@elmntl/jlpd-sdk 0.13.5 → 0.13.7

package/dist/jlpd-strategy/fluid-view.d.ts

@@ -60,6 +60,14 @@ export interface FluidTick {
  * program — byte-identical to the on-chain `derive_fluid_tick_pda` (golden-vector tested).
  */
 export declare function deriveFluidTickPda(vaultId: number, tick: number): PublicKey;
+/**
+ * Net RAW debt of a decoded position: tick-implied minus dust — the `net_debt_raw` the deployed
+ * partial-repay acceptance predicate is evaluated against (hedge_repay.rs). Supply-only positions
+ * read at the COLD tick and therefore return 0. Dust exceeding the tick-implied debt means the
+ * decoded (tick, collateral, dust) triple is inconsistent — a STRUCTURAL error the caller must
+ * treat as terminal, never as "no debt".
+ */
+export declare function fluidNetDebtRaw(position: FluidPosition): bigint;
 /**
  * The Tick account settle_yield's per-slot triple must carry for `position`: the canonical
  * `Tick(vaultId, position.tick)` for an ACTIVE debt position, or the `Tick(vaultId, MIN_TICK)`

package/dist/jlpd-strategy/fluid-view.js

@@ -20,6 +20,7 @@ exports.FLUID_ZERO_TICK_SCALED_RATIO = exports.JUP_LEND_EARN_MAX_SANE_RATE = exp
 exports.getRatioAtTick = getRatioAtTick;
 exports.decodeFluidPosition = decodeFluidPosition;
 exports.deriveFluidTickPda = deriveFluidTickPda;
+exports.fluidNetDebtRaw = fluidNetDebtRaw;
 exports.settleTickPdaForPosition = settleTickPdaForPosition;
 exports.decodeFluidTick = decodeFluidTick;
 exports.requireFluidPositionLiquidationCurrent = requireFluidPositionLiquidationCurrent;
@@ -296,6 +297,21 @@ function deriveFluidTickPda(vaultId, tick) {
     normalizedLe.writeInt32LE(tick - FLUID_MIN_TICK);
     return web3_js_1.PublicKey.findProgramAddressSync([TICK_SEED, vaultIdLe, normalizedLe], constants_1.JUP_LEND_BORROW_PROGRAM_ID)[0];
 }
+/**
+ * Net RAW debt of a decoded position: tick-implied minus dust — the `net_debt_raw` the deployed
+ * partial-repay acceptance predicate is evaluated against (hedge_repay.rs). Supply-only positions
+ * read at the COLD tick and therefore return 0. Dust exceeding the tick-implied debt means the
+ * decoded (tick, collateral, dust) triple is inconsistent — a STRUCTURAL error the caller must
+ * treat as terminal, never as "no debt".
+ */
+function fluidNetDebtRaw(position) {
+    const tick = position.isSupplyOnly ? FLUID_COLD_TICK : position.tick;
+    const tickDebt = tickImpliedDebtRaw(tick, position.collateralRaw);
+    if (position.dustDebtRaw > tickDebt) {
+        throw new Error(`fluidNetDebtRaw: dust ${position.dustDebtRaw} exceeds tick-implied debt ${tickDebt} — inconsistent position`);
+    }
+    return tickDebt - position.dustDebtRaw;
+}
 /**
  * The Tick account settle_yield's per-slot triple must carry for `position`: the canonical
  * `Tick(vaultId, position.tick)` for an ACTIVE debt position, or the `Tick(vaultId, MIN_TICK)`

package/dist/jlpd-strategy/hedge-derived.d.ts

@@ -5,12 +5,12 @@
  * `hedge-state.ts` that answers the same questions the on-chain guards answer:
  *   - per-slot LTV, valued on that slot's OWN pinned Fluid oracle (matches `hedge_borrow`'s /
  *     `hedge_withdraw_collateral`'s post-op guard basis exactly — see `fluid-view.ts`)
- *   - pledged collateral summed across every ENABLED slot vs `HedgeState.maxPledgedCollateralJlp`
- *   - swap-churn budget remaining (`maxSwapNotionalPerSettle - swapNotionalSinceSettle`)
+ *   - each slot's pledged collateral vs its `HedgeState.maxPledgedBps` share of total controlled JLP
  */
 import { PublicKey } from "@solana/web3.js";
 import type { SolanaConnection } from "../common/connection";
 import { type HedgeState, type HedgePositionSlot } from "./hedge-state";
+import { type FluidPosition } from "./fluid-view";
 /**
  * Native decimals for each known hedge debt mint — mirrors `utils/oracle.rs`'s
  * `TOKEN_DECIMALS_{BTC,ETH,SOL,JUPUSD}` constants (the four mints
@@ -27,13 +27,13 @@ export declare function resolveDebtManifestAta(state: HedgeState, debtMint: Publ
 /** Sum already-decoded per-slot collateral (pure, never throws — for read-only dashboards). */
 export declare function sumPledgedCollateral(perSlotCollateralJlp: bigint[]): bigint;
 /**
- * Sum already-decoded per-slot collateral and enforce the total against
- * `HedgeState.maxPledgedCollateralJlp` — mirrors `sum_and_check_pledged_collateral` exactly
- * (checked addition; throws rather than wrapping past the cap). For DRIVER preflight (reject
- * before submitting a tx that would revert on-chain); dashboards should use
- * `sumPledgedCollateral` instead so an (unexpected) over-cap reading still renders.
+ * Mirror of `check_pledged_bps`: for each slot i, `collateral_i * 10000 <= maxPledgedBps[i] *
+ * (vaultJlpFree + Σ pledged)`. `perSlotCollateralJlp` is indexed BY SLOT (0 for a disabled/absent
+ * slot). Returns total pledged; throws on the first slot over its bps share. For DRIVER preflight
+ * (reject before a tx that would revert); dashboards should use `sumPledgedCollateral` instead so an
+ * (unexpected) over-cap reading still renders.
  */
-export declare function sumAndCheckPledgedCollateral(perSlotCollateralJlp: bigint[], maxPledgedCollateralJlp: bigint): bigint;
+export declare function checkPledgedBps(perSlotCollateralJlp: bigint[], maxPledgedBps: number[], vaultJlpFree: bigint): bigint;
 /**
  * `hedge_repay` repay-all sentinel (u64::MAX) — the only mode that guarantees `debt == 0`.
  * Fund the debt ATA to the on-chain budget (ceiled reading + 0.1% + 2 units) and crank the
@@ -63,6 +63,43 @@ export declare function fluidPartialRepayCreditRaw(xNative: bigint, debtDecimals
  * minimum position debt). `netRawDebt` = tick-implied − dust (fluid-view's `netDebtRaw` basis).
  */
 export declare function isPartialRepayAcceptable(xNative: bigint, netRawDebt: bigint, debtDecimals: number, borrowExPrice: bigint): boolean;
+export interface FluidPartialRepayVerdict {
+    accepted: boolean;
+    /** Human reason when refused; null when accepted. */
+    reason: string | null;
+    creditRaw: bigint | null;
+    netRaw: bigint;
+    minDebtRaw: bigint;
+}
+/**
+ * The DEPLOYED acceptance predicate for a partial repay of `x`, evaluated from a decoded
+ * position, extended with the driver's balance precondition (Fluid pulls `x + 1` on payback):
+ *
+ *   x ≥ MIN_OPERATE  ∧  C(x) ≥ 1  ∧  netRaw ≥ C(x) + minDebtRaw  ∧  debtAtaBalance ≥ x + 1
+ *
+ * An EXACT payoff must use the repay-all sentinel — the residual bound enforces that. Throws only
+ * on an INCONSISTENT position (dust > tick-implied), which is structural and terminal.
+ */
+export declare function evaluateFluidPartialRepay(args: {
+    xNative: bigint;
+    position: FluidPosition;
+    borrowExPrice: bigint;
+    debtDecimals: number;
+    debtAtaBalance: bigint;
+}): FluidPartialRepayVerdict;
+/**
+ * Largest acceptable partial repay ≤ `desiredNative` given the position AND the debt-ATA balance
+ * (Fluid's `x + 1` over-pull). Built on `maxPartialRepayNative`'s invert-and-verify, then
+ * re-verified through the full predicate so the ATA bound participates. Null = no acceptable
+ * partial exists — the caller escalates to repay-all (if fundable) or reports top-up-required.
+ */
+export declare function maxAcceptedFluidPartialRepay(args: {
+    desiredNative: bigint;
+    position: FluidPosition;
+    borrowExPrice: bigint;
+    debtDecimals: number;
+    debtAtaBalance: bigint;
+}): bigint | null;
 /**
  * Largest partial repay (native) the on-chain acceptance admits for `netRawDebt` at the given
  * stored price — the driver's sizing cap (anything larger reverts; anything at/below is safe at
@@ -70,18 +107,6 @@ export declare function isPartialRepayAcceptable(xNative: bigint, netRawDebt: bi
  * use the repay-all sentinel instead).
  */
 export declare function maxPartialRepayNative(netRawDebt: bigint, debtDecimals: number, borrowExPrice: bigint): bigint;
-/**
- * Swap-churn budget remaining before the next `settle_yield` resets the accumulator — mirrors
- * `HedgeState.maxSwapNotionalPerSettle - HedgeState.swapNotionalSinceSettle` (USD, 6-dec),
- * floored at 0 (the accumulator should never on-chain exceed the cap, but this stays
- * fail-safe against a stale/racing read).
- */
-export declare function churnBudgetRemainingUsd(state: Pick<HedgeState, "maxSwapNotionalPerSettle" | "swapNotionalSinceSettle">): bigint;
-/**
- * `HedgeState.maxPledgedCollateralJlp` as a bigint — headroom convenience: pass the result of
- * `sumAndCheckPledgedCollateral`'s successful total (or a raw sum) to get remaining pledge room.
- */
-export declare function pledgeHeadroomJlp(state: Pick<HedgeState, "maxPledgedCollateralJlp">, totalPledgedJlp: bigint): bigint;
 /** One enabled `HedgeState.positions` slot's derived valuation. */
 export interface HedgeSlotDerived {
     slotIndex: number;
@@ -109,27 +134,33 @@ export declare function fetchHedgeSlotDerived(connection: SolanaConnection, stat
  */
 export declare function fetchAllHedgeSlotsDerived(connection: SolanaConnection, state: HedgeState): Promise<HedgeSlotDerived[]>;
 /**
- * Portfolio-level hedge exposure: total pledged JLP collateral across every enabled slot (vs
- * `HedgeState.maxPledgedCollateralJlp`), and per-debt-mint net debt exposure (native units,
- * keyed by the debt mint's base58 — different debt mints are never summed together, since
+ * Portfolio-level hedge exposure: total pledged JLP collateral, each slot's pledged SHARE of total
+ * controlled JLP (bps, vs `HedgeState.maxPledgedBps`), and per-debt-mint net debt exposure (native
+ * units, keyed by the debt mint's base58 — different debt mints are never summed together, since
  * they are different tokens).
  */
 export interface HedgeExposure {
     /** Σ `collateralJlpNative` across every enabled slot. */
     totalPledgedCollateralJlp: bigint;
-    /** `HedgeState.maxPledgedCollateralJlp - totalPledgedCollateralJlp`, floored at 0. */
-    pledgeHeadroomJlp: bigint;
+    /** Per-slot (indexed by slot) pledged share of total controlled JLP (free vault JLP + Σ pledged), bps. */
+    pledgedShareBps: number[];
     /**
-     * `totalPledgedCollateralJlp > HedgeState.maxPledgedCollateralJlp` — should never be true given
-     * the on-chain guard (`hedge_supply_collateral` re-scans + rejects this every supply), but
-     * surfaced rather than thrown so a stale/racing read still renders on a dashboard.
+     * True if any slot's share exceeds its `HedgeState.maxPledgedBps[i]` — should never be true given
+     * the on-chain admission guard (`hedge_supply_collateral` rejects it every supply), but surfaced
+     * rather than thrown so a stale/racing read still renders on a dashboard.
      */
     pledgeCapExceeded: boolean;
     /** Per-debt-mint (base58) → summed native debt across every slot borrowing that mint. */
     debtByMint: Record<string, bigint>;
-    /** Swap-churn budget remaining (USD, 6-dec). */
-    churnBudgetRemainingUsd: bigint;
     slots: HedgeSlotDerived[];
 }
-/** Compute portfolio-level hedge exposure from a fully-fetched `HedgeState`. */
-export declare function fetchHedgeExposure(connection: SolanaConnection, state: HedgeState): Promise<HedgeExposure>;
+/**
+ * Compute portfolio-level hedge exposure. `vaultJlpFree` is the config-owned vault JLP ATA balance
+ * (base units) — the free-JLP term of the pledge-cap denominator; fetch it alongside the state.
+ *
+ * NOTE: this reads each position's stored collateral WITHOUT applying the Fluid
+ * liquidation-staleness gate (`requireFluidPositionLiquidationCurrent`), so during a
+ * liquidation-stale window a slot's collateral (and thus `pledgedShareBps` / `pledgeCapExceeded`)
+ * can be phantom. Best-effort for dashboards; the on-chain guards are authoritative.
+ */
+export declare function fetchHedgeExposure(connection: SolanaConnection, state: HedgeState, vaultJlpFree: bigint): Promise<HedgeExposure>;

package/dist/jlpd-strategy/hedge-derived.js

@@ -6,22 +6,21 @@
  * `hedge-state.ts` that answers the same questions the on-chain guards answer:
  *   - per-slot LTV, valued on that slot's OWN pinned Fluid oracle (matches `hedge_borrow`'s /
  *     `hedge_withdraw_collateral`'s post-op guard basis exactly — see `fluid-view.ts`)
- *   - pledged collateral summed across every ENABLED slot vs `HedgeState.maxPledgedCollateralJlp`
- *   - swap-churn budget remaining (`maxSwapNotionalPerSettle - swapNotionalSinceSettle`)
+ *   - each slot's pledged collateral vs its `HedgeState.maxPledgedBps` share of total controlled JLP
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FLUID_MIN_OPERATE_NATIVE = exports.REPAY_ALL_SENTINEL = void 0;
 exports.debtMintDecimals = debtMintDecimals;
 exports.resolveDebtManifestAta = resolveDebtManifestAta;
 exports.sumPledgedCollateral = sumPledgedCollateral;
-exports.sumAndCheckPledgedCollateral = sumAndCheckPledgedCollateral;
+exports.checkPledgedBps = checkPledgedBps;
 exports.clampRepayAmount = clampRepayAmount;
 exports.fluidMinDebtRaw = fluidMinDebtRaw;
 exports.fluidPartialRepayCreditRaw = fluidPartialRepayCreditRaw;
 exports.isPartialRepayAcceptable = isPartialRepayAcceptable;
+exports.evaluateFluidPartialRepay = evaluateFluidPartialRepay;
+exports.maxAcceptedFluidPartialRepay = maxAcceptedFluidPartialRepay;
 exports.maxPartialRepayNative = maxPartialRepayNative;
-exports.churnBudgetRemainingUsd = churnBudgetRemainingUsd;
-exports.pledgeHeadroomJlp = pledgeHeadroomJlp;
 exports.fetchHedgeSlotDerived = fetchHedgeSlotDerived;
 exports.fetchAllHedgeSlotsDerived = fetchAllHedgeSlotsDerived;
 exports.fetchHedgeExposure = fetchHedgeExposure;
@@ -73,18 +72,33 @@ function sumPledgedCollateral(perSlotCollateralJlp) {
     return total;
 }
 /**
- * Sum already-decoded per-slot collateral and enforce the total against
- * `HedgeState.maxPledgedCollateralJlp` — mirrors `sum_and_check_pledged_collateral` exactly
- * (checked addition; throws rather than wrapping past the cap). For DRIVER preflight (reject
- * before submitting a tx that would revert on-chain); dashboards should use
- * `sumPledgedCollateral` instead so an (unexpected) over-cap reading still renders.
+ * Mirror of `check_pledged_bps`: for each slot i, `collateral_i * 10000 <= maxPledgedBps[i] *
+ * (vaultJlpFree + Σ pledged)`. `perSlotCollateralJlp` is indexed BY SLOT (0 for a disabled/absent
+ * slot). Returns total pledged; throws on the first slot over its bps share. For DRIVER preflight
+ * (reject before a tx that would revert); dashboards should use `sumPledgedCollateral` instead so an
+ * (unexpected) over-cap reading still renders.
  */
-function sumAndCheckPledgedCollateral(perSlotCollateralJlp, maxPledgedCollateralJlp) {
-    const total = sumPledgedCollateral(perSlotCollateralJlp);
-    if (total > maxPledgedCollateralJlp) {
-        throw new Error(`sumAndCheckPledgedCollateral: total pledged ${total} exceeds cap ${maxPledgedCollateralJlp}`);
+function checkPledgedBps(perSlotCollateralJlp, maxPledgedBps, vaultJlpFree) {
+    // Mirror the program's fixed [_; MAX_HEDGE_POSITIONS] arrays: validate EVERY slot's bps, so a
+    // short array can't skip an out-of-range later entry the way the on-chain check never would.
+    if (perSlotCollateralJlp.length !== constants_1.MAX_HEDGE_POSITIONS ||
+        maxPledgedBps.length !== constants_1.MAX_HEDGE_POSITIONS) {
+        throw new Error(`checkPledgedBps: expected ${constants_1.MAX_HEDGE_POSITIONS} slot entries, got ` +
+            `collateral=${perSlotCollateralJlp.length} bps=${maxPledgedBps.length}`);
     }
-    return total;
+    const totalPledged = sumPledgedCollateral(perSlotCollateralJlp);
+    const totalControlled = vaultJlpFree + totalPledged;
+    for (let i = 0; i < perSlotCollateralJlp.length; i++) {
+        const bps = maxPledgedBps[i] ?? 0;
+        if (!Number.isInteger(bps) || bps < 0 || bps > 10000) {
+            throw new Error(`checkPledgedBps: maxPledgedBps[${i}] out of range: ${bps}`);
+        }
+        if (perSlotCollateralJlp[i] * 10000n > BigInt(bps) * totalControlled) {
+            throw new Error(`checkPledgedBps: slot ${i} pledged ${perSlotCollateralJlp[i]} exceeds ${bps}bps of ` +
+                `controlled JLP ${totalControlled}`);
+        }
+    }
+    return totalPledged;
 }
 /**
  * `hedge_repay` repay-all sentinel (u64::MAX) — the only mode that guarantees `debt == 0`.
@@ -145,6 +159,70 @@ function isPartialRepayAcceptable(xNative, netRawDebt, debtDecimals, borrowExPri
     }
     return credit >= 1n && credit + fluidMinDebtRaw(debtDecimals) <= netRawDebt;
 }
+/**
+ * The DEPLOYED acceptance predicate for a partial repay of `x`, evaluated from a decoded
+ * position, extended with the driver's balance precondition (Fluid pulls `x + 1` on payback):
+ *
+ *   x ≥ MIN_OPERATE  ∧  C(x) ≥ 1  ∧  netRaw ≥ C(x) + minDebtRaw  ∧  debtAtaBalance ≥ x + 1
+ *
+ * An EXACT payoff must use the repay-all sentinel — the residual bound enforces that. Throws only
+ * on an INCONSISTENT position (dust > tick-implied), which is structural and terminal.
+ */
+function evaluateFluidPartialRepay(args) {
+    const netRaw = (0, fluid_view_1.fluidNetDebtRaw)(args.position);
+    const minDebtRaw = fluidMinDebtRaw(args.debtDecimals);
+    const base = { netRaw, minDebtRaw };
+    if (args.xNative < exports.FLUID_MIN_OPERATE_NATIVE) {
+        return { accepted: false, reason: `x ${args.xNative} < Fluid minimum ${exports.FLUID_MIN_OPERATE_NATIVE}`, creditRaw: null, ...base };
+    }
+    if (args.debtAtaBalance < args.xNative + 1n) {
+        return {
+            accepted: false,
+            reason: `debt ATA ${args.debtAtaBalance} < x+1 (${args.xNative + 1n}) — Fluid over-pulls one native unit`,
+            creditRaw: null,
+            ...base,
+        };
+    }
+    let creditRaw;
+    try {
+        creditRaw = fluidPartialRepayCreditRaw(args.xNative, args.debtDecimals, args.borrowExPrice);
+    }
+    catch (e) {
+        return { accepted: false, reason: e instanceof Error ? e.message : String(e), creditRaw: null, ...base };
+    }
+    if (creditRaw < 1n || netRaw < creditRaw + minDebtRaw) {
+        return {
+            accepted: false,
+            reason: `residual bound: net ${netRaw} < credit ${creditRaw} + min ${minDebtRaw}`,
+            creditRaw,
+            ...base,
+        };
+    }
+    return { accepted: true, reason: null, creditRaw, ...base };
+}
+/**
+ * Largest acceptable partial repay ≤ `desiredNative` given the position AND the debt-ATA balance
+ * (Fluid's `x + 1` over-pull). Built on `maxPartialRepayNative`'s invert-and-verify, then
+ * re-verified through the full predicate so the ATA bound participates. Null = no acceptable
+ * partial exists — the caller escalates to repay-all (if fundable) or reports top-up-required.
+ */
+function maxAcceptedFluidPartialRepay(args) {
+    const netRaw = (0, fluid_view_1.fluidNetDebtRaw)(args.position);
+    let x = maxPartialRepayNative(netRaw, args.debtDecimals, args.borrowExPrice);
+    if (x <= 0n)
+        return null;
+    if (x > args.desiredNative)
+        x = args.desiredNative;
+    if (args.debtAtaBalance < 2n)
+        return null;
+    if (x > args.debtAtaBalance - 1n)
+        x = args.debtAtaBalance - 1n;
+    for (let i = 0; i < 4 && x >= exports.FLUID_MIN_OPERATE_NATIVE; i++, x -= 1n) {
+        if (evaluateFluidPartialRepay({ ...args, xNative: x }).accepted)
+            return x;
+    }
+    return null;
+}
 /**
  * Largest partial repay (native) the on-chain acceptance admits for `netRawDebt` at the given
  * stored price — the driver's sizing cap (anything larger reverts; anything at/below is safe at
@@ -164,27 +242,6 @@ function maxPartialRepayNative(netRawDebt, debtDecimals, borrowExPrice) {
     }
     return x >= exports.FLUID_MIN_OPERATE_NATIVE ? x : 0n;
 }
-/**
- * Swap-churn budget remaining before the next `settle_yield` resets the accumulator — mirrors
- * `HedgeState.maxSwapNotionalPerSettle - HedgeState.swapNotionalSinceSettle` (USD, 6-dec),
- * floored at 0 (the accumulator should never on-chain exceed the cap, but this stays
- * fail-safe against a stale/racing read).
- */
-function churnBudgetRemainingUsd(state) {
-    const max = BigInt(state.maxSwapNotionalPerSettle.toString());
-    const since = BigInt(state.swapNotionalSinceSettle.toString());
-    const remaining = max - since;
-    return remaining > 0n ? remaining : 0n;
-}
-/**
- * `HedgeState.maxPledgedCollateralJlp` as a bigint — headroom convenience: pass the result of
- * `sumAndCheckPledgedCollateral`'s successful total (or a raw sum) to get remaining pledge room.
- */
-function pledgeHeadroomJlp(state, totalPledgedJlp) {
-    const cap = BigInt(state.maxPledgedCollateralJlp.toString());
-    const headroom = cap - totalPledgedJlp;
-    return headroom > 0n ? headroom : 0n;
-}
 /**
  * Fetch + value ONE `HedgeState.positions[slotIndex]` slot — the async convenience wrapper
  * matching `hedge_borrow`'s / `hedge_withdraw_collateral`'s post-op LTV guard basis exactly
@@ -210,22 +267,29 @@ async function fetchAllHedgeSlotsDerived(connection, state) {
     const results = await Promise.all(state.positions.map((slot, slotIndex) => (0, hedge_state_1.isHedgePositionSlotDisabled)(slot) ? Promise.resolve(null) : fetchHedgeSlotDerived(connection, state, slotIndex)));
     return results.filter((r) => r !== null);
 }
-/** Compute portfolio-level hedge exposure from a fully-fetched `HedgeState`. */
-async function fetchHedgeExposure(connection, state) {
+/**
+ * Compute portfolio-level hedge exposure. `vaultJlpFree` is the config-owned vault JLP ATA balance
+ * (base units) — the free-JLP term of the pledge-cap denominator; fetch it alongside the state.
+ *
+ * NOTE: this reads each position's stored collateral WITHOUT applying the Fluid
+ * liquidation-staleness gate (`requireFluidPositionLiquidationCurrent`), so during a
+ * liquidation-stale window a slot's collateral (and thus `pledgedShareBps` / `pledgeCapExceeded`)
+ * can be phantom. Best-effort for dashboards; the on-chain guards are authoritative.
+ */
+async function fetchHedgeExposure(connection, state, vaultJlpFree) {
     const slots = await fetchAllHedgeSlotsDerived(connection, state);
-    const totalPledgedCollateralJlp = sumPledgedCollateral(slots.map((s) => s.collateralJlpNative));
-    const cap = BigInt(state.maxPledgedCollateralJlp.toString());
+    // Per-slot collateral indexed BY SLOT (0 for disabled) so it aligns with maxPledgedBps.
+    const perSlot = state.positions.map(() => 0n);
+    for (const s of slots)
+        perSlot[s.slotIndex] = s.collateralJlpNative;
+    const totalPledgedCollateralJlp = sumPledgedCollateral(perSlot);
+    const totalControlled = vaultJlpFree + totalPledgedCollateralJlp;
+    const pledgedShareBps = perSlot.map((c) => totalControlled > 0n ? Number((c * 10000n) / totalControlled) : 0);
+    const pledgeCapExceeded = perSlot.some((c, i) => c * 10000n > BigInt(state.maxPledgedBps[i] ?? 0) * totalControlled);
     const debtByMint = {};
     for (const s of slots) {
         const key = s.slot.debtMint.toBase58();
         debtByMint[key] = (debtByMint[key] ?? 0n) + s.debtNative;
     }
-    return {
-        totalPledgedCollateralJlp,
-        pledgeHeadroomJlp: cap - totalPledgedCollateralJlp > 0n ? cap - totalPledgedCollateralJlp : 0n,
-        pledgeCapExceeded: totalPledgedCollateralJlp > cap,
-        debtByMint,
-        churnBudgetRemainingUsd: churnBudgetRemainingUsd(state),
-        slots,
-    };
+    return { totalPledgedCollateralJlp, pledgedShareBps, pledgeCapExceeded, debtByMint, slots };
 }

package/dist/jlpd-strategy/hedge-instructions.d.ts

@@ -184,10 +184,11 @@ export interface InitOrUpdateHedgeStateArgs {
     jlWbtcLending?: PublicKey | null;
     /** wETH Earn `lending` rate-source account. `null`/omitted = unchanged. */
     jlWethLending?: PublicKey | null;
-    /** JLP-native pledge cap (base units, 6 decimals). `null`/omitted = unchanged (init: 0). */
-    maxPledgedCollateralJlp?: bigint | BN | null;
-    /** Per-settle swap-churn budget (USD, 6-dec). `null`/omitted = unchanged (init: 0). */
-    maxSwapNotionalPerSettle?: bigint | BN | null;
+    /**
+     * Per-slot pledged-collateral cap, bps of total controlled JLP, one entry per positions slot
+     * (each 0..=10000, Σ 0..=10000). `null`/omitted = unchanged (init: [0,0,0,0] = fail-closed).
+     */
+    maxPledgedBps?: number[] | null;
     /** Pair-native per-position LTV cap, bps (0..=`MAX_HEDGE_LTV_BPS`). `null`/omitted = unchanged (init: 0). */
     maxLtvBps?: number | null;
     /** Hedge master switch. `null`/omitted = unchanged (init: false). */

package/dist/jlpd-strategy/hedge-instructions.js

@@ -1,7 +1,4 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HedgeManifestRole = void 0;
 exports.createHedgeSupplyCollateralIx = createHedgeSupplyCollateralIx;
@@ -12,7 +9,6 @@ exports.createHedgeSwapIx = createHedgeSwapIx;
 exports.createInitOrUpdateHedgeStateIx = createInitOrUpdateHedgeStateIx;
 const web3_js_1 = require("@solana/web3.js");
 const spl_token_1 = require("@solana/spl-token");
-const bn_js_1 = __importDefault(require("bn.js"));
 const buffer_1 = require("../common/buffer");
 const constants_1 = require("./constants");
 function toBigIntAmount(v) {
@@ -92,7 +88,7 @@ function createHedgeWithdrawCollateralIx(args, programId = constants_1.PROGRAM_I
 //   0.  manager             [signer]
 //   1.  config               []          JLPD Config PDA (read-only — this ix never writes it)
 //   2.  manager_role          []          ManagerRole PDA
-//   3.  hedge_state          [writable]  writes swap_notional_since_settle
+//   3.  hedge_state          []          HedgeState PDA (read-only — this ix never writes it)
 //   4.  src_ata              [writable]  == manifest_role_ata(hedge_state, params.src_role)
 //   5.  dst_ata              [writable]  == manifest_role_ata(hedge_state, params.dst_role)
 //   6.  price_oracle_src      []          Doves oracle for src_role, if Doves-priced; else unused
@@ -160,7 +156,7 @@ function createHedgeSwapIx(args, programId = constants_1.PROGRAM_ID) {
         { pubkey: manager, isSigner: true, isWritable: false },
         { pubkey: config, isSigner: false, isWritable: false },
         { pubkey: managerRole, isSigner: false, isWritable: false },
-        { pubkey: hedgeState, isSigner: false, isWritable: true },
+        { pubkey: hedgeState, isSigner: false, isWritable: false },
         { pubkey: srcAta, isSigner: false, isWritable: true },
         { pubkey: dstAta, isSigner: false, isWritable: true },
         { pubkey: priceOracleSrc, isSigner: false, isWritable: false },
@@ -206,8 +202,7 @@ function createHedgeSwapIx(args, programId = constants_1.PROGRAM_ID) {
 //   jl_jupusd / jl_wbtc / jl_weth:                  Option<Pubkey>  (3) — Earn fToken ATAs
 //   jl_jupusd_mint / jl_wbtc_mint / jl_weth_mint:   Option<Pubkey>  (3) — admin-set fToken mints
 //   jl_jupusd_lending / jl_wbtc_lending / jl_weth_lending: Option<Pubkey> (3) — Earn rate sources
-//   max_pledged_collateral_jlp:   Option<u64>
-//   max_swap_notional_per_settle: Option<u64>
+//   max_pledged_bps:              Option<[u16; MAX_HEDGE_POSITIONS(4)]>
 //   max_ltv_bps:                  Option<u16>
 //   enabled:                      Option<bool>
 // ---------------------------------------------------------------------------
@@ -240,6 +235,33 @@ function writeOptionalBool(parts, value) {
         parts.push(0x00);
     }
 }
+/** Serialize `Option<[u16; n]>` — 1-byte tag, then n u16 LE if `Some` (a fixed-size Rust array, no
+ *  length prefix). Mirrors the program's `validate_max_pledged_bps`: throws if the array is the
+ *  wrong length, an entry exceeds 10000 (100%), or the entries sum above 10000 — so a bad governance
+ *  proposal fails locally instead of on-chain. */
+function writeOptionalU16Array(parts, value, n) {
+    if (value == null) {
+        parts.push(0x00);
+        return;
+    }
+    if (value.length !== n) {
+        throw new RangeError(`maxPledgedBps must have exactly ${n} entries, got ${value.length}`);
+    }
+    let sum = 0;
+    for (const v of value) {
+        if (!Number.isInteger(v) || v < 0 || v > 10000) {
+            throw new RangeError(`maxPledgedBps entry must be an integer in 0..=10000, got: ${v}`);
+        }
+        sum += v;
+    }
+    if (sum > 10000) {
+        throw new RangeError(`maxPledgedBps entries sum to ${sum}, exceeds 10000 (100%)`);
+    }
+    parts.push(0x01);
+    for (const v of value) {
+        parts.push(v & 0xff, (v >> 8) & 0xff);
+    }
+}
 /**
  * Build the on-chain `init_or_update_hedge_state` instruction (provisions/updates the singleton
  * `HedgeState` PDA). See this section's module doc comment above for the full account list and
@@ -278,9 +300,9 @@ function createInitOrUpdateHedgeStateIx(args, programId = constants_1.PROGRAM_ID
     (0, buffer_1.writeOptionalPubkey)(parts, args.jlJupusdLending ?? null);
     (0, buffer_1.writeOptionalPubkey)(parts, args.jlWbtcLending ?? null);
     (0, buffer_1.writeOptionalPubkey)(parts, args.jlWethLending ?? null);
-    // Guards.
-    (0, buffer_1.writeOptionalU64)(parts, args.maxPledgedCollateralJlp != null ? new bn_js_1.default(toBigIntAmount(args.maxPledgedCollateralJlp).toString()) : null);
-    (0, buffer_1.writeOptionalU64)(parts, args.maxSwapNotionalPerSettle != null ? new bn_js_1.default(toBigIntAmount(args.maxSwapNotionalPerSettle).toString()) : null);
+    // Guards. max_pledged_bps: Option<[u16; MAX_HEDGE_POSITIONS]> (1-byte tag + 4*u16 LE if Some),
+    // then max_ltv_bps: Option<u16>, then enabled: Option<bool>.
+    writeOptionalU16Array(parts, args.maxPledgedBps ?? null, constants_1.MAX_HEDGE_POSITIONS);
     (0, buffer_1.writeOptionalU16)(parts, args.maxLtvBps ?? null);
     writeOptionalBool(parts, args.enabled ?? null);
     const data = Buffer.from(parts);

package/dist/jlpd-strategy/hedge-state.d.ts

@@ -1,5 +1,4 @@
 import { PublicKey } from "@solana/web3.js";
-import BN from "bn.js";
 import type { SolanaConnection } from "../common/connection";
 /**
  * One Fluid borrow position: the position NFT, that vault's pinned
@@ -55,12 +54,12 @@ export interface HedgeState {
     jlWbtcLending: PublicKey;
     /** Canonical `lending` account for the wETH pool (disabled until `jlWethMint` is set). */
     jlWethLending: PublicKey;
-    /** Max JLP (base units) that may be pledged as Fluid collateral, summed across every enabled slot. */
-    maxPledgedCollateralJlp: BN;
-    /** Swap-churn budget: max input notional (USD, 6-dec) `hedge_swap` may spend between settles. */
-    maxSwapNotionalPerSettle: BN;
-    /** Swap-churn accumulator: input notional spent since the last settle. Reset only by `settle_yield`. */
-    swapNotionalSinceSettle: BN;
+    /**
+     * Per-slot pledged-collateral cap, bps of total controlled JLP (one entry per positions slot,
+     * each 0..=10000). Lives in the reserved tail at bytes [1120..1128]. Replaces the removed absolute
+     * pledge cap + the swap-churn cap/accumulator (bytes [1088..1112] are now reserved, unread).
+     */
+    maxPledgedBps: number[];
     /** Liquidation-probability cap in basis points, valued on each position's own pinned Fluid oracle. */
     maxLtvBps: number;
     /** Hedge switch bitfield; bit 0 (`HEDGE_FLAG_ENABLED`) is the master switch. */

package/dist/jlpd-strategy/hedge-state.js

@@ -84,9 +84,14 @@ function deserializeHedgeState(data) {
         jlJupusdLending: (0, buffer_1.readPubkey)(data, afterPositions + 352),
         jlWbtcLending: (0, buffer_1.readPubkey)(data, afterPositions + 384),
         jlWethLending: (0, buffer_1.readPubkey)(data, afterPositions + 416),
-        maxPledgedCollateralJlp: (0, buffer_1.readU64)(data, afterPositions + 448),
-        maxSwapNotionalPerSettle: (0, buffer_1.readU64)(data, afterPositions + 456),
-        swapNotionalSinceSettle: (0, buffer_1.readU64)(data, afterPositions + 464),
+        // bytes [1088..1112] (afterPositions + 448..472) are reserved (removed guards), unread.
+        // max_pledged_bps: [u16; 4] in the reserved tail at byte 1120 (afterPositions + 480).
+        maxPledgedBps: [
+            (0, buffer_1.readU16)(data, afterPositions + 480),
+            (0, buffer_1.readU16)(data, afterPositions + 482),
+            (0, buffer_1.readU16)(data, afterPositions + 484),
+            (0, buffer_1.readU16)(data, afterPositions + 486),
+        ],
         maxLtvBps: (0, buffer_1.readU16)(data, afterPositions + 472),
         flags: (0, buffer_1.readU16)(data, afterPositions + 474),
         version: (0, buffer_1.readU8)(data, afterPositions + 476),

package/dist/jlpd-strategy/settle-yield.d.ts

@@ -8,10 +8,10 @@ export interface CreateSettleYieldIxArgs {
     tokenProgram?: PublicKey;
     programId?: PublicKey;
     /**
-     * Hedge block accounts (position/vault_state pairs per enabled hedge slot,
-     * plus the manifest + earn block), appended after the 15 fixed accounts and
-     * BEFORE `custodyAccounts`. Defaults to `[]` -- for now callers pass nothing
-     * while the hedge is disabled.
+     * Hedge block accounts (position/vault_state/tick triples per enabled hedge
+     * slot, plus the manifest + earn block), appended after the 15 fixed accounts
+     * and BEFORE `custodyAccounts`. Defaults to `[]` -- for now callers pass
+     * nothing while the hedge is disabled.
      */
     hedgeAccounts?: AccountMeta[];
     /**

package/dist/jlpd-strategy/settle-yield.js

@@ -17,7 +17,7 @@ const ata_1 = require("../common/ata");
  * Accounts (15 total):
  *   0: config (JlpdConfig PDA)
  *   1: manager_role (ManagerRole PDA)
- *   2: hedge_state (HedgeState PDA, mut -- resets swap-churn accumulator)
+ *   2: hedge_state (HedgeState PDA, read-only)
  *   3: vault_jlp_ata (JLP ATA owned by config)
  *   4: stv_0 (BTC strategy_state, mut)
  *   5: stv_1 (ETH strategy_state, mut)
@@ -31,7 +31,7 @@ const ata_1 = require("../common/ata");
  *  13: jlp_mint_account
  *  14: manager (signer)
  *  15+: remaining_accounts, in this EXACT order:
- *       [0 .. 2*enabled_hedge_slots) -- (position, vault_state) pairs per
+ *       [0 .. 3*enabled_hedge_slots) -- (position, vault_state, tick) triples per
  *         ENABLED hedge slot, then the manifest + earn block (one account per
  *         non-default hedge manifest slot). Empty while the hedge is disabled.
  *       [.. remainder) -- the JLP pool custody accounts, in pool `custodies`
@@ -46,7 +46,7 @@ function buildRawSettleYieldIx(args, programId = constants_1.PROGRAM_ID) {
     const keys = [
         { pubkey: config, isSigner: false, isWritable: true },
         { pubkey: managerRole, isSigner: false, isWritable: false },
-        { pubkey: hedgeState, isSigner: false, isWritable: true },
+        { pubkey: hedgeState, isSigner: false, isWritable: false },
         { pubkey: vaultJlpAta, isSigner: false, isWritable: false },
         { pubkey: stv0, isSigner: false, isWritable: true },
         { pubkey: stv1, isSigner: false, isWritable: true },

package/dist/p-stv-core/accounts.d.ts

@@ -99,11 +99,17 @@ export declare function warmAdminEffective(stv: Stv): PublicKey;
  *   [ 92.. 96]  claimAvailableAfter      u32   (unix seconds)
  *   [ 96.. 97]  bump                     u8
  *   [ 97.. 98]  version                  u8
- *   [ 98.. 99]  requestFlags             u8   (bit0 WR_FLAG_MIGRATE: 0=withdraw, 1=migrate)
+ *   [ 98.. 99]  requestFlags             u8   (mask 0x0F: bit0 WR_FLAG_MIGRATE,
+ *                                              bit1 WR_FLAG_FROZEN, bit2
+ *                                              WR_FLAG_RECIPIENT_USER_OK, bit3
+ *                                              WR_FLAG_RECIPIENT_COLD_OK)
  *   [ 99..104]  _padding                 [u8; 5]
  *   [104..112]  destVaultId              u64  (migrate: dest STV vault_id; withdraw: 0)
  *   [112..120]  minDestShares            u64  (migrate: slippage floor; withdraw: 0)
- *   [120..168]  _reserved0               [u8; 48]
+ *   [120..152]  claimRecipient           Pubkey (withdrawal-freeze co-signed
+ *                                              redirect target; [0;32] = pay
+ *                                              `user`, today's default)
+ *   [152..168]  _reserved                [u8; 16]
  */
 export declare function deserializeWithdrawRequest(data: Buffer): WithdrawRequest;
 /**
@@ -111,6 +117,16 @@ export declare function deserializeWithdrawRequest(data: Buffer): WithdrawReques
  * Returns `"migrate"` when WR_FLAG_MIGRATE (0x01) is set, else `"withdraw"`.
  */
 export declare function withdrawRequestKind(wr: WithdrawRequest): "withdraw" | "migrate";
+/** True if `WR_FLAG_FROZEN` is set on `requestFlags`. Mirrors `WithdrawRequest::is_frozen`. */
+export declare function isWithdrawRequestFrozen(wr: WithdrawRequest): boolean;
+/**
+ * A redirect is ARMED iff `claimRecipient` is nonzero AND both the user's and
+ * cold's approval bits are set on the same stored value. Mirrors the on-chain
+ * `WithdrawRequest::is_redirect_armed()` (state/withdraw_request.rs) exactly —
+ * when armed, `execute_claim` pays the canonical `ATA(claimRecipient, baseMint)`
+ * instead of `user`.
+ */
+export declare function isRedirectArmed(wr: WithdrawRequest): boolean;
 /**
  * DelayedDepositRequest — per-(STV, user, epoch) pending deposit. Total 152 bytes.
  *

package/dist/p-stv-core/accounts.js

@@ -5,6 +5,8 @@ exports.deserializeStv = deserializeStv;
 exports.warmAdminEffective = warmAdminEffective;
 exports.deserializeWithdrawRequest = deserializeWithdrawRequest;
 exports.withdrawRequestKind = withdrawRequestKind;
+exports.isWithdrawRequestFrozen = isWithdrawRequestFrozen;
+exports.isRedirectArmed = isRedirectArmed;
 exports.deserializeDelayedDepositRequest = deserializeDelayedDepositRequest;
 exports.deserializeManagerRole = deserializeManagerRole;
 exports.fetchGlobalConfig = fetchGlobalConfig;
@@ -209,11 +211,17 @@ function warmAdminEffective(stv) {
  *   [ 92.. 96]  claimAvailableAfter      u32   (unix seconds)
  *   [ 96.. 97]  bump                     u8
  *   [ 97.. 98]  version                  u8
- *   [ 98.. 99]  requestFlags             u8   (bit0 WR_FLAG_MIGRATE: 0=withdraw, 1=migrate)
+ *   [ 98.. 99]  requestFlags             u8   (mask 0x0F: bit0 WR_FLAG_MIGRATE,
+ *                                              bit1 WR_FLAG_FROZEN, bit2
+ *                                              WR_FLAG_RECIPIENT_USER_OK, bit3
+ *                                              WR_FLAG_RECIPIENT_COLD_OK)
  *   [ 99..104]  _padding                 [u8; 5]
  *   [104..112]  destVaultId              u64  (migrate: dest STV vault_id; withdraw: 0)
  *   [112..120]  minDestShares            u64  (migrate: slippage floor; withdraw: 0)
- *   [120..168]  _reserved0               [u8; 48]
+ *   [120..152]  claimRecipient           Pubkey (withdrawal-freeze co-signed
+ *                                              redirect target; [0;32] = pay
+ *                                              `user`, today's default)
+ *   [152..168]  _reserved                [u8; 16]
  */
 function deserializeWithdrawRequest(data) {
     if (data.length < constants_1.WITHDRAW_REQUEST_SIZE) {
@@ -236,6 +244,7 @@ function deserializeWithdrawRequest(data) {
         requestFlags: (0, buffer_1.readU8)(data, 98),
         destVaultId: (0, buffer_1.readU64)(data, 104),
         minDestShares: (0, buffer_1.readU64)(data, 112),
+        claimRecipient: (0, buffer_1.readPubkey)(data, 120),
     };
 }
 /**
@@ -245,6 +254,22 @@ function deserializeWithdrawRequest(data) {
 function withdrawRequestKind(wr) {
     return (wr.requestFlags & 0x01) !== 0 ? "migrate" : "withdraw";
 }
+/** True if `WR_FLAG_FROZEN` is set on `requestFlags`. Mirrors `WithdrawRequest::is_frozen`. */
+function isWithdrawRequestFrozen(wr) {
+    return (wr.requestFlags & constants_1.WR_FLAG_FROZEN) !== 0;
+}
+/**
+ * A redirect is ARMED iff `claimRecipient` is nonzero AND both the user's and
+ * cold's approval bits are set on the same stored value. Mirrors the on-chain
+ * `WithdrawRequest::is_redirect_armed()` (state/withdraw_request.rs) exactly —
+ * when armed, `execute_claim` pays the canonical `ATA(claimRecipient, baseMint)`
+ * instead of `user`.
+ */
+function isRedirectArmed(wr) {
+    return (!wr.claimRecipient.equals(web3_js_1.PublicKey.default) &&
+        (wr.requestFlags & constants_1.WR_FLAG_RECIPIENT_USER_OK) !== 0 &&
+        (wr.requestFlags & constants_1.WR_FLAG_RECIPIENT_COLD_OK) !== 0);
+}
 /**
  * DelayedDepositRequest — per-(STV, user, epoch) pending deposit. Total 152 bytes.
  *

package/dist/p-stv-core/constants.d.ts

@@ -42,6 +42,25 @@ export declare const IX_ACCEPT_VAULT_ADMIN = 20;
  * silently freezing a vault. See docs/spec-warm-admin-guardrails.md §4.3.
  */
 export declare const IX_TRIP_CIRCUIT_BREAKER = 21;
+/**
+ * freeze_withdraw_request (disc 0x16 = 22) — incident-response freeze on a
+ * single WithdrawRequest. OR-auth: the WR's own `user` (self-freeze) OR a
+ * valid manager for the STV. FIXED 4-account ABI (see
+ * `createFreezeWithdrawRequestIx`) — pause-exempt.
+ */
+export declare const IX_FREEZE_WITHDRAW_REQUEST = 22;
+/**
+ * unfreeze_withdraw_request (disc 0x17 = 23) — clears `WR_FLAG_FROZEN`.
+ * `stv.coldAdmin` may always; `stv.warmAdminEffective()` may only when the
+ * redirect is ARMED. Pause-exempt.
+ */
+export declare const IX_UNFREEZE_WITHDRAW_REQUEST = 23;
+/**
+ * set_claim_recipient (disc 0x18 = 24) — the 2-of-2 COLD-LOCK redirect.
+ * Signer is the WR's `user` OR `stv.coldAdmin` (never warm). WR must be
+ * frozen. Pause-exempt.
+ */
+export declare const IX_SET_CLAIM_RECIPIENT = 24;
 export declare const EVT_CONFIG_INITIALIZED = 0;
 export declare const EVT_CONFIG_UPDATED = 1;
 export declare const EVT_STV_CREATED = 2;
@@ -91,6 +110,31 @@ export declare const EVT_CIRCUIT_BREAKER_TRIPPED = 27;
 export declare const TRIP_AUTHORITY_KIND_COLD = 0;
 export declare const TRIP_AUTHORITY_KIND_WARM = 1;
 export declare const TRIP_AUTHORITY_KIND_MANAGER = 2;
+/**
+ * WithdrawRequestFrozen — emitted by freeze_withdraw_request (disc 22).
+ * Fields: wr(32), stv(32), user(32), epochId(4), authority(32), authorityKind(1).
+ */
+export declare const EVT_WITHDRAW_REQUEST_FROZEN = 28;
+/**
+ * WithdrawRequestUnfrozen — emitted by unfreeze_withdraw_request (disc 23).
+ * Fields: wr(32), stv(32), user(32), epochId(4), authority(32).
+ */
+export declare const EVT_WITHDRAW_REQUEST_UNFROZEN = 29;
+/**
+ * ClaimRecipientSet — emitted by set_claim_recipient (disc 24).
+ * Fields: wr(32), stv(32), user(32), epochId(4), recipient(32), approverKind(1), armed(1).
+ */
+export declare const EVT_CLAIM_RECIPIENT_SET = 30;
+/**
+ * freeze_withdraw_request / WithdrawRequestFrozenEvent authorityKind values.
+ */
+export declare const FREEZE_AUTHORITY_KIND_USER = 0;
+export declare const FREEZE_AUTHORITY_KIND_MANAGER = 1;
+/**
+ * set_claim_recipient / ClaimRecipientSetEvent approverKind values.
+ */
+export declare const RECIPIENT_APPROVER_KIND_USER = 0;
+export declare const RECIPIENT_APPROVER_KIND_COLD = 1;
 export declare const FLAG_PAUSED = 1;
 export declare const FLAG_DEPOSITS_DISABLED = 2;
 export declare const FLAG_WITHDRAWALS_DISABLED = 4;
@@ -131,6 +175,17 @@ export declare const FEE_CAP_BPS = 9900;
 export declare const MAX_FEE_BPS = 1000;
 /** WithdrawRequest.request_flags bit 0: 0 = withdraw, 1 = migrate. */
 export declare const WR_FLAG_MIGRATE = 1;
+/**
+ * WithdrawRequest.request_flags bit 1: the WR is frozen (incident response).
+ * Blocks payout in execute_claim unless a redirect is ARMED (exit-only).
+ */
+export declare const WR_FLAG_FROZEN = 2;
+/** WithdrawRequest.request_flags bit 2: the WR's `user` approved `claimRecipient`. */
+export declare const WR_FLAG_RECIPIENT_USER_OK = 4;
+/** WithdrawRequest.request_flags bit 3: `stv.coldAdmin` approved `claimRecipient`. */
+export declare const WR_FLAG_RECIPIENT_COLD_OK = 8;
+/** All bits outside this mask are reserved and must be zero. */
+export declare const WR_VALID_FLAGS_MASK = 15;
 export declare const GLOBAL_CONFIG_SIZE = 56;
 export declare const STV_SIZE = 664;
 export declare const WITHDRAW_REQUEST_SIZE = 168;

package/dist/p-stv-core/constants.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EVT_MANAGER_REMOVED = exports.EVT_MANAGER_ADDED = exports.EVT_STV_CLOSED = exports.EVT_FEES_SETTLED = exports.EVT_EPOCH_ADVANCED = exports.EVT_EPOCH_PROCESSED = exports.EVT_WITHDRAWN_FROM_STRATEGY = exports.EVT_DEPOSITED_TO_STRATEGY = exports.EVT_WITHDRAW_CLAIMED = exports.EVT_WITHDRAW_REQUEST_INCREASED = exports.EVT_WITHDRAW_REQUESTED = exports.EVT_DEPOSITED = exports.EVT_STV_UPDATED = exports.EVT_STV_CREATED = exports.EVT_CONFIG_UPDATED = exports.EVT_CONFIG_INITIALIZED = exports.IX_TRIP_CIRCUIT_BREAKER = exports.IX_ACCEPT_VAULT_ADMIN = exports.IX_SEED_STV = exports.IX_INSTANT_WITHDRAW = exports.IX_MIGRATE_CANCEL = exports.IX_PROCESS_DELAYED_DEPOSIT = exports.IX_MIGRATE_EXECUTE = exports.IX_MIGRATE_REQUEST = exports.IX_MIGRATE_LEND = exports.IX_OVERRIDE_CLAIM_WITHDRAW = exports.IX_REMOVE_MANAGER = exports.IX_ADD_MANAGER = exports.IX_CLOSE_STV = exports.IX_WITHDRAW_FROM_STRATEGY = exports.IX_DEPOSIT_TO_STRATEGY = exports.IX_PROCESS_EPOCH = exports.IX_CLAIM_WITHDRAW = exports.IX_REQUEST_WITHDRAW = exports.IX_DEPOSIT = exports.IX_INIT_OR_UPDATE_STV = exports.IX_INIT_OR_UPDATE_CONFIG = exports.DISC_MANAGER_ROLE = exports.DISC_DELAYED_DEPOSIT_REQUEST = exports.DISC_WITHDRAW_REQUEST = exports.DISC_STV = exports.DISC_GLOBAL_CONFIG = exports.MANAGER_SEED = exports.DELAYED_DEPOSIT_SEED = exports.MIGRATE_REQUEST_SEED = exports.WITHDRAW_REQUEST_SEED = exports.EV_MINT_SEED = exports.STV_SEED = exports.CONFIG_SEED = exports.PROGRAM_ID = void 0;
-exports.MANAGER_ROLE_SIZE = exports.DELAYED_DEPOSIT_REQUEST_SIZE = exports.WITHDRAW_REQUEST_SIZE = exports.STV_SIZE = exports.GLOBAL_CONFIG_SIZE = exports.WR_FLAG_MIGRATE = exports.MAX_FEE_BPS = exports.FEE_CAP_BPS = exports.MAX_STRATEGIES = exports.MAX_CHILD_VAULTS = exports.STALENESS_THRESHOLD = exports.BPS_DENOMINATOR = exports.PPS_DECIMALS = exports.CFG_FLAG_GLOBAL_PAUSED = exports.FLAG_SEEDED = exports.FLAG_BYPASS_MIGRATE_DST_WAITOUT = exports.FLAG_BYPASS_MIGRATE_SRC_WAITOUT = exports.FLAG_DELAYED_DEPOSIT = exports.FLAG_DEPOSIT_FEE_ON_MIGRATE = exports.FLAG_WITHDRAWAL_FEE_ON_MIGRATE = exports.FLAG_BYPASS_WITHDRAW_LIMIT = exports.FLAG_ALLOCATOR = exports.FLAG_REBALANCE_DISABLED = exports.FLAG_WITHDRAWALS_DISABLED = exports.FLAG_DEPOSITS_DISABLED = exports.FLAG_PAUSED = exports.TRIP_AUTHORITY_KIND_MANAGER = exports.TRIP_AUTHORITY_KIND_WARM = exports.TRIP_AUTHORITY_KIND_COLD = exports.EVT_CIRCUIT_BREAKER_TRIPPED = exports.EVT_WARM_ADMIN_SET = exports.EVT_ADMIN_ROTATION_ACCEPTED = exports.EVT_ADMIN_ROTATION_STARTED = exports.EVT_STV_SEEDED = exports.EVT_INSTANT_WITHDRAWN = exports.EVT_DELAYED_DEPOSIT_PROCESSED = exports.EVT_MIGRATE_EXECUTED = exports.EVT_MIGRATE_REQUESTED = exports.EVT_LEND_MIGRATED = exports.EVT_WITHDRAW_OVERRIDE_CLAIMED = void 0;
+exports.EVT_FEES_SETTLED = exports.EVT_EPOCH_ADVANCED = exports.EVT_EPOCH_PROCESSED = exports.EVT_WITHDRAWN_FROM_STRATEGY = exports.EVT_DEPOSITED_TO_STRATEGY = exports.EVT_WITHDRAW_CLAIMED = exports.EVT_WITHDRAW_REQUEST_INCREASED = exports.EVT_WITHDRAW_REQUESTED = exports.EVT_DEPOSITED = exports.EVT_STV_UPDATED = exports.EVT_STV_CREATED = exports.EVT_CONFIG_UPDATED = exports.EVT_CONFIG_INITIALIZED = exports.IX_SET_CLAIM_RECIPIENT = exports.IX_UNFREEZE_WITHDRAW_REQUEST = exports.IX_FREEZE_WITHDRAW_REQUEST = exports.IX_TRIP_CIRCUIT_BREAKER = exports.IX_ACCEPT_VAULT_ADMIN = exports.IX_SEED_STV = exports.IX_INSTANT_WITHDRAW = exports.IX_MIGRATE_CANCEL = exports.IX_PROCESS_DELAYED_DEPOSIT = exports.IX_MIGRATE_EXECUTE = exports.IX_MIGRATE_REQUEST = exports.IX_MIGRATE_LEND = exports.IX_OVERRIDE_CLAIM_WITHDRAW = exports.IX_REMOVE_MANAGER = exports.IX_ADD_MANAGER = exports.IX_CLOSE_STV = exports.IX_WITHDRAW_FROM_STRATEGY = exports.IX_DEPOSIT_TO_STRATEGY = exports.IX_PROCESS_EPOCH = exports.IX_CLAIM_WITHDRAW = exports.IX_REQUEST_WITHDRAW = exports.IX_DEPOSIT = exports.IX_INIT_OR_UPDATE_STV = exports.IX_INIT_OR_UPDATE_CONFIG = exports.DISC_MANAGER_ROLE = exports.DISC_DELAYED_DEPOSIT_REQUEST = exports.DISC_WITHDRAW_REQUEST = exports.DISC_STV = exports.DISC_GLOBAL_CONFIG = exports.MANAGER_SEED = exports.DELAYED_DEPOSIT_SEED = exports.MIGRATE_REQUEST_SEED = exports.WITHDRAW_REQUEST_SEED = exports.EV_MINT_SEED = exports.STV_SEED = exports.CONFIG_SEED = exports.PROGRAM_ID = void 0;
+exports.GLOBAL_CONFIG_SIZE = exports.WR_VALID_FLAGS_MASK = exports.WR_FLAG_RECIPIENT_COLD_OK = exports.WR_FLAG_RECIPIENT_USER_OK = exports.WR_FLAG_FROZEN = exports.WR_FLAG_MIGRATE = exports.MAX_FEE_BPS = exports.FEE_CAP_BPS = exports.MAX_STRATEGIES = exports.MAX_CHILD_VAULTS = exports.STALENESS_THRESHOLD = exports.BPS_DENOMINATOR = exports.PPS_DECIMALS = exports.CFG_FLAG_GLOBAL_PAUSED = exports.FLAG_SEEDED = exports.FLAG_BYPASS_MIGRATE_DST_WAITOUT = exports.FLAG_BYPASS_MIGRATE_SRC_WAITOUT = exports.FLAG_DELAYED_DEPOSIT = exports.FLAG_DEPOSIT_FEE_ON_MIGRATE = exports.FLAG_WITHDRAWAL_FEE_ON_MIGRATE = exports.FLAG_BYPASS_WITHDRAW_LIMIT = exports.FLAG_ALLOCATOR = exports.FLAG_REBALANCE_DISABLED = exports.FLAG_WITHDRAWALS_DISABLED = exports.FLAG_DEPOSITS_DISABLED = exports.FLAG_PAUSED = exports.RECIPIENT_APPROVER_KIND_COLD = exports.RECIPIENT_APPROVER_KIND_USER = exports.FREEZE_AUTHORITY_KIND_MANAGER = exports.FREEZE_AUTHORITY_KIND_USER = exports.EVT_CLAIM_RECIPIENT_SET = exports.EVT_WITHDRAW_REQUEST_UNFROZEN = exports.EVT_WITHDRAW_REQUEST_FROZEN = exports.TRIP_AUTHORITY_KIND_MANAGER = exports.TRIP_AUTHORITY_KIND_WARM = exports.TRIP_AUTHORITY_KIND_COLD = exports.EVT_CIRCUIT_BREAKER_TRIPPED = exports.EVT_WARM_ADMIN_SET = exports.EVT_ADMIN_ROTATION_ACCEPTED = exports.EVT_ADMIN_ROTATION_STARTED = exports.EVT_STV_SEEDED = exports.EVT_INSTANT_WITHDRAWN = exports.EVT_DELAYED_DEPOSIT_PROCESSED = exports.EVT_MIGRATE_EXECUTED = exports.EVT_MIGRATE_REQUESTED = exports.EVT_LEND_MIGRATED = exports.EVT_WITHDRAW_OVERRIDE_CLAIMED = exports.EVT_MANAGER_REMOVED = exports.EVT_MANAGER_ADDED = exports.EVT_STV_CLOSED = void 0;
+exports.MANAGER_ROLE_SIZE = exports.DELAYED_DEPOSIT_REQUEST_SIZE = exports.WITHDRAW_REQUEST_SIZE = exports.STV_SIZE = void 0;
 const web3_js_1 = require("@solana/web3.js");
 // ---------------------------------------------------------------------------
 // Program ID
@@ -68,6 +69,25 @@ exports.IX_ACCEPT_VAULT_ADMIN = 20;
  * silently freezing a vault. See docs/spec-warm-admin-guardrails.md §4.3.
  */
 exports.IX_TRIP_CIRCUIT_BREAKER = 21;
+/**
+ * freeze_withdraw_request (disc 0x16 = 22) — incident-response freeze on a
+ * single WithdrawRequest. OR-auth: the WR's own `user` (self-freeze) OR a
+ * valid manager for the STV. FIXED 4-account ABI (see
+ * `createFreezeWithdrawRequestIx`) — pause-exempt.
+ */
+exports.IX_FREEZE_WITHDRAW_REQUEST = 22;
+/**
+ * unfreeze_withdraw_request (disc 0x17 = 23) — clears `WR_FLAG_FROZEN`.
+ * `stv.coldAdmin` may always; `stv.warmAdminEffective()` may only when the
+ * redirect is ARMED. Pause-exempt.
+ */
+exports.IX_UNFREEZE_WITHDRAW_REQUEST = 23;
+/**
+ * set_claim_recipient (disc 0x18 = 24) — the 2-of-2 COLD-LOCK redirect.
+ * Signer is the WR's `user` OR `stv.coldAdmin` (never warm). WR must be
+ * frozen. Pause-exempt.
+ */
+exports.IX_SET_CLAIM_RECIPIENT = 24;
 // ---------------------------------------------------------------------------
 // Event Discriminators (1-byte)
 // ---------------------------------------------------------------------------
@@ -120,6 +140,31 @@ exports.EVT_CIRCUIT_BREAKER_TRIPPED = 27;
 exports.TRIP_AUTHORITY_KIND_COLD = 0;
 exports.TRIP_AUTHORITY_KIND_WARM = 1;
 exports.TRIP_AUTHORITY_KIND_MANAGER = 2;
+/**
+ * WithdrawRequestFrozen — emitted by freeze_withdraw_request (disc 22).
+ * Fields: wr(32), stv(32), user(32), epochId(4), authority(32), authorityKind(1).
+ */
+exports.EVT_WITHDRAW_REQUEST_FROZEN = 28;
+/**
+ * WithdrawRequestUnfrozen — emitted by unfreeze_withdraw_request (disc 23).
+ * Fields: wr(32), stv(32), user(32), epochId(4), authority(32).
+ */
+exports.EVT_WITHDRAW_REQUEST_UNFROZEN = 29;
+/**
+ * ClaimRecipientSet — emitted by set_claim_recipient (disc 24).
+ * Fields: wr(32), stv(32), user(32), epochId(4), recipient(32), approverKind(1), armed(1).
+ */
+exports.EVT_CLAIM_RECIPIENT_SET = 30;
+/**
+ * freeze_withdraw_request / WithdrawRequestFrozenEvent authorityKind values.
+ */
+exports.FREEZE_AUTHORITY_KIND_USER = 0;
+exports.FREEZE_AUTHORITY_KIND_MANAGER = 1;
+/**
+ * set_claim_recipient / ClaimRecipientSetEvent approverKind values.
+ */
+exports.RECIPIENT_APPROVER_KIND_USER = 0;
+exports.RECIPIENT_APPROVER_KIND_COLD = 1;
 // ---------------------------------------------------------------------------
 // Vault Flags
 // ---------------------------------------------------------------------------
@@ -171,6 +216,17 @@ exports.FEE_CAP_BPS = 9900;
 exports.MAX_FEE_BPS = 1000;
 /** WithdrawRequest.request_flags bit 0: 0 = withdraw, 1 = migrate. */
 exports.WR_FLAG_MIGRATE = 0x01;
+/**
+ * WithdrawRequest.request_flags bit 1: the WR is frozen (incident response).
+ * Blocks payout in execute_claim unless a redirect is ARMED (exit-only).
+ */
+exports.WR_FLAG_FROZEN = 0x02;
+/** WithdrawRequest.request_flags bit 2: the WR's `user` approved `claimRecipient`. */
+exports.WR_FLAG_RECIPIENT_USER_OK = 0x04;
+/** WithdrawRequest.request_flags bit 3: `stv.coldAdmin` approved `claimRecipient`. */
+exports.WR_FLAG_RECIPIENT_COLD_OK = 0x08;
+/** All bits outside this mask are reserved and must be zero. */
+exports.WR_VALID_FLAGS_MASK = 0x0f;
 // ---------------------------------------------------------------------------
 // Account Sizes
 // ---------------------------------------------------------------------------

package/dist/p-stv-core/events.js

@@ -59,12 +59,14 @@ function parseEventsFromLogs(logs, programId = constants_1.PROGRAM_ID) {
  *                               [41..49] amount | [49..57] sharesMinted | [57..65] depositFeeShares |
  *                               [65..73] pps
  *   WithdrawRequested           [0..1] disc | [1..9]  vaultId    | [9..41]  user         |
- *                               [41..49] shares | [49..53] epochId
+ *                               [41..49] shares | [49..53] epochId | [53..85] wr
  *   WithdrawRequestIncreased    [0..1] disc | [1..9]  vaultId    | [9..41]  user         |
  *                               [41..49] additionalShares | [49..57] totalShares |
- *                               [57..61] epochId
+ *                               [57..61] epochId | [61..93] wr
  *   WithdrawClaimed             [0..1] disc | [1..9]  vaultId    | [9..41]  user         |
- *                               [41..49] shares | [49..57] baseAmount | [57..61] epochId
+ *                               [41..49] shares | [49..57] baseAmount | [57..65] withdrawalFeeBase |
+ *                               [65..69] epochId | [69..101] wr | [101..133] recipient |
+ *                               [133..165] destination
  *   DepositedToStrategy         [0..1] disc | [1..9]  vaultId    | [9..41]  strategy     |
  *                               [41..49] amount | [49..57] sharesReceived
  *   WithdrawnFromStrategy       [0..1] disc | [1..9]  vaultId    | [9..41]  strategy     |
@@ -117,21 +119,28 @@ function parseEventBuffer(data) {
                 depositFeeShares: (0, buffer_1.readU64)(data, 57), pps: (0, buffer_1.readU64)(data, 65),
             } : null;
         case constants_1.EVT_WITHDRAW_REQUESTED:
-            return data.length >= 53 ? {
+            // Rust: vault_id(8), user(32), shares(8), epoch_id(4), wr(32) — wr appended (withdrawal-freeze feature).
+            return data.length >= 85 ? {
                 name: "WithdrawRequested", vaultId: (0, buffer_1.readU64)(data, 1), user: (0, buffer_1.readPubkey)(data, 9),
-                shares: (0, buffer_1.readU64)(data, 41), epochId: (0, buffer_1.readU32)(data, 49),
+                shares: (0, buffer_1.readU64)(data, 41), epochId: (0, buffer_1.readU32)(data, 49), wr: (0, buffer_1.readPubkey)(data, 53),
             } : null;
         case constants_1.EVT_WITHDRAW_REQUEST_INCREASED:
-            return data.length >= 61 ? {
+            // Rust: vault_id(8), user(32), additional_shares(8), total_shares(8), epoch_id(4), wr(32) — wr appended.
+            return data.length >= 93 ? {
                 name: "WithdrawRequestIncreased", vaultId: (0, buffer_1.readU64)(data, 1), user: (0, buffer_1.readPubkey)(data, 9),
                 additionalShares: (0, buffer_1.readU64)(data, 41), totalShares: (0, buffer_1.readU64)(data, 49), epochId: (0, buffer_1.readU32)(data, 57),
+                wr: (0, buffer_1.readPubkey)(data, 61),
             } : null;
         case constants_1.EVT_WITHDRAW_CLAIMED:
-            // Rust: vault_id(8), user(32), shares(8), net_base(8), withdrawal_fee_base(8), epoch_id(4)
-            return data.length >= 69 ? {
+            // Rust: vault_id(8), user(32), shares(8), net_base(8), withdrawal_fee_base(8), epoch_id(4),
+            //       wr(32), recipient(32), destination(32) — wr/recipient/destination appended
+            //       (withdrawal-freeze feature). recipient/destination equal user/vaultAta
+            //       unless the redirect was armed at claim time.
+            return data.length >= 165 ? {
                 name: "WithdrawClaimed", vaultId: (0, buffer_1.readU64)(data, 1), user: (0, buffer_1.readPubkey)(data, 9),
                 shares: (0, buffer_1.readU64)(data, 41), baseAmount: (0, buffer_1.readU64)(data, 49),
                 withdrawalFeeBase: (0, buffer_1.readU64)(data, 57), epochId: (0, buffer_1.readU32)(data, 65),
+                wr: (0, buffer_1.readPubkey)(data, 69), recipient: (0, buffer_1.readPubkey)(data, 101), destination: (0, buffer_1.readPubkey)(data, 133),
             } : null;
         case constants_1.EVT_DEPOSITED_TO_STRATEGY:
             return data.length >= 57 ? {
@@ -172,12 +181,15 @@ function parseEventBuffer(data) {
             } : null;
         case constants_1.EVT_WITHDRAW_OVERRIDE_CLAIMED:
             // Rust: vault_id(8), manager(32), user(32), shares(8), net_base(8),
-            //       withdrawal_fee_base(8), epoch_id(4), daily_withdrawn(8), daily_limit(8)
-            return data.length >= 117 ? {
+            //       withdrawal_fee_base(8), epoch_id(4), daily_withdrawn(8), daily_limit(8),
+            //       wr(32), recipient(32), destination(32) — wr/recipient/destination
+            //       appended (withdrawal-freeze feature).
+            return data.length >= 213 ? {
                 name: "WithdrawOverrideClaimed", vaultId: (0, buffer_1.readU64)(data, 1), manager: (0, buffer_1.readPubkey)(data, 9),
                 user: (0, buffer_1.readPubkey)(data, 41), shares: (0, buffer_1.readU64)(data, 73), baseAmount: (0, buffer_1.readU64)(data, 81),
                 withdrawalFeeBase: (0, buffer_1.readU64)(data, 89), epochId: (0, buffer_1.readU32)(data, 97),
                 dailyWithdrawnBase: (0, buffer_1.readU64)(data, 101), dailyLimit: (0, buffer_1.readU64)(data, 109),
+                wr: (0, buffer_1.readPubkey)(data, 117), recipient: (0, buffer_1.readPubkey)(data, 149), destination: (0, buffer_1.readPubkey)(data, 181),
             } : null;
         case constants_1.EVT_LEND_MIGRATED:
             return data.length >= 89 ? {
@@ -185,19 +197,21 @@ function parseEventBuffer(data) {
                 newLendProgram: (0, buffer_1.readPubkey)(data, 41), sharesWithdrawn: (0, buffer_1.readU64)(data, 73), baseMigrated: (0, buffer_1.readU64)(data, 81),
             } : null;
         case constants_1.EVT_MIGRATE_REQUESTED:
-            // Rust: src_vault_id(8), dest_vault_id(8), user(32), shares(8), epoch_id(4)
-            return data.length >= 61 ? {
+            // Rust: src_vault_id(8), dest_vault_id(8), user(32), shares(8), epoch_id(4), wr(32) — wr appended.
+            return data.length >= 93 ? {
                 name: "MigrateRequested", srcVaultId: (0, buffer_1.readU64)(data, 1), destVaultId: (0, buffer_1.readU64)(data, 9),
                 user: (0, buffer_1.readPubkey)(data, 17), shares: (0, buffer_1.readU64)(data, 49), epochId: (0, buffer_1.readU32)(data, 57),
+                wr: (0, buffer_1.readPubkey)(data, 61),
             } : null;
         case constants_1.EVT_MIGRATE_EXECUTED:
             // Rust: src_vault_id(8), dst_vault_id(8), user(32), shares_burned(8), base_moved(8),
-            //       withdrawal_fee_base(8), deposit_fee_base(8), user_dest_shares(8), epoch_id(4)
-            return data.length >= 93 ? {
+            //       withdrawal_fee_base(8), deposit_fee_base(8), user_dest_shares(8), epoch_id(4),
+            //       wr(32) — wr appended.
+            return data.length >= 125 ? {
                 name: "MigrateExecuted", srcVaultId: (0, buffer_1.readU64)(data, 1), destVaultId: (0, buffer_1.readU64)(data, 9),
                 user: (0, buffer_1.readPubkey)(data, 17), sharesBurned: (0, buffer_1.readU64)(data, 49), baseMoved: (0, buffer_1.readU64)(data, 57),
                 withdrawalFeeBase: (0, buffer_1.readU64)(data, 65), depositFeeBase: (0, buffer_1.readU64)(data, 73),
-                userDestShares: (0, buffer_1.readU64)(data, 81), epochId: (0, buffer_1.readU32)(data, 89),
+                userDestShares: (0, buffer_1.readU64)(data, 81), epochId: (0, buffer_1.readU32)(data, 89), wr: (0, buffer_1.readPubkey)(data, 93),
             } : null;
         case constants_1.EVT_DELAYED_DEPOSIT_PROCESSED:
             return data.length >= 77 ? {
@@ -240,6 +254,30 @@ function parseEventBuffer(data) {
                 name: "CircuitBreakerTripped", vaultId: (0, buffer_1.readU64)(data, 1), trippedBy: (0, buffer_1.readPubkey)(data, 9),
                 authorityKind: data[41],
             } : null;
+        case constants_1.EVT_WITHDRAW_REQUEST_FROZEN:
+            // Rust: wr(32), stv(32), user(32), epoch_id(4), authority(32), authority_kind(1)
+            // → total payload 134 bytes. authorityKind: 0=user, 1=manager
+            // (FREEZE_AUTHORITY_KIND_* in constants.ts).
+            return data.length >= 134 ? {
+                name: "WithdrawRequestFrozen", wr: (0, buffer_1.readPubkey)(data, 1), stv: (0, buffer_1.readPubkey)(data, 33),
+                user: (0, buffer_1.readPubkey)(data, 65), epochId: (0, buffer_1.readU32)(data, 97), authority: (0, buffer_1.readPubkey)(data, 101),
+                authorityKind: data[133],
+            } : null;
+        case constants_1.EVT_WITHDRAW_REQUEST_UNFROZEN:
+            // Rust: wr(32), stv(32), user(32), epoch_id(4), authority(32) → total payload 133 bytes.
+            return data.length >= 133 ? {
+                name: "WithdrawRequestUnfrozen", wr: (0, buffer_1.readPubkey)(data, 1), stv: (0, buffer_1.readPubkey)(data, 33),
+                user: (0, buffer_1.readPubkey)(data, 65), epochId: (0, buffer_1.readU32)(data, 97), authority: (0, buffer_1.readPubkey)(data, 101),
+            } : null;
+        case constants_1.EVT_CLAIM_RECIPIENT_SET:
+            // Rust: wr(32), stv(32), user(32), epoch_id(4), recipient(32), approver_kind(1), armed(1)
+            // → total payload 135 bytes. approverKind: 0=user, 1=cold
+            // (RECIPIENT_APPROVER_KIND_* in constants.ts).
+            return data.length >= 135 ? {
+                name: "ClaimRecipientSet", wr: (0, buffer_1.readPubkey)(data, 1), stv: (0, buffer_1.readPubkey)(data, 33),
+                user: (0, buffer_1.readPubkey)(data, 65), epochId: (0, buffer_1.readU32)(data, 97), recipient: (0, buffer_1.readPubkey)(data, 101),
+                approverKind: data[133], armed: data[134] !== 0,
+            } : null;
         default:
             return null;
     }

package/dist/p-stv-core/instructions.d.ts

@@ -216,7 +216,7 @@ export interface OverrideClaimWithdrawArgs {
     authority: PublicKey;
     /** GlobalConfig PDA — checked for CFG_FLAG_GLOBAL_PAUSED */
     config: PublicKey;
-    /** WithdrawRequest owner. NOT a signer — authority acts on their behalf. */
+    /** WithdrawRequest owner. Signer — MUST be distinct from `authority` (the on-chain handler rejects authority == user). */
     user: PublicKey;
     stv: PublicKey;
     withdrawRequest: PublicKey;
@@ -635,3 +635,34 @@ export interface TripCircuitBreakerArgs {
     managerRole?: PublicKey;
 }
 export declare function createTripCircuitBreakerIx(args: TripCircuitBreakerArgs, programId?: PublicKey): TransactionInstruction;
+export interface FreezeWithdrawRequestArgs {
+    /** Self-freeze: the WR's own `user`. Manager path: any valid manager for the STV. */
+    authority: PublicKey;
+    stv: PublicKey;
+    withdrawRequest: PublicKey;
+    /**
+     * ManagerRole PDA for (stv, authority). ALWAYS required on the wire (FIXED
+     * 4-account ABI) — the handler destructures exactly 4 accounts regardless
+     * of path. Pass a real ManagerRole PDA when `authority` is a manager;
+     * pass any account (e.g. `findStvManagerRolePda(stv, authority)`) as an
+     * unread placeholder when self-freezing (`authority === wr.user`).
+     */
+    managerRole: PublicKey;
+}
+export declare function createFreezeWithdrawRequestIx(args: FreezeWithdrawRequestArgs, programId?: PublicKey): TransactionInstruction;
+export interface UnfreezeWithdrawRequestArgs {
+    /** stv.coldAdmin (always) or stv.warmAdminEffective() (only when the redirect is armed). */
+    authority: PublicKey;
+    stv: PublicKey;
+    withdrawRequest: PublicKey;
+}
+export declare function createUnfreezeWithdrawRequestIx(args: UnfreezeWithdrawRequestArgs, programId?: PublicKey): TransactionInstruction;
+export interface SetClaimRecipientArgs {
+    /** wr.user OR stv.coldAdmin. Never warm — see module doc. */
+    authority: PublicKey;
+    stv: PublicKey;
+    withdrawRequest: PublicKey;
+    /** Recipient to propose/approve. `PublicKey.default` resets (cold-only). */
+    recipient: PublicKey;
+}
+export declare function createSetClaimRecipientIx(args: SetClaimRecipientArgs, programId?: PublicKey): TransactionInstruction;

package/dist/p-stv-core/instructions.js

@@ -24,6 +24,9 @@ exports.createInstantWithdrawIx = createInstantWithdrawIx;
 exports.createSeedStvIx = createSeedStvIx;
 exports.createAcceptVaultAdminIx = createAcceptVaultAdminIx;
 exports.createTripCircuitBreakerIx = createTripCircuitBreakerIx;
+exports.createFreezeWithdrawRequestIx = createFreezeWithdrawRequestIx;
+exports.createUnfreezeWithdrawRequestIx = createUnfreezeWithdrawRequestIx;
+exports.createSetClaimRecipientIx = createSetClaimRecipientIx;
 const web3_js_1 = require("@solana/web3.js");
 const spl_token_1 = require("@solana/spl-token");
 const buffer_1 = require("../common/buffer");
@@ -217,13 +220,15 @@ function createOverrideClaimWithdrawIx(args, programId = constants_1.PROGRAM_ID)
     const { authority, config, user, stv, withdrawRequest, vaultAta, userBaseAta, feeReceiverBaseAta, baseMint, tokenProgram, remainingAccounts = [], autoUnrouteCount = 0, protocolAumCount = 0, } = args;
     // Data: auto_unroute_count(1) + protocol_aum_count(1) — protocol_aum_count is data[1],
     // so always serialize both bytes (handler reads data[0]/data[1]). Data layout
-    // is unchanged by warm-admin-guardrails — only the account list changed.
+    // is unchanged by warm-admin-guardrails / withdrawal-freeze — only the
+    // account list (and user's signer flag) changed.
     const data = Buffer.from([constants_1.IX_OVERRIDE_CLAIM_WITHDRAW, autoUnrouteCount & 0xff, protocolAumCount & 0xff]);
     return new web3_js_1.TransactionInstruction({
         keys: [
             { pubkey: authority, isSigner: true, isWritable: false },
             { pubkey: config, isSigner: false, isWritable: false },
-            { pubkey: user, isSigner: false, isWritable: true },
+            // user is now a required signer, distinct from authority — see module doc.
+            { pubkey: user, isSigner: true, isWritable: true },
             { pubkey: stv, isSigner: false, isWritable: true },
             { pubkey: withdrawRequest, isSigner: false, isWritable: true },
             { pubkey: vaultAta, isSigner: false, isWritable: true },
@@ -668,3 +673,44 @@ function createTripCircuitBreakerIx(args, programId = constants_1.PROGRAM_ID) {
         data: Buffer.from([constants_1.IX_TRIP_CIRCUIT_BREAKER]),
     });
 }
+function createFreezeWithdrawRequestIx(args, programId = constants_1.PROGRAM_ID) {
+    const { authority, stv, withdrawRequest, managerRole } = args;
+    return new web3_js_1.TransactionInstruction({
+        keys: [
+            { pubkey: authority, isSigner: true, isWritable: false },
+            { pubkey: stv, isSigner: false, isWritable: false },
+            { pubkey: withdrawRequest, isSigner: false, isWritable: true },
+            { pubkey: managerRole, isSigner: false, isWritable: false },
+        ],
+        programId,
+        data: Buffer.from([constants_1.IX_FREEZE_WITHDRAW_REQUEST]),
+    });
+}
+function createUnfreezeWithdrawRequestIx(args, programId = constants_1.PROGRAM_ID) {
+    const { authority, stv, withdrawRequest } = args;
+    return new web3_js_1.TransactionInstruction({
+        keys: [
+            { pubkey: authority, isSigner: true, isWritable: false },
+            { pubkey: stv, isSigner: false, isWritable: false },
+            { pubkey: withdrawRequest, isSigner: false, isWritable: true },
+        ],
+        programId,
+        data: Buffer.from([constants_1.IX_UNFREEZE_WITHDRAW_REQUEST]),
+    });
+}
+function createSetClaimRecipientIx(args, programId = constants_1.PROGRAM_ID) {
+    const { authority, stv, withdrawRequest, recipient } = args;
+    const data = Buffer.concat([
+        Buffer.from([constants_1.IX_SET_CLAIM_RECIPIENT]),
+        recipient.toBuffer(),
+    ]);
+    return new web3_js_1.TransactionInstruction({
+        keys: [
+            { pubkey: authority, isSigner: true, isWritable: false },
+            { pubkey: stv, isSigner: false, isWritable: false },
+            { pubkey: withdrawRequest, isSigner: false, isWritable: true },
+        ],
+        programId,
+        data,
+    });
+}

package/dist/p-stv-core/types.d.ts

@@ -125,6 +125,14 @@ export interface WithdrawRequest {
     destVaultId: BN;
     /** Migrate kind: minimum dest shares (slippage protection). Withdraw kind: 0. */
     minDestShares: BN;
+    /**
+     * Incident-response redirect target for `execute_claim` payout (offset 120).
+     * `PublicKey.default` (`[0;32]`, the deployed zero state) = pay `user`,
+     * exactly today's behavior. A redirect is ARMED iff this is nonzero AND both
+     * `WR_FLAG_RECIPIENT_USER_OK` and `WR_FLAG_RECIPIENT_COLD_OK` are set on
+     * `requestFlags` — see `isRedirectArmed` (accounts.ts).
+     */
+    claimRecipient: PublicKey;
 }
 export interface DelayedDepositRequest {
     stv: PublicKey;
@@ -183,6 +191,8 @@ export interface WithdrawRequestedEvent {
     user: PublicKey;
     shares: BN;
     epochId: number;
+    /** WithdrawRequest PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
 }
 export interface WithdrawRequestIncreasedEvent {
     name: "WithdrawRequestIncreased";
@@ -191,6 +201,8 @@ export interface WithdrawRequestIncreasedEvent {
     additionalShares: BN;
     totalShares: BN;
     epochId: number;
+    /** WithdrawRequest PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
 }
 export interface WithdrawClaimedEvent {
     name: "WithdrawClaimed";
@@ -200,6 +212,15 @@ export interface WithdrawClaimedEvent {
     baseAmount: BN;
     withdrawalFeeBase: BN;
     epochId: number;
+    /** WithdrawRequest PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
+    /**
+     * Payout target: `user` unless the redirect was ARMED at claim time, in
+     * which case this is the stored `claimRecipient`.
+     */
+    recipient: PublicKey;
+    /** ATA the payout was actually sent to: `ATA(recipient, baseMint)`. */
+    destination: PublicKey;
 }
 export interface DepositedToStrategyEvent {
     name: "DepositedToStrategy";
@@ -268,6 +289,15 @@ export interface WithdrawOverrideClaimedEvent {
     epochId: number;
     dailyWithdrawnBase: BN;
     dailyLimit: BN;
+    /** WithdrawRequest PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
+    /**
+     * Payout target: `user` unless the redirect was ARMED at claim time, in
+     * which case this is the stored `claimRecipient`.
+     */
+    recipient: PublicKey;
+    /** ATA the payout was actually sent to: `ATA(recipient, baseMint)`. */
+    destination: PublicKey;
 }
 export interface LendMigratedEvent {
     name: "LendMigrated";
@@ -284,6 +314,8 @@ export interface MigrateRequestedEvent {
     user: PublicKey;
     shares: BN;
     epochId: number;
+    /** WithdrawRequest (migrate-kind) PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
 }
 export interface MigrateExecutedEvent {
     name: "MigrateExecuted";
@@ -296,6 +328,8 @@ export interface MigrateExecutedEvent {
     depositFeeBase: BN;
     userDestShares: BN;
     epochId: number;
+    /** WithdrawRequest (migrate-kind) PDA (appended field, withdrawal-freeze feature). */
+    wr: PublicKey;
 }
 export interface DelayedDepositProcessedEvent {
     name: "DelayedDepositProcessed";
@@ -358,4 +392,43 @@ export interface CircuitBreakerTrippedEvent {
     trippedBy: PublicKey;
     authorityKind: number;
 }
-export type StvEvent = ConfigInitializedEvent | ConfigUpdatedEvent | StvCreatedEvent | StvUpdatedEvent | DepositedEvent | WithdrawRequestedEvent | WithdrawRequestIncreasedEvent | WithdrawClaimedEvent | DepositedToStrategyEvent | WithdrawnFromStrategyEvent | EpochProcessedEvent | EpochAdvancedEvent | FeesSettledEvent | StvClosedEvent | ManagerAddedEvent | ManagerRemovedEvent | WithdrawOverrideClaimedEvent | LendMigratedEvent | MigrateRequestedEvent | MigrateExecutedEvent | DelayedDepositProcessedEvent | InstantWithdrawnEvent | StvSeededEvent | AdminRotationStartedEvent | AdminRotationAcceptedEvent | WarmAdminSetEvent | CircuitBreakerTrippedEvent;
+/**
+ * Emitted by `freeze_withdraw_request` (disc 22).
+ * `authorityKind`: 0 = user (self-freeze), 1 = manager
+ * (see `FREEZE_AUTHORITY_KIND_*` in constants.ts).
+ */
+export interface WithdrawRequestFrozenEvent {
+    name: "WithdrawRequestFrozen";
+    wr: PublicKey;
+    stv: PublicKey;
+    user: PublicKey;
+    epochId: number;
+    authority: PublicKey;
+    authorityKind: number;
+}
+/** Emitted by `unfreeze_withdraw_request` (disc 23). */
+export interface WithdrawRequestUnfrozenEvent {
+    name: "WithdrawRequestUnfrozen";
+    wr: PublicKey;
+    stv: PublicKey;
+    user: PublicKey;
+    epochId: number;
+    authority: PublicKey;
+}
+/**
+ * Emitted by `set_claim_recipient` (disc 24).
+ * `approverKind`: 0 = user, 1 = cold (see `RECIPIENT_APPROVER_KIND_*` in
+ * constants.ts). `armed` mirrors `WithdrawRequest.isRedirectArmed()` as of
+ * this call.
+ */
+export interface ClaimRecipientSetEvent {
+    name: "ClaimRecipientSet";
+    wr: PublicKey;
+    stv: PublicKey;
+    user: PublicKey;
+    epochId: number;
+    recipient: PublicKey;
+    approverKind: number;
+    armed: boolean;
+}
+export type StvEvent = ConfigInitializedEvent | ConfigUpdatedEvent | StvCreatedEvent | StvUpdatedEvent | DepositedEvent | WithdrawRequestedEvent | WithdrawRequestIncreasedEvent | WithdrawClaimedEvent | DepositedToStrategyEvent | WithdrawnFromStrategyEvent | EpochProcessedEvent | EpochAdvancedEvent | FeesSettledEvent | StvClosedEvent | ManagerAddedEvent | ManagerRemovedEvent | WithdrawOverrideClaimedEvent | LendMigratedEvent | MigrateRequestedEvent | MigrateExecutedEvent | DelayedDepositProcessedEvent | InstantWithdrawnEvent | StvSeededEvent | AdminRotationStartedEvent | AdminRotationAcceptedEvent | WarmAdminSetEvent | CircuitBreakerTrippedEvent | WithdrawRequestFrozenEvent | WithdrawRequestUnfrozenEvent | ClaimRecipientSetEvent;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elmntl/jlpd-sdk",
-  "version": "0.13.5",
-  "description": "SDK for JLP.D (JLP Deconstructed) by Elemental \u2014 p-stv-core, jlpd-strategy, and elemental-lend clients",
+  "version": "0.13.7",
+  "description": "SDK for JLP.D (JLP Deconstructed) by Elemental — p-stv-core, jlpd-strategy, and elemental-lend clients",
   "license": "Apache-2.0",
   "keywords": [
     "solana",
@@ -70,4 +70,4 @@
   "publishConfig": {
     "access": "public"
   }
-}
+}