@logswap/sdk 0.5.51 → 0.5.53

package/dist/fees.d.ts

@@ -0,0 +1,52 @@
+/**
+ * fees.ts — swap fees over a window, from `Swap` logs.
+ *
+ * `F` cannot answer "what did takers pay this week": it is per unit of L, it carries the mint-fee
+ * credits as well as swap fees, and it has no window. Each `Swap` event carries the quote leg and
+ * φ, and the fee is a fixed fraction of that leg, so the sum over a window is exact up to rounding:
+ *
+ *   quote in  (price up):   the curve takes q/(1+φ), the fee is q·φ/(1+φ)
+ *   quote out (price down): the curve releases q/(1−φ), the fee is q·φ/(1−φ)
+ *
+ * Both equal φ·L·|Δx| summed over the swap's segments — the same φ·|dx| per unit L that `F` books.
+ */
+import type { LogswapClient } from "./client.js";
+import type { DiscoveredMarket } from "./pools.js";
+/** The fee one swap paid, in quote, from its `Swap` event's fields. */
+export declare function swapFeeOf(e: {
+    baseIn: boolean;
+    amountIn: bigint;
+    amountOut: bigint;
+}, phi: bigint): bigint;
+/** Swap fees paid over a window, in the market's quote units. */
+export interface SwapFeeWindow {
+    fromBlock: bigint;
+    toBlock: bigint;
+    /** Window start, unix seconds — `since`, or the first block's timestamp, never before the market opened. */
+    from: bigint;
+    /** Window end, unix seconds — the last block's timestamp. */
+    to: bigint;
+    seconds: bigint;
+    swapFees: bigint;
+    swaps: number;
+}
+/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+export declare function blockAtOrAfter(c: LogswapClient, t: bigint, lo: bigint, hi: bigint): Promise<bigint>;
+/**
+ * Sum the swap fees of market `m` over a window: from `since` (unix seconds) or `fromBlock`, to
+ * `toBlock` (default latest). Either start is clamped to the market's opening, so a period longer
+ * than the market's life measures its whole life and `seconds` says how long that was.
+ */
+export declare function swapFees(c: LogswapClient, m: DiscoveredMarket, opts?: {
+    since?: bigint;
+    fromBlock?: bigint;
+    toBlock?: bigint;
+}): Promise<SwapFeeWindow>;
+/**
+ * The window's swap fees over the market's CURRENT active L, annualised linearly over the window.
+ * A fraction: 0.12 is 12%. Linear: fees are paid out, so none compound.
+ *
+ * Per unit of L. An uncapped position is worth L·(x − ξ + 1), so its return on capital is this
+ * divided by (x − ξ + 1).
+ */
+export declare function swapFeeApy(w: Pick<SwapFeeWindow, "swapFees" | "seconds">, lActive: bigint): number;

package/dist/fees.js

@@ -0,0 +1,79 @@
+/**
+ * fees.ts — swap fees over a window, from `Swap` logs.
+ *
+ * `F` cannot answer "what did takers pay this week": it is per unit of L, it carries the mint-fee
+ * credits as well as swap fees, and it has no window. Each `Swap` event carries the quote leg and
+ * φ, and the fee is a fixed fraction of that leg, so the sum over a window is exact up to rounding:
+ *
+ *   quote in  (price up):   the curve takes q/(1+φ), the fee is q·φ/(1+φ)
+ *   quote out (price down): the curve releases q/(1−φ), the fee is q·φ/(1−φ)
+ *
+ * Both equal φ·L·|Δx| summed over the swap's segments — the same φ·|dx| per unit L that `F` books.
+ */
+import { cPoolManagerAbi } from "./generated.js";
+const WAD = 10n ** 18n;
+const YEAR_SECONDS = 31_536_000;
+/** The fee one swap paid, in quote, from its `Swap` event's fields. */
+export function swapFeeOf(e, phi) {
+    return e.baseIn ? (e.amountOut * phi) / (WAD - phi) : (e.amountIn * phi) / (WAD + phi);
+}
+/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+export async function blockAtOrAfter(c, t, lo, hi) {
+    while (lo < hi) {
+        const mid = (lo + hi) / 2n;
+        if ((await c.public.getBlock({ blockNumber: mid })).timestamp < t)
+            lo = mid + 1n;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+/**
+ * Sum the swap fees of market `m` over a window: from `since` (unix seconds) or `fromBlock`, to
+ * `toBlock` (default latest). Either start is clamped to the market's opening, so a period longer
+ * than the market's life measures its whole life and `seconds` says how long that was.
+ */
+export async function swapFees(c, m, opts = {}) {
+    const toBlock = opts.toBlock ?? (await c.public.getBlockNumber());
+    const [opened, last] = await Promise.all([
+        c.public.getBlock({ blockNumber: m.blockNumber }),
+        c.public.getBlock({ blockNumber: toBlock }),
+    ]);
+    let fromBlock;
+    let from;
+    if (opts.since !== undefined && opts.since > opened.timestamp) {
+        fromBlock = await blockAtOrAfter(c, opts.since, m.blockNumber, toBlock);
+        from = opts.since;
+    }
+    else if (opts.fromBlock !== undefined && opts.fromBlock > m.blockNumber) {
+        fromBlock = opts.fromBlock;
+        from = (await c.public.getBlock({ blockNumber: fromBlock })).timestamp;
+    }
+    else {
+        fromBlock = m.blockNumber;
+        from = opened.timestamp;
+    }
+    const ev = cPoolManagerAbi.find((x) => x.type === "event" && x.name === "Swap");
+    if (!ev)
+        throw new Error("logswap: Swap event missing from the generated ABI");
+    const logs = fromBlock > toBlock
+        ? []
+        : await c.public.getLogs({ address: c.addresses.cPoolManager, event: ev, args: { poolId: m.poolId }, fromBlock, toBlock });
+    let fees = 0n;
+    for (const l of logs)
+        fees += swapFeeOf({ baseIn: l.args.baseIn, amountIn: l.args.amountIn, amountOut: l.args.amountOut }, l.args.phi);
+    const to = last.timestamp;
+    return { fromBlock, toBlock, from, to, seconds: to > from ? to - from : 0n, swapFees: fees, swaps: logs.length };
+}
+/**
+ * The window's swap fees over the market's CURRENT active L, annualised linearly over the window.
+ * A fraction: 0.12 is 12%. Linear: fees are paid out, so none compound.
+ *
+ * Per unit of L. An uncapped position is worth L·(x − ξ + 1), so its return on capital is this
+ * divided by (x − ξ + 1).
+ */
+export function swapFeeApy(w, lActive) {
+    if (w.seconds <= 0n || lActive <= 0n)
+        return 0;
+    return (Number(w.swapFees) / Number(lActive)) * (YEAR_SECONDS / Number(w.seconds));
+}

package/dist/fpool.d.ts

@@ -807,7 +807,12 @@ export interface FPoolSwapArgs {
     /** Leg index into `bases`. */
     j: number;
     amountIn: bigint;
-    minOut?: bigint;
+    /**
+     * The least the swap must return. Required: an F swap is exact-in, and without a floor on the
+     * output a front-run takes the difference. {@link fPoolQuoteSwap} is exact; bound it with
+     * {@link withSlippage} (`"output"`).
+     */
+    minOut: bigint;
     /** Who receives the out leg. Defaults to the account. */
     to?: Address;
     /** Absolute unix seconds. Defaulted to a bounded window, as every router write is. */
@@ -825,10 +830,12 @@ export declare function fPoolSwapBaseForBase(c: LogswapClient, a: FPoolSwapArgs
     k: number;
 }): Promise<`0x${string}`>;
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
-export declare function fPoolMint(c: LogswapClient, a: {
+export declare function fPoolMint(c: LogswapClient, 
+/** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+a: {
     poolId: Hex;
     dL: bigint;
-    maxQuoteIn?: bigint;
+    maxQuoteIn: bigint;
     account: Address;
     to?: Address;
 }): Promise<`0x${string}`>;
@@ -837,13 +844,28 @@ export declare function fPoolMint(c: LogswapClient, a: {
  * By owner since contracts `c782811` (decisions 019): the account burns its own shares; an
  * operator may pass another owner's address, as on the C manager's `burnById`.
  */
-export declare function fPoolBurn(c: LogswapClient, a: {
+export declare function fPoolBurn(c: LogswapClient, 
+/** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+a: {
     poolId: Hex;
     shares: bigint;
-    minQuoteOut?: bigint;
+    minQuoteOut: bigint;
     account: Address;
     owner?: Address;
 }): Promise<`0x${string}`>;
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export declare function fPoolPreviewBurn(st: Pick<FPoolState, "Q" | "reserves" | "totalSupply">, shares: bigint): {
+    quoteOut: bigint;
+    basesOut: bigint[];
+};
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export declare function fPoolPreviewMintQuote(st: Pick<FPoolState, "Q" | "L">, dL: bigint): bigint;
 /**
  * Quote needed to zap into exposure `dL`. An UPPER bound: buying each leg raises its mark, so the
  * mint consumes less base than was bought for it and every zap ends with a refund. Size from this
@@ -874,15 +896,28 @@ export declare function fPoolZapIn(c: LogswapClient, a: {
  * cross the floor; only the burn's own quote slice touches the quote leg. Into the quote every
  * base leg is sold, which is the one path a drained quote leg can block.
  */
-export declare function fPoolZapOut(c: LogswapClient, a: {
+export declare function fPoolZapOut(c: LogswapClient, 
+/** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+a: {
     poolId: Hex;
     shares: bigint;
     tokenOut: Address;
-    minOut?: bigint;
+    minOut: bigint;
     to?: Address;
     account: Address;
     deadline?: bigint;
 }): Promise<`0x${string}`>;
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export declare function fPoolPreviewZapOut(c: LogswapClient, a: {
+    poolId: Hex;
+    shares: bigint;
+    tokenOut: Address;
+    account: Address;
+}): Promise<bigint>;
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the
  * router under one lock: redeem `shares` of generation `gen` in place — the legs, the quote and

package/dist/fpool.js

@@ -222,7 +222,7 @@ export function fPoolShareValue(s) {
 async function fSwap(c, a, kind, k = 0) {
     const st = await getFPool(c, a.poolId);
     const pull = kind === FPoolQuoteKind.QuoteIn ? st.quote : st.bases[a.j];
-    return writeRouter(c, "swapExactIn", [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut ?? 0n, a.to ?? a.account, a.deadline ?? defaultDeadline()], a.account, [pull]);
+    return writeRouter(c, "swapExactIn", [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut, a.to ?? a.account, a.deadline ?? defaultDeadline()], a.account, [pull]);
 }
 export async function fPoolSwapQuoteIn(c, a) {
     return fSwap(c, a, FPoolQuoteKind.QuoteIn);
@@ -240,17 +240,37 @@ export async function fPoolSwapBaseForBase(c, a) {
 }
 // ─── liquidity ────────────────────────────────────────────────────────────────
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
-export async function fPoolMint(c, a) {
+export async function fPoolMint(c, 
+/** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+a) {
     // shares go to `to` (the account by default); on a gated pool `to` must be allowed
-    return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn ?? 2n ** 256n - 1n], a.account);
+    return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn], a.account);
 }
 /**
  * Burn shares for the pro-rata slice of every reserve. Available at any Q, and after dissolution.
  * By owner since contracts `c782811` (decisions 019): the account burns its own shares; an
  * operator may pass another owner's address, as on the C manager's `burnById`.
  */
-export async function fPoolBurn(c, a) {
-    return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut ?? 0n], a.account);
+export async function fPoolBurn(c, 
+/** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+a) {
+    return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut], a.account);
+}
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export function fPoolPreviewBurn(st, shares) {
+    if (st.totalSupply === 0n)
+        return { quoteOut: 0n, basesOut: st.reserves.map(() => 0n) };
+    return { quoteOut: (st.Q * shares) / st.totalSupply, basesOut: st.reserves.map((r) => (r * shares) / st.totalSupply) };
+}
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export function fPoolPreviewMintQuote(st, dL) {
+    return st.L === 0n ? 0n : (st.Q * dL + st.L - 1n) / st.L;
 }
 // ─── zaps (on the router — one router, one Permit2 spender) ───────────────────
 /**
@@ -288,9 +308,26 @@ export async function fPoolZapIn(c, a) {
  * cross the floor; only the burn's own quote slice touches the quote leg. Into the quote every
  * base leg is sold, which is the one path a drained quote leg can block.
  */
-export async function fPoolZapOut(c, a) {
+export async function fPoolZapOut(c, 
+/** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+a) {
     const to = a.to ?? a.account;
-    return writeRouter(c, "zapOut", [a.poolId, a.shares, a.tokenOut, a.minOut ?? 0n, to, a.deadline ?? defaultDeadline()], a.account);
+    return writeRouter(c, "zapOut", [a.poolId, a.shares, a.tokenOut, a.minOut, to, a.deadline ?? defaultDeadline()], a.account);
+}
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export async function fPoolPreviewZapOut(c, a) {
+    const { result } = await c.public.simulateContract({
+        address: c.addresses.router,
+        abi: logswapRouterAbi,
+        functionName: "zapOut",
+        args: [a.poolId, a.shares, a.tokenOut, 0n, a.account, defaultDeadline()],
+        account: a.account,
+    });
+    return result;
 }
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the

package/dist/index.d.ts

@@ -19,5 +19,6 @@ export * from "./onboard.js";
 export * from "./indexer.js";
 export * from "./tokencache.js";
 export * from "./fpool.js";
+export * from "./fees.js";
 export { cPoolManagerAbi, fPoolManagerAbi, logswapLensAbi, logswapRouterAbi, padPolicyAbi, polPolicyAbi, policyRegistryAbi, privatePolicyAbi, publicPolicyAbi } from "./generated.js";
 export * from "./admin.js";

package/dist/index.js

@@ -19,5 +19,6 @@ export * from "./onboard.js";
 export * from "./indexer.js";
 export * from "./tokencache.js";
 export * from "./fpool.js";
+export * from "./fees.js";
 export { cPoolManagerAbi, fPoolManagerAbi, logswapLensAbi, logswapRouterAbi, padPolicyAbi, polPolicyAbi, policyRegistryAbi, privatePolicyAbi, publicPolicyAbi } from "./generated.js";
 export * from "./admin.js";

package/dist/liquidity.d.ts

@@ -33,8 +33,14 @@ export interface MintArgs extends WriteOptions {
     cap?: bigint;
     /** Exposure to add. */
     L: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /**
+     * The most the mint may pull, per token. REQUIRED: the pulled amounts depend on spot when the
+     * transaction lands, so an unbounded mint can be sandwiched into depositing far more than the
+     * preview showed. Derive them from the preview with {@link withSlippage} (`"input"`); pass
+     * {@link UNBOUNDED} only where the price cannot move under you.
+     */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Mint at `targetFloor`, blending across the two adjacent rungs when it is off-grid.
@@ -55,8 +61,9 @@ export interface CreateMarketArgs extends WriteOptions {
     targetFloor: bigint;
     /** The founding exposure; must exceed the manager's `minBackstopL` lock. */
     L: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required, as on {@link mint}. Creation is atomic at `x0`, so the flows are fixed by the arguments; {@link UNBOUNDED} is safe here only for that reason. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Create a market ATOMICALLY: `initialize` at `x0` plus the backstop-establishing first mint in
@@ -72,12 +79,13 @@ export interface ZapArgs extends WriteOptions {
     /** Fund entirely from base (true) or entirely from quote (false). */
     fundWithBase: boolean;
     amountIn: bigint;
-    /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. 0 = unbounded. */
-    minSwapOut?: bigint;
+    /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. Required. */
+    minSwapOut: bigint;
     targetFloor: bigint;
     cap?: bigint;
     L: bigint;
-    maxIn?: bigint;
+    /** The most of the funding token the zap may pull. Required. */
+    maxIn: bigint;
 }
 /**
  * Fund a mint from a single asset: the router swaps the imbalanced part through the curve, then
@@ -96,8 +104,9 @@ export interface UpdateArgs extends WriteOptions {
     toCap?: bigint;
     /** New exposure. `0n` exits the position entirely. */
     newL: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required: see {@link MintArgs}. {@link previewEdit} gives the exact flows to bound. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export declare function update(c: LogswapClient, a: UpdateArgs): Promise<Hash>;
@@ -107,16 +116,16 @@ export interface MoveArgs extends WriteOptions {
     shares: bigint;
     toFloor: bigint;
     toCap?: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required: see {@link MintArgs}. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Reposition at constant exposure — the L-pinned parent of `floor`, `cap` and `shift`; in kind.
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export declare function move(c: LogswapClient, a: MoveArgs): Promise<Hash>;
 /** Which token the edit settles in. `kind` moves both legs; `base` / `quote` nets the other side through the curve. */
@@ -128,6 +137,13 @@ export interface EditArgs extends WriteOptions, PairBounds {
     shares: bigint;
     /** Default `kind`. */
     settleIn?: SettleIn;
+    /**
+     * Tolerance in basis points, applied to the flows the edit is expected to move (the lens's
+     * exact preview, plus a quote of the netting swap when `settleIn` is one token). Required: an
+     * edit's flows depend on spot when it lands. An explicit bound in `PairBounds` overrides the one
+     * derived for that token.
+     */
+    slippageBps: number;
 }
 export interface EditPreview {
     /** Signed, + = the caller deposits; the mint fee is inside `dQuote`. */
@@ -146,11 +162,22 @@ export declare function previewEdit(c: LogswapClient, a: {
     toCap?: bigint;
     newL: bigint;
 }): Promise<EditPreview>;
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export declare function boundsFromFlows(dBase: bigint, dQuote: bigint, bps: number): Required<PairBounds>;
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export declare function edit(c: LogswapClient, a: EditArgs & {
     toFloor: bigint;
@@ -213,8 +240,9 @@ export interface BurnArgs extends WriteOptions {
     key: PoolKey;
     ids: readonly bigint[];
     shares: readonly bigint[];
-    minBaseOut?: bigint;
-    minQuoteOut?: bigint;
+    /** The least of each token the burn must return. Required: a burn's legs depend on spot. */
+    minBaseOut: bigint;
+    minQuoteOut: bigint;
 }
 /**
  * Exit, in kind, across one or more classes. Accrued fees are swept into the same settlement.

package/dist/liquidity.js

@@ -25,7 +25,8 @@ import { logswapLensAbi, logswapRouterAbi } from "./generated.js";
 import { NO_CAP } from "./ids.js";
 import { describeId, getPositionClass } from "./positions.js";
 import { execute, OPEN_DELTA, settleInKind, settleOnly, swapExactInAction, swapExactOutAction, updateAction, } from "./actions.js";
-import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, } from "./write.js";
+import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, withSlippage, } from "./write.js";
+import { quoteExactIn, quoteExactOut } from "./swap.js";
 /**
  * Mint at `targetFloor`, blending across the two adjacent rungs when it is off-grid.
  *
@@ -37,7 +38,6 @@ import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, send
  * costs zero quote too — that is what makes single-asset entry possible in both directions.
  */
 export async function mint(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "mintBlended",
@@ -46,8 +46,8 @@ export async function mint(c, a) {
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -62,7 +62,6 @@ export async function mint(c, a) {
  * uncapped.
  */
 export async function createMarket(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "createMarket",
@@ -71,8 +70,8 @@ export async function createMarket(c, a) {
             a.x0,
             a.targetFloor,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -94,11 +93,11 @@ export async function zapIn(c, a) {
             a.key,
             a.fundWithBase,
             a.amountIn,
-            a.minSwapOut ?? 0n,
+            a.minSwapOut,
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxIn ?? (1n << 256n) - 1n,
+            a.maxIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -106,7 +105,6 @@ export async function zapIn(c, a) {
 }
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export async function update(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "update",
@@ -117,8 +115,8 @@ export async function update(c, a) {
             a.toFloor,
             a.toCap ?? NO_CAP,
             a.newL,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -129,11 +127,9 @@ export async function update(c, a) {
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export async function move(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWrite(c, {
         abi: logswapRouterAbi,
         functionName: "move",
@@ -143,8 +139,8 @@ export async function move(c, a) {
             a.shares,
             a.toFloor,
             a.toCap ?? NO_CAP,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -161,11 +157,26 @@ export async function previewEdit(c, a) {
     }));
     return { dBase: r[0], dQuote: r[1], fees: r[2] };
 }
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export function boundsFromFlows(dBase, dQuote, bps) {
+    const inb = (d) => (d > 0n ? withSlippage(d, bps, "input") : 0n);
+    const outb = (d) => (d < 0n ? withSlippage(-d, bps, "output") : 0n);
+    return { maxBaseIn: inb(dBase), maxQuoteIn: inb(dQuote), minBaseOut: outb(dBase), minQuoteOut: outb(dQuote) };
+}
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export async function edit(c, a) {
     const { key } = a;
@@ -174,27 +185,37 @@ export async function edit(c, a) {
         updateAction({ key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL }),
     ];
     const settleIn = a.settleIn ?? "kind";
+    const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
     let settle;
     if (settleIn === "kind") {
-        settle = settleInKind(key, recipient, a);
+        settle = settleInKind(key, recipient, { ...boundsFromFlows(p.dBase, p.dQuote, a.slippageBps), ...defined(a) });
     }
     else {
-        const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
         // the swept fees ride INSIDE dQuote (the manager burns by owner and nets them; decisions 018),
         // so quote's open delta after the update is dQuote itself — `fees` is reported for display only
         const otherFlow = settleIn === "base" ? p.dQuote : p.dBase; // + = owed, − = released
         const otherIsBase = settleIn === "quote";
-        if (otherFlow < 0n)
+        let own = settleIn === "base" ? p.dBase : p.dQuote;
+        if (otherFlow < 0n) {
             actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
-        else if (otherFlow > 0n)
+            own -= await quoteExactIn(c, key, otherIsBase, -otherFlow);
+        }
+        else if (otherFlow > 0n) {
             actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+            own += await quoteExactOut(c, key, otherIsBase, otherFlow);
+        }
+        const b = settleIn === "base" ? boundsFromFlows(own, 0n, a.slippageBps) : boundsFromFlows(0n, own, a.slippageBps);
         settle = settleOnly(key, recipient, settleIn, {
-            maxIn: settleIn === "base" ? a.maxBaseIn : a.maxQuoteIn,
-            minOut: settleIn === "base" ? a.minBaseOut : a.minQuoteOut,
+            maxIn: settleIn === "base" ? (a.maxBaseIn ?? b.maxBaseIn) : (a.maxQuoteIn ?? b.maxQuoteIn),
+            minOut: settleIn === "base" ? (a.minBaseOut ?? b.minBaseOut) : (a.minQuoteOut ?? b.minQuoteOut),
         });
     }
     return execute(c, { actions, settle, deadline: a.deadline, recipient });
 }
+/** The explicit bounds a caller passed, without the undefined ones (so they do not erase derived ones). */
+function defined(b) {
+    return Object.fromEntries(["maxBaseIn", "maxQuoteIn", "minBaseOut", "minQuoteOut"].filter((k) => b[k] !== undefined).map((k) => [k, b[k]]));
+}
 /** The class behind `shares` of `id`: its floor, cap, and the exposure those shares carry. */
 async function classOf(c, key, id, shares) {
     const [d, cls] = await Promise.all([describeId(c, id, key.tickSpacing), getPositionClass(c, id)]);
@@ -297,8 +318,8 @@ export async function burn(c, a) {
             a.key,
             a.ids,
             a.shares,
-            a.minBaseOut ?? 0n,
-            a.minQuoteOut ?? 0n,
+            a.minBaseOut,
+            a.minQuoteOut,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],

package/dist/write.js

@@ -53,7 +53,8 @@ export function withSlippage(quoted, bps, side) {
     if (bps < 0 || bps > 10_000)
         throw new Error(`logswap: slippage bps out of range: ${bps}`);
     const b = BigInt(Math.round(bps));
-    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b)) / 10000n;
+    // an input bound rounds UP: flooring it would put a wei-exact quote at bps = 0 one wei short
+    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b) + 9999n) / 10000n;
 }
 /**
  * Send a router write with a gas buffer over an explicit estimate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logswap/sdk",
-  "version": "0.5.51",
+  "version": "0.5.53",
   "description": "TypeScript SDK for Logswap, the liquidity primitive introducing the logarithmic invariant — typed wrappers over the CPoolManager / FPoolManager / Router / Lens surface.",
   "license": "GPL-2.0-or-later",
   "type": "module",
@@ -25,6 +25,7 @@
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf dist src/generated.ts",
     "test": "vitest run",
+    "test:isolated": "bash scripts/test-isolated.sh",
     "test:watch": "vitest",
     "prepublishOnly": "npm run codegen && npm run build"
   },

package/src/fees.ts

@@ -0,0 +1,103 @@
+/**
+ * fees.ts — swap fees over a window, from `Swap` logs.
+ *
+ * `F` cannot answer "what did takers pay this week": it is per unit of L, it carries the mint-fee
+ * credits as well as swap fees, and it has no window. Each `Swap` event carries the quote leg and
+ * φ, and the fee is a fixed fraction of that leg, so the sum over a window is exact up to rounding:
+ *
+ *   quote in  (price up):   the curve takes q/(1+φ), the fee is q·φ/(1+φ)
+ *   quote out (price down): the curve releases q/(1−φ), the fee is q·φ/(1−φ)
+ *
+ * Both equal φ·L·|Δx| summed over the swap's segments — the same φ·|dx| per unit L that `F` books.
+ */
+
+import type { LogswapClient } from "./client.js";
+import { cPoolManagerAbi } from "./generated.js";
+import type { DiscoveredMarket } from "./pools.js";
+
+const WAD = 10n ** 18n;
+const YEAR_SECONDS = 31_536_000;
+
+/** The fee one swap paid, in quote, from its `Swap` event's fields. */
+export function swapFeeOf(e: { baseIn: boolean; amountIn: bigint; amountOut: bigint }, phi: bigint): bigint {
+  return e.baseIn ? (e.amountOut * phi) / (WAD - phi) : (e.amountIn * phi) / (WAD + phi);
+}
+
+/** Swap fees paid over a window, in the market's quote units. */
+export interface SwapFeeWindow {
+  fromBlock: bigint;
+  toBlock: bigint;
+  /** Window start, unix seconds — `since`, or the first block's timestamp, never before the market opened. */
+  from: bigint;
+  /** Window end, unix seconds — the last block's timestamp. */
+  to: bigint;
+  seconds: bigint;
+  swapFees: bigint;
+  swaps: number;
+}
+
+/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+export async function blockAtOrAfter(c: LogswapClient, t: bigint, lo: bigint, hi: bigint): Promise<bigint> {
+  while (lo < hi) {
+    const mid = (lo + hi) / 2n;
+    if ((await c.public.getBlock({ blockNumber: mid })).timestamp < t) lo = mid + 1n;
+    else hi = mid;
+  }
+  return lo;
+}
+
+/**
+ * Sum the swap fees of market `m` over a window: from `since` (unix seconds) or `fromBlock`, to
+ * `toBlock` (default latest). Either start is clamped to the market's opening, so a period longer
+ * than the market's life measures its whole life and `seconds` says how long that was.
+ */
+export async function swapFees(
+  c: LogswapClient,
+  m: DiscoveredMarket,
+  opts: { since?: bigint; fromBlock?: bigint; toBlock?: bigint } = {},
+): Promise<SwapFeeWindow> {
+  const toBlock = opts.toBlock ?? (await c.public.getBlockNumber());
+  const [opened, last] = await Promise.all([
+    c.public.getBlock({ blockNumber: m.blockNumber }),
+    c.public.getBlock({ blockNumber: toBlock }),
+  ]);
+
+  let fromBlock: bigint;
+  let from: bigint;
+  if (opts.since !== undefined && opts.since > opened.timestamp) {
+    fromBlock = await blockAtOrAfter(c, opts.since, m.blockNumber, toBlock);
+    from = opts.since;
+  } else if (opts.fromBlock !== undefined && opts.fromBlock > m.blockNumber) {
+    fromBlock = opts.fromBlock;
+    from = (await c.public.getBlock({ blockNumber: fromBlock })).timestamp;
+  } else {
+    fromBlock = m.blockNumber;
+    from = opened.timestamp;
+  }
+
+  type Ev = Extract<(typeof cPoolManagerAbi)[number], { type: "event"; name: "Swap" }>;
+  const ev = cPoolManagerAbi.find((x): x is Ev => x.type === "event" && x.name === "Swap");
+  if (!ev) throw new Error("logswap: Swap event missing from the generated ABI");
+
+  const logs = fromBlock > toBlock
+    ? []
+    : await c.public.getLogs({ address: c.addresses.cPoolManager, event: ev, args: { poolId: m.poolId }, fromBlock, toBlock });
+
+  let fees = 0n;
+  for (const l of logs) fees += swapFeeOf({ baseIn: l.args.baseIn!, amountIn: l.args.amountIn!, amountOut: l.args.amountOut! }, l.args.phi!);
+
+  const to = last.timestamp;
+  return { fromBlock, toBlock, from, to, seconds: to > from ? to - from : 0n, swapFees: fees, swaps: logs.length };
+}
+
+/**
+ * The window's swap fees over the market's CURRENT active L, annualised linearly over the window.
+ * A fraction: 0.12 is 12%. Linear: fees are paid out, so none compound.
+ *
+ * Per unit of L. An uncapped position is worth L·(x − ξ + 1), so its return on capital is this
+ * divided by (x − ξ + 1).
+ */
+export function swapFeeApy(w: Pick<SwapFeeWindow, "swapFees" | "seconds">, lActive: bigint): number {
+  if (w.seconds <= 0n || lActive <= 0n) return 0;
+  return (Number(w.swapFees) / Number(lActive)) * (YEAR_SECONDS / Number(w.seconds));
+}

package/src/fpool.ts

@@ -359,7 +359,12 @@ export interface FPoolSwapArgs {
   /** Leg index into `bases`. */
   j: number;
   amountIn: bigint;
-  minOut?: bigint;
+  /**
+   * The least the swap must return. Required: an F swap is exact-in, and without a floor on the
+   * output a front-run takes the difference. {@link fPoolQuoteSwap} is exact; bound it with
+   * {@link withSlippage} (`"output"`).
+   */
+  minOut: bigint;
   /** Who receives the out leg. Defaults to the account. */
   to?: Address;
   /** Absolute unix seconds. Defaulted to a bounded window, as every router write is. */
@@ -379,7 +384,7 @@ async function fSwap(c: LogswapClient, a: FPoolSwapArgs, kind: FPoolQuoteKind, k
   return writeRouter(
     c,
     "swapExactIn",
-    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut ?? 0n, a.to ?? a.account, a.deadline ?? defaultDeadline()],
+    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut, a.to ?? a.account, a.deadline ?? defaultDeadline()],
     a.account,
     [pull],
   );
@@ -407,10 +412,11 @@ export async function fPoolSwapBaseForBase(c: LogswapClient, a: FPoolSwapArgs &
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
 export async function fPoolMint(
   c: LogswapClient,
-  a: { poolId: Hex; dL: bigint; maxQuoteIn?: bigint; account: Address; to?: Address },
+  /** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+  a: { poolId: Hex; dL: bigint; maxQuoteIn: bigint; account: Address; to?: Address },
 ) {
   // shares go to `to` (the account by default); on a gated pool `to` must be allowed
-  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn ?? 2n ** 256n - 1n], a.account);
+  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn], a.account);
 }
 
 /**
@@ -420,9 +426,27 @@ export async function fPoolMint(
  */
 export async function fPoolBurn(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; minQuoteOut?: bigint; account: Address; owner?: Address },
+  /** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+  a: { poolId: Hex; shares: bigint; minQuoteOut: bigint; account: Address; owner?: Address },
 ) {
-  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut ?? 0n], a.account);
+  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut], a.account);
+}
+
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export function fPoolPreviewBurn(st: Pick<FPoolState, "Q" | "reserves" | "totalSupply">, shares: bigint): { quoteOut: bigint; basesOut: bigint[] } {
+  if (st.totalSupply === 0n) return { quoteOut: 0n, basesOut: st.reserves.map(() => 0n) };
+  return { quoteOut: (st.Q * shares) / st.totalSupply, basesOut: st.reserves.map((r) => (r * shares) / st.totalSupply) };
+}
+
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export function fPoolPreviewMintQuote(st: Pick<FPoolState, "Q" | "L">, dL: bigint): bigint {
+  return st.L === 0n ? 0n : (st.Q * dL + st.L - 1n) / st.L;
 }
 
 // ─── zaps (on the router — one router, one Permit2 spender) ───────────────────
@@ -475,17 +499,37 @@ export async function fPoolZapIn(
  */
 export async function fPoolZapOut(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut?: bigint; to?: Address; account: Address; deadline?: bigint },
+  /** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut: bigint; to?: Address; account: Address; deadline?: bigint },
 ) {
   const to = a.to ?? a.account;
   return writeRouter(
     c,
     "zapOut",
-    [a.poolId, a.shares, a.tokenOut, a.minOut ?? 0n, to, a.deadline ?? defaultDeadline()],
+    [a.poolId, a.shares, a.tokenOut, a.minOut, to, a.deadline ?? defaultDeadline()],
     a.account,
   );
 }
 
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export async function fPoolPreviewZapOut(
+  c: LogswapClient,
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; account: Address },
+): Promise<bigint> {
+  const { result } = await c.public.simulateContract({
+    address: c.addresses.router,
+    abi: logswapRouterAbi,
+    functionName: "zapOut",
+    args: [a.poolId, a.shares, a.tokenOut, 0n, a.account, defaultDeadline()],
+    account: a.account,
+  } as never);
+  return result as bigint;
+}
+
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the
  * router under one lock: redeem `shares` of generation `gen` in place — the legs, the quote and

package/src/index.ts

@@ -19,5 +19,6 @@ export * from "./onboard.js";
 export * from "./indexer.js";
 export * from "./tokencache.js";
 export * from "./fpool.js";
+export * from "./fees.js";
 export { cPoolManagerAbi, fPoolManagerAbi, logswapLensAbi, logswapRouterAbi, padPolicyAbi, polPolicyAbi, policyRegistryAbi, privatePolicyAbi, publicPolicyAbi } from "./generated.js";
 export * from "./admin.js";

package/src/liquidity.ts

@@ -46,8 +46,10 @@ import {
   resolveRecipient,
   sendRouterWrite,
   sendRouterWriteWithPermits,
+  withSlippage,
   type WriteOptions,
 } from "./write.js";
+import { quoteExactIn, quoteExactOut } from "./swap.js";
 
 /* mint ====================================================================== */
 
@@ -58,8 +60,14 @@ export interface MintArgs extends WriteOptions {
   cap?: bigint;
   /** Exposure to add. */
   L: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /**
+   * The most the mint may pull, per token. REQUIRED: the pulled amounts depend on spot when the
+   * transaction lands, so an unbounded mint can be sandwiched into depositing far more than the
+   * preview showed. Derive them from the preview with {@link withSlippage} (`"input"`); pass
+   * {@link UNBOUNDED} only where the price cannot move under you.
+   */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -73,7 +81,6 @@ export interface MintArgs extends WriteOptions {
  * costs zero quote too — that is what makes single-asset entry possible in both directions.
  */
 export async function mint(c: LogswapClient, a: MintArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "mintBlended",
@@ -82,8 +89,8 @@ export async function mint(c: LogswapClient, a: MintArgs): Promise<Hash> {
       a.targetFloor,
       a.cap ?? NO_CAP,
       a.L,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -98,8 +105,9 @@ export interface CreateMarketArgs extends WriteOptions {
   targetFloor: bigint;
   /** The founding exposure; must exceed the manager's `minBackstopL` lock. */
   L: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required, as on {@link mint}. Creation is atomic at `x0`, so the flows are fixed by the arguments; {@link UNBOUNDED} is safe here only for that reason. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -111,7 +119,6 @@ export interface CreateMarketArgs extends WriteOptions {
  * uncapped.
  */
 export async function createMarket(c: LogswapClient, a: CreateMarketArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "createMarket",
@@ -120,8 +127,8 @@ export async function createMarket(c: LogswapClient, a: CreateMarketArgs): Promi
       a.x0,
       a.targetFloor,
       a.L,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -133,12 +140,13 @@ export interface ZapArgs extends WriteOptions {
   /** Fund entirely from base (true) or entirely from quote (false). */
   fundWithBase: boolean;
   amountIn: bigint;
-  /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. 0 = unbounded. */
-  minSwapOut?: bigint;
+  /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. Required. */
+  minSwapOut: bigint;
   targetFloor: bigint;
   cap?: bigint;
   L: bigint;
-  maxIn?: bigint;
+  /** The most of the funding token the zap may pull. Required. */
+  maxIn: bigint;
 }
 
 /**
@@ -157,11 +165,11 @@ export async function zapIn(c: LogswapClient, a: ZapArgs): Promise<Hash> {
       a.key,
       a.fundWithBase,
       a.amountIn,
-      a.minSwapOut ?? 0n,
+      a.minSwapOut,
       a.targetFloor,
       a.cap ?? NO_CAP,
       a.L,
-      a.maxIn ?? (1n << 256n) - 1n,
+      a.maxIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -178,13 +186,13 @@ export interface UpdateArgs extends WriteOptions {
   toCap?: bigint;
   /** New exposure. `0n` exits the position entirely. */
   newL: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required: see {@link MintArgs}. {@link previewEdit} gives the exact flows to bound. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export async function update(c: LogswapClient, a: UpdateArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "update",
@@ -195,8 +203,8 @@ export async function update(c: LogswapClient, a: UpdateArgs): Promise<Hash> {
       a.toFloor,
       a.toCap ?? NO_CAP,
       a.newL,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -209,8 +217,9 @@ export interface MoveArgs extends WriteOptions {
   shares: bigint;
   toFloor: bigint;
   toCap?: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required: see {@link MintArgs}. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -218,11 +227,9 @@ export interface MoveArgs extends WriteOptions {
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export async function move(c: LogswapClient, a: MoveArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWrite(c, {
     abi: logswapRouterAbi,
     functionName: "move",
@@ -232,8 +239,8 @@ export async function move(c: LogswapClient, a: MoveArgs): Promise<Hash> {
       a.shares,
       a.toFloor,
       a.toCap ?? NO_CAP,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -252,6 +259,13 @@ export interface EditArgs extends WriteOptions, PairBounds {
   shares: bigint;
   /** Default `kind`. */
   settleIn?: SettleIn;
+  /**
+   * Tolerance in basis points, applied to the flows the edit is expected to move (the lens's
+   * exact preview, plus a quote of the netting swap when `settleIn` is one token). Required: an
+   * edit's flows depend on spot when it lands. An explicit bound in `PairBounds` overrides the one
+   * derived for that token.
+   */
+  slippageBps: number;
 }
 
 export interface EditPreview {
@@ -277,11 +291,27 @@ export async function previewEdit(
   return { dBase: r[0], dQuote: r[1], fees: r[2] };
 }
 
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export function boundsFromFlows(dBase: bigint, dQuote: bigint, bps: number): Required<PairBounds> {
+  const inb = (d: bigint) => (d > 0n ? withSlippage(d, bps, "input") : 0n);
+  const outb = (d: bigint) => (d < 0n ? withSlippage(-d, bps, "output") : 0n);
+  return { maxBaseIn: inb(dBase), maxQuoteIn: inb(dQuote), minBaseOut: outb(dBase), minQuoteOut: outb(dQuote) };
+}
+
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export async function edit(c: LogswapClient, a: EditArgs & { toFloor: bigint; toCap?: bigint; newL: bigint }): Promise<Hash> {
   const { key } = a;
@@ -290,25 +320,39 @@ export async function edit(c: LogswapClient, a: EditArgs & { toFloor: bigint; to
     updateAction({ key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL }),
   ];
   const settleIn = a.settleIn ?? "kind";
+  const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
   let settle: Settle;
   if (settleIn === "kind") {
-    settle = settleInKind(key, recipient, a);
+    settle = settleInKind(key, recipient, { ...boundsFromFlows(p.dBase, p.dQuote, a.slippageBps), ...defined(a) });
   } else {
-    const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
     // the swept fees ride INSIDE dQuote (the manager burns by owner and nets them; decisions 018),
     // so quote's open delta after the update is dQuote itself — `fees` is reported for display only
     const otherFlow = settleIn === "base" ? p.dQuote : p.dBase; // + = owed, − = released
     const otherIsBase = settleIn === "quote";
-    if (otherFlow < 0n) actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
-    else if (otherFlow > 0n) actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+    let own = settleIn === "base" ? p.dBase : p.dQuote;
+    if (otherFlow < 0n) {
+      actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
+      own -= await quoteExactIn(c, key, otherIsBase, -otherFlow);
+    } else if (otherFlow > 0n) {
+      actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+      own += await quoteExactOut(c, key, otherIsBase, otherFlow);
+    }
+    const b = settleIn === "base" ? boundsFromFlows(own, 0n, a.slippageBps) : boundsFromFlows(0n, own, a.slippageBps);
     settle = settleOnly(key, recipient, settleIn, {
-      maxIn: settleIn === "base" ? a.maxBaseIn : a.maxQuoteIn,
-      minOut: settleIn === "base" ? a.minBaseOut : a.minQuoteOut,
+      maxIn: settleIn === "base" ? (a.maxBaseIn ?? b.maxBaseIn) : (a.maxQuoteIn ?? b.maxQuoteIn),
+      minOut: settleIn === "base" ? (a.minBaseOut ?? b.minBaseOut) : (a.minQuoteOut ?? b.minQuoteOut),
     });
   }
   return execute(c, { actions, settle, deadline: a.deadline, recipient });
 }
 
+/** The explicit bounds a caller passed, without the undefined ones (so they do not erase derived ones). */
+function defined(b: PairBounds): PairBounds {
+  return Object.fromEntries(
+    (["maxBaseIn", "maxQuoteIn", "minBaseOut", "minQuoteOut"] as const).filter((k) => b[k] !== undefined).map((k) => [k, b[k]]),
+  );
+}
+
 /** The class behind `shares` of `id`: its floor, cap, and the exposure those shares carry. */
 async function classOf(c: LogswapClient, key: PoolKey, id: bigint, shares: bigint) {
   const [d, cls] = await Promise.all([describeId(c, id, key.tickSpacing), getPositionClass(c, id)]);
@@ -405,8 +449,9 @@ export interface BurnArgs extends WriteOptions {
   key: PoolKey;
   ids: readonly bigint[];
   shares: readonly bigint[];
-  minBaseOut?: bigint;
-  minQuoteOut?: bigint;
+  /** The least of each token the burn must return. Required: a burn's legs depend on spot. */
+  minBaseOut: bigint;
+  minQuoteOut: bigint;
 }
 
 /**
@@ -424,8 +469,8 @@ export async function burn(c: LogswapClient, a: BurnArgs): Promise<Hash> {
       a.key,
       a.ids,
       a.shares,
-      a.minBaseOut ?? 0n,
-      a.minQuoteOut ?? 0n,
+      a.minBaseOut,
+      a.minQuoteOut,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],

package/src/write.ts

@@ -68,7 +68,8 @@ export function resolveRecipient(c: LogswapClient, o?: WriteOptions): Address {
 export function withSlippage(quoted: bigint, bps: number, side: "output" | "input"): bigint {
   if (bps < 0 || bps > 10_000) throw new Error(`logswap: slippage bps out of range: ${bps}`);
   const b = BigInt(Math.round(bps));
-  return side === "output" ? (quoted * (10_000n - b)) / 10_000n : (quoted * (10_000n + b)) / 10_000n;
+  // an input bound rounds UP: flooring it would put a wei-exact quote at bps = 0 one wei short
+  return side === "output" ? (quoted * (10_000n - b)) / 10_000n : (quoted * (10_000n + b) + 9_999n) / 10_000n;
 }
 
 /**