@eco-incorp/sauce 0.99.0

package/sdk/dist/svm/venues/kipseli/index.js

@@ -0,0 +1,352 @@
+/**
+ * Kipseli venue adapter (EcoSwapSVM ladder fragment, adapter contract v2).
+ *
+ * Kipseli (program `3TK9D8aoBFYjYZtKCjciPrVrRStsnvo7KmpcJqDavpaU`, Jupiter's own label per
+ * `benchmark/adapters/fixtures/jupiter-program-id-to-label.json`) is a closed-source, no-IDL
+ * ORACLE-PRICED PMM — NOT the constant-product pool the integration brief guessed. There is no
+ * published Anchor IDL (confirmed absent at the standard IDL PDA), so everything below is
+ * recovered by binary/account/transaction reverse engineering: `getProgramAccounts` over the
+ * program (at integration time 39 owned accounts: 34 tiny 9-byte `BanEntry` PDAs — see below — plus
+ * a 40-byte config-only account and four `Pool` accounts of sizes 162/168/456/496; re-scanned
+ * 2026-09-14 the program held 166 owned accounts: 160 `BanEntry`, the 40-byte config, and FIVE
+ * `Pool` accounts of sizes 162/168/456/496/840 — the 840 is a later realloc, see below), Anchor
+ * account-discriminator + instruction-log archaeology
+ * (`Program log: Instruction: <Name>` — Anchor's auto-logged instruction names are present even
+ * with no IDL published), and `getTransaction`-decoded real mainnet swaps (a systematic pass over
+ * 400 real, successful, program-scoped-log-verified `SwapV2` calls on the one liquid pool, spanning
+ * amounts from 10,000 lamports to ~3.9B raw units, both directions).
+ *
+ * ── Why "no on-chain IDL" does not mean "unreadable": the account graph ──
+ * Every non-trivial-size account (162/168/456/496 and, as of 2026-09-14, 840 bytes) shares the SAME
+ * 8-byte Anchor account discriminator `f19a6d0411b16dbc` — `sha256("account:Pool")[:8]`, the same
+ * collision pumpswap's and meteora-damm-v1-stable's OWN "Pool" structs carry (see
+ * `ecoswap/svm/discovery.ts`'s `SVM_FAMILY_FILTERS.pumpswap` comment — gPA is program-scoped, so the
+ * shared name never causes a cross-family match). All are SOL/USDC pools. Liquidity migrates between
+ * pool instances over time: at integration only `89dvMturcS87kYgrwyeWqqsaFZUi5dQQpBHs6pvfUu3v`
+ * (496 bytes) carried real inventory (1185.51 USDC / 1.639 SOL); by 2026-09-14 that pool's keeper had
+ * stopped (~10.8 days stale, drained to ~0.65 USDC / 0.008 SOL) and a NEW 840-byte pool
+ * `7yD7gfXv49SFxhx9uTc11dEd7Nj98rGWeYMdZJgheZbG` had become the live one (~26,036 USDC / 47.48 SOL, a
+ * fresh keeper-pushed price), with 162/168/456 all drained to near-zero and long stale.
+ *
+ * The 840-byte layout is a REALLOC of the SAME `Pool` account type, not a new one: it carries the
+ * identical `account:Pool` discriminator and its first 496 bytes are field-compatible with the 496
+ * layout — every field this adapter reads (`base_token` @72 = WSOL, `quote_token` @104 = USDC,
+ * `price` @136, `expiry` @144, `fee` @152) decodes to the right value at the SAME offset, its derived
+ * ATA vaults exist and hold the matching mint + live balance, and the 344 appended bytes sit entirely
+ * AFTER the last field this adapter needs (so they are never read). Confirmed 2026-09-14 by
+ * `getAccountInfo`/`getProgramAccounts` against live chain data (not an explorer's decoded view).
+ * This adapter is therefore SCOPED to the SET of ground-truthed layouts `POOL_ACCOUNT_SIZES` =
+ * {496, 840} — a fetch-time size gate still drops any OTHER-sized `Pool` account cleanly (one bad
+ * candidate never kills discovery, the standard venue-robustness convention).
+ *
+ * ── Cross-repo coupling (must land together with any bump that serves 840) ──
+ * sauce-recipes' `ecoswap/svm/discovery.ts` filters kipseli candidates with a SINGLE-size gPA filter
+ * `kipseli: { dataSize: 496 }`, so on its own it will never SURFACE the 840-byte pool for discovery.
+ * Serving 840 end-to-end needs BOTH sides: this SDK widening (done) AND a recipes-side discovery
+ * change (two unioned gPA queries by dataSize, or a discriminator-only filter) plus an SDK version
+ * bump and re-pin — the two must ship together, or discovery stays blind to the only live pool.
+ *
+ * Confirmed pool layout (offsets from account start, identical for the 496 and 840 layouts): disc(8)
+ * @0; `global_config`/admin authority pubkey @8 (32 bytes, unused by this adapter — informational;
+ * it was identical across the original four pools + the 40-byte config account, but the newer 840
+ * pool carries a DIFFERENT config pubkey — a new pool generation — so it is NOT a universal constant); a per-pool 32-byte field @40 that does NOT
+ * resolve to any funded/existing account for any of the four pools (confirmed via `getAccountInfo` —
+ * every candidate reads back null) — most likely a creation-time seed/salt rather than a real
+ * address reference, also unused; `base_token` mint @72 (32 bytes, WSOL for the liquid pool);
+ * `quote_token` mint @104 (32 bytes, USDC); `price` @136 (u64 LE) — see PRICING MODEL; `expiry` @144
+ * (u64 LE, MILLISECONDS since Unix epoch — verified: on a real `UpdatePoolPriceWithFee` transaction,
+ * this field's stored value landed within ~1.2s of that transaction's own `blockTime * 1000`); `fee`
+ * @152 (u64 LE, currently 100 on the live pool — units not pinned down, folded into the conservative
+ * haircut below rather than modeled explicitly, see PRICING MODEL); a bump-like byte @160-161. The
+ * two SPL vaults are NOT stored in the pool account at any offset (confirmed by exhaustive byte
+ * search for their known base58 bytes) — they are the STANDARD Associated Token Account for
+ * (owner=pool, mint) under the classic Token program, confirmed by deriving both and matching them
+ * byte-for-byte against the pool's real `getTokenAccountsByOwner` result.
+ *
+ * ── The tiny 9-byte accounts: BanEntry, not pools ──
+ * `getProgramAccounts` also returns a GROWING set of 9-byte accounts (34 at integration, 160 by
+ * 2026-09-14 — one is created per distinct trader, so the count only rises), every one holding the
+ * SAME content: an 8-byte discriminator + a trailing `0xff` byte. This is consistent with an Anchor
+ * `init_if_needed` PDA storing just `bump: u8` (canonical bump is 255 for the overwhelming majority
+ * of addresses — ~255/256 by construction — so all-sharing-0xff is expected, not a decoding
+ * error) — a per-trader compliance/ban-list marker. Its PDA seed formula (`[b"ban", trader_pubkey]`)
+ * was recovered by BRUTE-FORCING seed-string candidates against a real transaction whose signer and
+ * "real user" account were the SAME pubkey (a direct, non-relayed swap) and matching the derived PDA
+ * against that transaction's actual 11th/12th swap-instruction accounts — see BUILD_SWAP below.
+ *
+ * ── Swap instruction (disc = Anchor `sha256("global:swap_v2")[:8]` = `2b04ed0b1ac91e62`, i.e.
+ * Kipseli's own instruction is literally named `swap_v2` — confirmed via the program's own embedded
+ * Rust source paths, `strings` on the dumped program binary: `src/instructions/swap_v2.rs`) —
+ * ground-truthed against a SYSTEMATIC pull of 400 real, successful, program-scoped-log-verified
+ * mainnet swaps (not a handful of samples):
+ *   `disc(8) ++ amountIn(8, u64 LE, patched at runtime) ++ minOut(8, u64 LE, always 0 in every one
+ *   of the 400 real swaps) ++ direction(1 byte)`. direction is INDEPENDENTLY confirmed against real
+ *   SPL token balance deltas on both sides of 3 hand-picked transactions (not merely correlated with
+ *   an event field — an EVENT field this adapter does NOT use, `f104`/`f112` in the RE notes, turned
+ *   out to vary 1/2/4/5 inconsistently with real direction and is NOT the direction signal):
+ *   `0x00` = quote(USDC) in / base(SOL) out ("quoteToBase", the family default), `0x01` = base(SOL)
+ *   in / quote(USDC) out ("baseToQuote").
+ * There is also a `SwapV3` variant (disc `f0e02621b01ff1af`, seen live in a multi-hop Jupiter route)
+ * that this adapter does not emit — SwapV2 alone was sufficient to cover every real transaction
+ * sampled, and matching an unverified V3 shape risks an account-list mismatch this pass did not
+ * ground-truth.
+ *
+ * ── Accounts (13, FIXED role order regardless of direction — confirmed identical across every one
+ * of the 400 sampled swaps, both directions, both the direct-signer and Jupiter-delegated-signer
+ * cases) ──
+ *   0  signer          (writable, signer) — the CPI's authorizing wallet (owns or is delegated over
+ *      the input ATA below; for Sauce's own execute_from_account flow this is always `user.owner`)
+ *   1  pool             (writable) — the 496-byte Pool account
+ *   2  baseVault        (writable) — the base(SOL)-side ATA owned by `pool` — ALWAYS this role,
+ *      never swapped by direction (only the trailing instruction byte picks the flow direction)
+ *   3  quoteVault        (writable) — the quote(USDC)-side ATA owned by `pool`
+ *   4  baseMint          (readonly)
+ *   5  quoteMint          (readonly)
+ *   6  user_base_token_account  (writable) — the signer's base-side ATA — ALWAYS this role
+ *   7  user_quote_token_account (writable) — the signer's quote-side ATA
+ *   8  TOKEN_PROGRAM      (readonly)
+ *   9  SYSTEM_PROGRAM      (readonly) — needed for the BanEntry `init_if_needed` lazy allocation
+ *   10 real_user          (signer) — a SEPARATE identity field from `signer` (account 0) in the
+ *      general case (a Jupiter-delegated swap shows a DIFFERENT pubkey here than account 0); Sauce's
+ *      `SwapUser` has no distinct "real user" concept, so this adapter always sets it to the SAME
+ *      `user.owner` ref as account 0 — exactly the shape real DIRECT (non-relayed) swaps take on
+ *      chain, confirmed live (both signer AND real_user were the identical pubkey in that sample).
+ *   11 user_ban_entry     (writable) — `[b"ban", real_user]` PDA (here: `[b"ban", user.owner]`)
+ *   12 real_user_ban_entry (writable) — the SAME PDA as (11) given this adapter's signer==real_user
+ *      design; a genuinely relayed flow would need TWO different ban-entry PDAs here, but Sauce's
+ *      execution model has no such split.
+ * Accounts 11/12 depend on the trade's REAL owner address, which `buildSwapV2` never sees (only a
+ * symbolic ref) — exactly pumpswap's own `USER_VOLUME_ACCUMULATOR_REF` situation (see
+ * `./pumpswap/index.js`'s pumpswap adapter): `KIPSELI_BAN_ENTRY_REF` is exported bare (a plain
+ * ref, no `address`), and the CALLER resolves it — `deriveKipseliBanEntry(ownerAddress)` below does
+ * exactly that derivation for a caller that has the real owner pubkey in hand (a test harness or a
+ * future production wiring step), the same way sauce-recipes' `test/svm/ecoswap-svm.pumpswap-buy.realcpi.e2e.test.ts`
+ * resolves pumpswap's own ref.
+ *
+ * ── PRICING MODEL — an oracle-pushed price, NOT reserve-ratio (the brief's "CP-class AMM expected"
+ * guess is WRONG for this venue, corrected here with real measurement) ──
+ * The pool's two vaults are wildly imbalanced relative to the real trade rate: on the live pool, raw
+ * vault ratio (quoteVault/baseVault) is ~723 USDC/SOL while the real, keeper-pushed `price` field
+ * (and every real swap's realized rate) sits at ~77.5 USDC/SOL — a ~9.3x gap. A constant-product
+ * model over the raw vaults (the pattern this repo's other undecoded-oracle adapters, bisonfi/
+ * aquifer/scorch, fall back to) would therefore be CATASTROPHICALLY wrong here, not merely
+ * imprecise — this venue's `price` field IS decodable and MUST be used instead.
+ * `price` (u64 @136) is `(quote-per-base, human/UI units) * 1e9` — verified by cross-multiplying
+ * against 400 real swaps' own `amountIn`/`amountOut` (after applying each pair's decimals delta):
+ * measured deviation between the stored/event-logged execution price and the realized
+ * amountIn/amountOut ratio was MEDIAN 0.0095%, P90 0.0222%, P99 0.0370%, MAX 0.0496% across the full
+ * 400-swap sample — i.e. this venue quotes essentially AT its published price, with no material
+ * size-dependent slippage inside the sampled range (dust to ~3.9B raw units). The `fee` field (@152,
+ * =100 on the live pool) is NOT separately modeled — its contribution, if any, is already inside
+ * that sub-0.05% measured band, well under the conservative haircut below.
+ * The generic (any future base/quote decimals pair) conversion: rawQuotePerRawBase = (price / 1e9) *
+ * 10^(quoteDecimals - baseDecimals). `ADJ_NUM`/`ADJ_DEN` (a `paramsFor`-carried, per-pool pair, NOT
+ * baked into the compiled shape — so one compiled Kipseli shape serves any future non-SOL/USDC pair
+ * without recompiling) hold `10^max(baseDecimals-quoteDecimals,0)` / `10^max(quoteDecimals-baseDecimals,0)`
+ * respectively, computed once from each mint's own decimals byte (standard SPL Mint layout, offset
+ * 44) during `fetchPoolConfig`. `price` itself is read LIVE at cook time (`accountUint`, never a
+ * prepare-time snapshot) — the same "no baked snapshot" discipline `quantum`/`phoenix` use for their
+ * own live-refreshed state, appropriate here since a keeper can move `price` between prepare and
+ * cook. A flat `HAIRCUT_NUM/HAIRCUT_DEN` = 995/1000 (0.5%) multiplicative safety margin — roughly
+ * 10x the measured max deviation above — absorbs both that residual and any keeper-cadence drift
+ * between our quote and the real cook (observed keeper interval when active: ~1-2s). The result is
+ * additionally CAPPED at the live output-side vault balance (never quote more than the pool actually
+ * holds) — the same defensive cap every other prop-AMM adapter in this repo applies.
+ * Floor-only integer division throughout (`Math.mulDiv`, confirmed floor semantics repo-wide) means
+ * every rounding step can only ever UNDER-quote, never over — combined with the haircut and the
+ * reserve cap, this quote curve never promises more than the venue can deliver.
+ *
+ * ── Staleness / expiry (a REAL, currently-observed condition, not a hypothetical) ──
+ * `expiry` (@144, ms since epoch) is checked at the FAMILIES-registry gate level
+ * (`ecoswap/svm/index.ts`'s `kipseli.gate`, mirroring `quantum`'s own live-gate pattern) rather than
+ * on-chain (the KIPSELI PROGRAM ITSELF already reverts a stale-priced swap — "The price was
+ * expired", recovered from the dumped binary's error strings — so this off-chain gate is a
+ * self-drop convenience, not a substitute for that on-chain check). AT INTEGRATION TIME the live
+ * pool's stored `expiry` was ALREADY ~8.7 days in the past — this venue's keeper has stopped
+ * refreshing it, so the adapter currently self-drops this pool via the gate (empty universe, not a
+ * crash) until the keeper resumes or a new pool with a live price appears. This is the disclosed,
+ * honest "sequencing, not a blocker" case the maintainer's brief describes: the full adapter — CPI,
+ * account plan, quote model, CU pin — is built and correct; LIVENESS of any one pool instance is a
+ * live-state fact this gate re-evaluates every request, never a reason the integration was withheld.
+ *
+ * ── CU (REAL mainnet measurement, not modeled) ──
+ * `Program 3TK9D8ao...consumed <n> of ... compute units` read directly off 42 real, successful,
+ * program-scoped-log-verified transactions (both directions, sizes from 10,000 lamports to ~3.9B raw
+ * units): MIN 33,051 / MEAN 35,218 / MAX 42,392 CU, no correlation with trade size (the max was a
+ * small trade) — consistent with a fixed-cost oracle-read + two SPL transfers, no per-size loop. See
+ * sauce-recipes' `ecoswap/svm/budget.ts`'s `kipseli` pin for how this real number is folded into the family's
+ * `slot`/`rung` coefficients (same method as the `humidifi`/`metadao-futarchy` pins: an existing
+ * CP-family baseline plus this REAL, margin-padded CPI cost — never the ~50k placeholder every
+ * pre-2026-07-31 pin used).
+ */
+import { address, getAddressCodec, getAddressEncoder } from "@solana/kit";
+import { memoizedGetProgramDerivedAddress } from "../pda-memo.js";
+import { readUintLE } from "../math.js";
+import { TOKEN_2022_PROGRAM_ID, classifyMintProgram } from "../../token-program.js";
+import { parseMintExtensions } from "../../token-extensions.js";
+const SLUG = "kipseli";
+export const KIPSELI_PROGRAM_ID = address("3TK9D8aoBFYjYZtKCjciPrVrRStsnvo7KmpcJqDavpaU");
+const TOKEN_PROGRAM = address("TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA");
+const ASSOCIATED_TOKEN_PROGRAM = address("ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL");
+/**
+ * Ref for the `[b"ban", real_user]` PDA (accounts 11/12 of the swap CPI — see the module doc). Not
+ * resolvable from pool state (it depends on the trade's real owner, which `buildSwapV2` never sees
+ * as a real address, only a ref) — the CALLER resolves it, exactly `pumpswap`'s own
+ * `USER_VOLUME_ACCUMULATOR_REF` situation. `deriveKipseliBanEntry` below performs the derivation for
+ * a caller holding the real owner address.
+ */
+export const KIPSELI_BAN_ENTRY_REF = "kipseli-ban-entry";
+/** `[b"ban", owner]` under the Kipseli program — see the module doc's "34 tiny 9-byte accounts" section. */
+export async function deriveKipseliBanEntry(owner) {
+    const encoder = getAddressEncoder();
+    return memoizedGetProgramDerivedAddress(KIPSELI_PROGRAM_ID, [
+        new TextEncoder().encode("ban"),
+        new Uint8Array(encoder.encode(owner)),
+    ]);
+}
+/** Standard ATA PDA: `[owner, tokenProgram, mint]` under the Associated Token program. */
+async function deriveAta(owner, mint, tokenProgram) {
+    const encoder = getAddressEncoder();
+    return memoizedGetProgramDerivedAddress(ASSOCIATED_TOKEN_PROGRAM, [
+        new Uint8Array(encoder.encode(owner)),
+        new Uint8Array(encoder.encode(tokenProgram)),
+        new Uint8Array(encoder.encode(mint)),
+    ]);
+}
+/** Anchor `sha256("account:Pool")[:8]` — shared with pumpswap's/meteora-damm-v1-stable's own "Pool"
+ * structs (gPA is program-scoped, so this never causes a cross-family match — see the module doc). */
+const POOL_DISCRIMINATOR = [0xf1, 0x9a, 0x6d, 0x04, 0x11, 0xb1, 0x6d, 0xbc];
+/**
+ * Servable `Pool` layouts, each ground-truthed field-by-field against a real, same-disc pool of that
+ * exact size (see the module doc's "account graph" section):
+ *   - 496: the original layout (`89dvMturcS87kYgrwyeWqqsaFZUi5dQQpBHs6pvfUu3v`).
+ *   - 840: a later realloc that APPENDS 344 trailing bytes (`7yD7gfXv49SFxhx9uTc11dEd7Nj98rGWeYMdZJgheZbG`
+ *     — ~47.5 SOL / ~26k USDC live at 2026-09-14, the current liquid SOL/USDC pool). Same
+ *     `account:Pool` discriminator, and the first 496 bytes are field-compatible: every field THIS
+ *     adapter reads — `base_token` @72, `quote_token` @104, `price` @136, `expiry` @144, `fee` @152 —
+ *     lives in that shared prefix, so the decode below is byte-for-byte identical for both and the
+ *     appended region is never read.
+ * STRICT per-size (a `Set`, not a `>=` floor): any OTHER Pool-disc size — the drained 162/168/456
+ * generations, or a future realloc — still self-drops via the size throw below, so one out-of-scope
+ * candidate never kills discovery (the standard venue-robustness convention).
+ */
+const POOL_ACCOUNT_SIZES = new Set([496, 840]);
+const OFF_BASE_MINT = 72;
+const OFF_QUOTE_MINT = 104;
+const OFF_EXPIRY_MS = 144;
+/** Standard SPL Mint layout: `decimals` is a single byte at offset 44 (82-byte classic mint). */
+const MINT_DECIMALS_OFFSET = 44;
+const MINT_MIN_SIZE = 45;
+const VAULT_MIN_SIZE = 165;
+const codec = getAddressCodec();
+const pubkeyAt = (data, offset) => codec.decode(data.subarray(offset, offset + 32));
+function kipseliConfig(cfg) {
+    if (cfg.venue !== SLUG)
+        throw new Error(`${SLUG} ladder adapter got a '${cfg.venue}' pool config`);
+    return cfg;
+}
+async function fetchDecimals(load, mint) {
+    const data = await load(mint);
+    if (data === null)
+        throw new Error(`${SLUG} mint ${mint} not found`);
+    if (data.length < MINT_MIN_SIZE) {
+        throw new Error(`${SLUG} mint ${mint} account is ${data.length} bytes, too small for a Mint (want >= ${MINT_MIN_SIZE})`);
+    }
+    return data[MINT_DECIMALS_OFFSET];
+}
+function pow10(n) {
+    let v = 1n;
+    for (let i = 0; i < n; i++)
+        v *= 10n;
+    return v;
+}
+async function fetchPoolConfig(load, pool) {
+    const data = await load(pool);
+    if (data === null)
+        throw new Error(`${SLUG} pool ${pool} not found`);
+    if (!POOL_ACCOUNT_SIZES.has(data.length)) {
+        const accepted = [...POOL_ACCOUNT_SIZES].join("/");
+        throw new Error(`${SLUG} pool ${pool} is ${data.length} bytes, expected one of ${accepted} (out of scope — see module doc)`);
+    }
+    if (!POOL_DISCRIMINATOR.every((b, i) => data[i] === b)) {
+        throw new Error(`${SLUG} pool ${pool} has an unexpected account discriminator`);
+    }
+    const baseMint = pubkeyAt(data, OFF_BASE_MINT);
+    const quoteMint = pubkeyAt(data, OFF_QUOTE_MINT);
+    const expiryMs = readUintLE(data, OFF_EXPIRY_MS, 8);
+    // This venue's on-chain swap_v2 ix is legacy-SPL (Tokenkeg) only, so a
+    // Token-2022 mint (or one carrying an un-routable extension) must SELF-DROP
+    // the pool rather than be silently assumed legacy. The thrown error IS the
+    // graceful-drop signal (the SvmRoute orchestrator catches a fetchPoolConfig
+    // throw and drops the venue). An unreadable mint falls back to the legacy
+    // assumption, keeping the classic 82-byte path byte-identical.
+    const _mints = [baseMint, quoteMint];
+    const _mintDatas = await Promise.all(_mints.map((mint) => load(mint)));
+    for (let _i = 0; _i < _mints.length; _i++) {
+        const mint = _mints[_i];
+        const mintData = _mintDatas[_i];
+        if (mintData === null)
+            continue;
+        if (classifyMintProgram(mint, mintData) === TOKEN_2022_PROGRAM_ID) {
+            throw new Error(`${SLUG}: dropping pool ${pool} — mint ${mint} is Token-2022 (this venue's swap is legacy-SPL only)`);
+        }
+        const { blocking } = parseMintExtensions(mintData);
+        if (blocking.length > 0) {
+            throw new Error(`${SLUG}: dropping pool ${pool} — mint ${mint} is un-routable: ${blocking.join("; ")}`);
+        }
+    }
+    const [baseVault, quoteVault, baseDecimals, quoteDecimals] = await Promise.all([
+        deriveAta(pool, baseMint, TOKEN_PROGRAM),
+        deriveAta(pool, quoteMint, TOKEN_PROGRAM),
+        fetchDecimals(load, baseMint),
+        fetchDecimals(load, quoteMint),
+    ]);
+    const _vaults = [
+        ["base", baseVault, baseMint],
+        ["quote", quoteVault, quoteMint],
+    ];
+    const _vaultDatas = await Promise.all(_vaults.map(([, vault]) => load(vault)));
+    for (let _i = 0; _i < _vaults.length; _i++) {
+        const [role, vault, mint] = _vaults[_i];
+        const vaultData = _vaultDatas[_i];
+        if (vaultData === null)
+            throw new Error(`${SLUG} pool ${pool}: derived ${role} vault ${vault} does not exist`);
+        if (vaultData.length < VAULT_MIN_SIZE) {
+            throw new Error(`${SLUG} pool ${pool}: ${role} vault ${vault} is ${vaultData.length} bytes, not an SPL token account`);
+        }
+        const vaultMint = pubkeyAt(vaultData, 0);
+        if (vaultMint !== mint) {
+            throw new Error(`${SLUG} pool ${pool}: ${role} vault ${vault} holds mint ${vaultMint}, expected ${mint}`);
+        }
+    }
+    const delta = baseDecimals - quoteDecimals;
+    const adjNum = delta > 0 ? pow10(delta) : 1n;
+    const adjDen = delta < 0 ? pow10(-delta) : 1n;
+    return {
+        venue: SLUG,
+        pool,
+        direction: "quoteToBase",
+        baseMint,
+        quoteMint,
+        baseVault,
+        quoteVault,
+        adjNum,
+        adjDen,
+        expiryMs,
+    };
+}
+function quoteAccounts(base) {
+    const cfg = kipseliConfig(base);
+    return [
+        { ref: `${cfg.pool}:baseVault`, address: cfg.baseVault },
+        { ref: `${cfg.pool}:quoteVault`, address: cfg.quoteVault },
+    ];
+}
+export const kipseli = {
+    slug: SLUG,
+    kind: "constant-product",
+    programId: KIPSELI_PROGRAM_ID,
+    fetchPoolConfig,
+    quoteAccounts,
+};
+//# sourceMappingURL=index.js.map

package/sdk/dist/svm/venues/kipseli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/svm/venues/kipseli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoLG;AACH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,MAAM,IAAI,GAAG,SAAS,CAAC;AACvB,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,8CAA8C,CAAC,CAAC;AAC1F,MAAM,aAAa,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AAC7E,MAAM,wBAAwB,GAAG,OAAO,CAAC,8CAA8C,CAAC,CAAC;AAEzF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,OAAO,gCAAgC,CAAC,kBAAkB,EAAE;QAC1D,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,IAAa,EAAE,YAAqB;IAC3E,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,OAAO,gCAAgC,CAAC,wBAAwB,EAAE;QAChE,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;sGACsG;AACtG,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5E;;;;;;;;;;;;;GAaG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,iGAAiG;AACjG,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;AAChC,MAAM,QAAQ,GAAG,CAAC,IAAgB,EAAE,MAAc,EAAW,EAAE,CAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AAkBnD,SAAS,aAAa,CAAC,GAAe;IACpC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,GAAG,CAAC,KAAK,eAAe,CAAC,CAAC;IAC7E,OAAO,GAAwB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,IAAa;IAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,YAAY,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,SAAS,IAAI,eAAe,IAAI,CAAC,MAAM,yCAAyC,aAAa,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,GAAG,CAAC;IACrC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAmB,EAAE,IAAa;IAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,SAAS,IAAI,OAAO,IAAI,CAAC,MAAM,2BAA2B,QAAQ,kCAAkC,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,0CAA0C,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAEpD,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,mBAAmB,IAAI,WAAW,IAAI,uDAAuD,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,mBAAmB,IAAI,WAAW,IAAI,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7E,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC;QACxC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC7B,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG;QACd,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC7B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC;KACxB,CAAC;IACX,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAE,CAAC;QACzC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAE,CAAC;QACnC,IAAI,SAAS,KAAK,IAAI;YACpB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,iBAAiB,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,SAAS,IAAI,KAAK,IAAI,UAAU,KAAK,OAAO,SAAS,CAAC,MAAM,kCAAkC,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,SAAS,IAAI,KAAK,IAAI,UAAU,KAAK,eAAe,SAAS,cAAc,IAAI,EAAE,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,GAAG,aAAa,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,IAAI;QACJ,SAAS,EAAE,aAAa;QACxB,QAAQ;QACR,SAAS;QACT,SAAS;QACT,UAAU;QACV,MAAM;QACN,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO;QACL,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE;QACxD,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,kBAA2B;IACjC,SAAS,EAAE,kBAAkB;IAC7B,eAAe;IACf,aAAa;CACd,CAAC"}

package/sdk/dist/svm/venues/lemmingsfi/index.d.ts

@@ -0,0 +1,46 @@
+import type { Address } from "@solana/kit";
+import type { AccountLoader, PoolConfig, VenueAccount } from "../types.js";
+declare const SLUG = "lemmingsfi";
+export declare const LEMMINGSFI_PROGRAM_ID: Address<"BQEJZUB4CzoT6UhRffoCkqCyqQNrCPCSGHcPEmsdbEsX">;
+/**
+ * The program's only 76-byte owned account, anywhere — a global singleton
+ * both real pools' real swaps pass as account[1]. See file header.
+ */
+export declare const LEMMINGSFI_CONFIG: Address<"6DZQsK3i1YtvyQCsWxZpY1Ski8dmSjqYnjCUPQiMqT1Z">;
+export declare const OFF_MINT_A = 8;
+export declare const OFF_MINT_B = 40;
+export declare const OFF_VAULT_A = 72;
+export declare const OFF_VAULT_B = 104;
+export declare const OFF_PRICE_TICK = 168;
+export declare const OFF_LAST_UPDATE_TS = 184;
+/**
+ * Self-drop threshold — see the file header's STALENESS section. Deliberately
+ * far stricter than the keeper's own historical ~6s cadence; the real
+ * on-chain threshold is not independently recovered.
+ */
+export declare const STALE_AFTER_SECONDS = 60n;
+export interface LemmingsFiPoolConfig extends PoolConfig {
+    venue: typeof SLUG;
+    /** 0 = mintB in / mintA out, 1 = mintA in / mintB out. */
+    direction: 0 | 1;
+    mintA: Address;
+    mintB: Address;
+    vaultA: Address;
+    vaultB: Address;
+    /** Reduced `1000 * 10^decA / 10^decB` — see file header "PRICING MODEL". */
+    kNum: bigint;
+    kDen: bigint;
+    /** Live at fetch time — the recipe-side `gate` re-checks it against `now`. */
+    lastUpdateTs: bigint;
+}
+export declare function fetchLemmingsFiPoolConfig(load: AccountLoader, pool: Address): Promise<LemmingsFiPoolConfig>;
+declare function quoteAccounts(base: PoolConfig): VenueAccount[];
+export declare const lemmingsfi: {
+    slug: string;
+    kind: "constant-product";
+    programId: Address<"BQEJZUB4CzoT6UhRffoCkqCyqQNrCPCSGHcPEmsdbEsX">;
+    fetchPoolConfig: typeof fetchLemmingsFiPoolConfig;
+    quoteAccounts: typeof quoteAccounts;
+};
+export {};
+//# sourceMappingURL=index.d.ts.map

package/sdk/dist/svm/venues/lemmingsfi/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/svm/venues/lemmingsfi/index.ts"],"names":[],"mappings":"AAoJA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3E,QAAA,MAAM,IAAI,eAAe,CAAC;AAC1B,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,8CAA8C,CACjC,CAAC;AAC1D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,8CAA8C,CAErF,CAAC;AAGF,eAAO,MAAM,UAAU,IAAI,CAAC;AAC5B,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,KAAK,CAAC;AAC9B,eAAO,MAAM,WAAW,MAAM,CAAC;AAC/B,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAOtC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AA2BvC,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,KAAK,EAAE,OAAO,IAAI,CAAC;IACnB,0DAA0D;IAC1D,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,oBAAoB,CAAC,CAgD/B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,CAMvD;AAED,eAAO,MAAM,UAAU;;;;;;CAMtB,CAAC"}