@logswap/sdk 0.5.52 → 0.5.53

package/dist/fpool.d.ts

@@ -807,7 +807,12 @@ export interface FPoolSwapArgs {
     /** Leg index into `bases`. */
     j: number;
     amountIn: bigint;
-    minOut?: bigint;
+    /**
+     * The least the swap must return. Required: an F swap is exact-in, and without a floor on the
+     * output a front-run takes the difference. {@link fPoolQuoteSwap} is exact; bound it with
+     * {@link withSlippage} (`"output"`).
+     */
+    minOut: bigint;
     /** Who receives the out leg. Defaults to the account. */
     to?: Address;
     /** Absolute unix seconds. Defaulted to a bounded window, as every router write is. */
@@ -825,10 +830,12 @@ export declare function fPoolSwapBaseForBase(c: LogswapClient, a: FPoolSwapArgs
     k: number;
 }): Promise<`0x${string}`>;
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
-export declare function fPoolMint(c: LogswapClient, a: {
+export declare function fPoolMint(c: LogswapClient, 
+/** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+a: {
     poolId: Hex;
     dL: bigint;
-    maxQuoteIn?: bigint;
+    maxQuoteIn: bigint;
     account: Address;
     to?: Address;
 }): Promise<`0x${string}`>;
@@ -837,13 +844,28 @@ export declare function fPoolMint(c: LogswapClient, a: {
  * By owner since contracts `c782811` (decisions 019): the account burns its own shares; an
  * operator may pass another owner's address, as on the C manager's `burnById`.
  */
-export declare function fPoolBurn(c: LogswapClient, a: {
+export declare function fPoolBurn(c: LogswapClient, 
+/** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+a: {
     poolId: Hex;
     shares: bigint;
-    minQuoteOut?: bigint;
+    minQuoteOut: bigint;
     account: Address;
     owner?: Address;
 }): Promise<`0x${string}`>;
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export declare function fPoolPreviewBurn(st: Pick<FPoolState, "Q" | "reserves" | "totalSupply">, shares: bigint): {
+    quoteOut: bigint;
+    basesOut: bigint[];
+};
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export declare function fPoolPreviewMintQuote(st: Pick<FPoolState, "Q" | "L">, dL: bigint): bigint;
 /**
  * Quote needed to zap into exposure `dL`. An UPPER bound: buying each leg raises its mark, so the
  * mint consumes less base than was bought for it and every zap ends with a refund. Size from this
@@ -874,15 +896,28 @@ export declare function fPoolZapIn(c: LogswapClient, a: {
  * cross the floor; only the burn's own quote slice touches the quote leg. Into the quote every
  * base leg is sold, which is the one path a drained quote leg can block.
  */
-export declare function fPoolZapOut(c: LogswapClient, a: {
+export declare function fPoolZapOut(c: LogswapClient, 
+/** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+a: {
     poolId: Hex;
     shares: bigint;
     tokenOut: Address;
-    minOut?: bigint;
+    minOut: bigint;
     to?: Address;
     account: Address;
     deadline?: bigint;
 }): Promise<`0x${string}`>;
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export declare function fPoolPreviewZapOut(c: LogswapClient, a: {
+    poolId: Hex;
+    shares: bigint;
+    tokenOut: Address;
+    account: Address;
+}): Promise<bigint>;
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the
  * router under one lock: redeem `shares` of generation `gen` in place — the legs, the quote and

package/dist/fpool.js

@@ -222,7 +222,7 @@ export function fPoolShareValue(s) {
 async function fSwap(c, a, kind, k = 0) {
     const st = await getFPool(c, a.poolId);
     const pull = kind === FPoolQuoteKind.QuoteIn ? st.quote : st.bases[a.j];
-    return writeRouter(c, "swapExactIn", [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut ?? 0n, a.to ?? a.account, a.deadline ?? defaultDeadline()], a.account, [pull]);
+    return writeRouter(c, "swapExactIn", [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut, a.to ?? a.account, a.deadline ?? defaultDeadline()], a.account, [pull]);
 }
 export async function fPoolSwapQuoteIn(c, a) {
     return fSwap(c, a, FPoolQuoteKind.QuoteIn);
@@ -240,17 +240,37 @@ export async function fPoolSwapBaseForBase(c, a) {
 }
 // ─── liquidity ────────────────────────────────────────────────────────────────
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
-export async function fPoolMint(c, a) {
+export async function fPoolMint(c, 
+/** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+a) {
     // shares go to `to` (the account by default); on a gated pool `to` must be allowed
-    return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn ?? 2n ** 256n - 1n], a.account);
+    return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn], a.account);
 }
 /**
  * Burn shares for the pro-rata slice of every reserve. Available at any Q, and after dissolution.
  * By owner since contracts `c782811` (decisions 019): the account burns its own shares; an
  * operator may pass another owner's address, as on the C manager's `burnById`.
  */
-export async function fPoolBurn(c, a) {
-    return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut ?? 0n], a.account);
+export async function fPoolBurn(c, 
+/** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+a) {
+    return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut], a.account);
+}
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export function fPoolPreviewBurn(st, shares) {
+    if (st.totalSupply === 0n)
+        return { quoteOut: 0n, basesOut: st.reserves.map(() => 0n) };
+    return { quoteOut: (st.Q * shares) / st.totalSupply, basesOut: st.reserves.map((r) => (r * shares) / st.totalSupply) };
+}
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export function fPoolPreviewMintQuote(st, dL) {
+    return st.L === 0n ? 0n : (st.Q * dL + st.L - 1n) / st.L;
 }
 // ─── zaps (on the router — one router, one Permit2 spender) ───────────────────
 /**
@@ -288,9 +308,26 @@ export async function fPoolZapIn(c, a) {
  * cross the floor; only the burn's own quote slice touches the quote leg. Into the quote every
  * base leg is sold, which is the one path a drained quote leg can block.
  */
-export async function fPoolZapOut(c, a) {
+export async function fPoolZapOut(c, 
+/** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+a) {
     const to = a.to ?? a.account;
-    return writeRouter(c, "zapOut", [a.poolId, a.shares, a.tokenOut, a.minOut ?? 0n, to, a.deadline ?? defaultDeadline()], a.account);
+    return writeRouter(c, "zapOut", [a.poolId, a.shares, a.tokenOut, a.minOut, to, a.deadline ?? defaultDeadline()], a.account);
+}
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export async function fPoolPreviewZapOut(c, a) {
+    const { result } = await c.public.simulateContract({
+        address: c.addresses.router,
+        abi: logswapRouterAbi,
+        functionName: "zapOut",
+        args: [a.poolId, a.shares, a.tokenOut, 0n, a.account, defaultDeadline()],
+        account: a.account,
+    });
+    return result;
 }
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the

package/dist/liquidity.d.ts

@@ -33,8 +33,14 @@ export interface MintArgs extends WriteOptions {
     cap?: bigint;
     /** Exposure to add. */
     L: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /**
+     * The most the mint may pull, per token. REQUIRED: the pulled amounts depend on spot when the
+     * transaction lands, so an unbounded mint can be sandwiched into depositing far more than the
+     * preview showed. Derive them from the preview with {@link withSlippage} (`"input"`); pass
+     * {@link UNBOUNDED} only where the price cannot move under you.
+     */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Mint at `targetFloor`, blending across the two adjacent rungs when it is off-grid.
@@ -55,8 +61,9 @@ export interface CreateMarketArgs extends WriteOptions {
     targetFloor: bigint;
     /** The founding exposure; must exceed the manager's `minBackstopL` lock. */
     L: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required, as on {@link mint}. Creation is atomic at `x0`, so the flows are fixed by the arguments; {@link UNBOUNDED} is safe here only for that reason. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Create a market ATOMICALLY: `initialize` at `x0` plus the backstop-establishing first mint in
@@ -72,12 +79,13 @@ export interface ZapArgs extends WriteOptions {
     /** Fund entirely from base (true) or entirely from quote (false). */
     fundWithBase: boolean;
     amountIn: bigint;
-    /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. 0 = unbounded. */
-    minSwapOut?: bigint;
+    /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. Required. */
+    minSwapOut: bigint;
     targetFloor: bigint;
     cap?: bigint;
     L: bigint;
-    maxIn?: bigint;
+    /** The most of the funding token the zap may pull. Required. */
+    maxIn: bigint;
 }
 /**
  * Fund a mint from a single asset: the router swaps the imbalanced part through the curve, then
@@ -96,8 +104,9 @@ export interface UpdateArgs extends WriteOptions {
     toCap?: bigint;
     /** New exposure. `0n` exits the position entirely. */
     newL: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required: see {@link MintArgs}. {@link previewEdit} gives the exact flows to bound. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export declare function update(c: LogswapClient, a: UpdateArgs): Promise<Hash>;
@@ -107,16 +116,16 @@ export interface MoveArgs extends WriteOptions {
     shares: bigint;
     toFloor: bigint;
     toCap?: bigint;
-    maxBaseIn?: bigint;
-    maxQuoteIn?: bigint;
+    /** Required: see {@link MintArgs}. */
+    maxBaseIn: bigint;
+    maxQuoteIn: bigint;
 }
 /**
  * Reposition at constant exposure — the L-pinned parent of `floor`, `cap` and `shift`; in kind.
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export declare function move(c: LogswapClient, a: MoveArgs): Promise<Hash>;
 /** Which token the edit settles in. `kind` moves both legs; `base` / `quote` nets the other side through the curve. */
@@ -128,6 +137,13 @@ export interface EditArgs extends WriteOptions, PairBounds {
     shares: bigint;
     /** Default `kind`. */
     settleIn?: SettleIn;
+    /**
+     * Tolerance in basis points, applied to the flows the edit is expected to move (the lens's
+     * exact preview, plus a quote of the netting swap when `settleIn` is one token). Required: an
+     * edit's flows depend on spot when it lands. An explicit bound in `PairBounds` overrides the one
+     * derived for that token.
+     */
+    slippageBps: number;
 }
 export interface EditPreview {
     /** Signed, + = the caller deposits; the mint fee is inside `dQuote`. */
@@ -146,11 +162,22 @@ export declare function previewEdit(c: LogswapClient, a: {
     toCap?: bigint;
     newL: bigint;
 }): Promise<EditPreview>;
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export declare function boundsFromFlows(dBase: bigint, dQuote: bigint, bps: number): Required<PairBounds>;
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export declare function edit(c: LogswapClient, a: EditArgs & {
     toFloor: bigint;
@@ -213,8 +240,9 @@ export interface BurnArgs extends WriteOptions {
     key: PoolKey;
     ids: readonly bigint[];
     shares: readonly bigint[];
-    minBaseOut?: bigint;
-    minQuoteOut?: bigint;
+    /** The least of each token the burn must return. Required: a burn's legs depend on spot. */
+    minBaseOut: bigint;
+    minQuoteOut: bigint;
 }
 /**
  * Exit, in kind, across one or more classes. Accrued fees are swept into the same settlement.

package/dist/liquidity.js

@@ -25,7 +25,8 @@ import { logswapLensAbi, logswapRouterAbi } from "./generated.js";
 import { NO_CAP } from "./ids.js";
 import { describeId, getPositionClass } from "./positions.js";
 import { execute, OPEN_DELTA, settleInKind, settleOnly, swapExactInAction, swapExactOutAction, updateAction, } from "./actions.js";
-import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, } from "./write.js";
+import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, withSlippage, } from "./write.js";
+import { quoteExactIn, quoteExactOut } from "./swap.js";
 /**
  * Mint at `targetFloor`, blending across the two adjacent rungs when it is off-grid.
  *
@@ -37,7 +38,6 @@ import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, send
  * costs zero quote too — that is what makes single-asset entry possible in both directions.
  */
 export async function mint(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "mintBlended",
@@ -46,8 +46,8 @@ export async function mint(c, a) {
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -62,7 +62,6 @@ export async function mint(c, a) {
  * uncapped.
  */
 export async function createMarket(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "createMarket",
@@ -71,8 +70,8 @@ export async function createMarket(c, a) {
             a.x0,
             a.targetFloor,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -94,11 +93,11 @@ export async function zapIn(c, a) {
             a.key,
             a.fundWithBase,
             a.amountIn,
-            a.minSwapOut ?? 0n,
+            a.minSwapOut,
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxIn ?? (1n << 256n) - 1n,
+            a.maxIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -106,7 +105,6 @@ export async function zapIn(c, a) {
 }
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export async function update(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "update",
@@ -117,8 +115,8 @@ export async function update(c, a) {
             a.toFloor,
             a.toCap ?? NO_CAP,
             a.newL,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -129,11 +127,9 @@ export async function update(c, a) {
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export async function move(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWrite(c, {
         abi: logswapRouterAbi,
         functionName: "move",
@@ -143,8 +139,8 @@ export async function move(c, a) {
             a.shares,
             a.toFloor,
             a.toCap ?? NO_CAP,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -161,11 +157,26 @@ export async function previewEdit(c, a) {
     }));
     return { dBase: r[0], dQuote: r[1], fees: r[2] };
 }
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export function boundsFromFlows(dBase, dQuote, bps) {
+    const inb = (d) => (d > 0n ? withSlippage(d, bps, "input") : 0n);
+    const outb = (d) => (d < 0n ? withSlippage(-d, bps, "output") : 0n);
+    return { maxBaseIn: inb(dBase), maxQuoteIn: inb(dQuote), minBaseOut: outb(dBase), minQuoteOut: outb(dQuote) };
+}
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export async function edit(c, a) {
     const { key } = a;
@@ -174,27 +185,37 @@ export async function edit(c, a) {
         updateAction({ key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL }),
     ];
     const settleIn = a.settleIn ?? "kind";
+    const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
     let settle;
     if (settleIn === "kind") {
-        settle = settleInKind(key, recipient, a);
+        settle = settleInKind(key, recipient, { ...boundsFromFlows(p.dBase, p.dQuote, a.slippageBps), ...defined(a) });
     }
     else {
-        const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
         // the swept fees ride INSIDE dQuote (the manager burns by owner and nets them; decisions 018),
         // so quote's open delta after the update is dQuote itself — `fees` is reported for display only
         const otherFlow = settleIn === "base" ? p.dQuote : p.dBase; // + = owed, − = released
         const otherIsBase = settleIn === "quote";
-        if (otherFlow < 0n)
+        let own = settleIn === "base" ? p.dBase : p.dQuote;
+        if (otherFlow < 0n) {
             actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
-        else if (otherFlow > 0n)
+            own -= await quoteExactIn(c, key, otherIsBase, -otherFlow);
+        }
+        else if (otherFlow > 0n) {
             actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+            own += await quoteExactOut(c, key, otherIsBase, otherFlow);
+        }
+        const b = settleIn === "base" ? boundsFromFlows(own, 0n, a.slippageBps) : boundsFromFlows(0n, own, a.slippageBps);
         settle = settleOnly(key, recipient, settleIn, {
-            maxIn: settleIn === "base" ? a.maxBaseIn : a.maxQuoteIn,
-            minOut: settleIn === "base" ? a.minBaseOut : a.minQuoteOut,
+            maxIn: settleIn === "base" ? (a.maxBaseIn ?? b.maxBaseIn) : (a.maxQuoteIn ?? b.maxQuoteIn),
+            minOut: settleIn === "base" ? (a.minBaseOut ?? b.minBaseOut) : (a.minQuoteOut ?? b.minQuoteOut),
         });
     }
     return execute(c, { actions, settle, deadline: a.deadline, recipient });
 }
+/** The explicit bounds a caller passed, without the undefined ones (so they do not erase derived ones). */
+function defined(b) {
+    return Object.fromEntries(["maxBaseIn", "maxQuoteIn", "minBaseOut", "minQuoteOut"].filter((k) => b[k] !== undefined).map((k) => [k, b[k]]));
+}
 /** The class behind `shares` of `id`: its floor, cap, and the exposure those shares carry. */
 async function classOf(c, key, id, shares) {
     const [d, cls] = await Promise.all([describeId(c, id, key.tickSpacing), getPositionClass(c, id)]);
@@ -297,8 +318,8 @@ export async function burn(c, a) {
             a.key,
             a.ids,
             a.shares,
-            a.minBaseOut ?? 0n,
-            a.minQuoteOut ?? 0n,
+            a.minBaseOut,
+            a.minQuoteOut,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],

package/dist/write.js

@@ -53,7 +53,8 @@ export function withSlippage(quoted, bps, side) {
     if (bps < 0 || bps > 10_000)
         throw new Error(`logswap: slippage bps out of range: ${bps}`);
     const b = BigInt(Math.round(bps));
-    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b)) / 10000n;
+    // an input bound rounds UP: flooring it would put a wei-exact quote at bps = 0 one wei short
+    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b) + 9999n) / 10000n;
 }
 /**
  * Send a router write with a gas buffer over an explicit estimate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logswap/sdk",
-  "version": "0.5.52",
+  "version": "0.5.53",
   "description": "TypeScript SDK for Logswap, the liquidity primitive introducing the logarithmic invariant — typed wrappers over the CPoolManager / FPoolManager / Router / Lens surface.",
   "license": "GPL-2.0-or-later",
   "type": "module",

package/src/fpool.ts

@@ -359,7 +359,12 @@ export interface FPoolSwapArgs {
   /** Leg index into `bases`. */
   j: number;
   amountIn: bigint;
-  minOut?: bigint;
+  /**
+   * The least the swap must return. Required: an F swap is exact-in, and without a floor on the
+   * output a front-run takes the difference. {@link fPoolQuoteSwap} is exact; bound it with
+   * {@link withSlippage} (`"output"`).
+   */
+  minOut: bigint;
   /** Who receives the out leg. Defaults to the account. */
   to?: Address;
   /** Absolute unix seconds. Defaulted to a bounded window, as every router write is. */
@@ -379,7 +384,7 @@ async function fSwap(c: LogswapClient, a: FPoolSwapArgs, kind: FPoolQuoteKind, k
   return writeRouter(
     c,
     "swapExactIn",
-    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut ?? 0n, a.to ?? a.account, a.deadline ?? defaultDeadline()],
+    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut, a.to ?? a.account, a.deadline ?? defaultDeadline()],
     a.account,
     [pull],
   );
@@ -407,10 +412,11 @@ export async function fPoolSwapBaseForBase(c: LogswapClient, a: FPoolSwapArgs &
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
 export async function fPoolMint(
   c: LogswapClient,
-  a: { poolId: Hex; dL: bigint; maxQuoteIn?: bigint; account: Address; to?: Address },
+  /** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+  a: { poolId: Hex; dL: bigint; maxQuoteIn: bigint; account: Address; to?: Address },
 ) {
   // shares go to `to` (the account by default); on a gated pool `to` must be allowed
-  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn ?? 2n ** 256n - 1n], a.account);
+  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn], a.account);
 }
 
 /**
@@ -420,9 +426,27 @@ export async function fPoolMint(
  */
 export async function fPoolBurn(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; minQuoteOut?: bigint; account: Address; owner?: Address },
+  /** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+  a: { poolId: Hex; shares: bigint; minQuoteOut: bigint; account: Address; owner?: Address },
 ) {
-  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut ?? 0n], a.account);
+  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut], a.account);
+}
+
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export function fPoolPreviewBurn(st: Pick<FPoolState, "Q" | "reserves" | "totalSupply">, shares: bigint): { quoteOut: bigint; basesOut: bigint[] } {
+  if (st.totalSupply === 0n) return { quoteOut: 0n, basesOut: st.reserves.map(() => 0n) };
+  return { quoteOut: (st.Q * shares) / st.totalSupply, basesOut: st.reserves.map((r) => (r * shares) / st.totalSupply) };
+}
+
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export function fPoolPreviewMintQuote(st: Pick<FPoolState, "Q" | "L">, dL: bigint): bigint {
+  return st.L === 0n ? 0n : (st.Q * dL + st.L - 1n) / st.L;
 }
 
 // ─── zaps (on the router — one router, one Permit2 spender) ───────────────────
@@ -475,17 +499,37 @@ export async function fPoolZapIn(
  */
 export async function fPoolZapOut(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut?: bigint; to?: Address; account: Address; deadline?: bigint },
+  /** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut: bigint; to?: Address; account: Address; deadline?: bigint },
 ) {
   const to = a.to ?? a.account;
   return writeRouter(
     c,
     "zapOut",
-    [a.poolId, a.shares, a.tokenOut, a.minOut ?? 0n, to, a.deadline ?? defaultDeadline()],
+    [a.poolId, a.shares, a.tokenOut, a.minOut, to, a.deadline ?? defaultDeadline()],
     a.account,
   );
 }
 
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export async function fPoolPreviewZapOut(
+  c: LogswapClient,
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; account: Address },
+): Promise<bigint> {
+  const { result } = await c.public.simulateContract({
+    address: c.addresses.router,
+    abi: logswapRouterAbi,
+    functionName: "zapOut",
+    args: [a.poolId, a.shares, a.tokenOut, 0n, a.account, defaultDeadline()],
+    account: a.account,
+  } as never);
+  return result as bigint;
+}
+
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the
  * router under one lock: redeem `shares` of generation `gen` in place — the legs, the quote and

package/src/liquidity.ts

@@ -46,8 +46,10 @@ import {
   resolveRecipient,
   sendRouterWrite,
   sendRouterWriteWithPermits,
+  withSlippage,
   type WriteOptions,
 } from "./write.js";
+import { quoteExactIn, quoteExactOut } from "./swap.js";
 
 /* mint ====================================================================== */
 
@@ -58,8 +60,14 @@ export interface MintArgs extends WriteOptions {
   cap?: bigint;
   /** Exposure to add. */
   L: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /**
+   * The most the mint may pull, per token. REQUIRED: the pulled amounts depend on spot when the
+   * transaction lands, so an unbounded mint can be sandwiched into depositing far more than the
+   * preview showed. Derive them from the preview with {@link withSlippage} (`"input"`); pass
+   * {@link UNBOUNDED} only where the price cannot move under you.
+   */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -73,7 +81,6 @@ export interface MintArgs extends WriteOptions {
  * costs zero quote too — that is what makes single-asset entry possible in both directions.
  */
 export async function mint(c: LogswapClient, a: MintArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "mintBlended",
@@ -82,8 +89,8 @@ export async function mint(c: LogswapClient, a: MintArgs): Promise<Hash> {
       a.targetFloor,
       a.cap ?? NO_CAP,
       a.L,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -98,8 +105,9 @@ export interface CreateMarketArgs extends WriteOptions {
   targetFloor: bigint;
   /** The founding exposure; must exceed the manager's `minBackstopL` lock. */
   L: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required, as on {@link mint}. Creation is atomic at `x0`, so the flows are fixed by the arguments; {@link UNBOUNDED} is safe here only for that reason. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -111,7 +119,6 @@ export interface CreateMarketArgs extends WriteOptions {
  * uncapped.
  */
 export async function createMarket(c: LogswapClient, a: CreateMarketArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "createMarket",
@@ -120,8 +127,8 @@ export async function createMarket(c: LogswapClient, a: CreateMarketArgs): Promi
       a.x0,
       a.targetFloor,
       a.L,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -133,12 +140,13 @@ export interface ZapArgs extends WriteOptions {
   /** Fund entirely from base (true) or entirely from quote (false). */
   fundWithBase: boolean;
   amountIn: bigint;
-  /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. 0 = unbounded. */
-  minSwapOut?: bigint;
+  /** The least the swap leg may return (contracts 7c82eed, decisions 043): the zap's own slippage bound, as `swapExactIn`'s. Required. */
+  minSwapOut: bigint;
   targetFloor: bigint;
   cap?: bigint;
   L: bigint;
-  maxIn?: bigint;
+  /** The most of the funding token the zap may pull. Required. */
+  maxIn: bigint;
 }
 
 /**
@@ -157,11 +165,11 @@ export async function zapIn(c: LogswapClient, a: ZapArgs): Promise<Hash> {
       a.key,
       a.fundWithBase,
       a.amountIn,
-      a.minSwapOut ?? 0n,
+      a.minSwapOut,
       a.targetFloor,
       a.cap ?? NO_CAP,
       a.L,
-      a.maxIn ?? (1n << 256n) - 1n,
+      a.maxIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -178,13 +186,13 @@ export interface UpdateArgs extends WriteOptions {
   toCap?: bigint;
   /** New exposure. `0n` exits the position entirely. */
   newL: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required: see {@link MintArgs}. {@link previewEdit} gives the exact flows to bound. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export async function update(c: LogswapClient, a: UpdateArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWriteWithPermits(c, {
     abi: logswapRouterAbi,
     functionName: "update",
@@ -195,8 +203,8 @@ export async function update(c: LogswapClient, a: UpdateArgs): Promise<Hash> {
       a.toFloor,
       a.toCap ?? NO_CAP,
       a.newL,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -209,8 +217,9 @@ export interface MoveArgs extends WriteOptions {
   shares: bigint;
   toFloor: bigint;
   toCap?: bigint;
-  maxBaseIn?: bigint;
-  maxQuoteIn?: bigint;
+  /** Required: see {@link MintArgs}. */
+  maxBaseIn: bigint;
+  maxQuoteIn: bigint;
 }
 
 /**
@@ -218,11 +227,9 @@ export interface MoveArgs extends WriteOptions {
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export async function move(c: LogswapClient, a: MoveArgs): Promise<Hash> {
-  const MAX = (1n << 256n) - 1n;
   return sendRouterWrite(c, {
     abi: logswapRouterAbi,
     functionName: "move",
@@ -232,8 +239,8 @@ export async function move(c: LogswapClient, a: MoveArgs): Promise<Hash> {
       a.shares,
       a.toFloor,
       a.toCap ?? NO_CAP,
-      a.maxBaseIn ?? MAX,
-      a.maxQuoteIn ?? MAX,
+      a.maxBaseIn,
+      a.maxQuoteIn,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],
@@ -252,6 +259,13 @@ export interface EditArgs extends WriteOptions, PairBounds {
   shares: bigint;
   /** Default `kind`. */
   settleIn?: SettleIn;
+  /**
+   * Tolerance in basis points, applied to the flows the edit is expected to move (the lens's
+   * exact preview, plus a quote of the netting swap when `settleIn` is one token). Required: an
+   * edit's flows depend on spot when it lands. An explicit bound in `PairBounds` overrides the one
+   * derived for that token.
+   */
+  slippageBps: number;
 }
 
 export interface EditPreview {
@@ -277,11 +291,27 @@ export async function previewEdit(
   return { dBase: r[0], dQuote: r[1], fees: r[2] };
 }
 
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export function boundsFromFlows(dBase: bigint, dQuote: bigint, bps: number): Required<PairBounds> {
+  const inb = (d: bigint) => (d > 0n ? withSlippage(d, bps, "input") : 0n);
+  const outb = (d: bigint) => (d < 0n ? withSlippage(-d, bps, "output") : 0n);
+  return { maxBaseIn: inb(dBase), maxQuoteIn: inb(dQuote), minBaseOut: outb(dBase), minQuoteOut: outb(dQuote) };
+}
+
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export async function edit(c: LogswapClient, a: EditArgs & { toFloor: bigint; toCap?: bigint; newL: bigint }): Promise<Hash> {
   const { key } = a;
@@ -290,25 +320,39 @@ export async function edit(c: LogswapClient, a: EditArgs & { toFloor: bigint; to
     updateAction({ key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL }),
   ];
   const settleIn = a.settleIn ?? "kind";
+  const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
   let settle: Settle;
   if (settleIn === "kind") {
-    settle = settleInKind(key, recipient, a);
+    settle = settleInKind(key, recipient, { ...boundsFromFlows(p.dBase, p.dQuote, a.slippageBps), ...defined(a) });
   } else {
-    const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
     // the swept fees ride INSIDE dQuote (the manager burns by owner and nets them; decisions 018),
     // so quote's open delta after the update is dQuote itself — `fees` is reported for display only
     const otherFlow = settleIn === "base" ? p.dQuote : p.dBase; // + = owed, − = released
     const otherIsBase = settleIn === "quote";
-    if (otherFlow < 0n) actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
-    else if (otherFlow > 0n) actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+    let own = settleIn === "base" ? p.dBase : p.dQuote;
+    if (otherFlow < 0n) {
+      actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
+      own -= await quoteExactIn(c, key, otherIsBase, -otherFlow);
+    } else if (otherFlow > 0n) {
+      actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+      own += await quoteExactOut(c, key, otherIsBase, otherFlow);
+    }
+    const b = settleIn === "base" ? boundsFromFlows(own, 0n, a.slippageBps) : boundsFromFlows(0n, own, a.slippageBps);
     settle = settleOnly(key, recipient, settleIn, {
-      maxIn: settleIn === "base" ? a.maxBaseIn : a.maxQuoteIn,
-      minOut: settleIn === "base" ? a.minBaseOut : a.minQuoteOut,
+      maxIn: settleIn === "base" ? (a.maxBaseIn ?? b.maxBaseIn) : (a.maxQuoteIn ?? b.maxQuoteIn),
+      minOut: settleIn === "base" ? (a.minBaseOut ?? b.minBaseOut) : (a.minQuoteOut ?? b.minQuoteOut),
     });
   }
   return execute(c, { actions, settle, deadline: a.deadline, recipient });
 }
 
+/** The explicit bounds a caller passed, without the undefined ones (so they do not erase derived ones). */
+function defined(b: PairBounds): PairBounds {
+  return Object.fromEntries(
+    (["maxBaseIn", "maxQuoteIn", "minBaseOut", "minQuoteOut"] as const).filter((k) => b[k] !== undefined).map((k) => [k, b[k]]),
+  );
+}
+
 /** The class behind `shares` of `id`: its floor, cap, and the exposure those shares carry. */
 async function classOf(c: LogswapClient, key: PoolKey, id: bigint, shares: bigint) {
   const [d, cls] = await Promise.all([describeId(c, id, key.tickSpacing), getPositionClass(c, id)]);
@@ -405,8 +449,9 @@ export interface BurnArgs extends WriteOptions {
   key: PoolKey;
   ids: readonly bigint[];
   shares: readonly bigint[];
-  minBaseOut?: bigint;
-  minQuoteOut?: bigint;
+  /** The least of each token the burn must return. Required: a burn's legs depend on spot. */
+  minBaseOut: bigint;
+  minQuoteOut: bigint;
 }
 
 /**
@@ -424,8 +469,8 @@ export async function burn(c: LogswapClient, a: BurnArgs): Promise<Hash> {
       a.key,
       a.ids,
       a.shares,
-      a.minBaseOut ?? 0n,
-      a.minQuoteOut ?? 0n,
+      a.minBaseOut,
+      a.minQuoteOut,
       resolveRecipient(c, a),
       resolveDeadline(a),
     ],

package/src/write.ts

@@ -68,7 +68,8 @@ export function resolveRecipient(c: LogswapClient, o?: WriteOptions): Address {
 export function withSlippage(quoted: bigint, bps: number, side: "output" | "input"): bigint {
   if (bps < 0 || bps > 10_000) throw new Error(`logswap: slippage bps out of range: ${bps}`);
   const b = BigInt(Math.round(bps));
-  return side === "output" ? (quoted * (10_000n - b)) / 10_000n : (quoted * (10_000n + b)) / 10_000n;
+  // an input bound rounds UP: flooring it would put a wei-exact quote at bps = 0 one wei short
+  return side === "output" ? (quoted * (10_000n - b)) / 10_000n : (quoted * (10_000n + b) + 9_999n) / 10_000n;
 }
 
 /**