@usesigil/kit 0.2.0 → 0.2.2

package/dist/agent-errors.d.ts

@@ -5,7 +5,7 @@
  * Every error includes a category, retryability flag, and
  * recovery actions that tell the agent exactly what to do next.
  *
- * Maps all 72 on-chain error codes (6000-6071) plus 34 SDK
+ * Maps all 76 on-chain error codes (6000-6075) plus 34 SDK
  * error codes (7000-7033) to AgentError with machine-readable metadata.
  *
  * Zero dependency on @solana/web3.js or @coral-xyz/anchor.
@@ -51,7 +51,7 @@ export declare const ON_CHAIN_ERROR_MAP: Record<number, ErrorMapping>;
  * Convert any error into a structured AgentError.
  *
  * Handles:
- * - On-chain Anchor errors (code 6000-6069)
+ * - On-chain Anchor errors (code 6000-6075)
  * - SDK errors (code 7000-7033)
  * - Network/RPC errors (from message patterns)
  * - Unknown errors (wrapped as FATAL)
@@ -142,7 +142,7 @@ export declare class SigilSdkError extends Error implements AgentError {
  * Returns a SigilSdkError (extends Error) so instanceof Error checks still work.
  *
  * Processing order:
- * 1. Try on-chain error extraction via toAgentError() (numeric codes 6000-6071)
+ * 1. Try on-chain error extraction via toAgentError() (numeric codes 6000-6075)
  * 2. Pattern-match SDK error messages (11 patterns from seal.ts throw sites)
  * 3. Fallback to UNKNOWN/FATAL
  */

package/dist/agent-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-errors.d.ts","sourceRoot":"","sources":["../src/agent-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,GACrB,OAAO,CAAC;AAEZ,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,aAAa,CAAC;IACxB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAMD,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,cAAc,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA+hC3D,CAAC;AAkgBF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,UAAU,CAoGZ;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B,GAAG,UAAU,CAsCb;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,MAAM,GACzB,UAAU,GAAG,IAAI,CA8BnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAYhE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAIlD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAkD1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,kBAAkB,CAqCnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAoOD;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAM,YAAW,UAAU;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;gBAErB,UAAU,EAAE,UAAU;CAWnC;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CA6B7D"}
+{"version":3,"file":"agent-errors.d.ts","sourceRoot":"","sources":["../src/agent-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,MAAM,aAAa,GACrB,kBAAkB,GAClB,WAAW,GACX,YAAY,GACZ,YAAY,GACZ,oBAAoB,GACpB,cAAc,GACd,kBAAkB,GAClB,wBAAwB,GACxB,qBAAqB,GACrB,OAAO,CAAC;AAEZ,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,aAAa,CAAC;IACxB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gEAAgE;IAChE,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAMD,UAAU,YAAY;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,cAAc,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA0lC3D,CAAC;AAkgBF;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,UAAU,CAoGZ;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B,GAAG,UAAU,CAsCb;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,MAAM,GACzB,UAAU,GAAG,IAAI,CA8BnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAYhE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAIlD;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAkD1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,kBAAkB,CAqCnE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AAoOD;;;GAGG;AACH,qBAAa,aAAc,SAAQ,KAAM,YAAW,UAAU;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;gBAErB,UAAU,EAAE,UAAU;CAWnC;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CA6B7D"}

package/dist/agent-errors.js

@@ -5,7 +5,7 @@
  * Every error includes a category, retryability flag, and
  * recovery actions that tell the agent exactly what to do next.
  *
- * Maps all 72 on-chain error codes (6000-6071) plus 34 SDK
+ * Maps all 76 on-chain error codes (6000-6075) plus 34 SDK
  * error codes (7000-7033) to AgentError with machine-readable metadata.
  *
  * Zero dependency on @solana/web3.js or @coral-xyz/anchor.
@@ -393,20 +393,6 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     6027: {
-        name: "TimelockActive",
-        message: "Vault has timelock active — use queue_policy_update instead of direct update",
-        category: "POLICY_VIOLATION",
-        retryable: false,
-        recovery_actions: [
-            {
-                action: "queue_update",
-                description: "Queue the policy update through the timelock mechanism",
-                tool: "sigil_update_policy",
-                parameters: { use_timelock: true },
-            },
-        ],
-    },
-    6028: {
         name: "NoTimelockConfigured",
         message: "No timelock configured on this vault",
         category: "INPUT_VALIDATION",
@@ -418,7 +404,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6029: {
+    6028: {
         name: "DestinationNotAllowed",
         message: "Destination address not in vault's allowed destinations list",
         category: "POLICY_VIOLATION",
@@ -435,7 +421,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6030: {
+    6029: {
         name: "TooManyDestinations",
         message: "Too many destinations in allowlist (max 10)",
         category: "INPUT_VALIDATION",
@@ -447,7 +433,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6031: {
+    6030: {
         name: "InvalidProtocolMode",
         message: "Invalid protocol mode (must be 0=all, 1=allowlist, or 2=denylist)",
         category: "INPUT_VALIDATION",
@@ -460,7 +446,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Flash Trade expansion errors ---
-    6032: {
+    6031: {
         name: "InvalidNonSpendingAmount",
         message: "Non-spending action must have amount = 0",
         category: "INPUT_VALIDATION",
@@ -472,7 +458,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6033: {
+    6032: {
         name: "NoPositionsToClose",
         message: "No open positions to close or cancel",
         category: "RESOURCE_NOT_FOUND",
@@ -485,7 +471,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6034: {
+    6033: {
         name: "CpiCallNotAllowed",
         message: "Instruction must be top-level (CPI calls not allowed for validate/finalize)",
         category: "FATAL",
@@ -497,7 +483,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6035: {
+    6034: {
         name: "MissingFinalizeInstruction",
         message: "Transaction must include finalize_session after validate_and_authorize",
         category: "INPUT_VALIDATION",
@@ -510,7 +496,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Stablecoin-only enforcement errors ---
-    6036: {
+    6035: {
         name: "NonTrackedSwapMustReturnStablecoin",
         message: "Non-stablecoin swap must return stablecoin (vault stablecoin balance did not increase)",
         category: "INPUT_VALIDATION",
@@ -522,7 +508,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6037: {
+    6036: {
         name: "SwapSlippageExceeded",
         message: "Swap slippage exceeds policy max_slippage_bps or quoted output is zero",
         category: "POLICY_VIOLATION",
@@ -539,7 +525,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6038: {
+    6037: {
         name: "InvalidJupiterInstruction",
         message: "Cannot parse Jupiter swap instruction data",
         category: "INPUT_VALIDATION",
@@ -551,7 +537,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6039: {
+    6038: {
         name: "UnauthorizedTokenTransfer",
         message: "Top-level SPL Token transfer not allowed between validate and finalize",
         category: "POLICY_VIOLATION",
@@ -563,7 +549,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6040: {
+    6039: {
         name: "SlippageBpsTooHigh",
         message: "Slippage BPS exceeds maximum allowed (5000 = 50%)",
         category: "INPUT_VALIDATION",
@@ -575,7 +561,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6041: {
+    6040: {
         name: "ProtocolMismatch",
         message: "DeFi instruction program does not match the declared target_protocol",
         category: "INPUT_VALIDATION",
@@ -587,7 +573,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6042: {
+    6041: {
         name: "TooManyDeFiInstructions",
         message: "Non-stablecoin swap allows exactly one DeFi instruction",
         category: "INPUT_VALIDATION",
@@ -600,7 +586,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Multi-Agent errors ---
-    6043: {
+    6042: {
         name: "MaxAgentsReached",
         message: "Maximum agents per vault reached (limit: 10)",
         category: "INPUT_VALIDATION",
@@ -613,7 +599,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6044: {
+    6043: {
         name: "InsufficientPermissions",
         message: "Agent lacks permission for this action type",
         category: "PERMISSION",
@@ -630,7 +616,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6045: {
+    6044: {
         name: "InvalidPermissions",
         message: "Permission bitmask contains invalid bits (only 21 bits valid)",
         category: "INPUT_VALIDATION",
@@ -643,7 +629,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Escrow errors ---
-    6046: {
+    6045: {
         name: "EscrowNotActive",
         message: "Escrow is not in Active status",
         category: "RESOURCE_NOT_FOUND",
@@ -655,7 +641,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6047: {
+    6046: {
         name: "EscrowExpired",
         message: "Escrow has expired — can only be refunded now",
         category: "RESOURCE_NOT_FOUND",
@@ -668,7 +654,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6048: {
+    6047: {
         name: "EscrowNotExpired",
         message: "Escrow has not expired yet — cannot refund before expiry",
         category: "INPUT_VALIDATION",
@@ -685,7 +671,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6049: {
+    6048: {
         name: "InvalidEscrowVault",
         message: "Invalid escrow vault — source or destination vault mismatch",
         category: "INPUT_VALIDATION",
@@ -697,7 +683,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6050: {
+    6049: {
         name: "EscrowConditionsNotMet",
         message: "Escrow settlement conditions not met (SHA-256 proof invalid)",
         category: "INPUT_VALIDATION",
@@ -709,7 +695,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6051: {
+    6050: {
         name: "EscrowDurationExceeded",
         message: "Escrow duration exceeds maximum (30 days)",
         category: "INPUT_VALIDATION",
@@ -722,7 +708,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Instruction constraints errors ---
-    6052: {
+    6051: {
         name: "InvalidConstraintConfig",
         message: "Invalid constraint configuration: bounds exceeded",
         category: "INPUT_VALIDATION",
@@ -734,7 +720,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6053: {
+    6052: {
         name: "ConstraintViolated",
         message: "Instruction violated a configured constraint",
         category: "POLICY_VIOLATION",
@@ -751,7 +737,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6054: {
+    6053: {
         name: "InvalidConstraintsPda",
         message: "Invalid constraints PDA: wrong owner or vault",
         category: "INPUT_VALIDATION",
@@ -763,7 +749,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6055: {
+    6054: {
         name: "InvalidPendingConstraintsPda",
         message: "Invalid pending constraints PDA: wrong owner or vault",
         category: "INPUT_VALIDATION",
@@ -776,7 +762,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Per-agent spend limit errors ---
-    6056: {
+    6055: {
         name: "AgentSpendLimitExceeded",
         message: "Agent's rolling 24h spend exceeds their individual spending limit",
         category: "SPENDING_CAP",
@@ -798,7 +784,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6057: {
+    6056: {
         name: "OverlaySlotExhausted",
         message: "Per-agent overlay is full — cannot register agent with spending limit",
         category: "INPUT_VALIDATION",
@@ -811,7 +797,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6058: {
+    6057: {
         name: "AgentSlotNotFound",
         message: "Agent has per-agent spending limit but no overlay tracking slot",
         category: "RESOURCE_NOT_FOUND",
@@ -823,7 +809,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6059: {
+    6058: {
         name: "UnauthorizedTokenApproval",
         message: "Unauthorized SPL Token Approve detected between validate and finalize",
         category: "POLICY_VIOLATION",
@@ -835,7 +821,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6060: {
+    6059: {
         name: "InvalidSessionExpiry",
         message: "Session expiry slots out of range (10-450)",
         category: "INPUT_VALIDATION",
@@ -847,7 +833,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6061: {
+    6060: {
         name: "UnconstrainedProgramBlocked",
         message: "Program has no constraint entry and strict mode is enabled",
         category: "POLICY_VIOLATION",
@@ -865,7 +851,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Per-protocol spend cap errors ---
-    6062: {
+    6061: {
         name: "ProtocolCapExceeded",
         message: "Per-protocol rolling 24h spending cap would be exceeded",
         category: "SPENDING_CAP",
@@ -886,7 +872,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6063: {
+    6062: {
         name: "ProtocolCapsMismatch",
         message: "protocol_caps length must match protocols length when has_protocol_caps is true",
         category: "INPUT_VALIDATION",
@@ -899,7 +885,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Vault closure guard errors ---
-    6064: {
+    6063: {
         name: "ActiveEscrowsExist",
         message: "Active escrow deposits exist — close them before closing vault",
         category: "RESOURCE_NOT_FOUND",
@@ -911,7 +897,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6065: {
+    6064: {
         name: "ConstraintsNotClosed",
         message: "Instruction constraints PDA still exists — close it before closing vault",
         category: "RESOURCE_NOT_FOUND",
@@ -923,7 +909,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6066: {
+    6065: {
         name: "PendingPolicyExists",
         message: "A pending policy update exists — apply or cancel it before closing vault",
         category: "RESOURCE_NOT_FOUND",
@@ -936,7 +922,7 @@ export const ON_CHAIN_ERROR_MAP = {
         ],
     },
     // --- Agent pause errors ---
-    6067: {
+    6066: {
         name: "AgentPaused",
         message: "Agent is paused — unpause before executing actions",
         category: "PERMISSION",
@@ -948,7 +934,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6068: {
+    6067: {
         name: "AgentAlreadyPaused",
         message: "Agent is already paused",
         category: "INPUT_VALIDATION",
@@ -960,7 +946,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6069: {
+    6068: {
         name: "AgentNotPaused",
         message: "Agent is not paused — cannot unpause",
         category: "INPUT_VALIDATION",
@@ -972,7 +958,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6070: {
+    6069: {
         name: "UnauthorizedPostFinalizeInstruction",
         message: "Instructions after finalize_session must be ComputeBudget or SystemProgram only",
         category: "POLICY_VIOLATION",
@@ -984,7 +970,7 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
-    6071: {
+    6070: {
         name: "UnexpectedBalanceDecrease",
         message: "Vault stablecoin balance decreased more than the session authorized amount. " +
             "This indicates a compromised DeFi program attempted to drain vault tokens via CPI.",
@@ -1003,6 +989,69 @@ export const ON_CHAIN_ERROR_MAP = {
             },
         ],
     },
+    // --- TOCTOU + timelock hardening errors ---
+    6071: {
+        name: "TimelockTooShort",
+        message: "Timelock duration is below the minimum (1800 seconds / 30 minutes).",
+        category: "INPUT_VALIDATION",
+        retryable: false,
+        recovery_actions: [
+            {
+                action: "increase_timelock",
+                description: "Set timelock_duration to at least 1800 seconds (30 minutes).",
+            },
+        ],
+    },
+    6072: {
+        name: "PolicyVersionMismatch",
+        message: "Policy version changed since agent's last RPC read. Re-resolve vault state and retry.",
+        category: "TRANSIENT",
+        retryable: true,
+        retry_after_ms: 1000,
+        recovery_actions: [
+            {
+                action: "re_resolve_state",
+                description: "Re-fetch vault state via resolveVaultState() to get current policy version, then retry.",
+            },
+        ],
+    },
+    6073: {
+        name: "PendingAgentPermsExists",
+        message: "A pending agent permissions update already exists for this agent.",
+        category: "RESOURCE_NOT_FOUND",
+        retryable: false,
+        recovery_actions: [
+            {
+                action: "apply_or_cancel_pending",
+                description: "Apply or cancel the existing pending update before queuing a new one.",
+            },
+        ],
+    },
+    6074: {
+        name: "PendingCloseConstraintsExists",
+        message: "A pending close constraints operation already exists for this vault.",
+        category: "RESOURCE_NOT_FOUND",
+        retryable: false,
+        recovery_actions: [
+            {
+                action: "apply_or_cancel_pending",
+                description: "Apply or cancel the existing pending close constraints before queuing a new one.",
+            },
+        ],
+    },
+    6075: {
+        name: "ActiveSessionsExist",
+        message: "Cannot close vault with active sessions. Finalize all pending sessions first.",
+        category: "POLICY_VIOLATION",
+        retryable: true,
+        retry_after_ms: 10000,
+        recovery_actions: [
+            {
+                action: "finalize_sessions",
+                description: "Wait for active sessions to finalize or expire, then retry close_vault.",
+            },
+        ],
+    },
 };
 // ---------------------------------------------------------------------------
 // SDK error codes (7000-7033) — numeric to match agent error code pattern
@@ -1500,7 +1549,7 @@ const SDK_ERRORS = {
  * Convert any error into a structured AgentError.
  *
  * Handles:
- * - On-chain Anchor errors (code 6000-6069)
+ * - On-chain Anchor errors (code 6000-6075)
  * - SDK errors (code 7000-7033)
  * - Network/RPC errors (from message patterns)
  * - Unknown errors (wrapped as FATAL)
@@ -1802,7 +1851,7 @@ function extractErrorCode(error) {
         return null;
     const e = error;
     // Direct code property
-    if (typeof e.code === "number" && e.code >= 6000 && e.code <= 6069)
+    if (typeof e.code === "number" && e.code >= 6000 && e.code <= 6075)
         return e.code;
     // Anchor error structure
     if (e.error && typeof e.error === "object") {
@@ -1818,7 +1867,7 @@ function extractErrorCode(error) {
         const match = e.message.match(/custom program error: 0x([0-9a-fA-F]+)/);
         if (match) {
             const code = parseInt(match[1], 16);
-            if (code >= 6000 && code <= 6069)
+            if (code >= 6000 && code <= 6075)
                 return code;
         }
     }
@@ -2026,7 +2075,7 @@ export class SigilSdkError extends Error {
  * Returns a SigilSdkError (extends Error) so instanceof Error checks still work.
  *
  * Processing order:
- * 1. Try on-chain error extraction via toAgentError() (numeric codes 6000-6071)
+ * 1. Try on-chain error extraction via toAgentError() (numeric codes 6000-6075)
  * 2. Pattern-match SDK error messages (11 patterns from seal.ts throw sites)
  * 3. Fallback to UNKNOWN/FATAL
  */