@percolatorct/sdk 1.0.0-beta.8 → 2.0.0

package/dist/abi/instructions.d.ts

@@ -1,9 +1,4 @@
 import { PublicKey } from "@solana/web3.js";
-/**
- * Oracle price constraints.
- * Maximum oracle price that can be pushed to the on-chain oracle authority.
- */
-export declare const MAX_ORACLE_PRICE = 1000000000000n;
 /**
  * Instruction tags - exact match to Rust ix::Instruction::decode
  */
@@ -24,8 +19,6 @@ export declare const IX_TAG: {
     readonly CloseSlab: 13;
     readonly UpdateConfig: 14;
     readonly SetMaintenanceFee: 15;
-    readonly SetOracleAuthority: 16;
-    readonly PushOraclePrice: 17;
     readonly SetOraclePriceCap: 18;
     readonly ResolveMarket: 19;
     readonly WithdrawInsurance: 20;
@@ -38,11 +31,8 @@ export declare const IX_TAG: {
     readonly ReclaimEmptyAccount: 25;
     readonly SettleAccount: 26;
     readonly DepositFeeCredits: 27;
-    /** @deprecated No on-chain PauseMarket instruction */ readonly PauseMarket: 27;
     readonly ConvertReleasedPnl: 28;
-    /** @deprecated No on-chain UnpauseMarket instruction */ readonly UnpauseMarket: 28;
     readonly ResolvePermissionless: 29;
-    /** @deprecated Use ResolvePermissionless */ readonly AcceptAdmin: 29;
     readonly ForceCloseResolved: 30;
     readonly SetPythOracle: 32;
     readonly UpdateMarkPrice: 33;
@@ -85,8 +75,6 @@ export declare const IX_TAG: {
     readonly AttestCrossMargin: 55;
     /** PERC-622: Advance oracle phase (permissionless crank) */
     readonly AdvanceOraclePhase: 56;
-    /** PERC-623: Top up a market's keeper fund (permissionless) */
-    readonly TopUpKeeperFund: 57;
     /** PERC-629: Slash a market creator's deposit (permissionless) */
     readonly SlashCreationDeposit: 58;
     /** PERC-628: Initialize the global shared vault (admin) */
@@ -123,6 +111,26 @@ export declare const IX_TAG: {
     readonly SetDexPool: 74;
     /** CPI to the matcher program to initialize a matcher context account for an LP slot. Admin-only. */
     readonly InitMatcherCtx: 75;
+    /** PauseMarket (tag 76): admin emergency pause. Blocks Trade/Deposit/Withdraw/InitUser. */
+    readonly PauseMarket: 76;
+    /** UnpauseMarket (tag 77): admin unpause. Re-enables all operations. */
+    readonly UnpauseMarket: 77;
+    /** PERC-305 / SECURITY(H-4): Set PnL cap for ADL pre-check (admin only). */
+    readonly SetMaxPnlCap: 78;
+    /** PERC-309: Set OI cap multiplier for LP withdrawal limits (admin only). Packed u64. */
+    readonly SetOiCapMultiplier: 79;
+    /** PERC-314: Set dispute params (window_slots + bond_amount, admin only). */
+    readonly SetDisputeParams: 80;
+    /** PERC-315: Set LP collateral params (enabled + ltv_bps, admin only). */
+    readonly SetLpCollateralParams: 81;
+    /** Phase E (2026-04-17): Accept a pending admin transfer. Signer must match pending_admin. */
+    readonly AcceptAdmin: 82;
+    /**
+     * v12.18.x 4-way authority split (added 2026-04-22, wrapper 86ea41f).
+     * Unified mutator for admin/hyperp_mark/insurance/insurance_operator.
+     * Wrapper handler: src/percolator.rs:6876.
+     */
+    readonly UpdateAuthority: 83;
 };
 /**
  * InitMarket instruction data (256 bytes total)
@@ -133,6 +141,46 @@ export declare const IX_TAG: {
  * Note: indexFeedId is the Pyth Pull feed ID (32 bytes hex), NOT an oracle pubkey.
  * The program validates PriceUpdateV2 accounts against this feed ID at runtime.
  */
+/**
+ * Optional 66-byte extended tail for InitMarket (S-4).
+ *
+ * When present and any field is non-zero the encoder appends a 66-byte block
+ * in the exact order that the program reads it (percolator.rs:1516-1545):
+ *   insurance_withdraw_max_bps          u16  (2 bytes)
+ *   insurance_withdraw_cooldown_slots   u64  (8 bytes)
+ *   permissionless_resolve_stale_slots  u64  (8 bytes)
+ *   funding_horizon_slots               u64  (8 bytes)
+ *   funding_k_bps                       u64  (8 bytes)
+ *   funding_max_premium_bps             i64  (8 bytes)
+ *   funding_max_bps_per_slot            i64  (8 bytes)
+ *   mark_min_fee                        u64  (8 bytes)
+ *   force_close_delay_slots             u64  (8 bytes)
+ *   total = 2 + 8*8 = 66 bytes
+ *
+ * When absent (or all fields are zero) the encoder omits the tail and the
+ * program treats all extended fields as their default zero values. This
+ * preserves full backward compatibility with existing 344-byte payloads.
+ */
+export interface InitMarketExtendedTail {
+    /** Maximum percentage of insurance fund withdrawable per cooldown window (0–10 000 bps). */
+    insuranceWithdrawMaxBps: number;
+    /** Slots that must elapse between insurance withdrawals. Required when insuranceWithdrawMaxBps > 0. */
+    insuranceWithdrawCooldownSlots: bigint | string;
+    /** Slots after which an unresolved market may be permissionlessly resolved. */
+    permissionlessResolveStaleSlots: bigint | string;
+    /** Funding rate horizon in slots (custom_funding_k denominator). */
+    fundingHorizonSlots: bigint | string;
+    /** Funding rate K parameter in bps (0 = disabled). */
+    fundingKBps: bigint | string;
+    /** Maximum funding premium in bps (i64 — may be negative to flip direction). */
+    fundingMaxPremiumBps: bigint | string;
+    /** Maximum funding rate change per slot in bps (i64). */
+    fundingMaxBpsPerSlot: bigint | string;
+    /** Minimum fee charged per mark-price update (u64, in collateral base units). */
+    markMinFee: bigint | string;
+    /** Slots to delay forced close after trigger condition is met (0 = immediate). */
+    forceCloseDelaySlots: bigint | string;
+}
 export interface InitMarketArgs {
     admin: PublicKey | string;
     collateralMint: PublicKey | string;
@@ -143,25 +191,78 @@ export interface InitMarketArgs {
     unitScale: number;
     initialMarkPriceE6: bigint | string;
     maxMaintenanceFeePerSlot?: bigint | string;
+    /** @deprecated v12.17-only field. v12.19 wrapper does not read it. Kept for source-compat, value ignored. */
     maxInsuranceFloor?: bigint | string;
+    /** @deprecated v12.17-only field. v12.19 wrapper does not read it. Kept for source-compat, value ignored. */
     minOraclePriceCap?: bigint | string;
-    warmupPeriodSlots: bigint | string;
+    /**
+     * @deprecated Use hMin and hMax instead (v12.15+). Accepted as fallback for both hMin and hMax
+     * when hMin/hMax are not provided.
+     */
+    warmupPeriodSlots?: bigint | string;
+    /** Minimum horizon slots (v12.15+). Falls back to warmupPeriodSlots if not provided. */
+    hMin?: bigint | string;
+    /** Maximum horizon slots (v12.15+). Falls back to warmupPeriodSlots if not provided. */
+    hMax?: bigint | string;
     maintenanceMarginBps: bigint | string;
     initialMarginBps: bigint | string;
     tradingFeeBps: bigint | string;
     maxAccounts: bigint | string;
     newAccountFee: bigint | string;
-    riskReductionThreshold: bigint | string;
+    insuranceFloor?: bigint | string;
     maintenanceFeePerSlot: bigint | string;
     maxCrankStalenessSlots: bigint | string;
     liquidationFeeBps: bigint | string;
     liquidationFeeCap: bigint | string;
-    liquidationBufferBps: bigint | string;
+    liquidationBufferBps?: bigint | string;
     minLiquidationAbs: bigint | string;
-    minInitialDeposit: bigint | string;
+    /** @deprecated v12.17-only top-level field. v12.19 wrapper does not read a separate min_initial_deposit. Kept for source-compat, value ignored. */
+    minInitialDeposit?: bigint | string;
     minNonzeroMmReq: bigint | string;
     minNonzeroImReq: bigint | string;
+    /**
+     * Optional 66-byte extended tail (S-4).
+     * When present and any field is non-zero, appended after the 344-byte base payload.
+     * When absent (or all zeros), the base 344-byte payload is sent and the program
+     * uses default zero values for all extended fields.
+     * @see InitMarketExtendedTail
+     */
+    extendedTail?: InitMarketExtendedTail;
 }
+/**
+ * Encode InitMarket instruction data.
+ *
+ * Produces either a 344-byte base payload (no extended tail) or a 410-byte
+ * payload (344 + 66 extended tail) depending on whether `args.extendedTail`
+ * is provided and contains at least one non-zero field.
+ *
+ * The program (percolator.rs:1527-1545) treats an empty `rest` as all-zero
+ * defaults, so the 344-byte form is fully backward-compatible.
+ *
+ * @param args InitMarket arguments
+ * @returns Encoded instruction bytes
+ *
+ * @example
+ * ```ts
+ * const ix = encodeInitMarket({
+ *   admin: adminPk,
+ *   collateralMint: mintPk,
+ *   indexFeedId: "0000...0000",
+ *   // ... required fields ...
+ *   extendedTail: {
+ *     insuranceWithdrawMaxBps: 500,
+ *     insuranceWithdrawCooldownSlots: 216000n,
+ *     permissionlessResolveStaleSlots: 0n,
+ *     fundingHorizonSlots: 0n,
+ *     fundingKBps: 0n,
+ *     fundingMaxPremiumBps: 0n,
+ *     fundingMaxBpsPerSlot: 0n,
+ *     markMinFee: 0n,
+ *     forceCloseDelaySlots: 0n,
+ *   },
+ * });
+ * ```
+ */
 export declare function encodeInitMarket(args: InitMarketArgs): Uint8Array;
 /**
  * InitUser instruction data (9 bytes)
@@ -196,12 +297,41 @@ export interface WithdrawCollateralArgs {
 }
 export declare function encodeWithdrawCollateral(args: WithdrawCollateralArgs): Uint8Array;
 /**
- * KeeperCrank instruction data (4 bytes)
- * Funding rate is computed on-chain from LP inventory.
+ * Liquidation policy for KeeperCrank candidates (v12.17 two-phase crank).
+ *
+ * On-chain wire tags:
+ *   0x00 = FullClose — liquidate the entire position
+ *   0x01 = ExactPartial(u128) — reduce position by exactly `quantity` units
+ *   0xFF = TouchOnly — accrue fees / sweep dust, do NOT liquidate
+ */
+export declare const LiquidationPolicyTag: {
+    readonly FullClose: 0;
+    readonly ExactPartial: 1;
+    readonly TouchOnly: 255;
+};
+export type KeeperCrankCandidate = {
+    policy: typeof LiquidationPolicyTag.FullClose;
+    idx: number;
+} | {
+    policy: typeof LiquidationPolicyTag.ExactPartial;
+    idx: number;
+    quantity: bigint | string;
+} | {
+    policy: typeof LiquidationPolicyTag.TouchOnly;
+    idx: number;
+};
+/**
+ * KeeperCrank instruction data (v12.17 two-phase crank).
+ *
+ * Wire format: tag(1) + caller_idx(u16) + format_version=1(u8) +
+ *   candidates: [ idx(u16) + policy_tag(u8) [+ quantity(u128) if ExactPartial] ]*
+ *
+ * Empty candidates list = simple crank (accrue funding, sweep dust).
+ * With candidates = targeted liquidation/touch pass.
  */
 export interface KeeperCrankArgs {
     callerIdx: number;
-    allowPanic: boolean;
+    candidates?: KeeperCrankCandidate[];
 }
 export declare function encodeKeeperCrank(args: KeeperCrankArgs): Uint8Array;
 /**
@@ -235,21 +365,24 @@ export interface TopUpInsuranceArgs {
 }
 export declare function encodeTopUpInsurance(args: TopUpInsuranceArgs): Uint8Array;
 /**
- * TradeCpi instruction data (21 bytes)
+ * TradeCpi instruction data (29 bytes)
+ *
+ * v12.17: limit_price_e6 is now REQUIRED (slippage protection).
+ * Set to 0 to accept any price (no slippage protection).
+ * For buys: tx reverts if execution price > limitPriceE6.
+ * For sells: tx reverts if execution price < limitPriceE6.
  */
 export interface TradeCpiArgs {
     lpIdx: number;
     userIdx: number;
     size: bigint | string;
+    /** Limit price in e6 units. 0 = no limit (accept any price). */
+    limitPriceE6: bigint | string;
 }
 export declare function encodeTradeCpi(args: TradeCpiArgs): Uint8Array;
 /**
- * TradeCpiV2 instruction data (22 bytes) — PERC-154 optimized trade CPI.
- *
- * Same as TradeCpi but includes a caller-provided PDA bump byte.
- * Uses create_program_address instead of find_program_address,
- * saving ~1500 CU per trade. The bump should be obtained once via
- * deriveLpPda() and cached for the lifetime of the market.
+ * @deprecated Tag 35 removed in v12.17. Use TradeCpi (tag 10) with limitPriceE6 instead.
+ * TradeCpi now handles PDA bump internally. Sending tag 35 will fail with InvalidInstructionData.
  */
 export interface TradeCpiV2Args {
     lpIdx: number;
@@ -257,14 +390,25 @@ export interface TradeCpiV2Args {
     size: bigint | string;
     bump: number;
 }
-export declare function encodeTradeCpiV2(args: TradeCpiV2Args): Uint8Array;
+/** @deprecated Tag 35 removed in v12.17. Use encodeTradeCpi with limitPriceE6 instead. */
+export declare function encodeTradeCpiV2(_args: TradeCpiV2Args): Uint8Array;
 /**
- * SetRiskThreshold instruction data (17 bytes)
+ * @deprecated Tag 36 removed in v12.17. Will fail on-chain with InvalidInstructionData.
+ */
+export interface UnresolveMarketArgs {
+    confirmation: bigint | string;
+}
+/** @deprecated Tag 36 removed in v12.17. Will fail on-chain. */
+export declare function encodeUnresolveMarket(_args: UnresolveMarketArgs): Uint8Array;
+/**
+ * @deprecated Tag 11 removed in v12.17. Insurance floor is now set at InitMarket.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetRiskThresholdArgs {
     newThreshold: bigint | string;
 }
-export declare function encodeSetRiskThreshold(args: SetRiskThresholdArgs): Uint8Array;
+/** @deprecated Tag 11 removed in v12.17. Will fail on-chain. */
+export declare function encodeSetRiskThreshold(_args: SetRiskThresholdArgs): Uint8Array;
 /**
  * UpdateAdmin instruction data (33 bytes)
  */
@@ -277,61 +421,34 @@ export declare function encodeUpdateAdmin(args: UpdateAdminArgs): Uint8Array;
  */
 export declare function encodeCloseSlab(): Uint8Array;
 /**
- * UpdateConfig instruction data
- * Updates funding and threshold parameters at runtime (admin only)
+ * UpdateConfig instruction data.
+ *
+ * 35 bytes: tag(1) + funding_horizon_slots(8) + funding_k_bps(8) +
+ * funding_max_premium_bps(8) + funding_max_e9_per_slot(8) +
+ * tvl_insurance_cap_mult(2). Wire layout matches v12.19 wrapper at
+ * src/percolator.rs:2027-2041 (handle_update_config decode).
  */
 export interface UpdateConfigArgs {
     fundingHorizonSlots: bigint | string;
     fundingKBps: bigint | string;
-    fundingInvScaleNotionalE6: bigint | string;
     fundingMaxPremiumBps: bigint | string;
     fundingMaxBpsPerSlot: bigint | string;
-    threshFloor: bigint | string;
-    threshRiskBps: bigint | string;
-    threshUpdateIntervalSlots: bigint | string;
-    threshStepBps: bigint | string;
-    threshAlphaBps: bigint | string;
-    threshMin: bigint | string;
-    threshMax: bigint | string;
-    threshMinStep: bigint | string;
+    /**
+     * u16 deposit cap multiplier. 0 disables the protocol-enforced cap.
+     * Wrapper field added at src/percolator.rs:2031.
+     */
+    tvlInsuranceCapMult?: number;
 }
 export declare function encodeUpdateConfig(args: UpdateConfigArgs): Uint8Array;
 /**
- * SetMaintenanceFee instruction data (17 bytes)
+ * @deprecated Tag 15 removed in v12.17. Maintenance fee is set at InitMarket only.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetMaintenanceFeeArgs {
     newFee: bigint | string;
 }
-export declare function encodeSetMaintenanceFee(args: SetMaintenanceFeeArgs): Uint8Array;
-/**
- * SetOracleAuthority instruction data (33 bytes)
- * Sets the oracle price authority. Pass zero pubkey to disable and require Pyth/Chainlink.
- */
-export interface SetOracleAuthorityArgs {
-    newAuthority: PublicKey | string;
-}
-export declare function encodeSetOracleAuthority(args: SetOracleAuthorityArgs): Uint8Array;
-/**
- * PushOraclePrice instruction data (17 bytes)
- * Push a new oracle price (oracle authority only).
- * The price should be in e6 format and already include any inversion/scaling.
- */
-export interface PushOraclePriceArgs {
-    priceE6: bigint | string;
-    timestamp: bigint | string;
-}
-/**
- * Encode PushOraclePrice instruction data with validation.
- *
- * Validates oracle price constraints:
- * - Price cannot be zero (division by zero in on-chain engine)
- * - Price cannot exceed MAX_ORACLE_PRICE (prevents overflow in price math)
- *
- * @param args - PushOraclePrice arguments
- * @returns Encoded instruction data (17 bytes)
- * @throws Error if price is 0 or exceeds MAX_ORACLE_PRICE
- */
-export declare function encodePushOraclePrice(args: PushOraclePriceArgs): Uint8Array;
+/** @deprecated Tag 15 removed in v12.17. Will fail on-chain. */
+export declare function encodeSetMaintenanceFee(_args: SetMaintenanceFeeArgs): Uint8Array;
 /**
  * SetOraclePriceCap instruction data (9 bytes)
  * Set oracle price circuit breaker cap (admin only).
@@ -370,19 +487,17 @@ export interface AdminForceCloseArgs {
 }
 export declare function encodeAdminForceClose(args: AdminForceCloseArgs): Uint8Array;
 /**
- * UpdateRiskParams instruction data (17 or 25 bytes)
- * Update initial and maintenance margin BPS (admin only).
- *
- * R2-S13: The Rust program uses `data.len() >= 25` to detect the optional
- * tradingFeeBps field, so variable-length encoding is safe. When tradingFeeBps
- * is omitted, the data is 17 bytes (tag + 2×u64). When included, 25 bytes.
+ * @deprecated Tag 22 is now SetInsuranceWithdrawPolicy in v12.17.
+ * This encoder sends the WRONG wire format (u64+u64 instead of pubkey+u64+u16+u64).
+ * Use encodeSetInsuranceWithdrawPolicy instead.
  */
 export interface UpdateRiskParamsArgs {
     initialMarginBps: bigint | string;
     maintenanceMarginBps: bigint | string;
     tradingFeeBps?: bigint | string;
 }
-export declare function encodeUpdateRiskParams(args: UpdateRiskParamsArgs): Uint8Array;
+/** @deprecated Use encodeSetInsuranceWithdrawPolicy (tag 22). This sends wrong wire format. */
+export declare function encodeUpdateRiskParams(_args: UpdateRiskParamsArgs): Uint8Array;
 /**
  * On-chain confirmation code for RenounceAdmin (must match program constant).
  * ASCII "RENOUNCE" as u64 LE = 0x52454E4F554E4345.
@@ -393,11 +508,9 @@ export declare const RENOUNCE_ADMIN_CONFIRMATION = 5928230587143701317n;
  */
 export declare const UNRESOLVE_CONFIRMATION = 16045690984503054900n;
 /**
- * RenounceAdmin instruction data (9 bytes)
- * Irreversibly set admin to all zeros. After this, all admin-only instructions fail.
- *
- * Requires the confirmation code 0x52454E4F554E4345 ("RENOUNCE" as u64 LE)
- * to prevent accidental invocation.
+ * @deprecated Tag 23 is now WithdrawInsuranceLimited in v12.17.
+ * This encoder sends the confirmation code as a withdrawal amount — DANGEROUS.
+ * Use encodeWithdrawInsuranceLimited instead.
  */
 export declare function encodeRenounceAdmin(): Uint8Array;
 /**
@@ -456,29 +569,15 @@ export declare function encodePauseMarket(): Uint8Array;
  */
 export declare function encodeUnpauseMarket(): Uint8Array;
 /**
- * SetPythOracle (Tag 32) — switch a market to Pyth-pinned mode.
- *
- * After this instruction:
- * - oracle_authority is cleared → PushOraclePrice is disabled
- * - index_feed_id is set to feed_id → validated on every price read
- * - max_staleness_secs and conf_filter_bps are updated
- * - All price reads go directly to read_pyth_price_e6() with on-chain
- *   staleness + confidence + feed-ID validation (no silent fallback)
- *
- * Instruction data: tag(1) + feed_id(32) + max_staleness_secs(8) + conf_filter_bps(2) = 43 bytes
- *
- * Accounts:
- *   0. [signer, writable] Admin
- *   1. [writable]         Slab
+ * @deprecated Tag 32 removed in v12.17. Pyth oracle is configured at InitMarket via indexFeedId.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export interface SetPythOracleArgs {
-    /** 32-byte Pyth feed ID. All zeros is invalid (reserved for Hyperp mode). */
     feedId: Uint8Array;
-    /** Maximum age of Pyth price in seconds before OracleStale is returned. Must be > 0. */
     maxStalenessSecs: bigint;
-    /** Max confidence/price ratio in bps (0 = no confidence check). */
     confFilterBps: number;
 }
+/** @deprecated Tag 32 removed in v12.17. Pyth is configured at InitMarket. */
 export declare function encodeSetPythOracle(args: SetPythOracleArgs): Uint8Array;
 /**
  * Derive the expected Pyth PriceUpdateV2 account address for a given feed ID.
@@ -490,18 +589,8 @@ export declare function encodeSetPythOracle(args: SetPythOracleArgs): Uint8Array
 export declare const PYTH_RECEIVER_PROGRAM_ID = "rec5EKMGg6MxZYaMdyBfgwp4d5rB9T1VQH5pJv5LtFJ";
 export declare function derivePythPriceUpdateAccount(feedId: Uint8Array, shardId?: number): Promise<string>;
 /**
- * UpdateMarkPrice (Tag 33) — permissionless EMA mark price crank.
- *
- * Reads the current oracle price on-chain, applies 8-hour EMA smoothing
- * with circuit breaker, and writes result to authority_price_e6.
- *
- * Instruction data: 1 byte (tag only — all params read from on-chain state)
- *
- * Accounts:
- *   0. [writable] Slab
- *   1. []         Oracle account (Pyth PriceUpdateV2 / Chainlink / DEX AMM)
- *   2. []         Clock sysvar (SysvarC1ock11111111111111111111111111111111)
- *   3..N []       Remaining accounts (PumpSwap vaults, etc. if needed)
+ * @deprecated Tag 33 removed in v12.17. Use UpdateHyperpMark (tag 34) for DEX-oracle markets.
+ * Sending this instruction will fail with InvalidInstructionData.
  */
 export declare function encodeUpdateMarkPrice(): Uint8Array;
 /**
@@ -653,10 +742,30 @@ export interface VammMatcherParams {
     impactKBps: number;
     liquidityNotionalE6: bigint;
 }
-/** Magic bytes identifying a vAMM matcher context: "PERCMATC" as u64 LE */
+/** Magic bytes identifying a vAMM matcher context: "PERCMATC" as u64 LE = 0x504552434d415443 */
 export declare const VAMM_MAGIC = 5784119745439683651n;
-/** Offset into matcher context where vAMM params start */
+/** Alias matching the Rust constant name for parity tests */
+export declare const MATCHER_MAGIC = 5784119745439683651n;
+/** Offset where matcher return is written in the context account (always 0 per ABI) */
+export declare const CTX_RETURN_OFFSET = 0;
+/** Byte length of the MatcherReturn section of the context account */
+export declare const MATCHER_RETURN_LEN = 64;
+/** Offset into matcher context where vAMM params start (= MATCHER_RETURN_LEN) */
 export declare const CTX_VAMM_OFFSET = 64;
+/** Byte length of the MatcherCtx (vAMM state) section of the context account */
+export declare const CTX_VAMM_LEN = 256;
+/** Total matcher context account size: MATCHER_RETURN_LEN + CTX_VAMM_LEN */
+export declare const MATCHER_CONTEXT_LEN = 320;
+/** Byte length of a MatcherCall instruction (tag 0 CPI payload) */
+export declare const MATCHER_CALL_LEN = 67;
+/**
+ * Byte length of an InitMatcherCtx instruction payload sent to the matcher program.
+ * Layout: tag(1) + kind(1) + trading_fee_bps(4) + base_spread_bps(4) +
+ *   max_total_bps(4) + impact_k_bps(4) + liquidity_notional_e6(16) +
+ *   max_fill_abs(16) + max_inventory_abs(16) + fee_to_insurance_bps(2) +
+ *   skew_spread_mult_bps(2) + lp_account_id(8) = 78
+ */
+export declare const INIT_CTX_LEN = 78;
 /**
  * Compute execution price for a given LP quote.
  * For buys (isLong=true): price above oracle.
@@ -690,21 +799,6 @@ export declare const PHASE2_MATURITY_SLOTS = 3024000n;
  * @returns [newPhase, shouldTransition]
  */
 export declare function checkPhaseTransition(currentSlot: bigint, marketCreatedSlot: bigint, oraclePhase: number, cumulativeVolumeE6: bigint, phase2DeltaSlots: number, hasMatureOracle: boolean): [number, boolean];
-/**
- * TopUpKeeperFund (Tag 57) — permissionless keeper fund top-up.
- *
- * Instruction data: tag(1) + amount(8) = 9 bytes
- *
- * Accounts:
- *   0. [signer, writable] Funder
- *   1. [writable]         Slab
- *   2. [writable]         Keeper fund PDA
- *   3. []                 System program
- */
-export interface TopUpKeeperFundArgs {
-    amount: bigint | string;
-}
-export declare function encodeTopUpKeeperFund(args: TopUpKeeperFundArgs): Uint8Array;
 /**
  * SlashCreationDeposit (Tag 58) — permissionless: slash a market creator's deposit
  * after the spam grace period has elapsed (PERC-629).
@@ -836,28 +930,24 @@ export declare function encodeSetOiImbalanceHardBlock(args: {
  * Creates a PositionNft PDA + Token-2022 mint with metadata, then mints 1 NFT to the
  * position owner's ATA. The NFT represents ownership of `user_idx` in the slab.
  *
- * Instruction data layout: tag(1) + user_idx(2) = 3 bytes
+ * The program creates the ATA internally via CPI when the 11th account (Associated Token
+ * Program) is provided. This is required because the NFT mint PDA doesn't exist until the
+ * program creates it, so the ATA can't be created in a preceding instruction.
  *
- * Accounts:
- *   0. [signer, writable] payer
- *   1. [writable]         slab
- *   2. [writable]         position_nft PDA  (created — seeds: ["position_nft", slab, user_idx])
- *   3. [writable]         nft_mint PDA      (created)
- *   4. [writable]         owner_ata         (Token-2022 ATA for owner)
- *   5. [signer]           owner             (must match engine account owner)
- *   6. []                 vault_authority PDA
- *   7. []                 token_2022_program
- *   8. []                 system_program
- *   9. []                 rent sysvar
+ * Instruction data layout: tag(1) + user_idx(2) = 3 bytes
  *
- * @example
- * ```ts
- * const ix = new TransactionInstruction({
- *   programId: PROGRAM_ID,
- *   keys: buildAccountMetas(ACCOUNTS_MINT_POSITION_NFT, [payer, slab, nftPda, nftMint, ownerAta, owner, vaultAuth, TOKEN_2022_PROGRAM_ID, SystemProgram.programId, SYSVAR_RENT_PUBKEY]),
- *   data: Buffer.from(encodeMintPositionNft({ userIdx: 5 })),
- * });
- * ```
+ * Accounts (11):
+ *   0.  [signer, writable] payer
+ *   1.  [writable]         slab
+ *   2.  [writable]         position_nft PDA  (created — seeds: ["position_nft", slab, user_idx_u16_le])
+ *   3.  [writable]         nft_mint PDA      (created — seeds: ["position_nft_mint", slab, user_idx_u16_le])
+ *   4.  [writable]         owner_ata         (Token-2022 ATA for nft_mint — created by program if absent)
+ *   5.  [signer]           owner             (must match engine account owner)
+ *   6.  []                 vault_authority PDA (seeds: ["vault", slab])
+ *   7.  []                 token_2022_program (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb)
+ *   8.  []                 system_program
+ *   9.  []                 rent sysvar
+ *   10. []                 associated_token_program (ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL)
  */
 export interface MintPositionNftArgs {
     userIdx: number;
@@ -1053,7 +1143,12 @@ export interface SetInsuranceWithdrawPolicyArgs {
     cooldownSlots: bigint | string;
 }
 export declare function encodeSetInsuranceWithdrawPolicy(args: SetInsuranceWithdrawPolicyArgs): Uint8Array;
-/** WithdrawInsuranceLimited (tag 23): amount */
+/**
+ * WithdrawInsuranceLimited (tag 23): amount.
+ * Account count is 7 (resolved markets) or 8 (live markets — oracle required
+ * for same-instruction accrue_market_to per upstream 8ce8d54).
+ * See ACCOUNTS_WITHDRAW_INSURANCE_LIMITED_LIVE / _RESOLVED in accounts.ts.
+ */
 export declare function encodeWithdrawInsuranceLimited(args: {
     amount: bigint | string;
 }): Uint8Array;
@@ -1109,3 +1204,187 @@ export declare function encodeCloseOrphanSlab(): Uint8Array;
 export declare function encodeSetDexPool(args: {
     pool: PublicKey | string;
 }): Uint8Array;
+/** CreateInsuranceMint: creates the insurance LP mint PDA (tag 37, same as CreateLpVault) */
+export declare function encodeCreateInsuranceMint(): Uint8Array;
+/** DepositInsuranceLP: deposit collateral, receive LP tokens (tag 38, same as LpVaultDeposit) */
+export declare function encodeDepositInsuranceLP(args: {
+    amount: bigint | string;
+}): Uint8Array;
+/** WithdrawInsuranceLP: burn LP tokens, withdraw collateral (tag 39, same as LpVaultWithdraw) */
+export declare function encodeWithdrawInsuranceLP(args: {
+    lpAmount: bigint | string;
+}): Uint8Array;
+/**
+ * SetMaxPnlCap (Tag 78, PERC-305 / SECURITY(H-4)) — set the PnL cap for ADL
+ * pre-check (admin only). When `pnl_pos_tot <= max_pnl_cap`, ADL returns
+ * early (no deleveraging needed).
+ *
+ * `capE6 = 0` disables the cap (ADL always runs when insurance is depleted).
+ *
+ * Instruction data: tag(1) + cap(u64, 8) = 9 bytes
+ */
+export interface SetMaxPnlCapArgs {
+    /** PnL cap in engine quote units (e.g., 1_000_000 = $1 e6). 0 = cap disabled. */
+    cap: bigint | string;
+}
+export declare function encodeSetMaxPnlCap(args: SetMaxPnlCapArgs): Uint8Array;
+/**
+ * SetOiCapMultiplier (Tag 79, PERC-309) — set the OI cap multiplier for LP
+ * withdrawal limits (admin only). Packed u64:
+ *   lo 32 bits: multiplier_bps (e.g., 15000 = 1.5× soft cap in stressed state)
+ *   hi 32 bits: soft_cap_bps   (e.g., 8000  = 80% base cap)
+ *
+ * `packed = 0` disables enforcement (no cap on LP withdrawals).
+ *
+ * Instruction data: tag(1) + packed(u64, 8) = 9 bytes
+ */
+export interface SetOiCapMultiplierArgs {
+    /** Packed u64: lo32 = multiplier_bps, hi32 = soft_cap_bps. 0 = disabled. */
+    packed: bigint | string;
+}
+export declare function encodeSetOiCapMultiplier(args: SetOiCapMultiplierArgs): Uint8Array;
+/** Convenience: pack (multiplier_bps, soft_cap_bps) into the u64 expected by SetOiCapMultiplier. */
+export declare function packOiCap(multiplierBps: number, softCapBps: number): bigint;
+/**
+ * SetDisputeParams (Tag 80, PERC-314) — configure settlement dispute window
+ * and bond (admin only).
+ *
+ * - `windowSlots = 0` disables disputes (ChallengeSettlement returns
+ *   DisputeWindowClosed). Max: 2_000_000 slots (≈ 8 days at 400ms slots) to
+ *   prevent DoS via absurd freezes.
+ * - `bondAmount` (collateral tokens): refunded on dispute upheld, forfeited
+ *   on reject. 0 = no bond required.
+ *
+ * Instruction data: tag(1) + window_slots(u64, 8) + bond_amount(u64, 8) = 17 bytes
+ */
+export interface SetDisputeParamsArgs {
+    /** Dispute window in slots. 0 = disputes disabled. Max 2_000_000. */
+    windowSlots: bigint | string;
+    /** Bond required to open a dispute (collateral units). 0 = no bond. */
+    bondAmount: bigint | string;
+}
+export declare function encodeSetDisputeParams(args: SetDisputeParamsArgs): Uint8Array;
+/**
+ * SetLpCollateralParams (Tag 81, PERC-315) — configure LP token collateral
+ * acceptance (admin only).
+ *
+ * - `enabled = 0`: DepositLpCollateral rejects all new deposits.
+ * - `enabled = 1`: deposits allowed, subject to `ltvBps` haircut on value.
+ * - `ltvBps` max 10_000 (100%). Typical: 5000 (50% LTV).
+ *
+ * Instruction data: tag(1) + enabled(u8, 1) + ltv_bps(u16, 2) = 4 bytes
+ */
+export interface SetLpCollateralParamsArgs {
+    /** 0 = disabled (blocks new deposits), 1 = enabled. */
+    enabled: number;
+    /** LTV in bps (0-10000). 5000 = 50% LTV. */
+    ltvBps: number;
+}
+export declare function encodeSetLpCollateralParams(args: SetLpCollateralParamsArgs): Uint8Array;
+/**
+ * AcceptAdmin (Tag 82, Phase E 2026-04-17) — complete a two-step admin transfer.
+ *
+ * Called by the PROPOSED new admin (the pubkey passed to UpdateAdmin with
+ * `new_admin != default()`). The signer must match config.pending_admin
+ * exactly. On success, header.admin is swapped to pending_admin and
+ * pending_admin is cleared.
+ *
+ * Use `try_update_admin` then `try_accept_admin` for a full rotation, or
+ * skip AcceptAdmin entirely to leave a pending transfer that the old
+ * admin can overwrite (propose-again) or the new admin can never accept.
+ *
+ * Accounts:
+ *   [0] new admin (signer, must match pending_admin)
+ *   [1] slab (writable)
+ *
+ * Instruction data: tag(1) = 1 byte. No payload.
+ */
+export declare function encodeAcceptAdmin(): Uint8Array;
+/**
+ * ReclaimEmptyAccount (Tag 25) — permissionless reclamation of empty/dust
+ * accounts (wrapper §2.6, §10.7).
+ *
+ * Wrapper decode: src/percolator.rs:2088. Wire: tag(1) + user_idx u16(2).
+ *
+ * Accounts: see ACCOUNTS_RECLAIM_EMPTY_ACCOUNT.
+ */
+export interface ReclaimEmptyAccountArgs {
+    userIdx: number;
+}
+export declare function encodeReclaimEmptyAccount(args: ReclaimEmptyAccountArgs): Uint8Array;
+/**
+ * SettleAccount (Tag 26) — standalone account settlement (wrapper §10.2).
+ * Permissionless.
+ *
+ * Wrapper decode: src/percolator.rs:2092. Wire: tag(1) + user_idx u16(2).
+ *
+ * Accounts: see ACCOUNTS_SETTLE_ACCOUNT.
+ */
+export interface SettleAccountArgs {
+    userIdx: number;
+}
+export declare function encodeSettleAccount(args: SettleAccountArgs): Uint8Array;
+/**
+ * DepositFeeCredits (Tag 27) — direct fee-debt repayment (wrapper §10.3.1).
+ * Owner only.
+ *
+ * Wrapper decode: src/percolator.rs:2097. Wire: tag(1) + user_idx u16(2)
+ * + amount u64(8).
+ *
+ * Accounts: see ACCOUNTS_DEPOSIT_FEE_CREDITS.
+ */
+export interface DepositFeeCreditsArgs {
+    userIdx: number;
+    amount: bigint | string;
+}
+export declare function encodeDepositFeeCredits(args: DepositFeeCreditsArgs): Uint8Array;
+/**
+ * ConvertReleasedPnl (Tag 28) — voluntary PnL conversion with open position
+ * (wrapper §10.4.1). Owner only.
+ *
+ * Wrapper decode: src/percolator.rs:2103. Wire: tag(1) + user_idx u16(2)
+ * + amount u64(8).
+ *
+ * Accounts: see ACCOUNTS_CONVERT_RELEASED_PNL.
+ */
+export interface ConvertReleasedPnlArgs {
+    userIdx: number;
+    amount: bigint | string;
+}
+export declare function encodeConvertReleasedPnl(args: ConvertReleasedPnlArgs): Uint8Array;
+/**
+ * Authority kind for UpdateAuthority (tag 83). Maps to wrapper constants
+ * AUTHORITY_ADMIN/HYPERP_MARK/INSURANCE/INSURANCE_OPERATOR at
+ * src/percolator.rs:6862-6868.
+ *
+ * Note: kind=3 is reserved (the v12.18.x split uses 0/1/2/4).
+ */
+export declare const AUTHORITY_KIND: {
+    readonly Admin: 0;
+    readonly HyperpMark: 1;
+    readonly Insurance: 2;
+    readonly InsuranceOperator: 4;
+};
+export type AuthorityKind = (typeof AUTHORITY_KIND)[keyof typeof AUTHORITY_KIND];
+/**
+ * UpdateAuthority (Tag 83) — unified mutator for the four authority slots
+ * (admin, hyperp_mark, insurance, insurance_operator).
+ *
+ * The instruction takes both the current authority and the new authority as
+ * signers. Setting `newPubkey` to the zero pubkey burns the authority slot;
+ * burning admin requires `permissionless_resolve_stale_slots > 0` AND
+ * `force_close_delay_slots > 0` per the R4-H1 liveness guard.
+ *
+ * H-NEW-1 (closed in wrapper d760fc4): atomic admin rotation through this
+ * tag now clears `config.pending_admin`, invalidating any stale tag-12
+ * proposal.
+ *
+ * Wire: tag(1) + kind u8(1) + new_pubkey Pubkey(32) = 34 bytes.
+ *
+ * Accounts: see ACCOUNTS_UPDATE_AUTHORITY.
+ */
+export interface UpdateAuthorityArgs {
+    kind: AuthorityKind;
+    newPubkey: PublicKey | string;
+}
+export declare function encodeUpdateAuthority(args: UpdateAuthorityArgs): Uint8Array;