@usesigil/kit 0.17.0 → 0.19.0

package/dist/index.js

@@ -179,6 +179,9 @@ export { previewCreateVault } from "./preview-create-vault.js";
 // `compute_cosign_digest` byte-for-byte.
 export { buildCosignBundle } from "./cosign-helper.js";
 export { computeCosignDigest, cosignDigestsEqual, } from "./policy/compute-cosign-digest.js";
+// Elevated agent-permissions cosign digest (audit 2026-06-12). Mirrors the
+// on-chain compute_agent_perms_cosign_digest byte-for-byte.
+export { computeAgentPermsCosignDigest } from "./policy/compute-agent-perms-cosign-digest.js";
 // ─── TA-18 / G6 — Squads V4 Detection Helper (audit 2026-05-18) ─────────────
 // Read-only off-chain helper that inspects whether a vault owner pubkey is
 // owned by the Squads V4 multisig program. Used by the dashboard to decide

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,oCAAoC;AAEpC,iFAAiF;AACjF,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,cAAc,+BAA+B,CAAC;AAE9C,iFAAiF;AACjF,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,oEAAoE;AACpE,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,oEAAoE;AACpE,OAAO;AACL,UAAU;AACV,qBAAqB;AACrB,MAAM;AACN,YAAY,EAKZ,GAAG,EACH,UAAU,EACV,IAAI;AACJ,cAAc;AACd,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB;AAChB,8DAA8D;AAC9D,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,8BAA8B,EAC9B,sBAAsB;AACtB,qDAAqD;AACrD,mBAAmB;AAEnB,WAAW;AACX,gBAAgB;AAChB,gBAAgB;AAChB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB;AACtB,mBAAmB;AACnB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB;AACxB,YAAY;AACZ,gBAAgB,EAChB,eAAe,EACf,gBAAgB;AAChB,eAAe;AACf,OAAO,GACR,MAAM,YAAY,CAAC;AAGpB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAa7B,iFAAiF;AACjF,OAAO,EACL,WAAW;AACX,8DAA8D;AAC9D,oEAAoE;AACpE,gEAAgE;AAChE,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,YAAY;AACZ,4EAA4E;AAC5E,6EAA6E;AAC7E,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAOrB,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,QAAQ,EACR,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAWzB,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGvE,gFAAgF;AAChF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB;AACxB,2EAA2E;AAC3E,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AASjC,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAQ9B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAOlC,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAWjC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1E,gFAAgF;AAChF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvE,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,GAChB,MAAM,eAAe,CAAC;AAWvB,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,aAAa,GACd,MAAM,gBAAgB,CAAC;AAQxB,iFAAiF;AACjF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAQ3B,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAGjC,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,+EAA+E;AAC/E,OAAO,EACL,+CAA+C,EAC/C,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,EACd,qBAAqB;AACrB,oEAAoE;AACpE,sEAAsE;AACtE,8CAA8C;AAC9C,qBAAqB;AACrB,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,wDAAwD;AACxD,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,OAAO,EACL,gCAAgC,EAChC,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sCAAsC,EACtC,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AAYjC,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAMhC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAQrD,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,EACN,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAUrB,8EAA8E;AAC9E,OAAO,EACL,IAAI,EACJ,iBAAiB;AACjB,4DAA4D;AAC5D,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAUnB,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAQnC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQxE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAS7D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAQpE,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,EACX,yBAAyB;AACzB,qEAAqE;AACrE,cAAc,EACd,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,wEAAwE;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAE7C,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,sEAAsE;AACtE,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,eAAe,GAGhB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAM/D,gFAAgF;AAChF,0EAA0E;AAC1E,6EAA6E;AAC7E,sEAAsE;AACtE,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,iBAAiB;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAS/D,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,sEAAsE;AACtE,4EAA4E;AAC5E,wEAAwE;AACxE,yCAAyC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAG3C,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,+EAA+E;AAC/E,mFAAmF;AACnF,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,yDAAyD;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,sFAAsF;AACtF,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,oFAAoF;AACpF,6EAA6E;AAC7E,OAAO,EACL,UAAU,IAAI,aAAa,EAC3B,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,IAAI,IAAI,cAAc,GAWvB,MAAM,mBAAmB,CAAC;AA8C3B,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,0EAA0E;AAC1E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGtE,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAQ9B,+EAA+E;AAC/E,2EAA2E;AAC3E,kDAAkD;AAClD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,oCAAoC;AAEpC,iFAAiF;AACjF,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,cAAc,+BAA+B,CAAC;AAE9C,iFAAiF;AACjF,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,oEAAoE;AACpE,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,oEAAoE;AACpE,OAAO;AACL,UAAU;AACV,qBAAqB;AACrB,MAAM;AACN,YAAY,EAKZ,GAAG,EACH,UAAU,EACV,IAAI;AACJ,cAAc;AACd,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB;AAChB,8DAA8D;AAC9D,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,EACnB,8BAA8B,EAC9B,sBAAsB;AACtB,qDAAqD;AACrD,mBAAmB;AAEnB,WAAW;AACX,gBAAgB;AAChB,gBAAgB;AAChB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB;AACtB,mBAAmB;AACnB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB;AACxB,YAAY;AACZ,gBAAgB,EAChB,eAAe,EACf,gBAAgB;AAChB,eAAe;AACf,OAAO,GACR,MAAM,YAAY,CAAC;AAGpB,gFAAgF;AAChF,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAa7B,iFAAiF;AACjF,OAAO,EACL,WAAW;AACX,8DAA8D;AAC9D,oEAAoE;AACpE,gEAAgE;AAChE,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,YAAY;AACZ,4EAA4E;AAC5E,6EAA6E;AAC7E,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AAGxB,iFAAiF;AACjF,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAOrB,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,QAAQ,EACR,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAG5B,iFAAiF;AACjF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,QAAQ,EACR,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAWzB,iFAAiF;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGvE,gFAAgF;AAChF,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB;AACxB,2EAA2E;AAC3E,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,gFAAgF;AAChF,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AASjC,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAQ9B,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAOlC,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAMjC,gFAAgF;AAChF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EAC9B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAWjC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1E,gFAAgF;AAChF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQvE,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,GAChB,MAAM,eAAe,CAAC;AAWvB,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,aAAa,GACd,MAAM,gBAAgB,CAAC;AAQxB,iFAAiF;AACjF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAQ3B,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAGjC,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,+EAA+E;AAC/E,OAAO,EACL,+CAA+C,EAC/C,+CAA+C,GAChD,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,OAAO,EACP,cAAc,EACd,qBAAqB;AACrB,oEAAoE;AACpE,sEAAsE;AACtE,8CAA8C;AAC9C,qBAAqB;AACrB,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAClE,wDAAwD;AACxD,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAS5B,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,sEAAsE;AACtE,OAAO,EACL,gCAAgC,EAChC,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,sCAAsC,EACtC,8BAA8B,GAC/B,MAAM,yBAAyB,CAAC;AAYjC,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAMhC,gFAAgF;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAQrD,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,EACN,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAUrB,8EAA8E;AAC9E,OAAO,EACL,IAAI,EACJ,iBAAiB;AACjB,4DAA4D;AAC5D,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAUnB,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAQnC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAQ/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQxE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAS7D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAQpE,gFAAgF;AAChF,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,EACX,yBAAyB;AACzB,qEAAqE;AACrE,cAAc,EACd,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,wEAAwE;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EACL,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,GAE1B,MAAM,qCAAqC,CAAC;AAE7C,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,sEAAsE;AACtE,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,eAAe,GAGhB,MAAM,aAAa,CAAC;AAErB,+EAA+E;AAC/E,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAM/D,gFAAgF;AAChF,0EAA0E;AAC1E,6EAA6E;AAC7E,sEAAsE;AACtE,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,iBAAiB;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAS/D,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,sEAAsE;AACtE,4EAA4E;AAC5E,wEAAwE;AACxE,yCAAyC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAE3C,2EAA2E;AAC3E,4DAA4D;AAC5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAG9F,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAG/B,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAE7B,+EAA+E;AAC/E,mFAAmF;AACnF,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,yDAAyD;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAChF,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,sEAAsE;AACtE,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,sFAAsF;AACtF,2EAA2E;AAC3E,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,oFAAoF;AACpF,6EAA6E;AAC7E,OAAO,EACL,UAAU,IAAI,aAAa,EAC3B,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,IAAI,IAAI,cAAc,GAWvB,MAAM,mBAAmB,CAAC;AA8C3B,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,0EAA0E;AAC1E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAWtE,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAQ9B,+EAA+E;AAC/E,2EAA2E;AAC3E,kDAAkD;AAClD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/kit-adapter.d.ts

@@ -21,5 +21,5 @@
  * here once and the entire SDK compiles.
  */
 export type { Address, AddressesByLookupTableAddress, Base64EncodedBytes, Base64EncodedWireTransaction, Commitment, Instruction, KeyPairSigner, ReadonlyUint8Array, Rpc, SolanaRpcApi, TransactionSigner, } from "@solana/kit";
-export { AccountRole, addSignersToTransactionMessage, appendTransactionMessageInstruction, appendTransactionMessageInstructions, compileTransaction, compressTransactionMessageUsingAddressLookupTables, createKeyPairSignerFromBytes, createNoopSigner, createSolanaRpc, createTransactionMessage, fetchAddressesForLookupTables, fetchEncodedAccounts, generateKeyPairSigner, getAddressDecoder, getAddressEncoder, getBase58Decoder, getBase64EncodedWireTransaction, getCompiledTransactionMessageDecoder, getProgramDerivedAddress, getU64Decoder, isSome, pipe, setTransactionMessageFeePayer, setTransactionMessageLifetimeUsingBlockhash, signTransactionMessageWithSigners, signTransactionWithSigners, } from "@solana/kit";
+export { AccountRole, addSignersToTransactionMessage, appendTransactionMessageInstruction, appendTransactionMessageInstructions, compileTransaction, compressTransactionMessageUsingAddressLookupTables, createKeyPairSignerFromBytes, createNoopSigner, createSolanaRpc, createTransactionMessage, fetchAddressesForLookupTables, fetchEncodedAccounts, generateKeyPairSigner, getAddressDecoder, getAddressEncoder, getBase58Decoder, getBase64EncodedWireTransaction, getCompiledTransactionMessageDecoder, getProgramDerivedAddress, getU64Decoder, isSome, partiallySignTransactionMessageWithSigners, pipe, setTransactionMessageFeePayer, setTransactionMessageLifetimeUsingBlockhash, signTransactionMessageWithSigners, signTransactionWithSigners, } from "@solana/kit";
 //# sourceMappingURL=kit-adapter.d.ts.map

package/dist/kit-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kit-adapter.d.ts","sourceRoot":"","sources":["../src/kit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,YAAY,EACV,OAAO,EACP,6BAA6B,EAC7B,kBAAkB,EAClB,4BAA4B,EAC5B,UAAU,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,GAAG,EACH,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,kBAAkB,EAClB,kDAAkD,EAClD,4BAA4B,EAC5B,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,IAAI,EACJ,6BAA6B,EAC7B,2CAA2C,EAC3C,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"kit-adapter.d.ts","sourceRoot":"","sources":["../src/kit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,YAAY,EACV,OAAO,EACP,6BAA6B,EAC7B,kBAAkB,EAClB,4BAA4B,EAC5B,UAAU,EACV,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,GAAG,EACH,YAAY,EACZ,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,kBAAkB,EAClB,kDAAkD,EAClD,4BAA4B,EAC5B,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,0CAA0C,EAC1C,IAAI,EACJ,6BAA6B,EAC7B,2CAA2C,EAC3C,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,aAAa,CAAC"}

package/dist/kit-adapter.js

@@ -21,5 +21,5 @@
  * here once and the entire SDK compiles.
  */
 // ─── Value re-exports (tree-shake safe — named exports) ─────────────────────
-export { AccountRole, addSignersToTransactionMessage, appendTransactionMessageInstruction, appendTransactionMessageInstructions, compileTransaction, compressTransactionMessageUsingAddressLookupTables, createKeyPairSignerFromBytes, createNoopSigner, createSolanaRpc, createTransactionMessage, fetchAddressesForLookupTables, fetchEncodedAccounts, generateKeyPairSigner, getAddressDecoder, getAddressEncoder, getBase58Decoder, getBase64EncodedWireTransaction, getCompiledTransactionMessageDecoder, getProgramDerivedAddress, getU64Decoder, isSome, pipe, setTransactionMessageFeePayer, setTransactionMessageLifetimeUsingBlockhash, signTransactionMessageWithSigners, signTransactionWithSigners, } from "@solana/kit";
+export { AccountRole, addSignersToTransactionMessage, appendTransactionMessageInstruction, appendTransactionMessageInstructions, compileTransaction, compressTransactionMessageUsingAddressLookupTables, createKeyPairSignerFromBytes, createNoopSigner, createSolanaRpc, createTransactionMessage, fetchAddressesForLookupTables, fetchEncodedAccounts, generateKeyPairSigner, getAddressDecoder, getAddressEncoder, getBase58Decoder, getBase64EncodedWireTransaction, getCompiledTransactionMessageDecoder, getProgramDerivedAddress, getU64Decoder, isSome, partiallySignTransactionMessageWithSigners, pipe, setTransactionMessageFeePayer, setTransactionMessageLifetimeUsingBlockhash, signTransactionMessageWithSigners, signTransactionWithSigners, } from "@solana/kit";
 //# sourceMappingURL=kit-adapter.js.map

package/dist/kit-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"kit-adapter.js","sourceRoot":"","sources":["../src/kit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiBH,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,kBAAkB,EAClB,kDAAkD,EAClD,4BAA4B,EAC5B,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,IAAI,EACJ,6BAA6B,EAC7B,2CAA2C,EAC3C,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"kit-adapter.js","sourceRoot":"","sources":["../src/kit-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiBH,+EAA+E;AAC/E,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,kBAAkB,EAClB,kDAAkD,EAClD,4BAA4B,EAC5B,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,+BAA+B,EAC/B,oCAAoC,EACpC,wBAAwB,EACxB,aAAa,EACb,MAAM,EACN,0CAA0C,EAC1C,IAAI,EACJ,6BAA6B,EAC7B,2CAA2C,EAC3C,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,aAAa,CAAC"}

package/dist/policy/compute-agent-perms-cosign-digest.d.ts

@@ -0,0 +1,51 @@
+/**
+ * TA-09 (agent-perms) — Canonical agent-permissions cosign digest (SDK side).
+ *
+ * Mirrors `programs/sigil/src/utils/cosign_digest.rs::compute_agent_perms_cosign_digest`
+ * byte-for-byte. Separate from the policy `computeCosignDigest` by design: the
+ * policy digest binds policy fields; this one binds per-agent permission fields.
+ *
+ * Flow: on a `cosign_required` vault, raising an agent's capability or spending
+ * limit (or setting a non-zero cooldown) is an ELEVATED mutation. The owner +
+ * cosigner co-sign `queue_agent_permissions_update`; the handler recomputes this
+ * digest from the pending args + cosign-session pubkey and stores it, then
+ * `apply_agent_permissions_update` recomputes and asserts byte-equality
+ * (`ErrCosignRequired` on mismatch). This SDK helper produces the value an
+ * elevated transaction builder must reproduce.
+ *
+ * CANONICAL ENCODING (APPEND-ONLY — 81 bytes, NO Option tags / length prefixes /
+ * domain separator; mirrors cosign_digest.rs:110-117):
+ *   1. cosign_session : Pubkey (32 bytes raw)
+ *   2. agent          : Pubkey (32 bytes raw) — binds the digest to a specific
+ *      agent (prevents queue-on-A / apply-on-B replay)
+ *   3. new_capability : u8 (1 byte)
+ *   4. spending_limit_usd : u64 LE (8 bytes)
+ *   5. cooldown_seconds   : u64 LE (8 bytes)
+ */
+import type { Address } from "../kit-adapter.js";
+/**
+ * Canonical agent-perms cosign-digest input shape. Matches the on-chain
+ * `AgentPermsCosignDigestFields` struct exactly. Unlike the policy cosign
+ * digest, every field is unconditional fixed-width — there are NO `Option`
+ * discriminator bytes here (do not copy the policy-digest pattern).
+ */
+export interface AgentPermsCosignDigestFields {
+    /** The cosigning session pubkey (matches pending_agent_perms.cosign_session). */
+    cosignSession: Address | string;
+    /** The target agent's pubkey. */
+    agent: Address | string;
+    /** Proposed new capability: 0=Disabled, 1=Observer, 2=Operator. */
+    newCapability: number;
+    /** Proposed per-agent spending limit ($ × 1e6). */
+    spendingLimitUsd: bigint;
+    /** Proposed cooldown in seconds (0 = none). */
+    cooldownSeconds: bigint;
+}
+/**
+ * Compute the canonical SHA-256 agent-perms cosign digest. Returns a 32-byte
+ * Uint8Array, byte-identical to the on-chain helper for the same input.
+ *
+ * @throws if either pubkey doesn't base58-decode to exactly 32 bytes
+ */
+export declare function computeAgentPermsCosignDigest(fields: AgentPermsCosignDigestFields): Uint8Array;
+//# sourceMappingURL=compute-agent-perms-cosign-digest.d.ts.map

package/dist/policy/compute-agent-perms-cosign-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-agent-perms-cosign-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-agent-perms-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAMjD;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,iFAAiF;IACjF,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,iCAAiC;IACjC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,mEAAmE;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,4BAA4B,GACnC,UAAU,CAwBZ"}

package/dist/policy/compute-agent-perms-cosign-digest.js

@@ -0,0 +1,55 @@
+/**
+ * TA-09 (agent-perms) — Canonical agent-permissions cosign digest (SDK side).
+ *
+ * Mirrors `programs/sigil/src/utils/cosign_digest.rs::compute_agent_perms_cosign_digest`
+ * byte-for-byte. Separate from the policy `computeCosignDigest` by design: the
+ * policy digest binds policy fields; this one binds per-agent permission fields.
+ *
+ * Flow: on a `cosign_required` vault, raising an agent's capability or spending
+ * limit (or setting a non-zero cooldown) is an ELEVATED mutation. The owner +
+ * cosigner co-sign `queue_agent_permissions_update`; the handler recomputes this
+ * digest from the pending args + cosign-session pubkey and stores it, then
+ * `apply_agent_permissions_update` recomputes and asserts byte-equality
+ * (`ErrCosignRequired` on mismatch). This SDK helper produces the value an
+ * elevated transaction builder must reproduce.
+ *
+ * CANONICAL ENCODING (APPEND-ONLY — 81 bytes, NO Option tags / length prefixes /
+ * domain separator; mirrors cosign_digest.rs:110-117):
+ *   1. cosign_session : Pubkey (32 bytes raw)
+ *   2. agent          : Pubkey (32 bytes raw) — binds the digest to a specific
+ *      agent (prevents queue-on-A / apply-on-B replay)
+ *   3. new_capability : u8 (1 byte)
+ *   4. spending_limit_usd : u64 LE (8 bytes)
+ *   5. cooldown_seconds   : u64 LE (8 bytes)
+ */
+import { base58Decode32, sha256, writeU64Le } from "../canonical-encode.js";
+/** 32 (session) + 32 (agent) + 1 (capability) + 8 (limit) + 8 (cooldown). */
+const AGENT_PERMS_COSIGN_DIGEST_SIZE = 81;
+/**
+ * Compute the canonical SHA-256 agent-perms cosign digest. Returns a 32-byte
+ * Uint8Array, byte-identical to the on-chain helper for the same input.
+ *
+ * @throws if either pubkey doesn't base58-decode to exactly 32 bytes
+ */
+export function computeAgentPermsCosignDigest(fields) {
+    const buf = new Uint8Array(AGENT_PERMS_COSIGN_DIGEST_SIZE);
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    let off = 0;
+    // 1. cosign_session (32 bytes raw)
+    buf.set(base58Decode32(fields.cosignSession), off);
+    off += 32;
+    // 2. agent (32 bytes raw)
+    buf.set(base58Decode32(fields.agent), off);
+    off += 32;
+    // 3. new_capability (u8)
+    buf[off++] = fields.newCapability & 0xff;
+    // 4. spending_limit_usd (u64 LE)
+    off = writeU64Le(view, off, fields.spendingLimitUsd);
+    // 5. cooldown_seconds (u64 LE)
+    off = writeU64Le(view, off, fields.cooldownSeconds);
+    if (off !== buf.length) {
+        throw new Error(`computeAgentPermsCosignDigest: encoded ${off} bytes, expected ${buf.length}`);
+    }
+    return sha256(buf);
+}
+//# sourceMappingURL=compute-agent-perms-cosign-digest.js.map

package/dist/policy/compute-agent-perms-cosign-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute-agent-perms-cosign-digest.js","sourceRoot":"","sources":["../../src/policy/compute-agent-perms-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE5E,6EAA6E;AAC7E,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAqB1C;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,MAAoC;IAEpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,aAAuB,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,GAAG,IAAI,EAAE,CAAC;IACV,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,KAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,GAAG,IAAI,EAAE,CAAC;IACV,yBAAyB;IACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IACzC,iCAAiC;IACjC,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACrD,+BAA+B;IAC/B,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAEpD,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,0CAA0C,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/dist/policy/compute-cosign-digest.d.ts

@@ -10,15 +10,17 @@
  *      asserts byte-equality. Any tamper of pending args between queue and
  *      apply (e.g. a future discriminator-collision attack on the pending PDA)
  *      produces a digest mismatch and a hard reject (`ErrCosignRequired`,
- *      6089).
+ *      6080).
  *
  * The cosign digest is INTENTIONALLY narrower than TA-19 `policy_preview_digest`:
- * only the FIELDS that participate in "elevated mutation" detection are in
- * scope. Non-elevated fields (developer_fee_rate, max_slippage_bps,
- * session_expiry_seconds, timelock_duration narrowing, protocol_mode,
- * destination_mode, operating_hours, etc.) do NOT require cosign and are NOT
- * bound by THIS digest — they are still bound by TA-19
- * `policy_preview_digest` at queue time.
+ * only the B4 F-1 elevation-detection FIELDS are bound here. Some fields are
+ * genuinely non-elevated and never need cosign (session_expiry_seconds,
+ * timelock_duration narrowing, protocol_mode, destination_mode, etc.) — bound
+ * only by TA-19. NOTE (take-over 2026-06-17): RAISING max_slippage_bps or
+ * developer_fee_rate, and WIDENING operating_hours, ARE now elevated (they
+ * require the bound cosigner) but are deliberately NOT bound by THIS digest —
+ * the cosigner attests them via its tx-signature and TA-19 binds the values, so
+ * no cosign-digest field was added for them.
  *
  * Round 2 B4 F-1 fix (audit 2026-05-19): the cosign-digest binding now
  * extends to all G3 + G6 elevation triggers that were previously NOT bound:

package/dist/policy/compute-cosign-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compute-cosign-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3D;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IACjD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAoED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,UAAU,CA4K1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAexE"}
+{"version":3,"file":"compute-cosign-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;OAEG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IAC3D;;OAEG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;IACjD;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAoED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,UAAU,CA4K1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAexE"}

package/dist/policy/compute-cosign-digest.js

@@ -10,15 +10,17 @@
  *      asserts byte-equality. Any tamper of pending args between queue and
  *      apply (e.g. a future discriminator-collision attack on the pending PDA)
  *      produces a digest mismatch and a hard reject (`ErrCosignRequired`,
- *      6089).
+ *      6080).
  *
  * The cosign digest is INTENTIONALLY narrower than TA-19 `policy_preview_digest`:
- * only the FIELDS that participate in "elevated mutation" detection are in
- * scope. Non-elevated fields (developer_fee_rate, max_slippage_bps,
- * session_expiry_seconds, timelock_duration narrowing, protocol_mode,
- * destination_mode, operating_hours, etc.) do NOT require cosign and are NOT
- * bound by THIS digest — they are still bound by TA-19
- * `policy_preview_digest` at queue time.
+ * only the B4 F-1 elevation-detection FIELDS are bound here. Some fields are
+ * genuinely non-elevated and never need cosign (session_expiry_seconds,
+ * timelock_duration narrowing, protocol_mode, destination_mode, etc.) — bound
+ * only by TA-19. NOTE (take-over 2026-06-17): RAISING max_slippage_bps or
+ * developer_fee_rate, and WIDENING operating_hours, ARE now elevated (they
+ * require the bound cosigner) but are deliberately NOT bound by THIS digest —
+ * the cosigner attests them via its tx-signature and TA-19 binds the values, so
+ * no cosign-digest field was added for them.
  *
  * Round 2 B4 F-1 fix (audit 2026-05-19): the cosign-digest binding now
  * extends to all G3 + G6 elevation triggers that were previously NOT bound:

package/dist/policy/compute-cosign-digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"compute-cosign-digest.js","sourceRoot":"","sources":["../../src/policy/compute-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuGzC,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAE5E,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAC/D,MAAM,YAAY,GAA2B,CAAC,GAAG,EAAE;IACjD,MAAM,CAAC,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,YAAY,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,QAAQ,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAC;IAElE,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,KAAK,GACT,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,KAAK,GACT,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,WAAW,GACf,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAC7E,MAAM,WAAW,GACf,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,YAAY,GAChB,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IACvE,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IACjE,MAAM,SAAS,GACb,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IAErE,2EAA2E;IAC3E,uBAAuB;IACvB,MAAM,SAAS,GACb,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IAExE,6EAA6E;IAC7E,iEAAiE;IACjE,oDAAoD;IACpD,oDAAoD;IACpD,yBAAyB;IACzB,MAAM,SAAS,GACb,EAAE,GAAG,iBAAiB;QACtB,CAAC,GAAG,YAAY;QAChB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,GAAG,aAAa;QACjB,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,GAAG,mBAAmB;QACvB,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,gBAAgB;QACpB,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,GAAG,oCAAoC;QACxC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,2CAA2C;QAC/C,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,iCAAiC;QACrC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,GAAG,6BAA6B;QACjC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,GAAG,+BAA+B;QACnC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3B,GAAG,IAAI,EAAE,CAAC;IAEV,wCAAwC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,yDAAyD;IACzD,iEAAiE;IACjE,+DAA+D;IAC/D,0CAA0C;IAE1C,sCAAsC;IACtC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,mEAAmE;IACnE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,oDAAoD;IACpD,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAa,EAAE,CAAa;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,gCAAgC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,gEAAgE;QAChE,8DAA8D;QAC9D,qDAAqD;QACrD,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}
+{"version":3,"file":"compute-cosign-digest.js","sourceRoot":"","sources":["../../src/policy/compute-cosign-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAuGzC,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAE5E,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAC/D,MAAM,YAAY,GAA2B,CAAC,GAAG,EAAE;IACjD,MAAM,CAAC,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,YAAY,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,8CAA8C,GAAG,CAAC,MAAM,QAAQ,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC3D,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAC;IAElE,+DAA+D;IAC/D,MAAM,QAAQ,GACZ,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,KAAK,GACT,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,KAAK,GACT,MAAM,CAAC,mBAAmB,KAAK,SAAS;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,WAAW,GACf,MAAM,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;IAC7E,MAAM,WAAW,GACf,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrC,MAAM,YAAY,GAChB,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IACvE,MAAM,SAAS,GACb,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IACjE,MAAM,SAAS,GACb,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IAErE,2EAA2E;IAC3E,uBAAuB;IACvB,MAAM,SAAS,GACb,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAW,CAAC,CAAC,CAAC;IAExE,6EAA6E;IAC7E,iEAAiE;IACjE,oDAAoD;IACpD,oDAAoD;IACpD,yBAAyB;IACzB,MAAM,SAAS,GACb,EAAE,GAAG,iBAAiB;QACtB,CAAC,GAAG,YAAY;QAChB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC,GAAG,aAAa;QACjB,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC,GAAG,mBAAmB;QACvB,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,gBAAgB;QACpB,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC,GAAG,oCAAoC;QACxC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,2CAA2C;QAC/C,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC,GAAG,iCAAiC;QACrC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,GAAG,6BAA6B;QACjC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,GAAG,+BAA+B;QACnC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEtE,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC3B,GAAG,IAAI,EAAE,CAAC;IAEV,wCAAwC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACjB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,yDAAyD;IACzD,iEAAiE;IACjE,+DAA+D;IAC/D,0CAA0C;IAE1C,sCAAsC;IACtC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,6CAA6C;IAC7C,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,mEAAmE;IACnE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,oDAAoD;IACpD,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,oBAAoB,GAAG,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAa,EAAE,CAAa;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,gCAAgC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,gEAAgE;QAChE,8DAA8D;QAC9D,qDAAqD;QACrD,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC"}

package/dist/policy/compute-policy-preview-digest.d.ts

@@ -18,7 +18,9 @@
  *     discriminator-collision attack). Both cases reject — the owner sees a
  *     mismatch error rather than silently committing.
  *
- * CANONICAL ENCODING (FIXED — DO NOT REORDER):
+ * CANONICAL ENCODING (FIXED — DO NOT REORDER). Positions are the live byte
+ * order — see PER_FIELD_FIXED_SIZES below, the single source of truth that a
+ * module-load assertion pins against POLICY_PREVIEW_FIELD_COUNT:
  *   1. daily_spending_cap_usd: u64 LE (8 bytes)
  *   2. max_transaction_size_usd: u64 LE (8 bytes)
  *   3. max_slippage_bps: u16 LE (2 bytes)
@@ -30,36 +32,39 @@
  *   9. timelock_duration: u64 LE (8 bytes)
  *   10. session_expiry_seconds: u64 LE (8 bytes)
  *   11. observe_only: bool as 1 byte (0 or 1)
- *   12. has_constraints: bool as 1 byte (0 or 1)
- *   13. has_post_assertions: u8 (1 byte)
- *   14. created_at_slot: u64 LE (8 bytes) — PEN-CROSS-2 (Phase 2 close-up)
- *   15. operating_hours: u32 LE (4 bytes) — TA-05 (Phase 3 pre-exec)
- *   16. auto_promote_grays: bool as 1 byte (0/1) — TA-07 (Phase 3 pre-exec)
- *   17. auto_revoke_threshold: u8 (1 byte) — TA-17 (Phase 3 pre-exec)
- *   18. stable_balance_floor: u64 LE (8 bytes) — TA-12 (Phase 5 post-exec)
- *   19. per_recipient_daily_cap_usd: u64 LE (8 bytes) — TA-14 (Phase 5 post-exec)
- *   20. cosign_required: bool (1 byte 0/1) — G6 (audit 2026-05-18 cosign opt-in)
- *   21. agent_set_hash: [u8; 32] — Phase 8 PEN-CROSS-1 (audit 2026-05-19)
- *   22. cosign_session_pubkey: Pubkey (32 bytes) — D-5 (audit 2026-05-19, F-RP3-1)
+ *   12. has_post_assertions: u8 (1 byte) — M1-04 removed the former
+ *       has_constraints byte (digest-version bump); positions renumbered down.
+ *   13. created_at_slot: u64 LE (8 bytes) — PEN-CROSS-2 (Phase 2 close-up)
+ *   14. operating_hours: u32 LE (4 bytes) — TA-05 (Phase 3 pre-exec)
+ *   15. auto_promote_grays: bool as 1 byte (0/1) — TA-07 (Phase 3 pre-exec)
+ *   16. auto_revoke_threshold: u8 (1 byte) — TA-17 (Phase 3 pre-exec)
+ *   17. stable_balance_floor: u64 LE (8 bytes) — TA-12 (Phase 5 post-exec)
+ *   18. per_recipient_daily_cap_usd: u64 LE (8 bytes) — TA-14 (Phase 5 post-exec)
+ *   19. cosign_required: bool (1 byte 0/1) — G6 (audit 2026-05-18 cosign opt-in)
+ *   20. agent_set_hash: [u8; 32] — Phase 8 PEN-CROSS-1 (audit 2026-05-19)
+ *   21. cosign_session_pubkey: Pubkey (32 bytes) — D-5 (audit 2026-05-19, F-RP3-1)
+ *   22. operator_grant_delay_seconds: u64 LE (8 bytes) — F-Q6 (2026-06-02)
+ *   23. has_protocol_caps: bool as 1 byte (0/1) — M-1 (audit 2026-06-11)
+ *   24. protocol_caps: u32 LE length (4 bytes) ++ each cap u64 LE (8 bytes) — M-1
  *
  * Phase 3 append-only additions (TA-05/07/17): operating_hours,
  * auto_promote_grays, auto_revoke_threshold are appended at positions 15-17
  * to preserve the 14-field prefix (F-14 APPEND-ONLY rule).
  *
  * Phase 5 append-only additions (TA-12/TA-14): stable_balance_floor at
- * position 18, per_recipient_daily_cap_usd at position 19. Both bound by
+ * position 17, per_recipient_daily_cap_usd at position 18. Both bound by
  * TA-19 so silent SDK / pending-PDA mutations can't bypass the owner's
  * signed digest.
  *
  * G6 append-only addition (audit 2026-05-18 cosign opt-in): cosign_required
- * at position 20 (1 byte, 0/1). Owner's choice to opt into TA-09 cosign
+ * at position 19 (1 byte, 0/1). Owner's choice to opt into TA-09 cosign
  * enforcement is part of the signed policy — a compromised SDK cannot
  * silently disable cosign between owner approval and on-chain landing.
  * Disabling cosign on a live policy where this is true is itself an
  * elevated mutation per `queue_policy_update` (one-way ratchet).
  *
  * Phase 8 PEN-CROSS-1 append-only addition (Council ISC-66/A8/A9): the
- * `agent_set_hash` at position 21 binds the EXISTING agent set into the
+ * `agent_set_hash` at position 20 binds the EXISTING agent set into the
  * signed digest. SHA-256 over Borsh of `Vec<(Pubkey, u8 capability)>`
  * sorted by pubkey ascending. Closes the silent-insertion vector where
  * a phished-owner `register_agent(capability=OPERATOR)` would otherwise
@@ -68,7 +73,7 @@
  * (`EMPTY_AGENT_SET_HASH` — SHA-256 of [0x00,0x00,0x00,0x00]).
  *
  * D-5 append-only addition (audit 2026-05-19, F-RP3-1): the
- * `cosign_session_pubkey` at position 22 binds the owner's chosen
+ * `cosign_session_pubkey` at position 21 binds the owner's chosen
  * reactivate-time cosigner pubkey into the signed digest. The
  * `reactivate_vault` handler reads this pubkey at runtime and requires
  * a matching `is_signer == true` entry in `remaining_accounts` whenever
@@ -125,7 +130,7 @@ export interface PolicyPreviewFields {
     hasPostAssertions: number;
     /**
      * PEN-CROSS-2 (Phase 2 close-up): the slot at which `initialize_vault`
-     * minted the live policy. Bound by TA-19 at position 14. Closes the
+     * minted the live policy. Bound by TA-19 at position 13. Closes the
      * close+reinit replay window.
      */
     createdAtSlot: bigint;
@@ -135,14 +140,14 @@ export interface PolicyPreviewFields {
      * omitted by legacy callers (preserves existing test fixtures). Production
      * SDK consumers should pass 0xFFFFFF (all 24h enabled) explicitly.
      * Upper 8 bits MUST be zero — on-chain handler rejects with
-     * `ErrOutsideOperatingHours` (6084) if violated. Bound at position 15
+     * `ErrOutsideOperatingHours` (6084) if violated. Bound at position 14
      * of the canonical encoding.
      */
     operatingHours?: number;
     /**
      * TA-07 (Phase 3): owner-side toggle to bypass the 24h graylist friction
      * for newly-added destinations. Default false (friction enforced).
-     * Bound by TA-19 at canonical position 16 so silent flips can't change
+     * Bound by TA-19 at canonical position 15 so silent flips can't change
      * the friction model.
      */
     autoPromoteGrays?: boolean;
@@ -150,7 +155,7 @@ export interface PolicyPreviewFields {
      * TA-17 (Phase 3): consecutive-failure threshold for agent auto-revoke.
      * Range 3..=20. Default 0 (legacy callers — but on-chain handler now
      * requires this to be in [3, 20] at policy-write time). Bound at
-     * canonical position 17.
+     * canonical position 16.
      */
     autoRevokeThreshold?: number;
     /**
@@ -158,14 +163,14 @@ export interface PolicyPreviewFields {
      * USDC+USDT vault balance, asserted at every `finalize_session`
      * spending path completion. 6-decimal USDC face value (e.g.
      * `$100 = 100_000_000n`). Default 0 (no reserve — preserves existing
-     * vault behavior). Bound at canonical position 18.
+     * vault behavior). Bound at canonical position 17.
      */
     stableBalanceFloor?: bigint;
     /**
      * TA-14 (Phase 5 post-exec): owner-chosen rolling 24h per-recipient
      * outflow cap. 6-decimal USDC face value. Default 0 (no per-recipient
      * cap — preserves existing vault behavior). Bound at canonical
-     * position 19.
+     * position 18.
      */
     perRecipientDailyCapUsd?: bigint;
     /**
@@ -176,7 +181,7 @@ export interface PolicyPreviewFields {
      * 7-trigger elevation gate (raises caps, expands allowlists, weakens
      * floor / per-recipient / protocol caps) requires a cosign session.
      * Disabling cosign on a live policy where this is true is itself an
-     * elevated mutation (one-way ratchet). Bound at canonical position 20.
+     * elevated mutation (one-way ratchet). Bound at canonical position 19.
      */
     cosignRequired?: boolean;
     /**
@@ -185,7 +190,7 @@ export interface PolicyPreviewFields {
      * result of `computeAgentSetHash(...)` over the live vault's agent set
      * (use empty array for a freshly-initialized vault). Empty vault produces
      * the deterministic `EMPTY_AGENT_SET_HASH` value. Bound at canonical
-     * position 21. Optional with default `EMPTY_AGENT_SET_HASH` so legacy
+     * position 20. Optional with default `EMPTY_AGENT_SET_HASH` so legacy
      * fixtures (no agents) continue to compute the canonical digest.
      */
     agentSetHash?: Uint8Array;
@@ -195,7 +200,7 @@ export interface PolicyPreviewFields {
      * as 32 zero bytes) when omitted, matching the on-chain init state
      * where the gate is disabled. Owners opt in by passing a non-default
      * pubkey via `queue_policy_update` (the SDK helper here mirrors that
-     * value into the digest). Bound at canonical position 22.
+     * value into the digest). Bound at canonical position 21.
      *
      * Type: base58 string (e.g. an Address) OR a 32-byte raw Uint8Array.
      * The encoder accepts both shapes for parity with the protocols /
@@ -212,11 +217,27 @@ export interface PolicyPreviewFields {
      * `queue_policy_update` path.
      */
     operatorGrantDelaySeconds?: bigint;
+    /**
+     * M-1 (audit 2026-06-11): owner's per-protocol-caps master switch. Bound at
+     * canonical position 23 (default false when omitted, matching the on-chain
+     * init/legacy state). Mirrors the cosign digest's order (hasProtocolCaps
+     * before protocolCaps). Closes the gap where a tampered SDK could flip the
+     * caps switch without the owner's signed preview detecting it.
+     */
+    hasProtocolCaps?: boolean;
+    /**
+     * M-1 (audit 2026-06-11): owner's per-protocol rolling-24h spend caps,
+     * aligned 1:1 with `protocols` (≤ 10). Bound at canonical position 24 as a
+     * u32 LE length prefix ++ each cap as u64 LE (mirrors the `protocols` Vec
+     * pattern). Default [] when omitted.
+     */
+    protocolCaps?: readonly bigint[];
 }
 /** Mirrors `policy_digest.rs::POLICY_PREVIEW_FIELD_COUNT`.
  *  M1-04: was 22; has_constraints removed (digest-version bump).
- *  F-Q6 (2026-06-02): 21 → 22, binds operator_grant_delay_seconds. */
-export declare const POLICY_PREVIEW_FIELD_COUNT = 22;
+ *  F-Q6 (2026-06-02): 21 → 22, binds operator_grant_delay_seconds.
+ *  M-1 (2026-06-11): 22 → 24, binds has_protocol_caps (23) + protocol_caps (24). */
+export declare const POLICY_PREVIEW_FIELD_COUNT = 24;
 /**
  * Phase 8 PEN-CROSS-1 (Council ISC-141): SHA-256 of the Borsh-encoded
  * empty `Vec<(Pubkey, u8)>` — i.e. SHA-256 of [0x00, 0x00, 0x00, 0x00].

package/dist/policy/compute-policy-preview-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compute-policy-preview-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-policy-preview-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAML,YAAY,IAAI,qBAAqB,EACtC,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,6BAA6B;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACzC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,mBAAmB,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACnD,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAC;IAErB,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAgCD;;sEAEsE;AACtE,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAG/B,CAAC;AAEL;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,UAAU,CA8BZ;AA4DD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,mBAAmB,GAC1B,UAAU,CAoHZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,8BAAwB,CAAC"}
+{"version":3,"file":"compute-policy-preview-digest.d.ts","sourceRoot":"","sources":["../../src/policy/compute-policy-preview-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAML,YAAY,IAAI,qBAAqB,EACtC,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,6BAA6B;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACzC,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,mBAAmB,EAAE,SAAS,CAAC,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;IACnD,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,OAAO,CAAC;IAErB,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC;IACpD;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAgCD;;;oFAGoF;AACpF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAG/B,CAAC;AAEL;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,UAAU,CA8BZ;AA8DD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,mBAAmB,GAC1B,UAAU,CAmIZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,8BAAwB,CAAC"}