@logswap/sdk 0.5.52 → 0.5.54

package/dist/liquidity.js

@@ -25,7 +25,8 @@ import { logswapLensAbi, logswapRouterAbi } from "./generated.js";
 import { NO_CAP } from "./ids.js";
 import { describeId, getPositionClass } from "./positions.js";
 import { execute, OPEN_DELTA, settleInKind, settleOnly, swapExactInAction, swapExactOutAction, updateAction, } from "./actions.js";
-import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, } from "./write.js";
+import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, sendRouterWriteWithPermits, withSlippage, } from "./write.js";
+import { quoteExactIn, quoteExactOut } from "./swap.js";
 /**
  * Mint at `targetFloor`, blending across the two adjacent rungs when it is off-grid.
  *
@@ -37,7 +38,6 @@ import { requireWallet, resolveDeadline, resolveRecipient, sendRouterWrite, send
  * costs zero quote too — that is what makes single-asset entry possible in both directions.
  */
 export async function mint(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "mintBlended",
@@ -46,8 +46,8 @@ export async function mint(c, a) {
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -62,7 +62,6 @@ export async function mint(c, a) {
  * uncapped.
  */
 export async function createMarket(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "createMarket",
@@ -71,8 +70,8 @@ export async function createMarket(c, a) {
             a.x0,
             a.targetFloor,
             a.L,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -94,11 +93,11 @@ export async function zapIn(c, a) {
             a.key,
             a.fundWithBase,
             a.amountIn,
-            a.minSwapOut ?? 0n,
+            a.minSwapOut,
             a.targetFloor,
             a.cap ?? NO_CAP,
             a.L,
-            a.maxIn ?? (1n << 256n) - 1n,
+            a.maxIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -106,7 +105,6 @@ export async function zapIn(c, a) {
 }
 /** The primitive, through the router's named entry: resize and reposition in one call, in kind. */
 export async function update(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWriteWithPermits(c, {
         abi: logswapRouterAbi,
         functionName: "update",
@@ -117,8 +115,8 @@ export async function update(c, a) {
             a.toFloor,
             a.toCap ?? NO_CAP,
             a.newL,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -129,11 +127,9 @@ export async function update(c, a) {
  *
  * **Bound it.** The router used to settle this entry with no limit, which meant a reposition that
  * priced differently by inclusion time could pull the whole allowance (security-review2 M-01).
- * The defaults below are unbounded for callers who genuinely want that; pass `maxBaseIn` /
- * `maxQuoteIn` from a preview for anything user-facing.
+ * The bounds are required; {@link UNBOUNDED} is an explicit, visible opt-out.
  */
 export async function move(c, a) {
-    const MAX = (1n << 256n) - 1n;
     return sendRouterWrite(c, {
         abi: logswapRouterAbi,
         functionName: "move",
@@ -143,8 +139,8 @@ export async function move(c, a) {
             a.shares,
             a.toFloor,
             a.toCap ?? NO_CAP,
-            a.maxBaseIn ?? MAX,
-            a.maxQuoteIn ?? MAX,
+            a.maxBaseIn,
+            a.maxQuoteIn,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],
@@ -161,11 +157,26 @@ export async function previewEdit(c, a) {
     }));
     return { dBase: r[0], dQuote: r[1], fees: r[2] };
 }
+/**
+ * Bounds for a pair of signed flows (+ = the caller pays, − = the caller receives), at `bps` of
+ * tolerance: a payment is capped from above, a receipt floored from below, and a token that does
+ * not move in that direction is bound to zero.
+ */
+export function boundsFromFlows(dBase, dQuote, bps) {
+    const inb = (d) => (d > 0n ? withSlippage(d, bps, "input") : 0n);
+    const outb = (d) => (d < 0n ? withSlippage(-d, bps, "output") : 0n);
+    return { maxBaseIn: inb(dBase), maxQuoteIn: inb(dQuote), minBaseOut: outb(dBase), minQuoteOut: outb(dQuote) };
+}
 /**
  * The general edit as a batch: `[update]`, plus — when `settleIn` is one token — the one swap that
  * nets the other. The other side's flow is read off the preview: released → sold with an exact-in
  * of `OPEN_DELTA`; owed → bought with an exact-out of `OPEN_DELTA`. The settlement then binds the
  * other token to zero both ways, so a stale preview fails loudly rather than moving it.
+ *
+ * **Bounded by default.** The preview gives the edit's exact flows at today's state; `slippageBps`
+ * turns them into the settlement's bounds. With `settleIn` one token, the netting swap is quoted
+ * on today's curve, before the update changes the active liquidity — close for a small edit, and
+ * for a large one a bound that reverts rather than one that lets a sandwich through.
  */
 export async function edit(c, a) {
     const { key } = a;
@@ -174,27 +185,37 @@ export async function edit(c, a) {
         updateAction({ key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL }),
     ];
     const settleIn = a.settleIn ?? "kind";
+    const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
     let settle;
     if (settleIn === "kind") {
-        settle = settleInKind(key, recipient, a);
+        settle = settleInKind(key, recipient, { ...boundsFromFlows(p.dBase, p.dQuote, a.slippageBps), ...defined(a) });
     }
     else {
-        const p = await previewEdit(c, { key, fromId: a.fromId, shares: a.shares, toFloor: a.toFloor, toCap: a.toCap, newL: a.newL });
         // the swept fees ride INSIDE dQuote (the manager burns by owner and nets them; decisions 018),
         // so quote's open delta after the update is dQuote itself — `fees` is reported for display only
         const otherFlow = settleIn === "base" ? p.dQuote : p.dBase; // + = owed, − = released
         const otherIsBase = settleIn === "quote";
-        if (otherFlow < 0n)
+        let own = settleIn === "base" ? p.dBase : p.dQuote;
+        if (otherFlow < 0n) {
             actions.push(swapExactInAction({ key, baseIn: otherIsBase, amountIn: OPEN_DELTA }));
-        else if (otherFlow > 0n)
+            own -= await quoteExactIn(c, key, otherIsBase, -otherFlow);
+        }
+        else if (otherFlow > 0n) {
             actions.push(swapExactOutAction({ key, baseOut: otherIsBase, amountOut: OPEN_DELTA }));
+            own += await quoteExactOut(c, key, otherIsBase, otherFlow);
+        }
+        const b = settleIn === "base" ? boundsFromFlows(own, 0n, a.slippageBps) : boundsFromFlows(0n, own, a.slippageBps);
         settle = settleOnly(key, recipient, settleIn, {
-            maxIn: settleIn === "base" ? a.maxBaseIn : a.maxQuoteIn,
-            minOut: settleIn === "base" ? a.minBaseOut : a.minQuoteOut,
+            maxIn: settleIn === "base" ? (a.maxBaseIn ?? b.maxBaseIn) : (a.maxQuoteIn ?? b.maxQuoteIn),
+            minOut: settleIn === "base" ? (a.minBaseOut ?? b.minBaseOut) : (a.minQuoteOut ?? b.minQuoteOut),
         });
     }
     return execute(c, { actions, settle, deadline: a.deadline, recipient });
 }
+/** The explicit bounds a caller passed, without the undefined ones (so they do not erase derived ones). */
+function defined(b) {
+    return Object.fromEntries(["maxBaseIn", "maxQuoteIn", "minBaseOut", "minQuoteOut"].filter((k) => b[k] !== undefined).map((k) => [k, b[k]]));
+}
 /** The class behind `shares` of `id`: its floor, cap, and the exposure those shares carry. */
 async function classOf(c, key, id, shares) {
     const [d, cls] = await Promise.all([describeId(c, id, key.tickSpacing), getPositionClass(c, id)]);
@@ -297,8 +318,8 @@ export async function burn(c, a) {
             a.key,
             a.ids,
             a.shares,
-            a.minBaseOut ?? 0n,
-            a.minQuoteOut ?? 0n,
+            a.minBaseOut,
+            a.minQuoteOut,
             resolveRecipient(c, a),
             resolveDeadline(a),
         ],

package/dist/pools.d.ts

@@ -73,6 +73,8 @@ export interface DiscoveredMarket {
     x0: bigint;
     blockNumber: bigint;
     transactionHash: Hex;
+    /** The manager that emitted the `Initialize` — set when the row came from the indexer. */
+    manager?: Address;
 }
 /**
  * Enumerate markets from `Initialize` logs.

package/dist/pools.js

@@ -13,6 +13,7 @@
  */
 import { formatUnits } from "viem";
 import { logswapLensAbi, cPoolManagerAbi } from "./generated.js";
+import { signerFor } from "./write.js";
 import { readCachedToken, registerCacheClear, writeCachedToken } from "./tokencache.js";
 import { poolId } from "./keys.js";
 /** Read a market's full state by key. */
@@ -137,19 +138,10 @@ export async function isValidFloor(c, key, floor) {
  * magnitude while the contract behaves perfectly — which reads as "the app is broken".
  */
 export async function marketDecimals(c, key) {
-    const abi = [
-        { type: "function", name: "decimals", stateMutability: "view", inputs: [], outputs: [{ type: "uint8" }] },
-    ];
-    const read = async (token) => {
-        try {
-            return Number(await c.public.readContract({ address: token, abi, functionName: "decimals" }));
-        }
-        catch {
-            return 18; // same fallback the manager uses when the token does not implement it
-        }
-    };
-    const [base, quote] = await Promise.all([read(key.base), read(key.quote)]);
-    return { base, quote };
+    // It used to fall back to 18 on ANY failure, a dropped request included — a 6-decimal quote read
+    // as 18 is every amount 10^12 off. `marketTokens` retries and then refuses; so does this.
+    const { base, quote } = await marketTokens(c, key);
+    return { base: base.decimals, quote: quote.decimals };
 }
 /**
  * Both sides of a market, for labelling and scaling.
@@ -318,7 +310,7 @@ export async function initializeMarket(c, a) {
         abi: cPoolManagerAbi,
         functionName: "initialize",
         args: [a.key, a.x0],
-        account: a.account,
+        account: signerFor(c, a.account),
     });
     return c.wallet.writeContract(request);
 }

package/dist/write.d.ts

@@ -38,6 +38,14 @@ export declare function resolveDeadline(o: WriteOptions | undefined, now?: numbe
  * until someone uses a key the node does not have — a bot, a script, CI, or a real user's wallet.
  * Passing the object lets viem pick the correct path for both kinds.
  */
+/**
+ * The wallet's account OBJECT for a write the caller named by address — see {@link requireWallet}
+ * for why the object and never the address. The F helpers take `account: Address` in their
+ * arguments; passed straight to viem it became a JSON-RPC account and the NODE was asked to sign,
+ * which works only on a dev node holding the key (every agent on the devnet did exactly that).
+ * A named account that is not the wallet's is refused: nothing else could sign for it.
+ */
+export declare function signerFor(c: LogswapClient, address: Address): NonNullable<LogswapClient["wallet"]>["account"];
 export declare function requireWallet(c: LogswapClient): {
     account: NonNullable<LogswapClient["wallet"]>["account"];
     address: Address;

package/dist/write.js

@@ -32,6 +32,20 @@ export function resolveDeadline(o, now = Date.now()) {
  * until someone uses a key the node does not have — a bot, a script, CI, or a real user's wallet.
  * Passing the object lets viem pick the correct path for both kinds.
  */
+/**
+ * The wallet's account OBJECT for a write the caller named by address — see {@link requireWallet}
+ * for why the object and never the address. The F helpers take `account: Address` in their
+ * arguments; passed straight to viem it became a JSON-RPC account and the NODE was asked to sign,
+ * which works only on a dev node holding the key (every agent on the devnet did exactly that).
+ * A named account that is not the wallet's is refused: nothing else could sign for it.
+ */
+export function signerFor(c, address) {
+    const { account } = requireWallet(c);
+    if (account.address.toLowerCase() !== address.toLowerCase()) {
+        throw new Error(`logswap: the write names ${address} but the wallet signs as ${account.address}`);
+    }
+    return account;
+}
 export function requireWallet(c) {
     const account = c.wallet?.account;
     if (!c.wallet || !account) {
@@ -53,7 +67,8 @@ export function withSlippage(quoted, bps, side) {
     if (bps < 0 || bps > 10_000)
         throw new Error(`logswap: slippage bps out of range: ${bps}`);
     const b = BigInt(Math.round(bps));
-    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b)) / 10000n;
+    // an input bound rounds UP: flooring it would put a wei-exact quote at bps = 0 one wei short
+    return side === "output" ? (quoted * (10000n - b)) / 10000n : (quoted * (10000n + b) + 9999n) / 10000n;
 }
 /**
  * Send a router write with a gas buffer over an explicit estimate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logswap/sdk",
-  "version": "0.5.52",
+  "version": "0.5.54",
   "description": "TypeScript SDK for Logswap, the liquidity primitive introducing the logarithmic invariant — typed wrappers over the CPoolManager / FPoolManager / Router / Lens surface.",
   "license": "GPL-2.0-or-later",
   "type": "module",

package/src/fpool.ts

@@ -48,6 +48,7 @@ export { fPoolManagerAbi, padPolicyAbi, polPolicyAbi, privatePolicyAbi, publicPo
  */
 export const fPolicyBaseAbi = polPolicyAbi;
 import type { LogswapClient } from "./client.js";
+import { signerFor } from "./write.js";
 
 const WAD = 10n ** 18n;
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000" as const;
@@ -359,7 +360,12 @@ export interface FPoolSwapArgs {
   /** Leg index into `bases`. */
   j: number;
   amountIn: bigint;
-  minOut?: bigint;
+  /**
+   * The least the swap must return. Required: an F swap is exact-in, and without a floor on the
+   * output a front-run takes the difference. {@link fPoolQuoteSwap} is exact; bound it with
+   * {@link withSlippage} (`"output"`).
+   */
+  minOut: bigint;
   /** Who receives the out leg. Defaults to the account. */
   to?: Address;
   /** Absolute unix seconds. Defaulted to a bounded window, as every router write is. */
@@ -379,7 +385,7 @@ async function fSwap(c: LogswapClient, a: FPoolSwapArgs, kind: FPoolQuoteKind, k
   return writeRouter(
     c,
     "swapExactIn",
-    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut ?? 0n, a.to ?? a.account, a.deadline ?? defaultDeadline()],
+    [a.poolId, kind, BigInt(a.j), BigInt(k), a.amountIn, a.minOut, a.to ?? a.account, a.deadline ?? defaultDeadline()],
     a.account,
     [pull],
   );
@@ -407,10 +413,11 @@ export async function fPoolSwapBaseForBase(c: LogswapClient, a: FPoolSwapArgs &
 /** Deposit dL/L of every reserve, receive shares ∝ dL. θ is untouched by construction. */
 export async function fPoolMint(
   c: LogswapClient,
-  a: { poolId: Hex; dL: bigint; maxQuoteIn?: bigint; account: Address; to?: Address },
+  /** `maxQuoteIn` is required: the quote leg is Q·dL/L at landing, and Q moves with every swap. */
+  a: { poolId: Hex; dL: bigint; maxQuoteIn: bigint; account: Address; to?: Address },
 ) {
   // shares go to `to` (the account by default); on a gated pool `to` must be allowed
-  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn ?? 2n ** 256n - 1n], a.account);
+  return writeFPool(c, a.poolId, "mint", [a.to ?? a.account, a.dL, a.maxQuoteIn], a.account);
 }
 
 /**
@@ -420,9 +427,27 @@ export async function fPoolMint(
  */
 export async function fPoolBurn(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; minQuoteOut?: bigint; account: Address; owner?: Address },
+  /** `minQuoteOut` is required: the quote slice is Q·shares/S at landing. See {@link fPoolPreviewBurn}. */
+  a: { poolId: Hex; shares: bigint; minQuoteOut: bigint; account: Address; owner?: Address },
 ) {
-  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut ?? 0n], a.account);
+  return writeFPool(c, a.poolId, "burn", [a.owner ?? a.account, a.shares, a.minQuoteOut], a.account);
+}
+
+/**
+ * What burning `shares` returns at today's state — the manager's own arithmetic: every reserve and
+ * the quote pro rata, rounded down (FPoolManager.burn). Exact until the next swap or mint.
+ */
+export function fPoolPreviewBurn(st: Pick<FPoolState, "Q" | "reserves" | "totalSupply">, shares: bigint): { quoteOut: bigint; basesOut: bigint[] } {
+  if (st.totalSupply === 0n) return { quoteOut: 0n, basesOut: st.reserves.map(() => 0n) };
+  return { quoteOut: (st.Q * shares) / st.totalSupply, basesOut: st.reserves.map((r) => (r * shares) / st.totalSupply) };
+}
+
+/**
+ * The quote {@link fPoolMint} pulls for `dL` at today's state: Q·dL/L, rounded up (the pool never
+ * under-collects), before any mint fee — so bound it with {@link withSlippage} (`"input"`).
+ */
+export function fPoolPreviewMintQuote(st: Pick<FPoolState, "Q" | "L">, dL: bigint): bigint {
+  return st.L === 0n ? 0n : (st.Q * dL + st.L - 1n) / st.L;
 }
 
 // ─── zaps (on the router — one router, one Permit2 spender) ───────────────────
@@ -475,17 +500,37 @@ export async function fPoolZapIn(
  */
 export async function fPoolZapOut(
   c: LogswapClient,
-  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut?: bigint; to?: Address; account: Address; deadline?: bigint },
+  /** `minOut` is required: the sale routes every leg through the curve. See {@link fPoolPreviewZapOut}. */
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; minOut: bigint; to?: Address; account: Address; deadline?: bigint },
 ) {
   const to = a.to ?? a.account;
   return writeRouter(
     c,
     "zapOut",
-    [a.poolId, a.shares, a.tokenOut, a.minOut ?? 0n, to, a.deadline ?? defaultDeadline()],
+    [a.poolId, a.shares, a.tokenOut, a.minOut, to, a.deadline ?? defaultDeadline()],
     a.account,
   );
 }
 
+/**
+ * What {@link fPoolZapOut} returns at today's state: the router's own `zapOut`, simulated as the
+ * holder with no bound. Exact, but it needs what the real call needs — the shares, and the router
+ * as the holder's ERC-6909 operator — so it throws where the zap-out itself would revert.
+ */
+export async function fPoolPreviewZapOut(
+  c: LogswapClient,
+  a: { poolId: Hex; shares: bigint; tokenOut: Address; account: Address },
+): Promise<bigint> {
+  const { result } = await c.public.simulateContract({
+    address: c.addresses.router,
+    abi: logswapRouterAbi,
+    functionName: "zapOut",
+    args: [a.poolId, a.shares, a.tokenOut, 0n, a.account, defaultDeadline()],
+    account: a.account,
+  } as never);
+  return result as bigint;
+}
+
 /**
  * Roll a retired generation's bundle into the pool's live one (decisions 025, 032), on the
  * router under one lock: redeem `shares` of generation `gen` in place — the legs, the quote and
@@ -600,7 +645,7 @@ async function writeFPool(c: LogswapClient, poolId: Hex, functionName: string, a
     // one place all seven helpers share, is what keeps a caller from ever omitting it. The `as
     // never` casts blind tsc to arg counts, so this file's encode test is the real guard.
     args: [poolId, ...args],
-    account,
+    account: signerFor(c, account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -613,7 +658,7 @@ async function writeFPool0(c: LogswapClient, functionName: string, args: unknown
     abi: fPoolManagerAbi,
     functionName,
     args,
-    account,
+    account: signerFor(c, account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -644,7 +689,7 @@ async function writeRouter(
     abi: logswapRouterAbi,
     functionName: fn,
     args: sendArgs,
-    account,
+    account: signerFor(c, account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -705,7 +750,7 @@ export async function approveRouterForFPool(c: LogswapClient, account: Address)
     abi: fPoolManagerAbi,
     functionName: "setOperator",
     args: [c.addresses.router, true],
-    account,
+    account: signerFor(c, account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -1225,7 +1270,7 @@ async function writePolicy(c: LogswapClient, abi: readonly unknown[], a: { poolI
     abi,
     functionName,
     args: [a.poolId, ...args],
-    account: a.account,
+    account: signerFor(c, a.account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -1317,7 +1362,7 @@ export async function fPoolSetSponsorName(c: LogswapClient, a: { who: Address; n
     abi: policyRegistryAbi,
     functionName: "setSponsorName",
     args: [a.who, textToBytes32(a.name)],
-    account: a.account,
+    account: signerFor(c, a.account),
   } as never);
   return wallet.writeContract(request as never);
 }
@@ -1392,7 +1437,7 @@ export async function fPoolTransferShares(
     abi: fPoolManagerAbi,
     functionName: "transfer",
     args: [a.to, fPoolShareId(a.poolId, gen), a.shares],
-    account: a.account,
+    account: signerFor(c, a.account),
   } as never);
   return wallet.writeContract(request as never);
 }

package/src/indexer.ts

@@ -34,25 +34,70 @@ export function bytea(hex: Hex): string {
   return `\\x${hex.replace(/^0x/, "")}`;
 }
 
+/** How long an indexer call may take before the caller falls back (to the chain, or an empty view). */
+export const INDEXER_TIMEOUT_MS = 8_000;
+
 export async function gql<T>(
   url: string,
   query: string,
   variables?: Record<string, unknown>,
   signal?: AbortSignal,
 ): Promise<T> {
+  // A hung indexer must not hang its caller: every consumer has a fallback, and it only runs when
+  // this call ends. The caller's signal, if any, still wins.
   const res = await fetch(url, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({ query, variables }),
-    signal,
+    signal: signal ?? AbortSignal.timeout(INDEXER_TIMEOUT_MS),
   });
   if (!res.ok) throw new Error(`indexer: HTTP ${res.status} from ${url}`);
+  // an Access login page or a proxy's error page answers 200 with HTML; say so, rather than
+  // "Unexpected token <"
+  const ct = res.headers.get("content-type") ?? "";
+  if (!ct.includes("json")) throw new Error(`indexer: ${url} answered ${ct || "no content-type"}, not JSON (a login page?)`);
   const body = (await res.json()) as { data?: T; errors?: IndexerError[] };
   if (body.errors?.length) throw new Error(`indexer: ${body.errors.map((e) => e.message).join("; ")}`);
   if (!body.data) throw new Error("indexer: empty response");
   return body.data;
 }
 
+const PAGE = 1000;
+const MAX_PAGES = 100;
+
+/**
+ * Every row of a connection, page by page. A single `first: 1000` silently drops row 1001 onward —
+ * a pool's 1001st position class, a deployment's 1001st market — with nothing to say so. Pages by
+ * cursor in primary-key order, so rows inserted while paging cannot shift the window.
+ */
+export async function gqlAll<N>(
+  url: string,
+  field: string,
+  selection: string,
+  opts: { vars?: Record<string, { type: string; value: unknown }>; condition?: string; signal?: AbortSignal } = {},
+): Promise<N[]> {
+  const vars = opts.vars ?? {};
+  const decl = Object.entries(vars).map(([k, v]) => `, $${k}: ${v.type}`).join("");
+  const cond = opts.condition ? `, condition: ${opts.condition}` : "";
+  const q = `query Page($after: Cursor${decl}) {
+    ${field}(first: ${PAGE}, after: $after, orderBy: PRIMARY_KEY_ASC${cond}) {
+      pageInfo { hasNextPage endCursor } nodes { ${selection} }
+    }
+  }`;
+  const values = Object.fromEntries(Object.entries(vars).map(([k, v]) => [k, v.value]));
+  const out: N[] = [];
+  let after: string | null = null;
+  for (let i = 0; i < MAX_PAGES; i++) {
+    type Conn = { pageInfo: { hasNextPage: boolean; endCursor: string | null }; nodes: N[] };
+    const d: Record<string, Conn> = await gql<Record<string, Conn>>(url, q, { ...values, after }, opts.signal);
+    const page: Conn = d[field]!;
+    out.push(...page.nodes);
+    if (!page.pageInfo.hasNextPage || !page.pageInfo.endCursor) return out;
+    after = page.pageInfo.endCursor;
+  }
+  throw new Error(`indexer: ${field} has more than ${PAGE * MAX_PAGES} rows`);
+}
+
 /** A position class as the chain registered it: the floor/cap geometry, fixed for the id's life. */
 export interface RegisteredId {
   id: bigint;
@@ -63,16 +108,12 @@ export interface RegisteredId {
 
 /** Every position class ever registered in a pool. Historical — some may since have burnt to zero. */
 export async function registeredIds(url: string, poolId: Hex, signal?: AbortSignal): Promise<RegisteredId[]> {
-  const q = `query Ids($pool: String!) {
-    allIdRegistereds(condition: {poolId: $pool}, first: 1000) { nodes { id floor cap capped } }
-  }`;
-  const d = await gql<{ allIdRegistereds: { nodes: { id: string; floor: string; cap: string; capped: boolean }[] } }>(
-    url,
-    q,
-    { pool: bytea(poolId) },
+  const nodes = await gqlAll<{ id: string; floor: string; cap: string; capped: boolean }>(url, "allIdRegistereds", "id floor cap capped", {
+    vars: { pool: { type: "String!", value: bytea(poolId) } },
+    condition: "{poolId: $pool}",
     signal,
-  );
-  return d.allIdRegistereds.nodes.map((n) => ({
+  });
+  return nodes.map((n) => ({
     id: BigInt(n.id),
     floor: BigInt(n.floor),
     cap: BigInt(n.cap),
@@ -142,15 +183,12 @@ export async function indexerHealthy(url: string, signal?: AbortSignal): Promise
  * everywhere else, so a wrong id fails loudly instead of addressing the wrong pool.
  */
 export async function discoverMarketsIndexed(url: string, signal?: AbortSignal): Promise<DiscoveredMarket[]> {
-  const q = `{ allInitializes(first: 1000) { nodes {
-    poolId base quote tickSpacing phi x0 blockNumber txHash
-  } } }`;
   type Row = {
     poolId: Hex; base: Hex; quote: Hex; tickSpacing: string; phi: string;
-    x0: string; blockNumber: string; txHash: Hex;
+    x0: string; blockNumber: string; txHash: Hex; contractAddress: Hex;
   };
-  const d = await gql<{ allInitializes: { nodes: Row[] } }>(url, q, undefined, signal);
-  return d.allInitializes.nodes.map((n) => {
+  const nodes = await gqlAll<Row>(url, "allInitializes", "poolId base quote tickSpacing phi x0 blockNumber txHash contractAddress", { signal });
+  return nodes.map((n) => {
     const key: PoolKey = {
       base: n.base as Address,
       quote: n.quote as Address,
@@ -163,6 +201,7 @@ export async function discoverMarketsIndexed(url: string, signal?: AbortSignal):
       x0: BigInt(n.x0),
       blockNumber: BigInt(n.blockNumber),
       transactionHash: n.txHash,
+      manager: n.contractAddress,
     };
   });
 }
@@ -181,31 +220,14 @@ export async function discoverMarketsBest(
   if (url) {
     try {
       const markets = await discoverMarketsIndexed(url, signal);
-      // The indexer is a CACHE and the chain is the truth. After a redeploy the indexer keeps
-      // serving the previous deployment's markets; calling the new manager with those keys makes
-      // every read revert, refresh-proof (it presented as "phiEff reverted", forever). So verify
-      // each candidate against the manager the client is actually pointed at, and keep only the
-      // markets that exist there; if none survive, the chain scan is the answer.
-      if (markets.length) {
-        const alive = (
-          await Promise.all(
-            markets.map(async (m) => {
-              try {
-                await c.public.readContract({
-                  address: c.addresses.cPoolManager,
-                  abi: cPoolManagerAbi,
-                  functionName: "phiOf",
-                  args: [m.key],
-                } as never);
-                return m;
-              } catch {
-                return null;
-              }
-            }),
-          )
-        ).filter((m): m is DiscoveredMarket => m !== null);
-        if (alive.length) return { markets: alive, source: "indexer" };
-      }
+      // The indexer is a CACHE and the chain is the truth. After a redeploy it keeps serving the
+      // previous deployment's markets, and calling the new manager with those keys makes every
+      // read revert, refresh-proof. Each row names the manager that emitted it, so keep only the
+      // rows of the manager this client is pointed at — no read per row. None left means the
+      // indexer has not seen this deployment: the chain scan is the answer.
+      const mine = c.addresses.cPoolManager.toLowerCase();
+      const alive = markets.filter((m) => m.manager?.toLowerCase() === mine);
+      if (alive.length) return { markets: alive, source: "indexer" };
     } catch {
       /* fall through — a missing indexer must not cost you the market list */
     }