending
+ * PDAs (pending_owner, pending_agent_grant) the handler drains.
+ *
+ * Why this lives in its own file
+ * ─────────────────────────────
+ * The user-facing `closeVault` builder lives in `mutations.ts` (a
+ * generously-sized file). CH-3 is concurrently editing `mutations.ts`,
+ * so CH-2 keeps its surface minimal here: pure PDA enumeration helpers
+ * plus the canonical drain order. CH-3 imports
+ * {@link enumerateExistingPendingPdasForClose} (or the individual
+ * derivation helpers) when wiring the new account into the
+ * `remainingAccounts` list.
+ *
+ * On-chain ordering invariant
+ * ───────────────────────────
+ * close_vault.rs (HEAD 321a8fb3 + CH-2):
+ *
+ *   1. `pending_policy`              [b"pending_policy", vault]            — MUST be slot 0 when present (close_vault.rs unconditionally reads `remaining_accounts.first()`)
+ *   2. `pending_agent_perms`         [b"pending_agent_perms", vault, agent] — one per registered agent
+ *   3. `pending_owner`               [b"pending_owner", vault]
+ *   4. `pending_agent_grant`         [b"pending_agent_grant", vault]
+ *
+ * (M1-04b: the pending_close_constraints + pending_constraints drains were
+ * removed — the constraints engine is gone, those PDAs can never exist.)
+ *
+ * The Rust drain loops use `start_idx` (= 1 if `policy.has_pending_policy`,
+ * else 0) — a single static offset, not an incrementing cursor. So drains
+ * 2-4 all scan the same trailing window and match by pubkey. The order of
+ * items 2-4 in `remaining_accounts` does not matter functionally, but
+ * {@link CLOSE_VAULT_PENDING_PDA_ORDER} pins the canonical layout for
+ * review-grep + future audit symmetry.
+ *
+ * Behavior on RPC failure
+ * ───────────────────────
+ * {@link enumerateExistingPendingPdasForClose} treats RPC `getAccountInfo`
+ * failures as "absent": the close TX still goes through, the on-chain
+ * handler silently skips any drain block whose PDA isn't passed (since
+ * `lamports() > 0` is the guard). This matches the existing
+ * `mutations.ts::closeVault` behavior for `pending_policy` +
+ * `pending_agent_perms`. A transient RPC
+ * outage therefore degrades to "rent stays orphaned, vault still closes"
+ * — never to "close TX rejects".
+ */
+import { AccountRole, getProgramDerivedAddress, getAddressEncoder, } from "../kit-adapter.js";
+import { SIGIL_PROGRAM_ADDRESS } from "../generated/programs/sigil.js";
+import { getSigilModuleLogger } from "../logger.js";
+import { redactCause } from "../network-errors.js";
+// ─── Seed constants ──────────────────────────────────────────────────────
+const PENDING_OWNER_SEED = new TextEncoder().encode("pending_owner");
+const PENDING_AGENT_GRANT_SEED = new TextEncoder().encode("pending_agent_grant");
+/**
+ * Canonical layout pins for `close_vault` remaining_accounts.
+ *
+ * Mirrors the drain blocks in `programs/sigil/src/instructions/close_vault.rs`
+ * (HEAD 321a8fb3 + CH-2). The Rust loops match by pubkey within
+ * `remaining_accounts.iter().skip(start_idx)` so items 2-6 are
+ * positionally interchangeable, but callers SHOULD append in this order
+ * to keep audit-trail diffs reviewable.
+ */
+export const CLOSE_VAULT_PENDING_PDA_ORDER = [
+    "pending_policy",
+    "pending_agent_perms", // one per registered agent
+    "pending_owner",
+    "pending_agent_grant",
+];
+// ─── PDA derivation ──────────────────────────────────────────────────────
+/**
+ * Derive the `PendingOwnershipTransfer` PDA for a vault.
+ * Seeds: `[b"pending_owner", vault]`
+ *
+ * Drained by `close_vault.rs:187-203` (SFH-01 fix, audit 2026-05-19).
+ */
+export async function findPendingOwnerPda(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
+    const encoder = getAddressEncoder();
+    const [pda] = await getProgramDerivedAddress({
+        programAddress,
+        seeds: [PENDING_OWNER_SEED, encoder.encode(vault)],
+    });
+    return pda;
+}
+/**
+ * Derive the `PendingAgentGrant` PDA for a vault.
+ * Seeds: `[b"pending_agent_grant", vault]`
+ *
+ * Drained by `close_vault.rs:215-231` (SFH-01 fix, audit 2026-05-19).
+ */
+export async function findPendingAgentGrantPda(vault, programAddress = SIGIL_PROGRAM_ADDRESS) {
+    const encoder = getAddressEncoder();
+    const [pda] = await getProgramDerivedAddress({
+        programAddress,
+        seeds: [PENDING_AGENT_GRANT_SEED, encoder.encode(vault)],
+    });
+    return pda;
+}
+/**
+ * Enumerate the **SFH-01** pending PDAs (pending_owner, pending_agent_grant)
+ * that currently hold rent on-chain for a given vault.
+ *
+ * This helper is the load-bearing piece of the close-vault drain companion:
+ * the `closeVault` builder in `mutations.ts` appends the returned entries to
+ * the existing `pending_policy` + `pending_agent_perms` list to ensure every
+ * drainable PDA is covered.
+ *
+ * Failure mode: RPC errors on individual PDAs are logged via the Sigil
+ * module logger and treated as "absent" — the close TX still proceeds,
+ * but the missed PDA's rent stays orphaned (same compromise as the
+ * existing `mutations.ts::closeVault` handles for the other drains).
+ *
+ * HH-1 close (audit 2026-05-23): the optional `onRpcError` callback lets
+ * callers (e.g. `mutations.ts::closeVault`) escalate the visibility of
+ * an enumeration failure beyond the module logger — emit an
+ * ERROR-level log line with vault context, throw, or display a UI
+ * warning. Without the callback the existing best-effort drain
+ * semantic is preserved (warn-and-continue).
+ */
+export async function enumerateExistingPendingPdasForClose(rpc, vault, programAddress = SIGIL_PROGRAM_ADDRESS, onRpcError) {
+    const [pendingOwnerPda, pendingAgentGrantPda] = await Promise.all([
+        findPendingOwnerPda(vault, programAddress),
+        findPendingAgentGrantPda(vault, programAddress),
+    ]);
+    const candidates = [
+        { kind: "pending_owner", address: pendingOwnerPda },
+        { kind: "pending_agent_grant", address: pendingAgentGrantPda },
+    ];
+    const checks = await Promise.all(candidates.map(async ({ kind, address }) => {
+        try {
+            const info = await rpc
+                .getAccountInfo(address, { encoding: "base64" })
+                .send();
+            return info?.value
+                ? {
+                    kind,
+                    address,
+                    role: AccountRole.WRITABLE,
+                }
+                : null;
+        }
+        catch (err) {
+            const cause = redactCause(err);
+            getSigilModuleLogger().warn(`[close_vault] existence check failed for ${kind} ${address} — treating as absent: ${cause.message ?? cause.name ?? cause.code ?? "unknown"}`);
+            // HH-1 close (audit 2026-05-23): give callers a chance to
+            // escalate the RPC failure (e.g. emit error-level log with
+            // vault context, throw to abort close, surface in UI). The
+            // existing module logger is preserved as the default low-floor
+            // signal.
+            if (onRpcError !== undefined) {
+                try {
+                    onRpcError(kind, address, err);
+                }
+                catch {
+                    // Caller's callback must not break the enumeration —
+                    // swallow silently. Errors from the callback itself are
+                    // a programming bug in the caller.
+                }
+            }
+            return null;
+        }
+    }));
+    return checks.filter((entry) => entry !== null);
+}
+//# sourceMappingURL=close-vault.js.map

package/dist/dashboard/close-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"close-vault.js","sourceRoot":"","sources":["../../src/dashboard/close-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAIL,WAAW,EACX,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,4EAA4E;AAE5E,MAAM,kBAAkB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvD,qBAAqB,CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,gBAAgB;IAChB,qBAAqB,EAAE,2BAA2B;IAClD,eAAe;IACf,qBAAqB;CACb,CAAC;AAEX,4EAA4E;AAE5E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC;QAC3C,cAAc;QACd,KAAK,EAAE,CAAC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAc,EACd,iBAA0B,qBAAqB;IAE/C,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,wBAAwB,CAAC;QAC3C,cAAc;QACd,KAAK,EAAE,CAAC,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,GAAsB,EACtB,KAAc,EACd,iBAA0B,qBAAqB,EAC/C,UAIS;IAET,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,mBAAmB,CAAC,KAAK,EAAE,cAAc,CAAC;QAC1C,wBAAwB,CAAC,KAAK,EAAE,cAAc,CAAC;KAChD,CAAC,CAAC;IAEH,MAAM,UAAU,GAGX;QACH,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE;QACnD,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,oBAAoB,EAAE;KAC/D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG;iBACnB,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAC/C,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,EAAE,KAAK;gBAChB,CAAC,CAAE;oBACC,IAAI;oBACJ,OAAO;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ;iBACE;gBAChC,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,oBAAoB,EAAE,CAAC,IAAI,CACzB,4CAA4C,IAAI,IAAI,OAAO,0BACzD,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,SAC/C,EAAE,CACH,CAAC;YACF,0DAA0D;YAC1D,2DAA2D;YAC3D,2DAA2D;YAC3D,+DAA+D;YAC/D,UAAU;YACV,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,qDAAqD;oBACrD,wDAAwD;oBACxD,mCAAmC;gBACrC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAqC,EAAE,CAAC,KAAK,KAAK,IAAI,CAC7D,CAAC;AACJ,CAAC"}

package/dist/dashboard/errors.d.ts

@@ -58,8 +58,8 @@ export type DxErrorCategory = "user" | "network" | "program" | "unknown";
  * Friendly category for a `DxError` (FE↔BE contract §6.3 helper).
  *
  * Returns one of:
- *   - `"program"` — Anchor on-chain error (6000-6074). Tx reached the
- *     program and was rejected by program logic.
+ *   - `"program"` — Anchor on-chain error (6000-6104 post M1-04). Tx
+ *     reached the program and was rejected by program logic.
  *   - `"user"` — SDK / dashboard logic error (7000-7099). Client-side
  *     validation failure the user can fix.
  *   - `"network"` — RPC / network error (7100-7199). Transport layer;

package/dist/dashboard/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/dashboard/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8F1C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AA8B3C;;;;;;;;;;GAUG;AACH,QAAA,MAAM,uBAAuB,yCAKnB,CAAC;AAEX,KAAK,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AAOH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAwBzC;AAiCD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,eAAe,CAO3E;AAID,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAwBjE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/dashboard/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA8F1C,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AA8B3C;;;;;;;;;;GAUG;AACH,QAAA,MAAM,uBAAuB,yCAKnB,CAAC;AAEX,KAAK,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AAOH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAwBzC;AAqCD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,eAAe,CAO3E;AAID,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAwBjE"}

package/dist/dashboard/errors.js

@@ -11,7 +11,7 @@
  * re-throw." Used by `getPolicy`, `getOverview`, and `getVaultSummary`.
  */
 import { isSolanaError, SOLANA_ERROR__NONCE_ACCOUNT_NOT_FOUND, SOLANA_ERROR__ACCOUNTS__ACCOUNT_NOT_FOUND, SOLANA_ERROR__TRANSACTION_ERROR__ACCOUNT_NOT_FOUND, SOLANA_ERROR__TRANSACTION_ERROR__PROGRAM_ACCOUNT_NOT_FOUND, } from "@solana/errors";
-import { SDK_ERROR_CODES, toAgentError } from "../agent-errors.js";
+import { SDK_ERROR_CODES, SIGIL_ON_CHAIN_ERROR_MAX, SIGIL_ON_CHAIN_ERROR_MIN, toAgentError, } from "../agent-errors.js";
 /**
  * PR 2.A: SIGIL_ERROR__<DOMAIN>__<DESCRIPTOR> string codes (canonical
  * SigilErrorCode union from `errors/codes.ts`) → numeric DxError codes.
@@ -196,14 +196,18 @@ export function isAccountNotFoundError(err) {
 }
 // ─── DxError range constants (FE↔BE contract §6.3) ──────────────────────────
 /**
- * Lower bound of the Anchor on-chain error range. Any code in
+ * Bounds of the Anchor on-chain error range. Any code in
  * [ANCHOR_ERROR_MIN, ANCHOR_ERROR_MAX] means the transaction reached the
  * on-chain program and was rejected by program logic — FE renders a
  * specific "the vault's rules prevented this" message.
+ *
+ * Aliased from `agent-errors.ts` (single source of truth) so both the
+ * dashboard categorize-path and the SDK error-extraction predicate stay
+ * in lockstep without manual sync. Bump only at the constant declaration
+ * in `agent-errors.ts`.
  */
-const ANCHOR_ERROR_MIN = 6000;
-/** Upper bound of the Anchor on-chain error range (Sigil ships 71 codes: 6000-6070; 6074 is the reserved ceiling per the FE↔BE contract). */
-const ANCHOR_ERROR_MAX = 6074;
+const ANCHOR_ERROR_MIN = SIGIL_ON_CHAIN_ERROR_MIN;
+const ANCHOR_ERROR_MAX = SIGIL_ON_CHAIN_ERROR_MAX;
 /**
  * Lower bound of the SDK / dashboard logic error range (FE↔BE §6.3).
  * Codes in [SDK_ERROR_MIN, SDK_ERROR_MAX] are classified as "user"
@@ -236,8 +240,8 @@ export function isOnChainReverted(code) {
  * Friendly category for a `DxError` (FE↔BE contract §6.3 helper).
  *
  * Returns one of:
- *   - `"program"` — Anchor on-chain error (6000-6074). Tx reached the
- *     program and was rejected by program logic.
+ *   - `"program"` — Anchor on-chain error (6000-6104 post M1-04). Tx
+ *     reached the program and was rejected by program logic.
  *   - `"user"` — SDK / dashboard logic error (7000-7099). Client-side
  *     validation failure the user can fix.
  *   - `"network"` — RPC / network error (7100-7199). Transport layer;

package/dist/dashboard/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/dashboard/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,aAAa,EACb,qCAAqC,EACrC,yCAAyC,EACzC,kDAAkD,EAClD,0DAA0D,GAE3D,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGnE;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAA2B;IACrD,gDAAgD;IAChD,kCAAkC,EAAE,IAAI;IACxC,mCAAmC,EAAE,IAAI,EAAE,kBAAkB;IAC7D,wCAAwC,EAAE,IAAI,EAAE,oBAAoB;IACpE,oCAAoC,EAAE,IAAI;IAC1C,uDAAuD;IACvD,oCAAoC,EAAE,IAAI;IAC1C,oCAAoC,EAAE,IAAI;IAC1C,8BAA8B,EAAE,IAAI;IACpC,yDAAyD;IACzD,mCAAmC,EAAE,IAAI;IACzC,oCAAoC,EAAE,IAAI;IAC1C,wCAAwC,EAAE,IAAI,EAAE,yBAAyB;IACzE,+DAA+D;IAC/D,mCAAmC,EAAE,IAAI;IACzC,iCAAiC,EAAE,IAAI;IACvC,8BAA8B,EAAE,IAAI;IACpC,sCAAsC,EAAE,IAAI;IAC5C,yBAAyB,EAAE,IAAI;IAC/B,gEAAgE;IAChE,gCAAgC,EAAE,IAAI;IACtC,gCAAgC,EAAE,IAAI;IACtC,iCAAiC,EAAE,IAAI;IACvC,gCAAgC,EAAE,IAAI;IACtC,oCAAoC,EAAE,IAAI;IAC1C,qCAAqC,EAAE,IAAI;IAC3C,uCAAuC,EAAE,IAAI;IAC7C,iCAAiC,EAAE,IAAI,EAAE,mBAAmB;IAC5D,gCAAgC,EAAE,IAAI;IACtC,uCAAuC,EAAE,IAAI;IAC7C,kCAAkC,EAAE,IAAI;IACxC,sCAAsC,EAAE,IAAI;IAC5C,8BAA8B,EAAE,IAAI;IACpC,uCAAuC,EAAE,IAAI;IAC7C,gCAAgC,EAAE,IAAI;IACtC,mCAAmC,EAAE,IAAI;IACzC,sCAAsC,EAAE,IAAI,EAAE,gBAAgB;IAC9D,sCAAsC,EAAE,IAAI;IAC5C,uCAAuC,EAAE,IAAI;IAC7C,mCAAmC,EAAE,IAAI;IACzC,8BAA8B,EAAE,IAAI,EAAE,+BAA+B;IACrE,mCAAmC,EAAE,IAAI;IACzC,+BAA+B,EAAE,IAAI;IACrC,kCAAkC,EAAE,IAAI;IACxC,6BAA6B,EAAE,IAAI;IACnC,yBAAyB,EAAE,IAAI,EAAE,6BAA6B;IAC9D,mCAAmC;IACnC,2BAA2B,EAAE,IAAI,EAAE,mBAAmB;IACtD,sCAAsC,EAAE,IAAI;IAC5C,mCAAmC,EAAE,IAAI;IACzC,gCAAgC,EAAE,IAAI;IACtC,8BAA8B,EAAE,IAAI,EAAE,mBAAmB;IACzD,8BAA8B,EAAE,IAAI,EAAE,YAAY;IAClD,sCAAsC,EAAE,IAAI;IAC5C,sDAAsD;IACtD,6BAA6B,EAAE,IAAI;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1E;IACD,GAAG,sBAAsB;CAC1B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAG;IAC9B,qCAAqC;IACrC,yCAAyC;IACzC,kDAAkD;IAClD,0DAA0D;CAClD,CAAC;AAIX;;;;;;;;;;;;;GAaG;AACH,yEAAyE;AACzE,mEAAmE;AACnE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,GAAY;IAEZ,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,KAAK;YAAE,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,qDAAqD;IACvD,CAAC;IACD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,6IAA6I;AAC7I,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,4DAA4D;AAC5D,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,IAAI,gBAAgB;QACxB,IAAI,IAAI,gBAAgB,CACzB,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,IAAI,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,IAAI,IAAI,iBAAiB,IAAI,IAAI,IAAI,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,IAAI,aAAa;QAAE,OAAO,MAAM,CAAC;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,OAAgB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;YACvE,QAAQ,EACN,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAC5B,CAAC,CAA4C,EAAE,EAAE,CAC/C,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAClC,IAAI,EAAE;YACT,eAAe,EAAE,iBAAiB,CAAC,IAAI,CAAC;SACzC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG;YAC7C,QAAQ,EAAE,CAAC,oCAAoC,CAAC;YAChD,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/dashboard/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,aAAa,EACb,qCAAqC,EACrC,yCAAyC,EACzC,kDAAkD,EAClD,0DAA0D,GAE3D,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B;;;;;;;;;;GAUG;AACH,MAAM,sBAAsB,GAA2B;IACrD,gDAAgD;IAChD,kCAAkC,EAAE,IAAI;IACxC,mCAAmC,EAAE,IAAI,EAAE,kBAAkB;IAC7D,wCAAwC,EAAE,IAAI,EAAE,oBAAoB;IACpE,oCAAoC,EAAE,IAAI;IAC1C,uDAAuD;IACvD,oCAAoC,EAAE,IAAI;IAC1C,oCAAoC,EAAE,IAAI;IAC1C,8BAA8B,EAAE,IAAI;IACpC,yDAAyD;IACzD,mCAAmC,EAAE,IAAI;IACzC,oCAAoC,EAAE,IAAI;IAC1C,wCAAwC,EAAE,IAAI,EAAE,yBAAyB;IACzE,+DAA+D;IAC/D,mCAAmC,EAAE,IAAI;IACzC,iCAAiC,EAAE,IAAI;IACvC,8BAA8B,EAAE,IAAI;IACpC,sCAAsC,EAAE,IAAI;IAC5C,yBAAyB,EAAE,IAAI;IAC/B,gEAAgE;IAChE,gCAAgC,EAAE,IAAI;IACtC,gCAAgC,EAAE,IAAI;IACtC,iCAAiC,EAAE,IAAI;IACvC,gCAAgC,EAAE,IAAI;IACtC,oCAAoC,EAAE,IAAI;IAC1C,qCAAqC,EAAE,IAAI;IAC3C,uCAAuC,EAAE,IAAI;IAC7C,iCAAiC,EAAE,IAAI,EAAE,mBAAmB;IAC5D,gCAAgC,EAAE,IAAI;IACtC,uCAAuC,EAAE,IAAI;IAC7C,kCAAkC,EAAE,IAAI;IACxC,sCAAsC,EAAE,IAAI;IAC5C,8BAA8B,EAAE,IAAI;IACpC,uCAAuC,EAAE,IAAI;IAC7C,gCAAgC,EAAE,IAAI;IACtC,mCAAmC,EAAE,IAAI;IACzC,sCAAsC,EAAE,IAAI,EAAE,gBAAgB;IAC9D,sCAAsC,EAAE,IAAI;IAC5C,uCAAuC,EAAE,IAAI;IAC7C,mCAAmC,EAAE,IAAI;IACzC,8BAA8B,EAAE,IAAI,EAAE,+BAA+B;IACrE,mCAAmC,EAAE,IAAI;IACzC,+BAA+B,EAAE,IAAI;IACrC,kCAAkC,EAAE,IAAI;IACxC,6BAA6B,EAAE,IAAI;IACnC,yBAAyB,EAAE,IAAI,EAAE,6BAA6B;IAC9D,mCAAmC;IACnC,2BAA2B,EAAE,IAAI,EAAE,mBAAmB;IACtD,sCAAsC,EAAE,IAAI;IAC5C,mCAAmC,EAAE,IAAI;IACzC,gCAAgC,EAAE,IAAI;IACtC,8BAA8B,EAAE,IAAI,EAAE,mBAAmB;IACzD,8BAA8B,EAAE,IAAI,EAAE,YAAY;IAClD,sCAAsC,EAAE,IAAI;IAC5C,sDAAsD;IACtD,6BAA6B,EAAE,IAAI;CACpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1E;IACD,GAAG,sBAAsB;CAC1B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAG;IAC9B,qCAAqC;IACrC,yCAAyC;IACzC,kDAAkD;IAClD,0DAA0D;CAClD,CAAC;AAIX;;;;;;;;;;;;;GAaG;AACH,yEAAyE;AACzE,mEAAmE;AACnE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,GAAY;IAEZ,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,KAAK;YAAE,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,qDAAqD;IACvD,CAAC;IACD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,4DAA4D;AAC5D,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,IAAI,IAAI,gBAAgB;QACxB,IAAI,IAAI,gBAAgB,CACzB,CAAC;AACJ,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAwB;IACxD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,IAAI,IAAI,gBAAgB,IAAI,IAAI,IAAI,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,IAAI,IAAI,iBAAiB,IAAI,IAAI,IAAI,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,IAAI,aAAa;QAAE,OAAO,MAAM,CAAC;IAClE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAE9E,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,GAAY,EAAE,OAAgB;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;YACvE,QAAQ,EACN,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAC5B,CAAC,CAA4C,EAAE,EAAE,CAC/C,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAClC,IAAI,EAAE;YACT,eAAe,EAAE,iBAAiB,CAAC,IAAI,CAAC;SACzC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG;YAC7C,QAAQ,EAAE,CAAC,oCAAoC,CAAC;YAChD,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;AACH,CAAC"}