@degen-insurance/sdk 0.2.0

package/dist/abi.js

@@ -0,0 +1,49 @@
+import { parseAbi } from "viem";
+export const universalRouterAbi = parseAbi([
+    "function buyWithCover(address token, uint256 minOut, uint8 tier) payable returns (uint256 received, uint256 policyId)",
+    "function buyWithCoverVia(address token, uint256 minOut, uint8 tier, address referrer) payable returns (uint256 received, uint256 policyId)",
+    "function buy(address token, uint256 minOut) payable returns (uint256 received)",
+    "function previewCover(uint8 tier, uint256 totalValue) view returns (uint256 notional, uint256 premium)",
+]);
+export const insuranceCoreAbi = parseAbi([
+    "function latchTrigger(address token) returns (bool)",
+    "function claim(uint256 id) returns (uint256)",
+    "function latchAndClaim(uint256 id) returns (uint256)",
+    "function remainingCapacity(address token) view returns (uint256)",
+    // The two ways out of an insured position. Both end the cover, because the core holds the
+    // position in escrow for the life of the policy -- a holder cannot simply sell it, and a
+    // partner with no exit to offer leaves users stuck until expiry.
+    "function sellAndVoid(uint256 id, uint256 minOut) returns (uint256)",
+    "function voidAndRelease(uint256 id) returns (uint256)",
+    "function policyCount() view returns (uint256)",
+    "function policies(uint256 id) view returns ((address,uint96,address,uint48,uint48,uint128,uint128,uint128,uint128,uint8,uint8,uint16))",
+    "function quote(address token, uint256 notional, uint256 tokensOut, uint8 tier) view returns (uint256 premium, uint256 payout, uint256 entryPrice, uint256 floorPrice)",
+    // Both share caps are cumulative, so headroom depends on the wallet and on every policy
+    // already open against the token. Read, never assumed.
+    "function walletTokensInsured(address token, address holder) view returns (uint256)",
+    "function tokenTokensInsured(address token) view returns (uint256)",
+]);
+export const riskRegistryAbi = parseAbi([
+    "function checkToken(address token) view returns (bool ok, uint8 reason)",
+    "function tiers(uint256 id) view returns ((uint16,uint16,uint16,bool))",
+    // Field order mirrors RiskRegistry.Params exactly. Six uint16s, not five -- getting that
+    // wrong shifts every uint128 after it and silently reads a bps value as a wei limit.
+    "function getParams() view returns ((uint32,uint32,uint32,uint16,uint16,uint16,uint16,uint16,uint16,uint128,uint128,uint128,uint128))",
+]);
+export const launchPoolAbi = parseAbi([
+    "function quoteReserve() view returns (uint256)",
+    "function tokenReserve() view returns (uint256)",
+    "function feeBps() view returns (uint16)",
+    "function launchPrice() view returns (uint256)",
+    "function spotPrice() view returns (uint256)",
+]);
+export const erc20Abi = parseAbi([
+    "function balanceOf(address) view returns (uint256)",
+    "function totalSupply() view returns (uint256)",
+    "function symbol() view returns (string)",
+    "function decimals() view returns (uint8)",
+]);
+export const partnerRegistryAbi = parseAbi([
+    "function outstanding(address partner) view returns (uint256)",
+    "function claim(address to) returns (uint256)",
+]);

package/dist/alerts/state.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Alerting for cover.
+ *
+ * For insurance specifically this is the most valuable thing a bot can offer, and it needs no
+ * custody at all: knowing your window is about to close, or that your claim just paid, is worth
+ * more than being able to buy from inside the chat.
+ */
+/**
+ * Voided is new, and it is not a failure state: it is how a holder leaves early. The core
+ * escrows the position for the life of the policy, so exiting means `sellAndVoid` or
+ * `voidAndRelease`, and either ends the cover.
+ */
+export type PolicyStatus = "active" | "claimed" | "expired" | "voided";
+export interface PolicyView {
+    id: string;
+    symbol: string;
+    token: string;
+    holder: string;
+    notionalWei: bigint;
+    maxPayoutWei: bigint;
+    openedAt: number;
+    expiresAt: number;
+    status: PolicyStatus;
+    /** A trigger has been recorded inside this policy's window. */
+    triggered: boolean;
+}
+export type AlertKind = "cover_active" | "triggered_claimable" | "window_closing" | "claim_paid" | "expired_unused" | "cover_ended";
+export interface Alert {
+    kind: AlertKind;
+    policyId: string;
+    symbol: string;
+    /** Deduplication key: one alert of each kind per policy, ever. */
+    key: string;
+}
+export interface AlertConfig {
+    /** How long before expiry to warn, in seconds. */
+    closingWindowSeconds: number;
+}
+export declare const DEFAULT_ALERT_CONFIG: AlertConfig;
+/**
+ * Decide which alerts a policy warrants right now.
+ *
+ * `sent` carries the keys already delivered. Alerting is idempotent because the alternative is
+ * a bot that repeats "your window is closing" on every poll, which trains people to mute it and
+ * then miss the one message that mattered.
+ */
+export declare function alertsFor(policy: PolicyView, nowSeconds: number, sent: ReadonlySet<string>, config?: AlertConfig): Alert[];
+/** Run the whole book, returning alerts to send and the updated sent-key set. */
+export declare function sweep(policies: readonly PolicyView[], nowSeconds: number, sent: ReadonlySet<string>, config?: AlertConfig): {
+    alerts: Alert[];
+    sent: Set<string>;
+};

package/dist/alerts/state.js

@@ -0,0 +1,56 @@
+/**
+ * Alerting for cover.
+ *
+ * For insurance specifically this is the most valuable thing a bot can offer, and it needs no
+ * custody at all: knowing your window is about to close, or that your claim just paid, is worth
+ * more than being able to buy from inside the chat.
+ */
+export const DEFAULT_ALERT_CONFIG = { closingWindowSeconds: 180 };
+/**
+ * Decide which alerts a policy warrants right now.
+ *
+ * `sent` carries the keys already delivered. Alerting is idempotent because the alternative is
+ * a bot that repeats "your window is closing" on every poll, which trains people to mute it and
+ * then miss the one message that mattered.
+ */
+export function alertsFor(policy, nowSeconds, sent, config = DEFAULT_ALERT_CONFIG) {
+    const out = [];
+    const push = (kind) => {
+        const key = `${policy.id}:${kind}`;
+        if (!sent.has(key))
+            out.push({ kind, policyId: policy.id, symbol: policy.symbol, key });
+    };
+    if (policy.status === "claimed") {
+        push("claim_paid");
+        return out;
+    }
+    if (policy.status === "expired") {
+        push("expired_unused");
+        return out;
+    }
+    if (policy.status === "voided") {
+        push("cover_ended");
+        return out;
+    }
+    push("cover_active");
+    if (policy.triggered) {
+        push("triggered_claimable");
+        return out;
+    }
+    const remaining = policy.expiresAt - nowSeconds;
+    if (remaining > 0 && remaining <= config.closingWindowSeconds)
+        push("window_closing");
+    return out;
+}
+/** Run the whole book, returning alerts to send and the updated sent-key set. */
+export function sweep(policies, nowSeconds, sent, config = DEFAULT_ALERT_CONFIG) {
+    const next = new Set(sent);
+    const alerts = [];
+    for (const p of policies) {
+        for (const a of alertsFor(p, nowSeconds, next, config)) {
+            alerts.push(a);
+            next.add(a.key);
+        }
+    }
+    return { alerts, sent: next };
+}

package/dist/deployment.d.ts

@@ -0,0 +1,59 @@
+import type { Address } from "viem";
+/**
+ * One deployment of the protocol, on one chain.
+ *
+ * This is the answer to "how do I switch chains?" and the reason there is no `setChain()`.
+ * A setter implies one current chain, which is fine for a browser tab and wrong for the thing
+ * this SDK is actually for: a bot serving many users at once. Two requests for different
+ * chains arriving together would race on the same global, and the loser would build calldata
+ * for one chain and send it to another. Passing the deployment makes that unrepresentable --
+ * two chains is two values, and they cannot interfere.
+ *
+ * It also exists to keep addresses that must agree from drifting apart. Passing `core`,
+ * `router` and `registry` as three loose arguments lets a caller mix one chain's router with
+ * another's core, and nothing would notice until the transaction reverted for reasons that
+ * look nothing like the cause.
+ */
+export interface Deployment {
+    /** EIP-155 chain id. Checked against the connected client by `assertChain`. */
+    chainId: number;
+    /** For error messages. Never used to decide anything. */
+    name: string;
+    core: Address;
+    router: Address;
+    registry: Address;
+    partnerRegistry?: Address;
+    /**
+     * Whether a calibration run has produced a rate card for this chain.
+     *
+     * `Chains.card()` reverts `NoRateCard` for an uncalibrated chain rather than guessing, and
+     * this SDK follows it: premiums are the deliverable of a calibration run and belong to the
+     * chain they were measured on. Selling cover at another chain's numbers is not a smaller
+     * version of being right.
+     */
+    calibrated: boolean;
+}
+/**
+ * Robinhood Chain testnet.
+ *
+ * The only deployment exported here, because it is the only one whose addresses have been
+ * checked against the chain. Robinhood mainnet (4663) has a deployment in `broadcast/`, but
+ * shipping addresses nobody has verified is how a partner ends up pointed at the wrong
+ * contracts -- define it yourself with `defineDeployment` once you have confirmed it.
+ */
+export declare const ROBINHOOD_TESTNET: Deployment;
+/** Define a deployment this SDK does not ship. Validates shape, not chain state. */
+export declare function defineDeployment(d: Deployment): Deployment;
+/** The slice of a viem public client this module needs. */
+export interface ChainReader {
+    getChainId(): Promise<number>;
+}
+/**
+ * Confirm the client is actually on the deployment's chain.
+ *
+ * Worth a round trip before signing anything. A client pointed at the wrong RPC produces
+ * calldata that is perfectly well formed and addressed to contracts that are not there, and
+ * the failure arrives as an unrelated-looking revert -- or worse, as a success against
+ * whatever else happens to live at that address.
+ */
+export declare function assertChain(client: ChainReader, deployment: Deployment): Promise<void>;

package/dist/deployment.js

@@ -0,0 +1,46 @@
+/**
+ * Robinhood Chain testnet.
+ *
+ * The only deployment exported here, because it is the only one whose addresses have been
+ * checked against the chain. Robinhood mainnet (4663) has a deployment in `broadcast/`, but
+ * shipping addresses nobody has verified is how a partner ends up pointed at the wrong
+ * contracts -- define it yourself with `defineDeployment` once you have confirmed it.
+ */
+export const ROBINHOOD_TESTNET = {
+    chainId: 46630,
+    name: "Robinhood Chain Testnet",
+    core: "0x38C22152fB1214ff73ef95FC26d4f9FDf7178D07",
+    router: "0xDbd1F2b5b27Fc4a5d2354c6aa1a46db9888DCE89",
+    registry: "0x9C9FBE362EaC60fe57Bd66303De8de36c9b8E467",
+    partnerRegistry: "0xe8E49a8574a267DAe6E0C54E31Ca24F0e1258718",
+    // The testnet card is Robinhood mainnet's, borrowed to have something to quote. It has not
+    // been calibrated against testnet flow, and there is no reason to think it would match.
+    calibrated: false,
+};
+/** Define a deployment this SDK does not ship. Validates shape, not chain state. */
+export function defineDeployment(d) {
+    if (!Number.isInteger(d.chainId) || d.chainId <= 0)
+        throw new Error("chainId must be a positive integer");
+    for (const k of ["core", "router", "registry"]) {
+        if (!/^0x[0-9a-fA-F]{40}$/.test(d[k]))
+            throw new Error(`${k} is not an address`);
+    }
+    if (d.partnerRegistry && !/^0x[0-9a-fA-F]{40}$/.test(d.partnerRegistry)) {
+        throw new Error("partnerRegistry is not an address");
+    }
+    return d;
+}
+/**
+ * Confirm the client is actually on the deployment's chain.
+ *
+ * Worth a round trip before signing anything. A client pointed at the wrong RPC produces
+ * calldata that is perfectly well formed and addressed to contracts that are not there, and
+ * the failure arrives as an unrelated-looking revert -- or worse, as a success against
+ * whatever else happens to live at that address.
+ */
+export async function assertChain(client, deployment) {
+    const actual = await client.getChainId();
+    if (actual !== deployment.chainId) {
+        throw new Error(`wrong chain: client is on ${actual}, ${deployment.name} is ${deployment.chainId}`);
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Turning a revert into something a user can act on.
+ *
+ * A wallet that cannot estimate gas has no fee to show and no way to say why, so a reverting
+ * buy surfaces as "Network fee: Unavailable" or a bare selector. Neither tells anyone what to
+ * do next. Partners get the same mapping the front end uses, so a bot can explain the refusal
+ * in the chat instead of relaying hex.
+ */
+export declare const REVERT_REASONS: Record<string, string>;
+export declare function revertSelector(err: unknown): string | null;
+/**
+ * A human explanation for a failed call, or null if it cannot be attributed.
+ *
+ * Returns null rather than guessing, so a caller can distinguish "the contract refused, and
+ * here is why" from "something else went wrong" -- a transport failure must not be reported as
+ * a rejected trade.
+ */
+export declare function explainRevert(err: unknown): string | null;

package/dist/errors.js

@@ -0,0 +1,99 @@
+/**
+ * Turning a revert into something a user can act on.
+ *
+ * A wallet that cannot estimate gas has no fee to show and no way to say why, so a reverting
+ * buy surfaces as "Network fee: Unavailable" or a bare selector. Neither tells anyone what to
+ * do next. Partners get the same mapping the front end uses, so a bot can explain the refusal
+ * in the chat instead of relaying hex.
+ */
+export const REVERT_REASONS = {
+    // --- who is asking ---
+    "0xcebd1b85": "You launched this token, so you cannot insure it. Covering your own launch and then " +
+        "collapsing it is the attack this refusal exists to stop. Switch to a different wallet.",
+    "0xc12b6c65": "This wallet is not allowed to buy cover.",
+    "0x7623fb52": "This policy belongs to another wallet.",
+    // --- the amount ---
+    "0xeddee5b2": "That amount is below the minimum trade size. Try a larger amount.",
+    "0x04213078": "That amount is above the maximum trade size. Try a smaller amount.",
+    "0x83ebf0b2": "You have reached the limit on how much cover one wallet may hold on this token. Let an " +
+        "existing policy expire, or cover a different token.",
+    "0x1bdfed9c": "This token has reached its cover limit. Let an existing policy expire, or cover a " +
+        "different token.",
+    "0x40b3c2e2": "This token has as much cover written against it as it is allowed. Wait for an existing " +
+        "policy to expire, or cover a different token.",
+    "0xbeb57309": "The pool has as much cover outstanding as it is allowed to carry. Try again once some " +
+        "existing policies expire.",
+    "0xce7b4a4d": "The pool does not hold enough reserves to cover this. Try a smaller amount.",
+    "0x1f2a2005": "Enter an amount above zero.",
+    "0x7c946ed7": "Enter an amount above zero.",
+    "0x5fc23da0": "This position would be too large a share of the token's supply to reach its own trigger, " +
+        "so cover on it could never pay out. Try a smaller amount.",
+    // --- the price ---
+    "0xb68adad1": "The price has not risen far enough above the launch price for this cover level. A payout " +
+        "must stay below the real loss, which needs a higher entry. Try a lower cover level.",
+    "0x11f66e3a": "The price moved too far while this was being prepared. Refresh and try again.",
+    "0x7dd37f70": "The price moved while this was being sent. Try again.",
+    "0xf2ab8ff0": "This token has no launch price recorded yet, so cover cannot be priced.",
+    "0xaf110036": "At this amount and cover level the payout works out to zero. Try a larger amount.",
+    // --- the token or venue ---
+    "0xc186028c": "No trading venue is registered for this token, so it cannot be bought here.",
+    "0x6586e129": "There is no route to trade this token right now.",
+    "0x8698bf37": "This token is not recognised by the protocol.",
+    "0x94d366b5": "That cover level is currently switched off. Pick another.",
+    "0x21a9b143": "That cover level does not exist.",
+    "0xc4e5ad09": "This token has no price history yet. Cover needs a short history before it can be priced.",
+    // --- state ---
+    "0x80cb55e2": "This policy is no longer active.",
+    "0x2f23cfcd": "The cover window for this policy has closed.",
+    "0xcbc95a6c": "This policy has not been triggered, so there is nothing to claim yet.",
+    "0x969bf728": "There is nothing to claim on this policy.",
+    "0x6b49c94a": "The insured position is no longer held.",
+    "0xf0b778da": "This policy is still active.",
+    "0x5a65d188": "Deposits are paused right now.",
+};
+export function revertSelector(err) {
+    const seen = new Set();
+    const walk = (node, depth) => {
+        if (depth > 8 || node == null || typeof node !== "object" || seen.has(node))
+            return null;
+        seen.add(node);
+        const e = node;
+        // viem sometimes decodes it for us and puts the name here instead of raw bytes.
+        const raw = e.data;
+        if (typeof raw === "string" && /^0x[0-9a-fA-F]{8,}$/.test(raw))
+            return raw;
+        if (raw && typeof raw === "object") {
+            const inner = raw.data;
+            if (typeof inner === "string" && /^0x[0-9a-fA-F]{8,}$/.test(inner))
+                return inner;
+        }
+        for (const key of ["cause", "error", "info", "details"]) {
+            const found = walk(e[key], depth + 1);
+            if (found)
+                return found;
+        }
+        return null;
+    };
+    const fromGraph = typeof err === "object" ? walk(err, 0) : null;
+    if (fromGraph)
+        return fromGraph.slice(0, 10).toLowerCase();
+    // Only hex introduced as revert data -- never a loose address that happens to be nearby.
+    const text = typeof err === "string"
+        ? err
+        : String(err?.message ?? err ?? "");
+    const keyed = text.match(/(?:data|reverted with|custom error)\D{0,12}(0x[0-9a-fA-F]{8,})/i);
+    return keyed ? keyed[1].slice(0, 10).toLowerCase() : null;
+}
+/**
+ * A human explanation for a failed call, or null if it cannot be attributed.
+ *
+ * Returns null rather than guessing, so a caller can distinguish "the contract refused, and
+ * here is why" from "something else went wrong" -- a transport failure must not be reported as
+ * a rejected trade.
+ */
+export function explainRevert(err) {
+    const sel = revertSelector(err);
+    if (!sel)
+        return null;
+    return REVERT_REASONS[sel] ?? `This transaction would fail on chain (${sel}).`;
+}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./abi.js";
+export * from "./deployment.js";
+export * from "./limits.js";
+export * from "./errors.js";
+export * from "./tx/build.js";
+export * from "./alerts/state.js";
+export * from "./telegram/render.js";

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from "./abi.js";
+export * from "./deployment.js";
+export * from "./limits.js";
+export * from "./errors.js";
+export * from "./tx/build.js";
+export * from "./alerts/state.js";
+export * from "./telegram/render.js";

package/dist/limits.d.ts

@@ -0,0 +1,135 @@
+/**
+ * What a user is actually allowed to buy.
+ *
+ * Three separate limits decide it and they are denominated in three different things: the
+ * registry's minimum and maximum are notional wei, remaining capacity is a payout, and the
+ * share cap counts tokens. A user typing one number into one box cannot reconcile those, so a
+ * partner that does not do this arithmetic can only relay refusals after the fact -- which is
+ * what "This transaction would fail on chain (0xeddee5b2)" looked like before the front end
+ * grew the same helpers.
+ */
+export declare const BPS = 10000n;
+export interface Tier {
+    id: number;
+    name: string;
+    premiumBps: bigint;
+    payoutBps: bigint;
+    /** Entry price must be at least this many bps of the floor for the tier to be offered. */
+    minEntryBps: bigint;
+}
+/**
+ * Robinhood Chain's rate card, and nobody else's.
+ *
+ * Named for the chain it was measured on, because that is the whole of its validity. The
+ * premiums come from a calibration run over 4,679 pools and 301,612 buys on Robinhood Chain;
+ * `Chains.card()` reverts `NoRateCard` for every other chain rather than reuse them, and this
+ * SDK holds the same line. A premium is a claim about how often a token collapses, and that
+ * is a property of a chain's flow, not of the product.
+ *
+ * Use it to render a quote before you have a connection. Once you have one, read the card off
+ * the registry with `readRateCard` -- a deployment may have been reconfigured, and on any
+ * chain but Robinhood these numbers were never true to begin with.
+ */
+export declare const ROBINHOOD_RATE_CARD: readonly Tier[];
+export declare function tierById(card: readonly Tier[], id: number): Tier;
+/** The slice of a viem public client the rate-card read needs. */
+export interface TierReader {
+    readContract(args: {
+        address: `0x${string}`;
+        abi: readonly unknown[];
+        functionName: string;
+        args?: readonly unknown[];
+    }): Promise<unknown>;
+}
+/**
+ * Read the live rate card off a deployment's registry.
+ *
+ * The premium, the payout and the minimum entry are all product terms the contract enforces,
+ * so all three are read. Only the display name is local.
+ */
+export declare function readRateCard(reader: TierReader, registry: `0x${string}`, abi: readonly unknown[], ids?: readonly number[]): Promise<Tier[]>;
+/**
+ * Throw if a local card disagrees with the chain's.
+ *
+ * For callers who quote from `ROBINHOOD_RATE_CARD` before connecting: this is what turns a
+ * silent mispricing into a loud failure the first time it happens. Quoting one chain's
+ * premiums against another chain's risk is the failure mode worth being noisy about, because
+ * nothing downstream of it looks wrong -- the trade succeeds, at the wrong price.
+ */
+export declare function assertRateCard(local: readonly Tier[], onChain: readonly Tier[]): void;
+/** Split a total payment into the trade and the premium, exactly as the router does. */
+export declare function splitValue(total: bigint, premiumBps: bigint): {
+    notional: bigint;
+    premium: bigint;
+};
+/** A notional, grossed up to the total a user pays -- trade plus premium. */
+export declare function totalForNotional(notional: bigint, tier: Tier): bigint;
+/**
+ * Largest total spendable before the payout exceeds what is left on a token.
+ *
+ * Remaining capacity is a *payout* figure, and a user types a *trade size*. They differ by the
+ * tier -- 2.2x at Degen Max, 6.9x at Basic -- so relaying the capacity number itself tells a
+ * user to spend far less than they could.
+ */
+export declare function maxTotalForCapacity(capacity: bigint, tier: Tier): bigint;
+/** Pool state needed to price a trade, as the venue reports it. */
+export interface PoolQuote {
+    quoteReserve: bigint;
+    tokenReserve: bigint;
+    feeBps: bigint;
+    launchPrice: bigint;
+}
+/** Tokens a payment buys, from the pool's own constant-product maths. */
+export declare function quoteOut(q: PoolQuote, notional: bigint): bigint;
+/**
+ * The inverse of `quoteOut`: the largest payment that buys no more than `tokens`.
+ *
+ * The position-share cap is a share of supply, so it is expressed in tokens while the user
+ * pays in the quote asset. Rounds down, and settles the last wei against `quoteOut` rather
+ * than trusting the algebra -- integer division lands either side of the true answer depending
+ * on the residue, and "the maximum" being one wei too large is the whole bug this prevents.
+ */
+export declare function notionalForTokens(q: PoolQuote, tokens: bigint): bigint;
+export interface RiskLimits {
+    minTradeWei: bigint;
+    perTradeMaxWei: bigint;
+    /** Share of supply one wallet may insure on one token. */
+    maxPositionShareBps: bigint;
+    /** Share of supply insurable on one token across every wallet. */
+    maxTokenInsuredShareBps: bigint;
+    /**
+     * Largest notional the share caps still allow, converted from tokens at the current price.
+     *
+     * Leave undefined when it cannot be worked out. The bound is then omitted rather than
+     * guessed: the contract enforces it either way, and a fabricated limit is worse than a
+     * missing one.
+     */
+    maxShareNotionalWei?: bigint;
+}
+export interface AmountRange {
+    min: bigint;
+    max: bigint;
+    /** False when the limits leave no buyable amount at all. */
+    usable: boolean;
+}
+/**
+ * The band of totals a buy will actually be accepted at.
+ *
+ * A zero limit means "not known", never "capped at zero" -- treating an unloaded bound as a
+ * hard zero collapses the band and refuses everything.
+ *
+ * The share bound is shaved by 1%. It counts tokens while the user pays in the quote asset,
+ * and the rate between them moves on every trade, so a price fall between quoting a maximum
+ * and signing it means the same payment buys more. Sitting exactly on the limit is how a
+ * stated maximum still gets refused.
+ */
+export declare function amountRange(capacity: bigint, tier: Tier, limits: RiskLimits): AmountRange;
+/**
+ * Tokens a wallet may still insure on a token, before either share cap binds.
+ *
+ * Both caps are cumulative and both are a share of supply: one per wallet, one across all
+ * wallets. Whichever has less room left decides.
+ */
+export declare function shareHeadroom(supply: bigint, walletTokensInsured: bigint, tokenTokensInsured: bigint, limits: Pick<RiskLimits, "maxPositionShareBps" | "maxTokenInsuredShareBps">): bigint;
+/** Decode the `getParams()` tuple into the limits this module works in. */
+export declare function riskLimitsFromParams(p: readonly (bigint | number)[]): RiskLimits;