vaults_withdraw

1. Load the GLAM state or program account required by the instruction and verify the signer.
2. Verify that the integration is enabled on the vault and that the caller has the required delegate permission or owner authority.
3. Validate the instruction-specific policy, then invoke the external protocol with the vault authority where required.

• The submitted accounts must match the declared account list, signer requirements, writable requirements, fixed program addresses, and account relationships shown below.
• The GLAM state account is the source of truth for owner, enabled integrations, delegate permissions, policies, assets, borrowable assets, timelock settings, mint linkage, and pricing records.
• The vault account must be the PDA controlled by the core protocol program and derived conceptually from the state account; instructions use it as the vault authority for SOL, token accounts, and external positions.
• The vault integration ACL must enable this integration before the instruction is accepted; that enablement is defined on the GLAM state account.
• If the signer is not the owner, the delegate ACL on the GLAM state must contain the exact protocol permission required by this instruction; registering a delegate alone is insufficient.
• Instruction-specific destination accounts must satisfy the external protocol's own account model; GLAM validates the accounts it needs for authorization and policy enforcement, then passes the remaining protocol accounts through CPI.

Uses the standard Big Seven account pattern, plus the instruction-specific accounts below.

• Enable KaminoVaults on the vault integration ACL. Protocol bitflag: 0b00000010.
• Delegate permission: Kamino Vaults Withdraw (0b0000000000000010).

await glamClient.kaminoVaults.withdraw(
  kaminoVault,
  new BN(500_000_000),
);

• The target Kamino vault must be allowed by the Kamino vaults policy before deposit or withdrawal.