@percolatorct/sdk 1.0.0-beta.3 → 1.0.0-beta.31

package/dist/abi/instructions.d.ts

@@ -1,9 +1,4 @@
 import { PublicKey } from "@solana/web3.js";
-/**
- * Oracle price constraints.
- * Maximum oracle price that can be pushed to the on-chain oracle authority.
- */
-export declare const MAX_ORACLE_PRICE = 1000000000000n;
 /**
  * Instruction tags - exact match to Rust ix::Instruction::decode
  */
@@ -24,19 +19,21 @@ export declare const IX_TAG: {
     readonly CloseSlab: 13;
     readonly UpdateConfig: 14;
     readonly SetMaintenanceFee: 15;
-    readonly SetOracleAuthority: 16;
-    readonly PushOraclePrice: 17;
     readonly SetOraclePriceCap: 18;
     readonly ResolveMarket: 19;
     readonly WithdrawInsurance: 20;
     readonly AdminForceClose: 21;
-    readonly UpdateRiskParams: 22;
-    readonly RenounceAdmin: 23;
-    readonly PauseMarket: 27;
-    readonly UnpauseMarket: 28;
-    readonly AcceptAdmin: 29;
-    readonly SetInsuranceWithdrawPolicy: 30;
-    readonly WithdrawInsuranceLimited: 31;
+    readonly SetInsuranceWithdrawPolicy: 22;
+    /** @deprecated Use SetInsuranceWithdrawPolicy */ readonly UpdateRiskParams: 22;
+    readonly WithdrawInsuranceLimited: 23;
+    /** @deprecated Use WithdrawInsuranceLimited */ readonly RenounceAdmin: 23;
+    readonly QueryLpFees: 24;
+    readonly ReclaimEmptyAccount: 25;
+    readonly SettleAccount: 26;
+    readonly DepositFeeCredits: 27;
+    readonly ConvertReleasedPnl: 28;
+    readonly ResolvePermissionless: 29;
+    readonly ForceCloseResolved: 30;
     readonly SetPythOracle: 32;
     readonly UpdateMarkPrice: 33;
     readonly UpdateHyperpMark: 34;
@@ -78,8 +75,6 @@ export declare const IX_TAG: {
     readonly AttestCrossMargin: 55;
     /** PERC-622: Advance oracle phase (permissionless crank) */
     readonly AdvanceOraclePhase: 56;
-    /** PERC-623: Top up a market's keeper fund (permissionless) */
-    readonly TopUpKeeperFund: 57;
     /** PERC-629: Slash a market creator's deposit (permissionless) */
     readonly SlashCreationDeposit: 58;
     /** PERC-628: Initialize the global shared vault (admin) */
@@ -116,6 +111,20 @@ export declare const IX_TAG: {
     readonly SetDexPool: 74;
     /** CPI to the matcher program to initialize a matcher context account for an LP slot. Admin-only. */
     readonly InitMatcherCtx: 75;
+    /** PauseMarket (tag 76): admin emergency pause. Blocks Trade/Deposit/Withdraw/InitUser. */
+    readonly PauseMarket: 76;
+    /** UnpauseMarket (tag 77): admin unpause. Re-enables all operations. */
+    readonly UnpauseMarket: 77;
+    /** PERC-305 / SECURITY(H-4): Set PnL cap for ADL pre-check (admin only). */
+    readonly SetMaxPnlCap: 78;
+    /** PERC-309: Set OI cap multiplier for LP withdrawal limits (admin only). Packed u64. */
+    readonly SetOiCapMultiplier: 79;
+    /** PERC-314: Set dispute params (window_slots + bond_amount, admin only). */
+    readonly SetDisputeParams: 80;
+    /** PERC-315: Set LP collateral params (enabled + ltv_bps, admin only). */
+    readonly SetLpCollateralParams: 81;
+    /** Phase E (2026-04-17): Accept a pending admin transfer. Signer must match pending_admin. */
+    readonly AcceptAdmin: 82;
 };
 /**
  * InitMarket instruction data (256 bytes total)
@@ -126,6 +135,46 @@ export declare const IX_TAG: {
  * Note: indexFeedId is the Pyth Pull feed ID (32 bytes hex), NOT an oracle pubkey.
  * The program validates PriceUpdateV2 accounts against this feed ID at runtime.
  */
+/**
+ * Optional 66-byte extended tail for InitMarket (S-4).
+ *
+ * When present and any field is non-zero the encoder appends a 66-byte block
+ * in the exact order that the program reads it (percolator.rs:1516-1545):
+ *   insurance_withdraw_max_bps          u16  (2 bytes)
+ *   insurance_withdraw_cooldown_slots   u64  (8 bytes)
+ *   permissionless_resolve_stale_slots  u64  (8 bytes)
+ *   funding_horizon_slots               u64  (8 bytes)
+ *   funding_k_bps                       u64  (8 bytes)
+ *   funding_max_premium_bps             i64  (8 bytes)
+ *   funding_max_bps_per_slot            i64  (8 bytes)
+ *   mark_min_fee                        u64  (8 bytes)
+ *   force_close_delay_slots             u64  (8 bytes)
+ *   total = 2 + 8*8 = 66 bytes
+ *
+ * When absent (or all fields are zero) the encoder omits the tail and the
+ * program treats all extended fields as their default zero values. This
+ * preserves full backward compatibility with existing 344-byte payloads.
+ */
+export interface InitMarketExtendedTail {
+    /** Maximum percentage of insurance fund withdrawable per cooldown window (0–10 000 bps). */
+    insuranceWithdrawMaxBps: number;
+    /** Slots that must elapse between insurance withdrawals. Required when insuranceWithdrawMaxBps > 0. */
+    insuranceWithdrawCooldownSlots: bigint | string;
+    /** Slots after which an unresolved market may be permissionlessly resolved. */
+    permissionlessResolveStaleSlots: bigint | string;
+    /** Funding rate horizon in slots (custom_funding_k denominator). */
+    fundingHorizonSlots: bigint | string;
+    /** Funding rate K parameter in bps (0 = disabled). */
+    fundingKBps: bigint | string;
+    /** Maximum funding premium in bps (i64 — may be negative to flip direction). */
+    fundingMaxPremiumBps: bigint | string;
+    /** Maximum funding rate change per slot in bps (i64). */
+    fundingMaxBpsPerSlot: bigint | string;
+    /** Minimum fee charged per mark-price update (u64, in collateral base units). */
+    markMinFee: bigint | string;
+    /** Slots to delay forced close after trigger condition is met (0 = immediate). */
+    forceCloseDelaySlots: bigint | string;
+}
 export interface InitMarketArgs {
     admin: PublicKey | string;
     collateralMint: PublicKey | string;
@@ -135,20 +184,76 @@ export interface InitMarketArgs {
     invert: number;
     unitScale: number;
     initialMarkPriceE6: bigint | string;
-    warmupPeriodSlots: bigint | string;
+    maxMaintenanceFeePerSlot?: bigint | string;
+    maxInsuranceFloor?: bigint | string;
+    minOraclePriceCap?: bigint | string;
+    /**
+     * @deprecated Use hMin and hMax instead (v12.15+). Accepted as fallback for both hMin and hMax
+     * when hMin/hMax are not provided.
+     */
+    warmupPeriodSlots?: bigint | string;
+    /** Minimum horizon slots (v12.15+). Falls back to warmupPeriodSlots if not provided. */
+    hMin?: bigint | string;
+    /** Maximum horizon slots (v12.15+). Falls back to warmupPeriodSlots if not provided. */
+    hMax?: bigint | string;
     maintenanceMarginBps: bigint | string;
     initialMarginBps: bigint | string;
     tradingFeeBps: bigint | string;
     maxAccounts: bigint | string;
     newAccountFee: bigint | string;
-    riskReductionThreshold: bigint | string;
+    insuranceFloor?: bigint | string;
     maintenanceFeePerSlot: bigint | string;
     maxCrankStalenessSlots: bigint | string;
     liquidationFeeBps: bigint | string;
     liquidationFeeCap: bigint | string;
-    liquidationBufferBps: bigint | string;
+    liquidationBufferBps?: bigint | string;
     minLiquidationAbs: bigint | string;
+    minInitialDeposit: bigint | string;
+    minNonzeroMmReq: bigint | string;
+    minNonzeroImReq: bigint | string;
+    /**
+     * Optional 66-byte extended tail (S-4).
+     * When present and any field is non-zero, appended after the 344-byte base payload.
+     * When absent (or all zeros), the base 344-byte payload is sent and the program
+     * uses default zero values for all extended fields.
+     * @see InitMarketExtendedTail
+     */
+    extendedTail?: InitMarketExtendedTail;
 }
+/**
+ * Encode InitMarket instruction data.
+ *
+ * Produces either a 344-byte base payload (no extended tail) or a 410-byte
+ * payload (344 + 66 extended tail) depending on whether `args.extendedTail`
+ * is provided and contains at least one non-zero field.
+ *
+ * The program (percolator.rs:1527-1545) treats an empty `rest` as all-zero
+ * defaults, so the 344-byte form is fully backward-compatible.
+ *
+ * @param args InitMarket arguments
+ * @returns Encoded instruction bytes
+ *
+ * @example
+ * ```ts
+ * const ix = encodeInitMarket({
+ *   admin: adminPk,
+ *   collateralMint: mintPk,
+ *   indexFeedId: "0000...0000",
+ *   // ... required fields ...
+ *   extendedTail: {
+ *     insuranceWithdrawMaxBps: 500,
+ *     insuranceWithdrawCooldownSlots: 216000n,
+ *     permissionlessResolveStaleSlots: 0n,
+ *     fundingHorizonSlots: 0n,
+ *     fundingKBps: 0n,
+ *     fundingMaxPremiumBps: 0n,
+ *     fundingMaxBpsPerSlot: 0n,
+ *     markMinFee: 0n,
+ *     forceCloseDelaySlots: 0n,
+ *   },
+ * });
+ * ```
+ */
 export declare function encodeInitMarket(args: InitMarketArgs): Uint8Array;
 /**
  * InitUser instruction data (9 bytes)
@@ -183,12 +288,41 @@ export interface WithdrawCollateralArgs {
 }
 export declare function encodeWithdrawCollateral(args: WithdrawCollateralArgs): Uint8Array;
 /**
- * KeeperCrank instruction data (4 bytes)
- * Funding rate is computed on-chain from LP inventory.
+ * Liquidation policy for KeeperCrank candidates (v12.17 two-phase crank).
+ *
+ * On-chain wire tags:
+ *   0x00 = FullClose — liquidate the entire position
+ *   0x01 = ExactPartial(u128) — reduce position by exactly `quantity` units
+ *   0xFF = TouchOnly — accrue fees / sweep dust, do NOT liquidate
+ */
+export declare const LiquidationPolicyTag: {
+    readonly FullClose: 0;
+    readonly ExactPartial: 1;
+    readonly TouchOnly: 255;
+};
+export type KeeperCrankCandidate = {
+    policy: typeof LiquidationPolicyTag.FullClose;
+    idx: number;
+} | {
+    policy: typeof LiquidationPolicyTag.ExactPartial;
+    idx: number;
+    quantity: bigint | string;
+} | {
+    policy: typeof LiquidationPolicyTag.TouchOnly;
+    idx: number;
+};
+/**
+ * KeeperCrank instruction data (v12.17 two-phase crank).
+ *
+ * Wire format: tag(1) + caller_idx(u16) + format_version=1(u8) +
+ *   candidates: [ idx(u16) + policy_tag(u8) [+ quantity(u128) if ExactPartial] ]*
+ *
+ * Empty candidates list = simple crank (accrue funding, sweep dust).
+ * With candidates = targeted liquidation/touch pass.
  */
 export interface KeeperCrankArgs {
     callerIdx: number;
-    allowPanic: boolean;
+    candidates?: KeeperCrankCandidate[];
 }
 export declare function encodeKeeperCrank(args: KeeperCrankArgs): Uint8Array;
 /**
@@ -222,21 +356,24 @@ export interface TopUpInsuranceArgs {
 }
 export declare function encodeTopUpInsurance(args: TopUpInsuranceArgs): Uint8Array;
 /**
- * TradeCpi instruction data (21 bytes)
+ * TradeCpi instruction data (29 bytes)
+ *
+ * v12.17: limit_price_e6 is now REQUIRED (slippage protection).
+ * Set to 0 to accept any price (no slippage protection).
+ * For buys: tx reverts if execution price > limitPriceE6.
+ * For sells: tx reverts if execution price < limitPriceE6.
  */
 export interface TradeCpiArgs {
     lpIdx: number;
     userIdx: number;
     size: bigint | string;
+    /** Limit price in e6 units. 0 = no limit (accept any price). */
+    limitPriceE6: bigint | string;
 }
 export declare function encodeTradeCpi(args: TradeCpiArgs): Uint8Array;
 /**
- * TradeCpiV2 instruction data (22 bytes) — PERC-154 optimized trade CPI.
- *
- * Same as TradeCpi but includes a caller-provided PDA bump byte.
- * Uses create_program_address instead of find_program_address,
- * saving ~1500 CU per trade. The bump should be obtained once via
- * deriveLpPda() and cached for the lifetime of the market.
+ * @deprecated Tag 35 removed in v12.17. Use TradeCpi (tag 10) with limitPriceE6 instead.
+ * TradeCpi now handles PDA bump internally. Sending tag 35 will fail with InvalidInstructionData.
  */
 export interface TradeCpiV2Args {
     lpIdx: number;
@@ -244,13 +381,24 @@ export interface TradeCpiV2Args {
     size: bigint | string;
     bump: number;
 }
+/** @deprecated Tag 35 removed in v12.17. Use encodeTradeCpi with limitPriceE6 instead. */
 export declare function encodeTradeCpiV2(args: TradeCpiV2Args): Uint8Array;
 /**
- * SetRiskThreshold instruction data (17 bytes)
+ * @deprecated Tag 36 removed in v12.17. Will fail on-chain with InvalidInstructionData.
+ */
+export interface UnresolveMarketArgs {
+    confirmation: bigint | string;
+}
+/** @deprecated Tag 36 removed in v12.17. Will fail on-chain. */
+export declare function encodeUnresolveMarket(args: UnresolveMarketArgs): Uint8Array;
+/**
+ * @deprecated Tag 11 removed in v12.17. Insurance floor is now set at InitMarket.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetRiskThresholdArgs {
     newThreshold: bigint | string;
 }
+/** @deprecated Tag 11 removed in v12.17. Will fail on-chain. */
 export declare function encodeSetRiskThreshold(args: SetRiskThresholdArgs): Uint8Array;
 /**
  * UpdateAdmin instruction data (33 bytes)
@@ -264,61 +412,28 @@ export declare function encodeUpdateAdmin(args: UpdateAdminArgs): Uint8Array;
  */
 export declare function encodeCloseSlab(): Uint8Array;
 /**
- * UpdateConfig instruction data
- * Updates funding and threshold parameters at runtime (admin only)
+ * UpdateConfig instruction data (33 bytes)
+ *
+ * v12.17: Only 4 funding parameters. Threshold/insurance parameters are set
+ * at InitMarket and updated via dedicated instructions (SetRiskThreshold removed).
+ * fundingInvScaleNotionalE6 removed (now computed on-chain from LP state).
  */
 export interface UpdateConfigArgs {
     fundingHorizonSlots: bigint | string;
     fundingKBps: bigint | string;
-    fundingInvScaleNotionalE6: bigint | string;
     fundingMaxPremiumBps: bigint | string;
     fundingMaxBpsPerSlot: bigint | string;
-    threshFloor: bigint | string;
-    threshRiskBps: bigint | string;
-    threshUpdateIntervalSlots: bigint | string;
-    threshStepBps: bigint | string;
-    threshAlphaBps: bigint | string;
-    threshMin: bigint | string;
-    threshMax: bigint | string;
-    threshMinStep: bigint | string;
 }
 export declare function encodeUpdateConfig(args: UpdateConfigArgs): Uint8Array;
 /**
- * SetMaintenanceFee instruction data (17 bytes)
+ * @deprecated Tag 15 removed in v12.17. Maintenance fee is set at InitMarket only.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetMaintenanceFeeArgs {
     newFee: bigint | string;
 }
+/** @deprecated Tag 15 removed in v12.17. Will fail on-chain. */
 export declare function encodeSetMaintenanceFee(args: SetMaintenanceFeeArgs): Uint8Array;
-/**
- * SetOracleAuthority instruction data (33 bytes)
- * Sets the oracle price authority. Pass zero pubkey to disable and require Pyth/Chainlink.
- */
-export interface SetOracleAuthorityArgs {
-    newAuthority: PublicKey | string;
-}
-export declare function encodeSetOracleAuthority(args: SetOracleAuthorityArgs): Uint8Array;
-/**
- * PushOraclePrice instruction data (17 bytes)
- * Push a new oracle price (oracle authority only).
- * The price should be in e6 format and already include any inversion/scaling.
- */
-export interface PushOraclePriceArgs {
-    priceE6: bigint | string;
-    timestamp: bigint | string;
-}
-/**
- * Encode PushOraclePrice instruction data with validation.
- *
- * Validates oracle price constraints:
- * - Price cannot be zero (division by zero in on-chain engine)
- * - Price cannot exceed MAX_ORACLE_PRICE (prevents overflow in price math)
- *
- * @param args - PushOraclePrice arguments
- * @returns Encoded instruction data (17 bytes)
- * @throws Error if price is 0 or exceeds MAX_ORACLE_PRICE
- */
-export declare function encodePushOraclePrice(args: PushOraclePriceArgs): Uint8Array;
 /**
  * SetOraclePriceCap instruction data (9 bytes)
  * Set oracle price circuit breaker cap (admin only).
@@ -357,18 +472,16 @@ export interface AdminForceCloseArgs {
 }
 export declare function encodeAdminForceClose(args: AdminForceCloseArgs): Uint8Array;
 /**
- * UpdateRiskParams instruction data (17 or 25 bytes)
- * Update initial and maintenance margin BPS (admin only).
- *
- * R2-S13: The Rust program uses `data.len() >= 25` to detect the optional
- * tradingFeeBps field, so variable-length encoding is safe. When tradingFeeBps
- * is omitted, the data is 17 bytes (tag + 2×u64). When included, 25 bytes.
+ * @deprecated Tag 22 is now SetInsuranceWithdrawPolicy in v12.17.
+ * This encoder sends the WRONG wire format (u64+u64 instead of pubkey+u64+u16+u64).
+ * Use encodeSetInsuranceWithdrawPolicy instead.
  */
 export interface UpdateRiskParamsArgs {
     initialMarginBps: bigint | string;
     maintenanceMarginBps: bigint | string;
     tradingFeeBps?: bigint | string;
 }
+/** @deprecated Use encodeSetInsuranceWithdrawPolicy (tag 22). This sends wrong wire format. */
 export declare function encodeUpdateRiskParams(args: UpdateRiskParamsArgs): Uint8Array;
 /**
  * On-chain confirmation code for RenounceAdmin (must match program constant).
@@ -380,11 +493,9 @@ export declare const RENOUNCE_ADMIN_CONFIRMATION = 5928230587143701317n;
  */
 export declare const UNRESOLVE_CONFIRMATION = 16045690984503054900n;
 /**
- * RenounceAdmin instruction data (9 bytes)
- * Irreversibly set admin to all zeros. After this, all admin-only instructions fail.
- *
- * Requires the confirmation code 0x52454E4F554E4345 ("RENOUNCE" as u64 LE)
- * to prevent accidental invocation.
+ * @deprecated Tag 23 is now WithdrawInsuranceLimited in v12.17.
+ * This encoder sends the confirmation code as a withdrawal amount — DANGEROUS.
+ * Use encodeWithdrawInsuranceLimited instead.
  */
 export declare function encodeRenounceAdmin(): Uint8Array;
 /**
@@ -443,29 +554,15 @@ export declare function encodePauseMarket(): Uint8Array;
  */
 export declare function encodeUnpauseMarket(): Uint8Array;
 /**
- * SetPythOracle (Tag 32) — switch a market to Pyth-pinned mode.
- *
- * After this instruction:
- * - oracle_authority is cleared → PushOraclePrice is disabled
- * - index_feed_id is set to feed_id → validated on every price read
- * - max_staleness_secs and conf_filter_bps are updated
- * - All price reads go directly to read_pyth_price_e6() with on-chain
- *   staleness + confidence + feed-ID validation (no silent fallback)
- *
- * Instruction data: tag(1) + feed_id(32) + max_staleness_secs(8) + conf_filter_bps(2) = 43 bytes
- *
- * Accounts:
- *   0. [signer, writable] Admin
- *   1. [writable]         Slab
+ * @deprecated Tag 32 removed in v12.17. Pyth oracle is configured at InitMarket via indexFeedId.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetPythOracleArgs {
-    /** 32-byte Pyth feed ID. All zeros is invalid (reserved for Hyperp mode). */
     feedId: Uint8Array;
-    /** Maximum age of Pyth price in seconds before OracleStale is returned. Must be > 0. */
     maxStalenessSecs: bigint;
-    /** Max confidence/price ratio in bps (0 = no confidence check). */
     confFilterBps: number;
 }
+/** @deprecated Tag 32 removed in v12.17. Pyth is configured at InitMarket. */
 export declare function encodeSetPythOracle(args: SetPythOracleArgs): Uint8Array;
 /**
  * Derive the expected Pyth PriceUpdateV2 account address for a given feed ID.
@@ -477,18 +574,8 @@ export declare function encodeSetPythOracle(args: SetPythOracleArgs): Uint8Array
 export declare const PYTH_RECEIVER_PROGRAM_ID = "rec5EKMGg6MxZYaMdyBfgwp4d5rB9T1VQH5pJv5LtFJ";
 export declare function derivePythPriceUpdateAccount(feedId: Uint8Array, shardId?: number): Promise<string>;
 /**
- * UpdateMarkPrice (Tag 33) — permissionless EMA mark price crank.
- *
- * Reads the current oracle price on-chain, applies 8-hour EMA smoothing
- * with circuit breaker, and writes result to authority_price_e6.
- *
- * Instruction data: 1 byte (tag only — all params read from on-chain state)
- *
- * Accounts:
- *   0. [writable] Slab
- *   1. []         Oracle account (Pyth PriceUpdateV2 / Chainlink / DEX AMM)
- *   2. []         Clock sysvar (SysvarC1ock11111111111111111111111111111111)
- *   3..N []       Remaining accounts (PumpSwap vaults, etc. if needed)
+ * @deprecated Tag 33 removed in v12.17. Use UpdateHyperpMark (tag 34) for DEX-oracle markets.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export declare function encodeUpdateMarkPrice(): Uint8Array;
 /**
@@ -677,21 +764,6 @@ export declare const PHASE2_MATURITY_SLOTS = 3024000n;
  * @returns [newPhase, shouldTransition]
  */
 export declare function checkPhaseTransition(currentSlot: bigint, marketCreatedSlot: bigint, oraclePhase: number, cumulativeVolumeE6: bigint, phase2DeltaSlots: number, hasMatureOracle: boolean): [number, boolean];
-/**
- * TopUpKeeperFund (Tag 57) — permissionless keeper fund top-up.
- *
- * Instruction data: tag(1) + amount(8) = 9 bytes
- *
- * Accounts:
- *   0. [signer, writable] Funder
- *   1. [writable]         Slab
- *   2. [writable]         Keeper fund PDA
- *   3. []                 System program
- */
-export interface TopUpKeeperFundArgs {
-    amount: bigint | string;
-}
-export declare function encodeTopUpKeeperFund(args: TopUpKeeperFundArgs): Uint8Array;
 /**
  * SlashCreationDeposit (Tag 58) — permissionless: slash a market creator's deposit
  * after the spam grace period has elapsed (PERC-629).
@@ -823,28 +895,24 @@ export declare function encodeSetOiImbalanceHardBlock(args: {
  * Creates a PositionNft PDA + Token-2022 mint with metadata, then mints 1 NFT to the
  * position owner's ATA. The NFT represents ownership of `user_idx` in the slab.
  *
- * Instruction data layout: tag(1) + user_idx(2) = 3 bytes
+ * The program creates the ATA internally via CPI when the 11th account (Associated Token
+ * Program) is provided. This is required because the NFT mint PDA doesn't exist until the
+ * program creates it, so the ATA can't be created in a preceding instruction.
  *
- * Accounts:
- *   0. [signer, writable] payer
- *   1. [writable]         slab
- *   2. [writable]         position_nft PDA  (created — seeds: ["position_nft", slab, user_idx])
- *   3. [writable]         nft_mint PDA      (created)
- *   4. [writable]         owner_ata         (Token-2022 ATA for owner)
- *   5. [signer]           owner             (must match engine account owner)
- *   6. []                 vault_authority PDA
- *   7. []                 token_2022_program
- *   8. []                 system_program
- *   9. []                 rent sysvar
+ * Instruction data layout: tag(1) + user_idx(2) = 3 bytes
  *
- * @example
- * ```ts
- * const ix = new TransactionInstruction({
- *   programId: PROGRAM_ID,
- *   keys: buildAccountMetas(ACCOUNTS_MINT_POSITION_NFT, [payer, slab, nftPda, nftMint, ownerAta, owner, vaultAuth, TOKEN_2022_PROGRAM_ID, SystemProgram.programId, SYSVAR_RENT_PUBKEY]),
- *   data: Buffer.from(encodeMintPositionNft({ userIdx: 5 })),
- * });
- * ```
+ * Accounts (11):
+ *   0.  [signer, writable] payer
+ *   1.  [writable]         slab
+ *   2.  [writable]         position_nft PDA  (created — seeds: ["position_nft", slab, user_idx_u16_le])
+ *   3.  [writable]         nft_mint PDA      (created — seeds: ["position_nft_mint", slab, user_idx_u16_le])
+ *   4.  [writable]         owner_ata         (Token-2022 ATA for nft_mint — created by program if absent)
+ *   5.  [signer]           owner             (must match engine account owner)
+ *   6.  []                 vault_authority PDA (seeds: ["vault", slab])
+ *   7.  []                 token_2022_program (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb)
+ *   8.  []                 system_program
+ *   9.  []                 rent sysvar
+ *   10. []                 associated_token_program (ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL)
  */
 export interface MintPositionNftArgs {
     userIdx: number;
@@ -1032,3 +1100,168 @@ export interface InitMatcherCtxArgs {
     skewSpreadMultBps: number;
 }
 export declare function encodeInitMatcherCtx(args: InitMatcherCtxArgs): Uint8Array;
+/** SetInsuranceWithdrawPolicy (tag 22): authority + min_withdraw_base + max_withdraw_bps + cooldown_slots */
+export interface SetInsuranceWithdrawPolicyArgs {
+    authority: PublicKey | string;
+    minWithdrawBase: bigint | string;
+    maxWithdrawBps: number;
+    cooldownSlots: bigint | string;
+}
+export declare function encodeSetInsuranceWithdrawPolicy(args: SetInsuranceWithdrawPolicyArgs): Uint8Array;
+/**
+ * WithdrawInsuranceLimited (tag 23): amount.
+ * Account count is 7 (resolved markets) or 8 (live markets — oracle required
+ * for same-instruction accrue_market_to per upstream 8ce8d54).
+ * See ACCOUNTS_WITHDRAW_INSURANCE_LIMITED_LIVE / _RESOLVED in accounts.ts.
+ */
+export declare function encodeWithdrawInsuranceLimited(args: {
+    amount: bigint | string;
+}): Uint8Array;
+/** ResolvePermissionless (tag 29): no args */
+export declare function encodeResolvePermissionless(): Uint8Array;
+/** ForceCloseResolved (tag 30): user_idx */
+export declare function encodeForceCloseResolved(args: {
+    userIdx: number;
+}): Uint8Array;
+/** CreateLpVault (tag 37): fee_share_bps + util_curve_enabled */
+export declare function encodeCreateLpVault(args: {
+    feeShareBps: bigint | string;
+    utilCurveEnabled?: boolean;
+}): Uint8Array;
+/** LpVaultDeposit (tag 38): amount */
+export declare function encodeLpVaultDeposit(args: {
+    amount: bigint | string;
+}): Uint8Array;
+/** LpVaultCrankFees (tag 40): no args */
+export declare function encodeLpVaultCrankFees(): Uint8Array;
+/** ChallengeSettlement (tag 43): proposed_price_e6 */
+export declare function encodeChallengeSettlement(args: {
+    proposedPriceE6: bigint | string;
+}): Uint8Array;
+/** ResolveDispute (tag 44): accept (0 = reject, 1 = accept) */
+export declare function encodeResolveDispute(args: {
+    accept: number;
+}): Uint8Array;
+/** DepositLpCollateral (tag 45): user_idx + lp_amount */
+export declare function encodeDepositLpCollateral(args: {
+    userIdx: number;
+    lpAmount: bigint | string;
+}): Uint8Array;
+/** WithdrawLpCollateral (tag 46): user_idx + lp_amount */
+export declare function encodeWithdrawLpCollateral(args: {
+    userIdx: number;
+    lpAmount: bigint | string;
+}): Uint8Array;
+/** SetOffsetPair (tag 54): offset_bps */
+export declare function encodeSetOffsetPair(args: {
+    offsetBps: number;
+}): Uint8Array;
+/** AttestCrossMargin (tag 55): user_idx_a + user_idx_b */
+export declare function encodeAttestCrossMargin(args: {
+    userIdxA: number;
+    userIdxB: number;
+}): Uint8Array;
+/** RescueOrphanVault (tag 72): no args */
+export declare function encodeRescueOrphanVault(): Uint8Array;
+/** CloseOrphanSlab (tag 73): no args */
+export declare function encodeCloseOrphanSlab(): Uint8Array;
+/** SetDexPool (tag 74): pool pubkey */
+export declare function encodeSetDexPool(args: {
+    pool: PublicKey | string;
+}): Uint8Array;
+/** CreateInsuranceMint: creates the insurance LP mint PDA (tag 37, same as CreateLpVault) */
+export declare function encodeCreateInsuranceMint(): Uint8Array;
+/** DepositInsuranceLP: deposit collateral, receive LP tokens (tag 38, same as LpVaultDeposit) */
+export declare function encodeDepositInsuranceLP(args: {
+    amount: bigint | string;
+}): Uint8Array;
+/** WithdrawInsuranceLP: burn LP tokens, withdraw collateral (tag 39, same as LpVaultWithdraw) */
+export declare function encodeWithdrawInsuranceLP(args: {
+    lpAmount: bigint | string;
+}): Uint8Array;
+/**
+ * SetMaxPnlCap (Tag 78, PERC-305 / SECURITY(H-4)) — set the PnL cap for ADL
+ * pre-check (admin only). When `pnl_pos_tot <= max_pnl_cap`, ADL returns
+ * early (no deleveraging needed).
+ *
+ * `capE6 = 0` disables the cap (ADL always runs when insurance is depleted).
+ *
+ * Instruction data: tag(1) + cap(u64, 8) = 9 bytes
+ */
+export interface SetMaxPnlCapArgs {
+    /** PnL cap in engine quote units (e.g., 1_000_000 = $1 e6). 0 = cap disabled. */
+    cap: bigint | string;
+}
+export declare function encodeSetMaxPnlCap(args: SetMaxPnlCapArgs): Uint8Array;
+/**
+ * SetOiCapMultiplier (Tag 79, PERC-309) — set the OI cap multiplier for LP
+ * withdrawal limits (admin only). Packed u64:
+ *   lo 32 bits: multiplier_bps (e.g., 15000 = 1.5× soft cap in stressed state)
+ *   hi 32 bits: soft_cap_bps   (e.g., 8000  = 80% base cap)
+ *
+ * `packed = 0` disables enforcement (no cap on LP withdrawals).
+ *
+ * Instruction data: tag(1) + packed(u64, 8) = 9 bytes
+ */
+export interface SetOiCapMultiplierArgs {
+    /** Packed u64: lo32 = multiplier_bps, hi32 = soft_cap_bps. 0 = disabled. */
+    packed: bigint | string;
+}
+export declare function encodeSetOiCapMultiplier(args: SetOiCapMultiplierArgs): Uint8Array;
+/** Convenience: pack (multiplier_bps, soft_cap_bps) into the u64 expected by SetOiCapMultiplier. */
+export declare function packOiCap(multiplierBps: number, softCapBps: number): bigint;
+/**
+ * SetDisputeParams (Tag 80, PERC-314) — configure settlement dispute window
+ * and bond (admin only).
+ *
+ * - `windowSlots = 0` disables disputes (ChallengeSettlement returns
+ *   DisputeWindowClosed). Max: 2_000_000 slots (≈ 8 days at 400ms slots) to
+ *   prevent DoS via absurd freezes.
+ * - `bondAmount` (collateral tokens): refunded on dispute upheld, forfeited
+ *   on reject. 0 = no bond required.
+ *
+ * Instruction data: tag(1) + window_slots(u64, 8) + bond_amount(u64, 8) = 17 bytes
+ */
+export interface SetDisputeParamsArgs {
+    /** Dispute window in slots. 0 = disputes disabled. Max 2_000_000. */
+    windowSlots: bigint | string;
+    /** Bond required to open a dispute (collateral units). 0 = no bond. */
+    bondAmount: bigint | string;
+}
+export declare function encodeSetDisputeParams(args: SetDisputeParamsArgs): Uint8Array;
+/**
+ * SetLpCollateralParams (Tag 81, PERC-315) — configure LP token collateral
+ * acceptance (admin only).
+ *
+ * - `enabled = 0`: DepositLpCollateral rejects all new deposits.
+ * - `enabled = 1`: deposits allowed, subject to `ltvBps` haircut on value.
+ * - `ltvBps` max 10_000 (100%). Typical: 5000 (50% LTV).
+ *
+ * Instruction data: tag(1) + enabled(u8, 1) + ltv_bps(u16, 2) = 4 bytes
+ */
+export interface SetLpCollateralParamsArgs {
+    /** 0 = disabled (blocks new deposits), 1 = enabled. */
+    enabled: number;
+    /** LTV in bps (0-10000). 5000 = 50% LTV. */
+    ltvBps: number;
+}
+export declare function encodeSetLpCollateralParams(args: SetLpCollateralParamsArgs): Uint8Array;
+/**
+ * AcceptAdmin (Tag 82, Phase E 2026-04-17) — complete a two-step admin transfer.
+ *
+ * Called by the PROPOSED new admin (the pubkey passed to UpdateAdmin with
+ * `new_admin != default()`). The signer must match config.pending_admin
+ * exactly. On success, header.admin is swapped to pending_admin and
+ * pending_admin is cleared.
+ *
+ * Use `try_update_admin` then `try_accept_admin` for a full rotation, or
+ * skip AcceptAdmin entirely to leave a pending transfer that the old
+ * admin can overwrite (propose-again) or the new admin can never accept.
+ *
+ * Accounts:
+ *   [0] new admin (signer, must match pending_admin)
+ *   [1] slab (writable)
+ *
+ * Instruction data: tag(1) = 1 byte. No payload.
+ */
+export declare function encodeAcceptAdmin(): Uint8Array;