@ember-finance/sdk 2.40.0 → 2.42.0

package/dist/src/solana-vaults/interfaces/index.d.ts

@@ -32,6 +32,9 @@ export declare const SOLANA_SEEDS: {
     readonly parkingLot: "parking_lot";
     readonly parkingLotEscrow: "parking_lot_escrow";
     readonly depositRequest: "deposit_request";
+    readonly depositUser: "deposit_user";
+    readonly withdrawalUser: "withdrawal_user";
+    readonly parkingLotUser: "parking_lot_user";
 };
 /** A cluster the deployment manifest can describe. */
 export type SolanaCluster = "localnet" | "devnet" | "testnet" | "mainnet";
@@ -204,8 +207,13 @@ export interface ISolanaVaultState {
     sequenceNumber: bigint;
     /** `PublicKey.default` when no lot is bound. */
     parkingLot: PublicKey;
-    depositUserList: PublicKey[];
-    withdrawalUserList: PublicKey[];
+    /**
+     * Sizes of the two allow lists, not their members: each list is unbounded
+     * and lives in one PDA per account. 0 means open to all. Test one account
+     * with `deriveDepositUser` / `deriveWithdrawalUser`.
+     */
+    depositUserCount: bigint;
+    withdrawalUserCount: bigint;
     withdrawalFee: ISolanaWithdrawalFee;
 }
 /** `state::WithdrawalRequest`, the entry stored in the queue. */
@@ -241,6 +249,62 @@ export interface ISolanaWithdrawalQueue {
     head: bigint;
     tail: bigint;
 }
+/**
+ * `state::DepositParkingLot`: where async deposits wait to be forwarded.
+ *
+ * A FIFO addressed by sequence number rather than by position: `sequenceNumber`
+ * is the last handed out (the tail) and `queueStartIndex` the last settled (the
+ * head). Neither is ever reset, so `head === tail` means drained, not empty.
+ */
+export interface ISolanaParkingLotState {
+    address: PublicKey;
+    bump: number;
+    /** The bound vault. Immutable after construction. */
+    vault: PublicKey;
+    /** Runs `process_deposits` and the allow list. Rotated by the vault admin. */
+    operator: PublicKey;
+    /** Blocks new parks. Processing and cancellation stay live. */
+    depositsPaused: boolean;
+    /** Blocks cancellation. Parking and processing stay live. */
+    cancellationsPaused: boolean;
+    /** FIFO tail: the last sequence number handed out. */
+    sequenceNumber: bigint;
+    /** FIFO head: the last sequence number settled. Never reset. */
+    queueStartIndex: bigint;
+    /** Collateral escrowed for requests still pending. */
+    totalPendingAssets: bigint;
+    /**
+     * Solana-only: collateral owed to depositors whose refund could not be
+     * delivered, awaiting `claim_refund`. The escrow token account holds
+     * `totalPendingAssets + totalClaimableAssets`.
+     */
+    totalClaimableAssets: bigint;
+    /** Empty means open to all; otherwise only these may park. */
+    /**
+     * How many accounts the deposit allow list holds, not the accounts
+     * themselves: the list is unbounded and lives in one PDA per member, so
+     * there is nothing bounded to put here. 0 means the lot is open to all.
+     * Use `deriveParkingLotUser` to test one account.
+     */
+    depositAllowListCount: bigint;
+}
+/** `state::DepositRequest`: one parked deposit. */
+export interface ISolanaDepositRequest {
+    address: PublicKey;
+    bump: number;
+    parkingLot: PublicKey;
+    /** Its place in the lot's FIFO, and the seed of this account. */
+    sequenceNumber: bigint;
+    /** Escrowed the collateral; receives refunds and the rent. */
+    depositor: PublicKey;
+    /** Receives the minted vault shares. */
+    receiver: PublicKey;
+    assets: bigint;
+    /** Park time in ms. Informational, as in Move. */
+    timestamp: bigint;
+    /** Settled, but its refund is waiting to be claimed. */
+    claimable: boolean;
+}
 /** `state::ProtocolConfig`, decoded. */
 export interface ISolanaProtocolConfigState {
     admin: PublicKey;

package/dist/src/solana-vaults/interfaces/index.js

@@ -30,7 +30,13 @@ export const SOLANA_SEEDS = {
     withdrawalRequest: "withdrawal_request",
     parkingLot: "parking_lot",
     parkingLotEscrow: "parking_lot_escrow",
-    depositRequest: "deposit_request"
+    depositRequest: "deposit_request",
+    // One entry PDA per allow-listed account. The lists are unbounded, so
+    // membership is the existence of this account rather than a Vec on the
+    // vault; every gated instruction takes the caller's entry, present or not.
+    depositUser: "deposit_user",
+    withdrawalUser: "withdrawal_user",
+    parkingLotUser: "parking_lot_user"
 };
 // Call options and response types ship with the builders that take them, in
 // the phase that adds writes. Declaring them here first would be a public

package/dist/src/solana-vaults/on-chain-calls/tx-builder.d.ts

@@ -59,4 +59,77 @@ export declare class SolanaTxBuilder {
      * that `vault` and `owner` are both read-only.
      */
     static cancelPendingWithdrawalRequest(ctx: ISolanaVaultContext, owner: PublicKey, sequenceNumber: bigint): TransactionInstruction;
+    /** The lot and its escrow, derived from the vault's share mint. */
+    private static lotAccounts;
+    /**
+     * `parking_lot_deposit`: escrows collateral and queues a request.
+     *
+     * `sequenceNumber` MUST be the lot's current `sequence_number + 1`, since
+     * the program increments before it writes. That makes this racy by
+     * construction — if another park lands first the address is taken and the
+     * transaction fails — so it is read fresh in SolanaUserCalls rather than
+     * cached.
+     *
+     * `receiver` takes the minted shares when the request is forwarded; the
+     * depositor keeps the refund and the rent.
+     */
+    static parkingLotDeposit(ctx: ISolanaVaultContext, depositor: PublicKey, assets: bigint, sequenceNumber: bigint, receiver: PublicKey): TransactionInstruction;
+    /**
+     * `parking_lot_cancel_deposit`: withdraws a request before it settles and
+     * returns the escrowed collateral, closing the account to refund its rent.
+     *
+     * Takes the request's OWN sequence number, not the lot's next one.
+     */
+    static parkingLotCancelDeposit(ctx: ISolanaVaultContext, depositor: PublicKey, sequenceNumber: bigint): TransactionInstruction;
+    /**
+     * `parking_lot_claim_refund`: collects a refund that settlement could not
+     * deliver, for a request whose `claimable` flag is set.
+     *
+     * Identical account list to cancel — same four accounts, same order — so
+     * the two differ only in their discriminator and in what the program will
+     * accept.
+     */
+    static parkingLotClaimRefund(ctx: ISolanaVaultContext, depositor: PublicKey, sequenceNumber: bigint): TransactionInstruction;
+    private static refundLike;
+    /**
+     * `parking_lot_process_deposits`: forwards up to `numRequests` from the
+     * head of the queue into the vault, minting shares to each receiver.
+     *
+     * Operator-signed. The per-request accounts are not listed here: the
+     * program walks the queue from `queue_start_index` and reads each request
+     * through remaining_accounts, which the caller appends.
+     */
+    static parkingLotProcessDeposits(ctx: ISolanaVaultContext, operator: PublicKey, numRequests: bigint, remaining?: TransactionInstruction["keys"]): TransactionInstruction;
+    /** `parking_lot_process_deposits_up_to`: the same, bounded by sequence number. */
+    static parkingLotProcessDepositsUpTo(ctx: ISolanaVaultContext, operator: PublicKey, upToSequenceNumber: bigint, remaining?: TransactionInstruction["keys"]): TransactionInstruction;
+    private static processLike;
+    /**
+     * The four admin settings, which share one account list: config, vault,
+     * the lot, and the signer. They do NOT share one authority — the program
+     * decides, and the shapes being identical hides that:
+     *
+     * - `set_operator` — the vault admin.
+     * - `set_deposits_paused`, `set_cancellations_paused` — the GUARDIAN, via
+     *   `verify_guardian`, which also fails closed while no guardian is set.
+     * - `set_deposit_allow_list` — the lot's operator.
+     *
+     * Signing a pause with the vault admin key is rejected on chain.
+     */
+    private static lotSetting;
+    /** `parking_lot_set_operator`. */
+    static parkingLotSetOperator(ctx: ISolanaVaultContext, signer: PublicKey, newOperator: PublicKey): TransactionInstruction;
+    /** `parking_lot_set_deposits_paused`: blocks new parks only. */
+    static parkingLotSetDepositsPaused(ctx: ISolanaVaultContext, signer: PublicKey, paused: boolean): TransactionInstruction;
+    /** `parking_lot_set_cancellations_paused`: blocks cancellation only. */
+    static parkingLotSetCancellationsPaused(ctx: ISolanaVaultContext, signer: PublicKey, paused: boolean): TransactionInstruction;
+    /**
+     * `parking_lot_set_deposit_allow_list`: adds or removes one account.
+     * An empty list means the lot is open to everyone.
+     *
+     * Not built through `lotSetting`, unlike its three siblings: the list is
+     * unbounded, so adding an account CREATES its entry PDA and removing one
+     * closes it. That needs the entry and the system program, and makes the
+     * signer writable - it pays the rent, and is refunded on removal.
+     */
+    static parkingLotSetDepositAllowList(ctx: ISolanaVaultContext, signer: PublicKey, account: PublicKey, allowed: boolean): TransactionInstruction;
 }

package/dist/src/solana-vaults/on-chain-calls/tx-builder.js

@@ -1,5 +1,5 @@
 import { SystemProgram, TransactionInstruction } from "@solana/web3.js";
-import { ASSOCIATED_TOKEN_PROGRAM_ID, TOKEN_PROGRAM_ID, associatedTokenAddress, deriveProtocolConfig, deriveVaultAccount, deriveVaultPdas, deriveWithdrawalRequest, eventCpiAccounts, instructionDiscriminator, u128le, u64le } from "../utils/pdas.js";
+import { ASSOCIATED_TOKEN_PROGRAM_ID, TOKEN_PROGRAM_ID, associatedTokenAddress, deriveDepositRequest, deriveDepositUser, deriveParkingLot, deriveParkingLotEscrow, deriveParkingLotUser, deriveProtocolConfig, deriveVaultAccount, deriveVaultPdas, deriveWithdrawalRequest, deriveWithdrawalUser, eventCpiAccounts, instructionDiscriminator, u128le, u64le } from "../utils/pdas.js";
 /**
  * Builds the program's user instructions. Pure: it derives addresses and
  * encodes data, and never touches the network or signs.
@@ -63,6 +63,15 @@ export class SolanaTxBuilder {
                     isSigner: false,
                     isWritable: true
                 },
+                {
+                    // The depositor's deposit-allow-list entry, passed whether
+                    // or not it exists: the list is unbounded and lives in one
+                    // PDA per member, so the program reads this account to
+                    // decide. Read-only, and never created here.
+                    pubkey: deriveDepositUser(ctx.programId, pdas.vault, depositor),
+                    isSigner: false,
+                    isWritable: false
+                },
                 {
                     pubkey: associatedTokenAddress(depositor, ctx.collateralMint, ctx.collateralProgram),
                     isSigner: false,
@@ -136,6 +145,19 @@ export class SolanaTxBuilder {
                     isSigner: false,
                     isWritable: true
                 },
+                {
+                    // Both ends of the withdrawal allow list. Settlement
+                    // re-checks them, so a request whose owner or receiver was
+                    // de-listed meanwhile is skipped rather than paid.
+                    pubkey: deriveWithdrawalUser(ctx.programId, pdas.vault, owner),
+                    isSigner: false,
+                    isWritable: false
+                },
+                {
+                    pubkey: deriveWithdrawalUser(ctx.programId, pdas.vault, receiver),
+                    isSigner: false,
+                    isWritable: false
+                },
                 { pubkey: ctx.shareProgram, isSigner: false, isWritable: false },
                 { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
                 ...eventCpiAccounts(ctx.programId)
@@ -187,4 +209,258 @@ export class SolanaTxBuilder {
             ])
         });
     }
+    // --- parking lot ------------------------------------------------------
+    //
+    // All nine instructions build here. The three user ones are wired into
+    // SolanaUserCalls; the operator and admin ones have no call class yet
+    // (phases 3-4) but are pure instructions, so a caller can sign and send
+    // them today rather than wait for a surface that only wraps them.
+    /** The lot and its escrow, derived from the vault's share mint. */
+    static lotAccounts(ctx) {
+        const { vault } = deriveVaultPdas(ctx.programId, ctx.shareMint);
+        const parkingLot = deriveParkingLot(ctx.programId, vault);
+        return {
+            vault,
+            parkingLot,
+            escrow: deriveParkingLotEscrow(ctx.programId, parkingLot)
+        };
+    }
+    /**
+     * `parking_lot_deposit`: escrows collateral and queues a request.
+     *
+     * `sequenceNumber` MUST be the lot's current `sequence_number + 1`, since
+     * the program increments before it writes. That makes this racy by
+     * construction — if another park lands first the address is taken and the
+     * transaction fails — so it is read fresh in SolanaUserCalls rather than
+     * cached.
+     *
+     * `receiver` takes the minted shares when the request is forwarded; the
+     * depositor keeps the refund and the rent.
+     */
+    static parkingLotDeposit(ctx, depositor, assets, sequenceNumber, receiver) {
+        const { vault, parkingLot, escrow } = SolanaTxBuilder.lotAccounts(ctx);
+        return new TransactionInstruction({
+            programId: ctx.programId,
+            keys: [
+                {
+                    pubkey: deriveProtocolConfig(ctx.programId),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: vault, isSigner: false, isWritable: false },
+                { pubkey: parkingLot, isSigner: false, isWritable: true },
+                {
+                    // The lot keeps its OWN allow list, separate from the
+                    // vault's, but the entry is seeded by the vault.
+                    pubkey: deriveParkingLotUser(ctx.programId, vault, depositor),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: escrow, isSigner: false, isWritable: true },
+                { pubkey: ctx.collateralMint, isSigner: false, isWritable: false },
+                {
+                    pubkey: deriveDepositRequest(ctx.programId, parkingLot, sequenceNumber),
+                    isSigner: false,
+                    isWritable: true
+                },
+                { pubkey: depositor, isSigner: true, isWritable: true },
+                {
+                    pubkey: deriveVaultAccount(ctx.programId, vault, depositor),
+                    isSigner: false,
+                    isWritable: true
+                },
+                {
+                    pubkey: associatedTokenAddress(depositor, ctx.collateralMint, ctx.collateralProgram),
+                    isSigner: false,
+                    isWritable: true
+                },
+                { pubkey: ctx.collateralProgram, isSigner: false, isWritable: false },
+                { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
+                ...eventCpiAccounts(ctx.programId)
+            ],
+            data: Buffer.concat([
+                instructionDiscriminator("parking_lot_deposit"),
+                u64le(assets),
+                receiver.toBuffer()
+            ])
+        });
+    }
+    /**
+     * `parking_lot_cancel_deposit`: withdraws a request before it settles and
+     * returns the escrowed collateral, closing the account to refund its rent.
+     *
+     * Takes the request's OWN sequence number, not the lot's next one.
+     */
+    static parkingLotCancelDeposit(ctx, depositor, sequenceNumber) {
+        return SolanaTxBuilder.refundLike(ctx, depositor, sequenceNumber, "parking_lot_cancel_deposit");
+    }
+    /**
+     * `parking_lot_claim_refund`: collects a refund that settlement could not
+     * deliver, for a request whose `claimable` flag is set.
+     *
+     * Identical account list to cancel — same four accounts, same order — so
+     * the two differ only in their discriminator and in what the program will
+     * accept.
+     */
+    static parkingLotClaimRefund(ctx, depositor, sequenceNumber) {
+        return SolanaTxBuilder.refundLike(ctx, depositor, sequenceNumber, "parking_lot_claim_refund");
+    }
+    static refundLike(ctx, depositor, sequenceNumber, instruction) {
+        const { parkingLot, escrow } = SolanaTxBuilder.lotAccounts(ctx);
+        return new TransactionInstruction({
+            programId: ctx.programId,
+            keys: [
+                {
+                    pubkey: deriveProtocolConfig(ctx.programId),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: parkingLot, isSigner: false, isWritable: true },
+                { pubkey: escrow, isSigner: false, isWritable: true },
+                { pubkey: ctx.collateralMint, isSigner: false, isWritable: false },
+                {
+                    pubkey: deriveDepositRequest(ctx.programId, parkingLot, sequenceNumber),
+                    isSigner: false,
+                    isWritable: true
+                },
+                { pubkey: depositor, isSigner: true, isWritable: true },
+                {
+                    pubkey: associatedTokenAddress(depositor, ctx.collateralMint, ctx.collateralProgram),
+                    isSigner: false,
+                    isWritable: true
+                },
+                { pubkey: ctx.collateralProgram, isSigner: false, isWritable: false },
+                ...eventCpiAccounts(ctx.programId)
+            ],
+            data: Buffer.concat([
+                instructionDiscriminator(instruction),
+                u128le(sequenceNumber)
+            ])
+        });
+    }
+    /**
+     * `parking_lot_process_deposits`: forwards up to `numRequests` from the
+     * head of the queue into the vault, minting shares to each receiver.
+     *
+     * Operator-signed. The per-request accounts are not listed here: the
+     * program walks the queue from `queue_start_index` and reads each request
+     * through remaining_accounts, which the caller appends.
+     */
+    static parkingLotProcessDeposits(ctx, operator, numRequests, remaining = []) {
+        return SolanaTxBuilder.processLike(ctx, operator, "parking_lot_process_deposits", u64le(numRequests), remaining);
+    }
+    /** `parking_lot_process_deposits_up_to`: the same, bounded by sequence number. */
+    static parkingLotProcessDepositsUpTo(ctx, operator, upToSequenceNumber, remaining = []) {
+        return SolanaTxBuilder.processLike(ctx, operator, "parking_lot_process_deposits_up_to", u128le(upToSequenceNumber), remaining);
+    }
+    static processLike(ctx, operator, instruction, arg, remaining) {
+        const { vault, parkingLot, escrow } = SolanaTxBuilder.lotAccounts(ctx);
+        const pdas = deriveVaultPdas(ctx.programId, ctx.shareMint);
+        return new TransactionInstruction({
+            programId: ctx.programId,
+            keys: [
+                {
+                    pubkey: deriveProtocolConfig(ctx.programId),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: vault, isSigner: false, isWritable: true },
+                { pubkey: parkingLot, isSigner: false, isWritable: true },
+                { pubkey: escrow, isSigner: false, isWritable: true },
+                { pubkey: ctx.collateralMint, isSigner: false, isWritable: false },
+                { pubkey: ctx.shareMint, isSigner: false, isWritable: true },
+                { pubkey: pdas.vaultCollateral, isSigner: false, isWritable: true },
+                { pubkey: operator, isSigner: true, isWritable: false },
+                { pubkey: ctx.collateralProgram, isSigner: false, isWritable: false },
+                { pubkey: ctx.shareProgram, isSigner: false, isWritable: false },
+                ...eventCpiAccounts(ctx.programId),
+                ...remaining
+            ],
+            data: Buffer.concat([instructionDiscriminator(instruction), arg])
+        });
+    }
+    /**
+     * The four admin settings, which share one account list: config, vault,
+     * the lot, and the signer. They do NOT share one authority — the program
+     * decides, and the shapes being identical hides that:
+     *
+     * - `set_operator` — the vault admin.
+     * - `set_deposits_paused`, `set_cancellations_paused` — the GUARDIAN, via
+     *   `verify_guardian`, which also fails closed while no guardian is set.
+     * - `set_deposit_allow_list` — the lot's operator.
+     *
+     * Signing a pause with the vault admin key is rejected on chain.
+     */
+    static lotSetting(ctx, signer, instruction, arg) {
+        const { vault, parkingLot } = SolanaTxBuilder.lotAccounts(ctx);
+        return new TransactionInstruction({
+            programId: ctx.programId,
+            keys: [
+                {
+                    pubkey: deriveProtocolConfig(ctx.programId),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: vault, isSigner: false, isWritable: false },
+                { pubkey: parkingLot, isSigner: false, isWritable: true },
+                { pubkey: signer, isSigner: true, isWritable: false },
+                ...eventCpiAccounts(ctx.programId)
+            ],
+            data: Buffer.concat([instructionDiscriminator(instruction), arg])
+        });
+    }
+    /** `parking_lot_set_operator`. */
+    static parkingLotSetOperator(ctx, signer, newOperator) {
+        return SolanaTxBuilder.lotSetting(ctx, signer, "parking_lot_set_operator", newOperator.toBuffer());
+    }
+    /** `parking_lot_set_deposits_paused`: blocks new parks only. */
+    static parkingLotSetDepositsPaused(ctx, signer, paused) {
+        return SolanaTxBuilder.lotSetting(ctx, signer, "parking_lot_set_deposits_paused", Buffer.from([paused ? 1 : 0]));
+    }
+    /** `parking_lot_set_cancellations_paused`: blocks cancellation only. */
+    static parkingLotSetCancellationsPaused(ctx, signer, paused) {
+        return SolanaTxBuilder.lotSetting(ctx, signer, "parking_lot_set_cancellations_paused", Buffer.from([paused ? 1 : 0]));
+    }
+    /**
+     * `parking_lot_set_deposit_allow_list`: adds or removes one account.
+     * An empty list means the lot is open to everyone.
+     *
+     * Not built through `lotSetting`, unlike its three siblings: the list is
+     * unbounded, so adding an account CREATES its entry PDA and removing one
+     * closes it. That needs the entry and the system program, and makes the
+     * signer writable - it pays the rent, and is refunded on removal.
+     */
+    static parkingLotSetDepositAllowList(ctx, signer, account, allowed) {
+        const { vault, parkingLot } = SolanaTxBuilder.lotAccounts(ctx);
+        return new TransactionInstruction({
+            programId: ctx.programId,
+            keys: [
+                {
+                    pubkey: deriveProtocolConfig(ctx.programId),
+                    isSigner: false,
+                    isWritable: false
+                },
+                { pubkey: vault, isSigner: false, isWritable: false },
+                { pubkey: parkingLot, isSigner: false, isWritable: true },
+                {
+                    // The entry for the account being listed, not the signer.
+                    pubkey: deriveParkingLotUser(ctx.programId, vault, account),
+                    isSigner: false,
+                    isWritable: true
+                },
+                { pubkey: signer, isSigner: true, isWritable: true },
+                {
+                    pubkey: SystemProgram.programId,
+                    isSigner: false,
+                    isWritable: false
+                },
+                ...eventCpiAccounts(ctx.programId)
+            ],
+            data: Buffer.concat([
+                instructionDiscriminator("parking_lot_set_deposit_allow_list"),
+                account.toBuffer(),
+                Buffer.from([allowed ? 1 : 0])
+            ])
+        });
+    }
 }

package/dist/src/solana-vaults/on-chain-calls/user.d.ts

@@ -1,5 +1,5 @@
 import { type Connection, PublicKey, type TransactionInstruction } from "@solana/web3.js";
-import { type ISolanaWithdrawalRequest } from "../interfaces/index.js";
+import { type ISolanaDepositRequest, type ISolanaWithdrawalRequest } from "../interfaces/index.js";
 import { type SolanaSigner } from "../signers/solana-signer.js";
 import { SolanaDeploymentParser } from "../utils/deployment-parser.js";
 /** What a write returns. */
@@ -113,6 +113,56 @@ export declare class SolanaUserCalls {
      * on every repeat deposit for nothing.
      */
     private ensureShareAccount;
+    /**
+     * Parks a deposit: escrows collateral and queues a request for the
+     * operator to forward into the vault later. No shares are minted here.
+     *
+     * THIS CALL IS RACY BY CONSTRUCTION. The request's account address is
+     * seeded with the lot's `sequence_number + 1`, and the program increments
+     * before it writes, so two parks landing in the same slot collide and the
+     * loser fails its address check. The lot is read immediately before
+     * building to keep the window small, but it cannot be closed from here —
+     * on `ParkingLotSequenceTaken` the caller should simply call again, which
+     * re-reads and takes the next slot.
+     *
+     * No automatic retry: a resend after a failed SEND (rather than a failed
+     * simulation) could double-park if the first transaction actually landed.
+     *
+     * `receiver` takes the minted shares when the request is forwarded. The
+     * depositor keeps the refund and the account's rent either way.
+     */
+    parkDeposit(shareMint: PublicKey | string, assets: SolanaAmount, options?: ISolanaRedeemOptions): Promise<ISolanaTxResponse & {
+        sequenceNumber: bigint;
+    }>;
+    /**
+     * Cancels a parked deposit before it settles, returning the escrowed
+     * collateral and the account's rent.
+     *
+     * Takes the request's own sequence number — from `getParkedDeposits` —
+     * not the lot's next one.
+     */
+    cancelParkedDeposit(shareMint: PublicKey | string, sequenceNumber: SolanaAmount, options?: ISolanaWriteOptions): Promise<ISolanaTxResponse>;
+    /**
+     * Claims a refund that settlement could not deliver.
+     *
+     * Only for a request whose `claimable` flag is set — the request settled
+     * but the collateral could not be returned, so it waits in escrow under
+     * the lot's `totalClaimableAssets`. `getParkedDeposits` separates these
+     * from the ones still pending.
+     */
+    claimParkedRefund(shareMint: PublicKey | string, sequenceNumber: SolanaAmount, options?: ISolanaWriteOptions): Promise<ISolanaTxResponse>;
+    /**
+     * This depositor's parked deposits, split into those still queued and
+     * those whose refund is waiting to be claimed.
+     *
+     * Found by filtering on the request accounts themselves rather than by
+     * walking the queue: a claimable request has already settled, so it sits
+     * BELOW the lot's head and no scan of the pending window would see it.
+     */
+    getParkedDeposits(shareMint: PublicKey | string, owner?: PublicKey | string): Promise<{
+        pending: ISolanaDepositRequest[];
+        claimable: ISolanaDepositRequest[];
+    }>;
     /**
      * Queues a withdrawal. This does NOT return collateral: the shares are
      * escrowed and a request is appended to the vault's queue, which the

package/dist/src/solana-vaults/on-chain-calls/user.js

@@ -205,15 +205,107 @@ export class SolanaUserCalls {
      * missing: including it unconditionally costs a few hundred compute units
      * on every repeat deposit for nothing.
      */
-    async ensureShareAccount(ctx, owner) {
+    async ensureShareAccount(ctx, owner, payer = owner) {
         const ata = associatedTokenAddress(owner, ctx.shareMint, ctx.shareProgram);
         const existing = await this.connection.getAccountInfo(ata);
         if (existing !== null)
             return [];
         return [
-            SolanaTxBuilder.createAtaIdempotent(owner, owner, ctx.shareMint, ctx.shareProgram)
+            SolanaTxBuilder.createAtaIdempotent(payer, owner, ctx.shareMint, ctx.shareProgram)
         ];
     }
+    // --- parking lot ---
+    /**
+     * Parks a deposit: escrows collateral and queues a request for the
+     * operator to forward into the vault later. No shares are minted here.
+     *
+     * THIS CALL IS RACY BY CONSTRUCTION. The request's account address is
+     * seeded with the lot's `sequence_number + 1`, and the program increments
+     * before it writes, so two parks landing in the same slot collide and the
+     * loser fails its address check. The lot is read immediately before
+     * building to keep the window small, but it cannot be closed from here —
+     * on `ParkingLotSequenceTaken` the caller should simply call again, which
+     * re-reads and takes the next slot.
+     *
+     * No automatic retry: a resend after a failed SEND (rather than a failed
+     * simulation) could double-park if the first transaction actually landed.
+     *
+     * `receiver` takes the minted shares when the request is forwarded. The
+     * depositor keeps the refund and the account's rent either way.
+     */
+    async parkDeposit(shareMint, assets, options) {
+        const assetsValue = toBigInt(assets, "assets");
+        const signer = this.resolveSigner(options?.signer);
+        const ctx = await this.vaultContext(shareMint);
+        const lot = await this.reader.getParkingLot(ctx.shareMint);
+        if (lot === null) {
+            throw new Error(`vault ${ctx.shareMint.toBase58()} has no parking lot; deposit directly instead`);
+        }
+        if (lot.depositsPaused) {
+            throw new Error("the parking lot is not accepting deposits");
+        }
+        // +1: the slot this park will take, because the program increments
+        // before it writes.
+        const sequenceNumber = lot.sequenceNumber + 1n;
+        const receiver = options?.receiver
+            ? this.key(options.receiver)
+            : signer.publicKey;
+        // The program only checks the receiver's share account when the request
+        // is FORWARDED, and a missing one makes it skip and refund instead
+        // (`parking_lot.rs` can_receive_mint / should_skip). A first-time
+        // receiver's park would otherwise succeed here and silently become a
+        // refund later, long after the caller stopped watching. Idempotent, so
+        // it is a no-op when the account already exists, and the signer pays
+        // because the receiver may never have signed anything.
+        const response = await this.send([
+            ...(await this.ensureShareAccount(ctx, receiver, signer.publicKey)),
+            SolanaTxBuilder.parkingLotDeposit(ctx, signer.publicKey, assetsValue, sequenceNumber, receiver)
+        ], signer, options);
+        return { ...response, sequenceNumber };
+    }
+    /**
+     * Cancels a parked deposit before it settles, returning the escrowed
+     * collateral and the account's rent.
+     *
+     * Takes the request's own sequence number — from `getParkedDeposits` —
+     * not the lot's next one.
+     */
+    async cancelParkedDeposit(shareMint, sequenceNumber, options) {
+        rejectReceiver(options, "cancelParkedDeposit");
+        const sequenceValue = toBigInt(sequenceNumber, "sequenceNumber");
+        const signer = this.resolveSigner(options?.signer);
+        const ctx = await this.vaultContext(shareMint);
+        return this.send([
+            SolanaTxBuilder.parkingLotCancelDeposit(ctx, signer.publicKey, sequenceValue)
+        ], signer, options);
+    }
+    /**
+     * Claims a refund that settlement could not deliver.
+     *
+     * Only for a request whose `claimable` flag is set — the request settled
+     * but the collateral could not be returned, so it waits in escrow under
+     * the lot's `totalClaimableAssets`. `getParkedDeposits` separates these
+     * from the ones still pending.
+     */
+    async claimParkedRefund(shareMint, sequenceNumber, options) {
+        rejectReceiver(options, "claimParkedRefund");
+        const sequenceValue = toBigInt(sequenceNumber, "sequenceNumber");
+        const signer = this.resolveSigner(options?.signer);
+        const ctx = await this.vaultContext(shareMint);
+        return this.send([SolanaTxBuilder.parkingLotClaimRefund(ctx, signer.publicKey, sequenceValue)], signer, options);
+    }
+    /**
+     * This depositor's parked deposits, split into those still queued and
+     * those whose refund is waiting to be claimed.
+     *
+     * Found by filtering on the request accounts themselves rather than by
+     * walking the queue: a claimable request has already settled, so it sits
+     * BELOW the lot's head and no scan of the pending window would see it.
+     */
+    async getParkedDeposits(shareMint, owner) {
+        const address = owner ? this.key(owner) : this.resolveSigner().publicKey;
+        return this.reader.getDepositsFor(shareMint, address);
+    }
     // --- withdrawals ---
     /**
      * Queues a withdrawal. This does NOT return collateral: the shares are

package/dist/src/solana-vaults/on-chain-calls/vault-reader.d.ts

@@ -1,5 +1,5 @@
 import { type Connection, PublicKey } from "@solana/web3.js";
-import { type ISolanaProtocolConfigState, type ISolanaVaultAccount, type ISolanaVaultPdas, type ISolanaVaultState, type ISolanaWithdrawalRequestAccount } from "../interfaces/index.js";
+import { type ISolanaDepositRequest, type ISolanaParkingLotState, type ISolanaProtocolConfigState, type ISolanaVaultAccount, type ISolanaVaultPdas, type ISolanaVaultState, type ISolanaWithdrawalRequestAccount } from "../interfaces/index.js";
 import { type IWithdrawalFeeBreakdown } from "../utils/math.js";
 import { SolanaDeploymentParser } from "../utils/deployment-parser.js";
 /**
@@ -22,6 +22,18 @@ export declare class SolanaVaultReader {
     updateDeployment(parser: SolanaDeploymentParser): void;
     get programId(): PublicKey;
     private key;
+    /**
+     * Whether an account is on one of the unbounded allow lists.
+     *
+     * The program's own test is `UserListEntry::exists`: owned by the program
+     * AND non-empty. A bare "the account exists" is weaker and wrong here -
+     * these addresses are public and derivable, so anyone can make
+     * `getAccountInfo` return non-null for one by sending it lamports. That
+     * system-owned, dataless account would read as listed and then be rejected
+     * on chain, which is a confusing false positive on a path users hit
+     * directly.
+     */
+    private isListed;
     /** The protocol config, or null when the protocol is not initialised. */
     getProtocolConfig(): Promise<ISolanaProtocolConfigState | null>;
     isProtocolPaused(): Promise<boolean>;
@@ -139,6 +151,73 @@ export declare class SolanaVaultReader {
     private canDeposit;
     /** `quote.rs::can_withdraw`. */
     private canWithdraw;
+    /** The lot's address for a vault, whether or not one exists. */
+    parkingLotAddress(shareMint: PublicKey | string): PublicKey;
+    /**
+     * A vault's parking lot, or null when it has none.
+     *
+     * Null is the ordinary case: a lot is opt-in per vault, so most vaults have
+     * no account at this address at all.
+     */
+    getParkingLot(shareMint: PublicKey | string): Promise<ISolanaParkingLotState | null>;
+    /** The lot's escrow token account. */
+    parkingLotEscrowAddress(shareMint: PublicKey | string): PublicKey;
+    /** One parked deposit by its sequence number, or null if it is gone. */
+    getDepositRequest(shareMint: PublicKey | string, sequenceNumber: bigint): Promise<ISolanaDepositRequest | null>;
+    /**
+     * A page of the lot's queue, oldest first, with an explicit cursor.
+     *
+     * `limit` counts SLOTS SCANNED, not requests returned, because a slot may
+     * be empty: a cancelled request's account is closed while its number stays
+     * in the range. `scannedTo` is therefore returned separately and is always
+     * advanced — a page of zero requests still tells the caller where to
+     * resume, which an empty array alone could not.
+     *
+     * Reads are batched at `MAX_MULTIPLE_ACCOUNTS`: `getMultipleAccounts`
+     * refuses more than 100 pubkeys per call, so a larger window is split
+     * rather than failing.
+     *
+     * This window is `(queueStartIndex, sequenceNumber]` — the UNSETTLED part
+     * of the queue. Requests whose refund is waiting to be claimed sit BELOW
+     * the head and are not here; use `getRequestsByDepositor` for those.
+     */
+    getPendingDeposits(shareMint: PublicKey | string, options?: {
+        limit?: number;
+        after?: bigint;
+    }): Promise<{
+        requests: ISolanaDepositRequest[];
+        /** The last slot examined. Pass back as `after` to continue. */
+        scannedTo: bigint;
+        hasMore: boolean;
+    }>;
+    /**
+     * Every surviving request belonging to one depositor, wherever it sits in
+     * the queue.
+     *
+     * Position-independent on purpose. A CLAIMABLE request — one that settled
+     * but whose refund could not be delivered — lives BELOW `queueStartIndex`
+     * (see parking_lot.rs: "below the head only claimable requests remain"),
+     * so no scan of the pending window can ever find one. Walking downwards
+     * instead is unbounded and mostly hits closed accounts.
+     *
+     * So this filters on chain by the account's own bytes: the request's size,
+     * its parking lot at offset 9 and its depositor at offset 57. Those
+     * offsets track `DepositRequest` in state.rs and are pinned by test.
+     *
+     * `getProgramAccounts` is an indexed scan and some public RPCs restrict
+     * it; a provider endpoint is the right place to run this.
+     */
+    getRequestsByDepositor(shareMint: PublicKey | string, depositor: PublicKey | string): Promise<ISolanaDepositRequest[]>;
+    /**
+     * A depositor's requests, split by what they can do with them.
+     *
+     * `pending` is still queued and can be cancelled; `claimable` has settled
+     * with an undeliverable refund and is collected with `claim_refund`.
+     */
+    getDepositsFor(shareMint: PublicKey | string, depositor: PublicKey | string): Promise<{
+        pending: ISolanaDepositRequest[];
+        claimable: ISolanaDepositRequest[];
+    }>;
     /** An owner's vault account, or null before their first deposit or redeem. */
     getAccountState(shareMint: PublicKey | string, owner: PublicKey | string): Promise<ISolanaVaultAccount | null>;
     /** Queue head and tail. Equal means drained. */

package/dist/src/solana-vaults/on-chain-calls/vault-reader.js

@@ -1,6 +1,6 @@
 import { PublicKey } from "@solana/web3.js";
-import { decodeMint, decodeProtocolConfig, decodeVault, decodeVaultAccount, decodeWithdrawalQueue, decodeWithdrawalRequestAccount } from "../utils/borsh.js";
-import { accountDiscriminator, associatedTokenAddress, deriveVaultAccount } from "../utils/pdas.js";
+import { decodeDepositParkingLot, decodeDepositRequest, decodeMint, decodeProtocolConfig, decodeVault, decodeVaultAccount, decodeWithdrawalQueue, decodeWithdrawalRequestAccount } from "../utils/borsh.js";
+import { DEPOSIT_REQUEST_OFFSETS, DEPOSIT_REQUEST_SIZE, MAX_MULTIPLE_ACCOUNTS, MAX_QUEUE_SCAN, accountDiscriminator, associatedTokenAddress, deriveDepositRequest, deriveDepositUser, deriveParkingLot, deriveParkingLotEscrow, deriveVaultAccount, deriveWithdrawalUser } from "../utils/pdas.js";
 import { amountFromShares, amountFromSharesFloor, maxDepositAmount, maxMintShares, sharesFromAmount, sharesFromAmountCeil, vaultTvl, withdrawalFee } from "../utils/math.js";
 /**
  * Reads vault state from the chain.
@@ -29,6 +29,22 @@ export class SolanaVaultReader {
     key(value) {
         return typeof value === "string" ? new PublicKey(value) : value;
     }
+    /**
+     * Whether an account is on one of the unbounded allow lists.
+     *
+     * The program's own test is `UserListEntry::exists`: owned by the program
+     * AND non-empty. A bare "the account exists" is weaker and wrong here -
+     * these addresses are public and derivable, so anyone can make
+     * `getAccountInfo` return non-null for one by sending it lamports. That
+     * system-owned, dataless account would read as listed and then be rejected
+     * on chain, which is a confusing false positive on a path users hit
+     * directly.
+     */
+    async isListed(derive, shareMint, account) {
+        const entry = derive(this.programId, this.getVaultPdas(shareMint).vault, this.key(account));
+        const info = await this.connection.getAccountInfo(entry);
+        return info !== null && info.owner.equals(this.programId) && info.data.length > 0;
+    }
     // --- raw state ---
     /** The protocol config, or null when the protocol is not initialised. */
     async getProtocolConfig() {
@@ -238,32 +254,35 @@ export class SolanaVaultReader {
         return sharesFromAmountCeil(assets, (await this.getVaultState(shareMint)).rate.value);
     }
     async maxDeposit(shareMint, owner) {
-        const [vault, config, supply] = await Promise.all([
+        const [vault, config, supply, listed] = await Promise.all([
             this.getVaultState(shareMint),
             this.getProtocolConfig(),
-            this.getTotalSupply(shareMint)
+            this.getTotalSupply(shareMint),
+            this.isListed(deriveDepositUser, shareMint, owner)
         ]);
-        if (!this.canDeposit(vault, config, this.key(owner)))
+        if (!this.canDeposit(vault, config, this.key(owner), listed))
             return 0n;
         return maxDepositAmount(supply, vault.rate.value, vault.maxTvl);
     }
     async maxMint(shareMint, owner) {
-        const [vault, config, supply] = await Promise.all([
+        const [vault, config, supply, listed] = await Promise.all([
             this.getVaultState(shareMint),
             this.getProtocolConfig(),
-            this.getTotalSupply(shareMint)
+            this.getTotalSupply(shareMint),
+            this.isListed(deriveDepositUser, shareMint, owner)
         ]);
-        if (!this.canDeposit(vault, config, this.key(owner)))
+        if (!this.canDeposit(vault, config, this.key(owner), listed))
             return 0n;
         return maxMintShares(supply, vault.rate.value, vault.maxTvl);
     }
     async maxRedeem(shareMint, owner) {
-        const [vault, config, balance] = await Promise.all([
+        const [vault, config, balance, listed] = await Promise.all([
             this.getVaultState(shareMint),
             this.getProtocolConfig(),
-            this.balanceOf(shareMint, owner)
+            this.balanceOf(shareMint, owner),
+            this.isListed(deriveWithdrawalUser, shareMint, owner)
         ]);
-        if (!this.canWithdraw(vault, config, this.key(owner)))
+        if (!this.canWithdraw(vault, config, this.key(owner), listed))
             return 0n;
         // Below the minimum the whole balance is unredeemable, not merely capped.
         return balance < vault.minWithdrawalShares ? 0n : balance;
@@ -282,7 +301,7 @@ export class SolanaVaultReader {
             : amountFromSharesFloor(redeemable, vault.rate.value);
     }
     /** `quote.rs::can_deposit`. */
-    canDeposit(vault, config, owner) {
+    canDeposit(vault, config, owner, listed) {
         if (config?.pauseNonAdminOperations)
             return false;
         if (vault.paused || vault.pausedDeposits)
@@ -293,22 +312,164 @@ export class SolanaVaultReader {
             return false;
         // A bound parking lot closes the direct path to everyone not listed;
         // with no lot, an empty list is open to all.
-        if (!vault.parkingLot.equals(PublicKey.default)) {
-            return vault.depositUserList.some(a => a.equals(owner));
-        }
-        return (vault.depositUserList.length === 0 ||
-            vault.depositUserList.some(a => a.equals(owner)));
+        if (!vault.parkingLot.equals(PublicKey.default))
+            return listed;
+        return vault.depositUserCount === 0n || listed;
     }
     /** `quote.rs::can_withdraw`. */
-    canWithdraw(vault, config, owner) {
+    canWithdraw(vault, config, owner, listed) {
         if (config?.pauseNonAdminOperations)
             return false;
         if (vault.paused || vault.pausedWithdrawals)
             return false;
         if (vault.blacklisted.some(a => a.equals(owner)))
             return false;
-        return (vault.withdrawalUserList.length === 0 ||
-            vault.withdrawalUserList.some(a => a.equals(owner)));
+        return vault.withdrawalUserCount === 0n || listed;
+    }
+    // --- parking lot ---
+    /** The lot's address for a vault, whether or not one exists. */
+    parkingLotAddress(shareMint) {
+        return deriveParkingLot(this.programId, this.getVaultPdas(shareMint).vault);
+    }
+    /**
+     * A vault's parking lot, or null when it has none.
+     *
+     * Null is the ordinary case: a lot is opt-in per vault, so most vaults have
+     * no account at this address at all.
+     */
+    async getParkingLot(shareMint) {
+        const address = this.parkingLotAddress(shareMint);
+        const account = await this.connection.getAccountInfo(address);
+        return account === null ? null : decodeDepositParkingLot(account.data, address);
+    }
+    /** The lot's escrow token account. */
+    parkingLotEscrowAddress(shareMint) {
+        return deriveParkingLotEscrow(this.programId, this.parkingLotAddress(shareMint));
+    }
+    /** One parked deposit by its sequence number, or null if it is gone. */
+    async getDepositRequest(shareMint, sequenceNumber) {
+        const address = deriveDepositRequest(this.programId, this.parkingLotAddress(shareMint), sequenceNumber);
+        const account = await this.connection.getAccountInfo(address);
+        return account === null ? null : decodeDepositRequest(account.data, address);
+    }
+    /**
+     * A page of the lot's queue, oldest first, with an explicit cursor.
+     *
+     * `limit` counts SLOTS SCANNED, not requests returned, because a slot may
+     * be empty: a cancelled request's account is closed while its number stays
+     * in the range. `scannedTo` is therefore returned separately and is always
+     * advanced — a page of zero requests still tells the caller where to
+     * resume, which an empty array alone could not.
+     *
+     * Reads are batched at `MAX_MULTIPLE_ACCOUNTS`: `getMultipleAccounts`
+     * refuses more than 100 pubkeys per call, so a larger window is split
+     * rather than failing.
+     *
+     * This window is `(queueStartIndex, sequenceNumber]` — the UNSETTLED part
+     * of the queue. Requests whose refund is waiting to be claimed sit BELOW
+     * the head and are not here; use `getRequestsByDepositor` for those.
+     */
+    async getPendingDeposits(shareMint, options) {
+        const lot = await this.getParkingLot(shareMint);
+        if (lot === null) {
+            return { requests: [], scannedTo: 0n, hasMore: false };
+        }
+        // NaN survives trunc/max/min, and `slots.length < NaN` is false, so the
+        // scan loop would never run and `slots[-1].seq` would throw below.
+        const rawLimit = options?.limit;
+        const limit = Number.isFinite(rawLimit)
+            ? Math.min(Math.max(Math.trunc(rawLimit), 1), MAX_QUEUE_SCAN)
+            : MAX_MULTIPLE_ACCOUNTS;
+        // Clamp up to the head. Below it only CLAIMABLE requests survive (the
+        // program settles the rest and the head only moves forward), so an
+        // `after` behind the head would walk settled slots and report their
+        // requests as pending. Clamping also keeps the cursor monotonic: an
+        // `after` past the tail resumes at itself rather than being dragged
+        // back to `sequenceNumber`.
+        const after = options?.after ?? lot.queueStartIndex;
+        const resume = after > lot.queueStartIndex ? after : lot.queueStartIndex;
+        const from = resume + 1n;
+        if (from > lot.sequenceNumber) {
+            return { requests: [], scannedTo: resume, hasMore: false };
+        }
+        const slots = [];
+        for (let seq = from; seq <= lot.sequenceNumber && slots.length < limit; seq++) {
+            slots.push({
+                seq,
+                address: deriveDepositRequest(this.programId, lot.address, seq)
+            });
+        }
+        const requests = [];
+        for (let i = 0; i < slots.length; i += MAX_MULTIPLE_ACCOUNTS) {
+            const batch = slots.slice(i, i + MAX_MULTIPLE_ACCOUNTS);
+            const accounts = await this.connection.getMultipleAccountsInfo(batch.map(b => b.address));
+            accounts.forEach((account, j) => {
+                if (account === null)
+                    return; // cancelled or settled: slot closed
+                requests.push(decodeDepositRequest(account.data, batch[j].address));
+            });
+        }
+        const scannedTo = slots[slots.length - 1].seq;
+        return { requests, scannedTo, hasMore: scannedTo < lot.sequenceNumber };
+    }
+    /**
+     * Every surviving request belonging to one depositor, wherever it sits in
+     * the queue.
+     *
+     * Position-independent on purpose. A CLAIMABLE request — one that settled
+     * but whose refund could not be delivered — lives BELOW `queueStartIndex`
+     * (see parking_lot.rs: "below the head only claimable requests remain"),
+     * so no scan of the pending window can ever find one. Walking downwards
+     * instead is unbounded and mostly hits closed accounts.
+     *
+     * So this filters on chain by the account's own bytes: the request's size,
+     * its parking lot at offset 9 and its depositor at offset 57. Those
+     * offsets track `DepositRequest` in state.rs and are pinned by test.
+     *
+     * `getProgramAccounts` is an indexed scan and some public RPCs restrict
+     * it; a provider endpoint is the right place to run this.
+     */
+    async getRequestsByDepositor(shareMint, depositor) {
+        const lot = await this.getParkingLot(shareMint);
+        if (lot === null)
+            return [];
+        const accounts = await this.connection.getProgramAccounts(this.programId, {
+            filters: [
+                { dataSize: DEPOSIT_REQUEST_SIZE },
+                {
+                    memcmp: {
+                        offset: DEPOSIT_REQUEST_OFFSETS.parkingLot,
+                        bytes: lot.address.toBase58()
+                    }
+                },
+                {
+                    memcmp: {
+                        offset: DEPOSIT_REQUEST_OFFSETS.depositor,
+                        bytes: this.key(depositor).toBase58()
+                    }
+                }
+            ]
+        });
+        return accounts
+            .map(({ pubkey, account }) => decodeDepositRequest(account.data, pubkey))
+            .sort((a, b) => a.sequenceNumber < b.sequenceNumber
+            ? -1
+            : a.sequenceNumber > b.sequenceNumber
+                ? 1
+                : 0);
+    }
+    /**
+     * A depositor's requests, split by what they can do with them.
+     *
+     * `pending` is still queued and can be cancelled; `claimable` has settled
+     * with an undeliverable refund and is collected with `claim_refund`.
+     */
+    async getDepositsFor(shareMint, depositor) {
+        const mine = await this.getRequestsByDepositor(shareMint, depositor);
+        return {
+            pending: mine.filter(r => !r.claimable),
+            claimable: mine.filter(r => r.claimable)
+        };
     }
     // --- withdrawals ---
     /** An owner's vault account, or null before their first deposit or redeem. */

package/dist/src/solana-vaults/utils/borsh.d.ts

@@ -1,5 +1,5 @@
 import { PublicKey } from "@solana/web3.js";
-import type { ISolanaProtocolConfigState, ISolanaVaultAccount, ISolanaVaultState, ISolanaWithdrawalQueue, ISolanaWithdrawalRequestAccount } from "../interfaces/index.js";
+import type { ISolanaDepositRequest, ISolanaParkingLotState, ISolanaProtocolConfigState, ISolanaVaultAccount, ISolanaVaultState, ISolanaWithdrawalQueue, ISolanaWithdrawalRequestAccount } from "../interfaces/index.js";
 /**
  * Borsh decoding for `ember_vaults` accounts.
  *
@@ -62,4 +62,15 @@ export interface ISplMint {
  * The classic 82-byte SPL mint layout. The first 82 bytes of a Token-2022
  * mint are identical, so this reads both; it just ignores any extensions.
  */
+/**
+ * `state::DepositParkingLot`.
+ *
+ * Field order tracks the Rust struct and is load-bearing: a transposition
+ * decodes into plausible numbers rather than failing. `sequence_number` and
+ * `queue_start_index` are u128 - sixteen bytes each, not eight - so reading
+ * either as a u64 would silently shift every field after it.
+ */
+export declare function decodeDepositParkingLot(data: Buffer, address: PublicKey): ISolanaParkingLotState;
+/** `state::DepositRequest`, one parked deposit. */
+export declare function decodeDepositRequest(data: Buffer, address: PublicKey): ISolanaDepositRequest;
 export declare function decodeMint(data: Buffer): ISplMint;

package/dist/src/solana-vaults/utils/borsh.js

@@ -128,8 +128,11 @@ function decodeVaultInner(data) {
     const maxTvl = c.u64();
     const sequenceNumber = c.u128();
     const parkingLot = c.pubkey();
-    const depositUserList = c.vec(x => x.pubkey());
-    const withdrawalUserList = c.vec(x => x.pubkey());
+    // Counts, not members: both lists became one PDA per account, so the vault
+    // carries only their size. 0 means open to all; use deriveDepositUser /
+    // deriveWithdrawalUser to test one account.
+    const depositUserCount = c.u64();
+    const withdrawalUserCount = c.u64();
     // The tail the parking-lot change appended. Decoded rather than skipped:
     // a vault with fees configured would otherwise be indistinguishable from a
     // fee-free one.
@@ -161,8 +164,8 @@ function decodeVaultInner(data) {
         maxTvl,
         sequenceNumber,
         parkingLot,
-        depositUserList,
-        withdrawalUserList,
+        depositUserCount,
+        withdrawalUserCount,
         withdrawalFee
     };
     return { vault, position: c.position() };
@@ -225,6 +228,45 @@ export function decodeProtocolConfig(data) {
  * The classic 82-byte SPL mint layout. The first 82 bytes of a Token-2022
  * mint are identical, so this reads both; it just ignores any extensions.
  */
+/**
+ * `state::DepositParkingLot`.
+ *
+ * Field order tracks the Rust struct and is load-bearing: a transposition
+ * decodes into plausible numbers rather than failing. `sequence_number` and
+ * `queue_start_index` are u128 - sixteen bytes each, not eight - so reading
+ * either as a u64 would silently shift every field after it.
+ */
+export function decodeDepositParkingLot(data, address) {
+    const c = expect(data, "DepositParkingLot");
+    return {
+        address,
+        bump: c.u8(),
+        vault: c.pubkey(),
+        operator: c.pubkey(),
+        depositsPaused: c.bool(),
+        cancellationsPaused: c.bool(),
+        sequenceNumber: c.u128(),
+        queueStartIndex: c.u128(),
+        totalPendingAssets: c.u64(),
+        totalClaimableAssets: c.u64(),
+        depositAllowListCount: c.u64()
+    };
+}
+/** `state::DepositRequest`, one parked deposit. */
+export function decodeDepositRequest(data, address) {
+    const c = expect(data, "DepositRequest");
+    return {
+        address,
+        bump: c.u8(),
+        parkingLot: c.pubkey(),
+        sequenceNumber: c.u128(),
+        depositor: c.pubkey(),
+        receiver: c.pubkey(),
+        assets: c.u64(),
+        timestamp: c.u64(),
+        claimable: c.bool()
+    };
+}
 export function decodeMint(data) {
     const option = (o) => data.readUInt32LE(o) === 1 ? new PublicKey(data.subarray(o + 4, o + 36)) : null;
     return {

package/dist/src/solana-vaults/utils/pdas.d.ts

@@ -32,6 +32,67 @@ export declare const deriveVaultAccount: (programId: PublicKey, vault: PublicKey
  * nonce 0.
  */
 export declare const deriveWithdrawalRequest: (programId: PublicKey, vault: PublicKey, owner: PublicKey, nonce: bigint) => PublicKey;
+/**
+ * `getMultipleAccounts` refuses more than 100 pubkeys per call, so any wider
+ * window has to be split rather than sent whole.
+ */
+export declare const MAX_MULTIPLE_ACCOUNTS = 100;
+/** An upper bound on one queue scan, so a caller cannot ask for an unbounded walk. */
+export declare const MAX_QUEUE_SCAN = 1000;
+/** `DepositRequest` is fixed width, which lets getProgramAccounts filter on it. */
+export declare const DEPOSIT_REQUEST_SIZE = 138;
+/**
+ * Byte offsets into a `DepositRequest` account, discriminator included.
+ *
+ * Used as memcmp filters, so they track state.rs exactly: an offset that
+ * drifts returns nothing rather than failing, which looks like "no requests".
+ */
+export declare const DEPOSIT_REQUEST_OFFSETS: {
+    /** after discriminator(8) + bump(1) */
+    readonly parkingLot: 9;
+    /** after parking_lot(32) + sequence_number(16) */
+    readonly depositor: 57;
+    /** after receiver(32) + assets(8) + timestamp(8) */
+    readonly claimable: 137;
+};
+/** Membership of a vault's deposit allow list. Scoped to the vault. */
+export declare const deriveDepositUser: (programId: PublicKey, vault: PublicKey, account: PublicKey) => PublicKey;
+/** Membership of a vault's withdrawal allow list. Scoped to the vault. */
+export declare const deriveWithdrawalUser: (programId: PublicKey, vault: PublicKey, account: PublicKey) => PublicKey;
+/**
+ * Membership of a parking lot's own deposit allow list.
+ *
+ * Scoped to the VAULT, not the lot, matching the program's
+ * `[PARKING_LOT_USER_SEED, vault, account]`.
+ */
+export declare const deriveParkingLotUser: (programId: PublicKey, vault: PublicKey, account: PublicKey) => PublicKey;
+/**
+ * A vault's deposit parking lot: where async deposits wait to be forwarded.
+ *
+ * One lot per vault, so this is derivable from the vault alone. A vault with
+ * no lot simply has no account at this address.
+ */
+export declare const deriveParkingLot: (programId: PublicKey, vault: PublicKey) => PublicKey;
+/**
+ * The lot's escrow token account, holding collateral for pending requests.
+ *
+ * It holds `total_pending_assets + total_claimable_assets`: the second is
+ * Solana-only, owed to depositors whose refund could not be delivered.
+ */
+export declare const deriveParkingLotEscrow: (programId: PublicKey, parkingLot: PublicKey) => PublicKey;
+/**
+ * One parked deposit, keyed by its queue sequence number.
+ *
+ * The seed is a u128 (16 bytes LE), not the u64 the withdrawal request uses.
+ *
+ * WHEN PARKING, the sequence number is the lot's `sequence_number` PLUS ONE -
+ * the slot the next park will take, since the program increments before it
+ * writes. That makes a park racy by construction: if another lands first this
+ * address is already in use and the transaction fails its address check, and
+ * must be rebuilt against a fresh read. Cancelling or claiming an EXISTING
+ * request uses that request's own recorded sequence number instead.
+ */
+export declare const deriveDepositRequest: (programId: PublicKey, parkingLot: PublicKey, sequenceNumber: bigint) => PublicKey;
 /**
  * The event authority `emit_cpi!` signs with. Anchor requires it and the
  * program id as the last two accounts of every instruction that emits.

package/dist/src/solana-vaults/utils/pdas.js

@@ -76,11 +76,86 @@ export const deriveWithdrawalRequest = (programId, vault, owner, nonce) => Publi
     owner.toBuffer(),
     u64le(nonce)
 ], programId)[0];
-// The parking lot's PDAs - the lot, its escrow and a deposit request - are
-// derived in the phase that adds decoders for DepositParkingLot and
-// DepositRequest. Deriving an address nothing can read is a surface that
-// looks usable and is not. Note for then: a request's seed is the lot's
-// sequence_number + 1, the slot the next park will take.
+/**
+ * `getMultipleAccounts` refuses more than 100 pubkeys per call, so any wider
+ * window has to be split rather than sent whole.
+ */
+export const MAX_MULTIPLE_ACCOUNTS = 100;
+/** An upper bound on one queue scan, so a caller cannot ask for an unbounded walk. */
+export const MAX_QUEUE_SCAN = 1000;
+/** `DepositRequest` is fixed width, which lets getProgramAccounts filter on it. */
+export const DEPOSIT_REQUEST_SIZE = 138;
+/**
+ * Byte offsets into a `DepositRequest` account, discriminator included.
+ *
+ * Used as memcmp filters, so they track state.rs exactly: an offset that
+ * drifts returns nothing rather than failing, which looks like "no requests".
+ */
+export const DEPOSIT_REQUEST_OFFSETS = {
+    /** after discriminator(8) + bump(1) */
+    parkingLot: 9,
+    /** after parking_lot(32) + sequence_number(16) */
+    depositor: 57,
+    /** after receiver(32) + assets(8) + timestamp(8) */
+    claimable: 137
+};
+/**
+ * An allow-list entry: one account per listed member.
+ *
+ * The three lists are unbounded, so membership is not a `Vec` on the vault or
+ * the lot but the EXISTENCE of this PDA. The program's test is
+ * `UserListEntry::exists` - owned by the program and non-empty - which is
+ * stricter than "the account exists": these addresses are public and
+ * derivable, so anyone can make a bare `getAccountInfo` return non-null by
+ * sending lamports to one. A system-owned account with no data reads as
+ * listed to a naive check and is rejected on chain.
+ *
+ * Every gated instruction takes the caller's entry whether or not it exists,
+ * so these are always derivable without a network read.
+ */
+const deriveUserEntry = (programId, seedName, scope, account) => PublicKey.findProgramAddressSync([seed(seedName), scope.toBuffer(), account.toBuffer()], programId)[0];
+/** Membership of a vault's deposit allow list. Scoped to the vault. */
+export const deriveDepositUser = (programId, vault, account) => deriveUserEntry(programId, SOLANA_SEEDS.depositUser, vault, account);
+/** Membership of a vault's withdrawal allow list. Scoped to the vault. */
+export const deriveWithdrawalUser = (programId, vault, account) => deriveUserEntry(programId, SOLANA_SEEDS.withdrawalUser, vault, account);
+/**
+ * Membership of a parking lot's own deposit allow list.
+ *
+ * Scoped to the VAULT, not the lot, matching the program's
+ * `[PARKING_LOT_USER_SEED, vault, account]`.
+ */
+export const deriveParkingLotUser = (programId, vault, account) => deriveUserEntry(programId, SOLANA_SEEDS.parkingLotUser, vault, account);
+/**
+ * A vault's deposit parking lot: where async deposits wait to be forwarded.
+ *
+ * One lot per vault, so this is derivable from the vault alone. A vault with
+ * no lot simply has no account at this address.
+ */
+export const deriveParkingLot = (programId, vault) => PublicKey.findProgramAddressSync([seed(SOLANA_SEEDS.parkingLot), vault.toBuffer()], programId)[0];
+/**
+ * The lot's escrow token account, holding collateral for pending requests.
+ *
+ * It holds `total_pending_assets + total_claimable_assets`: the second is
+ * Solana-only, owed to depositors whose refund could not be delivered.
+ */
+export const deriveParkingLotEscrow = (programId, parkingLot) => PublicKey.findProgramAddressSync([seed(SOLANA_SEEDS.parkingLotEscrow), parkingLot.toBuffer()], programId)[0];
+/**
+ * One parked deposit, keyed by its queue sequence number.
+ *
+ * The seed is a u128 (16 bytes LE), not the u64 the withdrawal request uses.
+ *
+ * WHEN PARKING, the sequence number is the lot's `sequence_number` PLUS ONE -
+ * the slot the next park will take, since the program increments before it
+ * writes. That makes a park racy by construction: if another lands first this
+ * address is already in use and the transaction fails its address check, and
+ * must be rebuilt against a fresh read. Cancelling or claiming an EXISTING
+ * request uses that request's own recorded sequence number instead.
+ */
+export const deriveDepositRequest = (programId, parkingLot, sequenceNumber) => PublicKey.findProgramAddressSync([
+    seed(SOLANA_SEEDS.depositRequest),
+    parkingLot.toBuffer(),
+    u128le(sequenceNumber)
+], programId)[0];
 /**
  * The event authority `emit_cpi!` signs with. Anchor requires it and the
  * program id as the last two accounts of every instruction that emits.

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@ember-finance/sdk",
     "description": "Ember Protocol SDK",
-    "version": "2.40.0",
+    "version": "2.42.0",
     "type": "module",
     "module": "./dist/index.js",
     "main": "./dist/index.js",