PDA Derivation
Derive every program account address — seeds, signatures, and helpers.
The pda namespace derives Program Derived Addresses for every account the
program owns. Each helper returns a [PublicKey, number] tuple ([address, bump]) and accepts an optional final programId argument that defaults to
AURA_PROGRAM_ID.
import { deriveTreasuryAddress } from "@aura-protocol/sdk-ts";
const [treasury, bump] = deriveTreasuryAddress(owner.publicKey, "agent-prod-1");All helpers are re-exported at the root, and also available under the pda
namespace (pda.deriveTreasuryAddress(...)).
Treasury
deriveTreasuryAddress(owner: PublicKey, agentId: string, programId?): [PublicKey, number]Seeds: ["treasury", owner, agentId]. The treasury is the anchor for almost
every other account.
Per-treasury sidecars
Each treasury has at most one of these; the address is fully determined by the
treasury PDA. Seeds: [<seed>, treasury].
| Helper | Account |
|---|---|
deriveTreasuryAnalyticsAddress(treasury) | analytics + audit commitment |
deriveConfidentialGuardrailsAddress(treasury) | confidential guardrails |
deriveTrustIdentityAddress(treasury) | trust + identity |
derivePolicyHistoryAddress(treasury) | policy history |
derivePolicyCanaryAddress(treasury) | shadow/canary policy |
deriveHealthScoreAddress(treasury) | health score |
deriveActivityLogAddress(treasury) | activity log |
deriveAddressListAddress(treasury) | address allow/deny list |
deriveExternalLivenessAddress(treasury) | external liveness |
deriveFeeVaultAddress(treasury) | protocol-fee vault |
deriveFeeScheduleAddress(treasury) | fee schedule |
Indexed per-treasury PDAs
Seeds: [<seed>, treasury, idLe]. Identifiers are u64 little-endian unless
noted.
| Helper | Index type |
|---|---|
deriveScheduledIntentAddress(treasury, intentId) | u64 |
deriveConditionalProposalAddress(treasury, proposalId) | u64 |
deriveBatchProposalAddress(treasury, batchId) | u64 |
derivePolicyReceiptAddress(treasury, proposalId) | u64 |
derivePolicySimulationAddress(treasury, simulationId) | u64 |
deriveBudgetEnvelopeAddress(treasury, envelopeId) | u64 |
deriveInvariantReportAddress(treasury, reportId) | u64 |
deriveSnapshotAddress(treasury, snapshotIndex) | u32 |
deriveSnapshotAddress takes a u32 index (4-byte LE), unlike the u64
identifiers above. Its seed prefix is "treasury_snapshot".
Key-scoped PDAs
Seeds: [<seed>, treasury, pubkey].
| Helper | Keyed by |
|---|---|
deriveSessionKeyAddress(treasury, sessionKey) | session key pubkey |
deriveOperatorRoleAddress(treasury, operator) | operator pubkey |
derivePolicyCheckAddress(treasury, caller) | caller pubkey |
derivePolicyAttestationAddress(treasury, attester, policyVersion) | attester + u64 version |
Owner-scoped templates
Seeds: [<seed>, owner, templateId] (u64). Templates are authored per owner,
not per treasury.
derivePolicyTemplateAddress(owner: PublicKey, templateId: BNish, programId?)
deriveBillingTemplateAddress(owner: PublicKey, templateId: BNish, programId?)Chain, dWallet, and singletons
// Global per-chain profile — note: no treasury component. chainCode is a u8.
deriveChainProfileAddress(chainCode: number, programId?)
// AURA's per-dWallet runtime state. Seeds: ["dwallet_state", treasury, [chain]].
deriveDwalletStateAddress(treasury: PublicKey, chain: number, programId?)
// The global protocol-config singleton. Seeds: ["protocol_config"].
deriveProtocolConfigAddress(programId?)Swarm pools
A swarm pool is keyed by sha256(swarmId). Pass the id string and the SDK
hashes it, or pass a precomputed 32-byte hash.
import { deriveSwarmPoolAddress, hashSwarmId } from "@aura-protocol/sdk-ts";
const [pool] = deriveSwarmPoolAddress("trading-swarm-1");
const hash = hashSwarmId("trading-swarm-1"); // Uint8Array(32) — the stored swarm_id_hash
const [same] = deriveSwarmPoolAddress(hash);External CPI authorities
These derive addresses on the AURA program and the external Ika programs for the dWallet and Encrypt cross-program calls.
// AURA-side CPI signer authorities.
deriveDwalletCpiAuthorityAddress(programId?)
deriveEncryptCpiAuthorityAddress(programId?)
// Encrypt program's event authority (scoped to the encrypt program id).
deriveEncryptEventAuthorityAddress(encryptProgramId)
// Ika dWallet message-approval PDA (mirrors aura-core's find_message_approval_pda).
deriveMessageApprovalAddress(
dwalletProgramId,
curveCode, // u16
publicKey, // Uint8Array (the dWallet public key bytes)
schemeCode, // u16
digest, // Uint8Array(32) — message digest
metadataDigest?, // Uint8Array(32) — included only when non-zero
)