@perena/vault-sdk 1.0.27 → 1.0.29

package/dist/index.js

@@ -150,7 +150,7 @@ var require_compat = __commonJS({
     exports2.toWeb3PublicKey = toWeb3PublicKey;
     exports2.asWeb3PublicKey = asWeb3PublicKey2;
     exports2.toKitInstruction = toKitInstruction30;
-    exports2.fromKitInstruction = fromKitInstruction2;
+    exports2.fromKitInstruction = fromKitInstruction3;
     var kit_1 = require("@solana/kit");
     var web3_js_1 = require("@solana/web3.js");
     function fromWeb3PublicKey(pubkey) {
@@ -175,7 +175,7 @@ var require_compat = __commonJS({
         }))
       };
     }
-    function fromKitInstruction2(ix) {
+    function fromKitInstruction3(ix) {
       return new web3_js_1.TransactionInstruction({
         programId: toWeb3PublicKey(ix.programAddress),
         keys: (ix.accounts ?? []).map((account) => ({
@@ -342,7 +342,7 @@ var require_refs = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.createMultiCpiRefs = createMultiCpiRefs;
-    exports2.createCpiRefs = createCpiRefs3;
+    exports2.createCpiRefs = createCpiRefs4;
     var kit_1 = require("@solana/kit");
     var roles_1 = require_roles();
     var accounts_1 = require_accounts();
@@ -478,7 +478,7 @@ var require_refs = __commonJS({
         lookupTables: collectLookupTables(allCpis)
       };
     }
-    function createCpiRefs3(cpis, options) {
+    function createCpiRefs4(cpis, options) {
       const accountLists = toCpiAccountLists(cpis);
       const { pool, poolIndex } = buildPool(accountLists, options);
       const trackedIndices = resolveTrackedIndices(poolIndex, options?.trackAddresses);
@@ -592,11 +592,11 @@ var require_transaction = __commonJS({
   "../common/dist/utils/transaction.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.fetchLookupTables = fetchLookupTables2;
+    exports2.fetchLookupTables = fetchLookupTables3;
     exports2.getSignatureStatus = getSignatureStatus;
     exports2.sendVersionedTransaction = sendVersionedTransaction;
     var web3_js_1 = require("@solana/web3.js");
-    async function fetchLookupTables2(connection, lookupTables) {
+    async function fetchLookupTables3(connection, lookupTables) {
       const accounts2 = await Promise.all(lookupTables.map(async (lookupTable) => {
         const response = await connection.getAddressLookupTable(new web3_js_1.PublicKey(lookupTable));
         if (!response.value) {
@@ -613,7 +613,7 @@ var require_transaction = __commonJS({
     }
     async function sendVersionedTransaction({ connection, payer, instructions: instructions2, lookupTables }) {
       const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash("confirmed");
-      const lookupTableAccounts = await fetchLookupTables2(connection, lookupTables);
+      const lookupTableAccounts = await fetchLookupTables3(connection, lookupTables);
       const message2 = new web3_js_1.TransactionMessage({
         payerKey: payer.publicKey,
         recentBlockhash: blockhash,
@@ -2921,7 +2921,7 @@ var require_client = __commonJS({
     var extract_1 = require_extract();
     var routePreInstructions_1 = require_routePreInstructions();
     var constants_1 = require_constants4();
-    var JupiterSwapClient = class {
+    var JupiterSwapClient2 = class {
       constructor(rpc, config = {}) {
         this.rpc = rpc;
         this.config = config;
@@ -3012,7 +3012,7 @@ var require_client = __commonJS({
         };
       }
     };
-    exports2.JupiterSwapClient = JupiterSwapClient;
+    exports2.JupiterSwapClient = JupiterSwapClient2;
   }
 });
 
@@ -3232,6 +3232,7 @@ var require_dist4 = __commonJS({
 var index_exports = {};
 __export(index_exports, {
   ASSET_DECIMALS: () => ASSET_DECIMALS,
+  ASSET_REBALANCE_COOLDOWN_SECS: () => ASSET_REBALANCE_COOLDOWN_SECS,
   AccountClient: () => AccountClient,
   ActivateCircuitBreakerBuilder: () => ActivateCircuitBreakerBuilder,
   CONSENSUS_ORACLE_VARIANT: () => CONSENSUS_ORACLE_VARIANT,
@@ -3242,15 +3243,20 @@ __export(index_exports, {
   CreateAssetHoldingBuilder: () => CreateAssetHoldingBuilder,
   CreateTrancheStateBuilder: () => CreateTrancheStateBuilder,
   CreateVaultBuilder: () => CreateVaultBuilder,
+  DEFAULT_CU_PRICE_MICRO_LAMPORTS: () => DEFAULT_CU_PRICE_MICRO_LAMPORTS,
   DEFAULT_JUNIOR_EARLY_UNSTAKE_FEE_BPS: () => DEFAULT_JUNIOR_EARLY_UNSTAKE_FEE_BPS,
   DEFAULT_JUNIOR_STANDARD_UNSTAKE_FEE_BPS: () => DEFAULT_JUNIOR_STANDARD_UNSTAKE_FEE_BPS,
   DEFAULT_JUNIOR_WITHDRAWAL_LOCKUP_SECS: () => DEFAULT_JUNIOR_WITHDRAWAL_LOCKUP_SECS,
   DEFAULT_MAX_ACCEPTABLE_APY_BPS: () => DEFAULT_MAX_ACCEPTABLE_APY_BPS,
+  DEFAULT_MAX_ACCOUNTS: () => DEFAULT_MAX_ACCOUNTS,
   DEFAULT_MIN_AMOUNT_UI: () => DEFAULT_MIN_AMOUNT_UI,
   DEFAULT_ORACLE_STALENESS_THRESHOLD_SECS: () => DEFAULT_ORACLE_STALENESS_THRESHOLD_SECS,
   DEFAULT_PRICE_ORACLE_ACCOUNT: () => DEFAULT_PRICE_ORACLE_ACCOUNT,
   DEFAULT_PRICE_STALENESS_SECS: () => DEFAULT_PRICE_STALENESS_SECS,
   DEFAULT_PRICE_STALENESS_THRESHOLD_SECS: () => DEFAULT_PRICE_STALENESS_THRESHOLD_SECS,
+  DEFAULT_REBALANCE_BAND_BPS: () => DEFAULT_REBALANCE_BAND_BPS,
+  DEFAULT_SLIPPAGE_BPS: () => DEFAULT_SLIPPAGE_BPS,
+  DEFAULT_TARGET_LOCAL_BPS: () => DEFAULT_TARGET_LOCAL_BPS,
   DEFAULT_VAULT_ID: () => DEFAULT_VAULT_ID,
   DisableCircuitBreakerBuilder: () => DisableCircuitBreakerBuilder,
   EXTERNAL_POSITION_SAMPLES: () => EXTERNAL_POSITION_SAMPLES,
@@ -3264,6 +3270,9 @@ __export(index_exports, {
   FEE_VAULT_CACHE_CATEGORY: () => FEE_VAULT_CACHE_CATEGORY,
   FulfillJuniorTrancheWithdrawBuilder: () => FulfillJuniorTrancheWithdrawBuilder,
   IDL: () => IDL,
+  IDLE_RESERVE_FLOOR_BPS: () => IDLE_RESERVE_FLOOR_BPS,
+  IDLE_RESERVE_TARGET_BPS: () => IDLE_RESERVE_TARGET_BPS,
+  IdleLiquidityService: () => IdleLiquidityService,
   InitializeVaultRolesBuilder: () => InitializeVaultRolesBuilder,
   JupiterBalanceSource: () => JupiterBalanceSource,
   JupiterPriceSource: () => JupiterPriceSource,
@@ -3377,6 +3386,7 @@ __export(index_exports, {
   mintTokensTo: () => mintTokensTo,
   mostFrequent: () => mostFrequent,
   parseExternalLiquidityRefs: () => parseExternalLiquidityRefs,
+  planRebalance: () => planRebalance,
   prepareVaultTransaction: () => prepareVaultTransaction,
   priceInAccountingUnit: () => priceInAccountingUnit,
   readI64LE: () => readI64LE,
@@ -3469,13 +3479,13 @@ var import_path = __toESM(require("path"));
 var import_core18 = require("@anchor-lang/core");
 var import_web320 = require("@solana/web3.js");
 var import_kit10 = require("@solana/kit");
-var import_common36 = __toESM(require_dist());
+var import_common37 = __toESM(require_dist());
 
 // src/client/client.ts
 var import_core17 = require("@anchor-lang/core");
 var import_kit9 = require("@solana/kit");
 var import_web319 = require("@solana/web3.js");
-var import_common35 = __toESM(require_dist());
+var import_common36 = __toESM(require_dist());
 
 // src/idl/vault.ts
 var IDL = {
@@ -8162,66 +8172,6 @@ var IDL = {
             }
           }
         },
-        {
-          "name": "fee_collector"
-        },
-        {
-          "name": "fee_collector_output_ata",
-          "writable": true,
-          "pda": {
-            "seeds": [
-              {
-                "kind": "account",
-                "path": "fee_collector"
-              },
-              {
-                "kind": "account",
-                "path": "asset_token_program"
-              },
-              {
-                "kind": "account",
-                "path": "output_mint"
-              }
-            ],
-            "program": {
-              "kind": "const",
-              "value": [
-                140,
-                151,
-                37,
-                143,
-                78,
-                36,
-                137,
-                241,
-                187,
-                61,
-                16,
-                41,
-                20,
-                142,
-                13,
-                131,
-                11,
-                90,
-                19,
-                153,
-                218,
-                255,
-                16,
-                132,
-                4,
-                142,
-                123,
-                216,
-                219,
-                233,
-                248,
-                89
-              ]
-            }
-          }
-        },
         {
           "name": "queue_input_ata",
           "writable": true,
@@ -8294,7 +8244,24 @@ var IDL = {
           "address": "11111111111111111111111111111111"
         }
       ],
-      "args": []
+      "args": [
+        {
+          "name": "external_withdraw_ix_refs",
+          "type": {
+            "option": {
+              "defined": {
+                "name": "InstructionRefs"
+              }
+            }
+          }
+        },
+        {
+          "name": "external_liquidity_source",
+          "type": {
+            "option": "u8"
+          }
+        }
+      ]
     },
     {
       "name": "fulfill_junior_tranche_withdraw_fee_exempt",
@@ -8461,66 +8428,6 @@ var IDL = {
             }
           }
         },
-        {
-          "name": "fee_collector"
-        },
-        {
-          "name": "fee_collector_output_ata",
-          "writable": true,
-          "pda": {
-            "seeds": [
-              {
-                "kind": "account",
-                "path": "fee_collector"
-              },
-              {
-                "kind": "account",
-                "path": "asset_token_program"
-              },
-              {
-                "kind": "account",
-                "path": "output_mint"
-              }
-            ],
-            "program": {
-              "kind": "const",
-              "value": [
-                140,
-                151,
-                37,
-                143,
-                78,
-                36,
-                137,
-                241,
-                187,
-                61,
-                16,
-                41,
-                20,
-                142,
-                13,
-                131,
-                11,
-                90,
-                19,
-                153,
-                218,
-                255,
-                16,
-                132,
-                4,
-                142,
-                123,
-                216,
-                219,
-                233,
-                248,
-                89
-              ]
-            }
-          }
-        },
         {
           "name": "queue_input_ata",
           "writable": true,
@@ -8594,6 +8501,22 @@ var IDL = {
         }
       ],
       "args": [
+        {
+          "name": "external_withdraw_ix_refs",
+          "type": {
+            "option": {
+              "defined": {
+                "name": "InstructionRefs"
+              }
+            }
+          }
+        },
+        {
+          "name": "external_liquidity_source",
+          "type": {
+            "option": "u8"
+          }
+        },
         {
           "name": "signer_seeds",
           "type": {
@@ -12933,239 +12856,229 @@ var IDL = {
   ],
   "errors": [
     {
-      "code": 14001,
-      "name": "Unauthorized",
-      "msg": "You are not authorized to perform this action."
-    },
-    {
-      "code": 14002,
-      "name": "InvalidBankMint",
-      "msg": "Invalid mint"
-    },
-    {
-      "code": 14003,
-      "name": "AccountingIssue",
-      "msg": "Accounting issue"
+      "code": 6e3,
+      "name": "MintSupplyNonZero",
+      "msg": "Supplied share mint already has non-zero supply"
     },
     {
-      "code": 14004,
-      "name": "VaultAccountingIssue",
-      "msg": "Vault accounting issue"
+      "code": 6001,
+      "name": "InvalidAssetMint",
+      "msg": "Supplied mint is not accepted by this vault"
     },
     {
-      "code": 14005,
-      "name": "BankAccountingIssue",
-      "msg": "Bank accounting issue"
+      "code": 6002,
+      "name": "ZeroDepositAmount",
+      "msg": "Deposit amount must be greater than zero"
     },
     {
-      "code": 14006,
-      "name": "OnchainAccountingIssue",
-      "msg": "Onchain accounting issue"
+      "code": 6003,
+      "name": "ExceedsTvlLimit",
+      "msg": "Deposit would exceed the vault's TVL limit"
     },
     {
-      "code": 14007,
-      "name": "ExternalAccountingIssue",
-      "msg": "External accounting issue"
+      "code": 6004,
+      "name": "ZeroBurnAmount",
+      "msg": "Burn amount must be greater than zero"
     },
     {
-      "code": 14008,
-      "name": "MintSlippage",
-      "msg": "Minting failed due to slippage."
+      "code": 6005,
+      "name": "ZeroAssetAmount",
+      "msg": "Asset amount must be greater than zero"
     },
     {
-      "code": 14009,
-      "name": "BurningSlippage",
-      "msg": "Burning failed due to slippage."
+      "code": 6006,
+      "name": "InsufficientVaultLiquidity",
+      "msg": "Insufficient vault liquidity to satisfy withdrawal"
     },
     {
-      "code": 14010,
-      "name": "TeamAccountAlreadyExists",
-      "msg": "Team account already exists"
+      "code": 6007,
+      "name": "MintAuthorityNotCurator",
+      "msg": "Mint authority is not the curator"
     },
     {
-      "code": 14011,
-      "name": "OracleAccountAlreadyExists",
-      "msg": "Oracle account already exists"
+      "code": 6008,
+      "name": "ZeroTotalSupply",
+      "msg": "Vault total supply is zero"
     },
     {
-      "code": 14012,
+      "code": 6009,
       "name": "StaleOracle",
-      "msg": "Stale oracle"
+      "msg": "Vault oracle is stale"
     },
     {
-      "code": 14013,
-      "name": "LocalSignificantPriceChange",
-      "msg": "Price change is too large locally"
+      "code": 6010,
+      "name": "InvalidOracleUpdate",
+      "msg": "Invalid oracle update"
     },
     {
-      "code": 14014,
-      "name": "SignificantPriceChange",
-      "msg": "Price change is too large"
+      "code": 6011,
+      "name": "InvalidInitialMintSharePrice",
+      "msg": "Initial mint share price must be greater than zero"
     },
     {
-      "code": 14015,
-      "name": "RoundingImpact",
-      "msg": "Rounding impacts the protocol"
+      "code": 6012,
+      "name": "MaxApyExceeded",
+      "msg": "Oracle NAV update exceeds the vault's maximum acceptable APY"
     },
     {
-      "code": 14016,
-      "name": "BankIsHalted",
-      "msg": "Bank is halted"
+      "code": 6013,
+      "name": "InvalidApyConfig",
+      "msg": "Invalid APY configuration"
     },
     {
-      "code": 14017,
-      "name": "VaultIsHalted",
-      "msg": "Vault is halted"
+      "code": 6014,
+      "name": "InvalidFeeConfig",
+      "msg": "Invalid fee configuration"
     },
     {
-      "code": 14018,
-      "name": "ConversionOverflow",
-      "msg": "Conversion Overflow"
+      "code": 6015,
+      "name": "VaultHasLiveAssets",
+      "msg": "Vault has live supply, TVL, or holdings"
     },
     {
-      "code": 14019,
-      "name": "_Reserved8019",
-      "msg": "Reserved"
+      "code": 6016,
+      "name": "DepositMintsZeroShares",
+      "msg": "Deposit would mint zero shares"
     },
     {
-      "code": 14020,
-      "name": "InvalidArgument",
-      "msg": "Invalid argument"
+      "code": 6017,
+      "name": "InsufficientAccruedApyBalance",
+      "msg": "Insufficient accrued APY balance"
     },
     {
-      "code": 14021,
-      "name": "UserSanityCheck",
-      "msg": "User Sanity Check"
+      "code": 6018,
+      "name": "InvalidRole",
+      "msg": "Invalid role configuration"
     },
     {
-      "code": 14022,
-      "name": "MathOverflow",
-      "msg": "Math overflow"
+      "code": 6019,
+      "name": "InvalidProtocolInteraction",
+      "msg": "Invalid protocol interaction CPI"
     },
     {
-      "code": 14023,
-      "name": "InvalidMarginFiAccount",
-      "msg": "Invalid MarginFi account - must be correct PDA for this vault"
+      "code": 6020,
+      "name": "_Reserved7020",
+      "msg": "Reserved"
     },
     {
-      "code": 14024,
-      "name": "InvalidStartMarker",
-      "msg": "Invalid start marker"
+      "code": 6021,
+      "name": "InvalidExternalLiquidity",
+      "msg": "Invalid external liquidity configuration"
     },
     {
-      "code": 14025,
-      "name": "OracleUpdateOnEmptyReserve",
-      "msg": "Unable to push oracle update on an empty vault reserve"
+      "code": 6022,
+      "name": "SwapBalanceUnchanged",
+      "msg": "Swap did not change both source and destination balances"
     },
     {
-      "code": 14026,
-      "name": "InvalidRemainingAccountsLength",
-      "msg": "Invalid remaining accounts length"
+      "code": 6023,
+      "name": "ProtocolBalanceUnchanged",
+      "msg": "Protocol interaction did not change the affected token balance"
     },
     {
-      "code": 14027,
-      "name": "WithdrawalExceedsBalance",
-      "msg": "Specified withdrawal exceeds available balance"
+      "code": 6024,
+      "name": "ExcessiveSwapSlippage",
+      "msg": "Swap TVL loss exceeds the allowed slippage"
     },
     {
-      "code": 14028,
-      "name": "InsufficientPendingYield",
-      "msg": "Insufficient pending yield"
+      "code": 6025,
+      "name": "TranchingNotEnabled",
+      "msg": "Vault tranching is not enabled"
     },
     {
-      "code": 14029,
-      "name": "NotSupported",
-      "msg": "Not supported"
+      "code": 6026,
+      "name": "TranchingAlreadyEnabled",
+      "msg": "Vault tranching is already enabled"
     },
     {
-      "code": 14030,
-      "name": "ExceedsMaxYieldingTvl",
-      "msg": "Exceeds maximum yielding TVL"
+      "code": 6027,
+      "name": "TrancheStateRequired",
+      "msg": "Tranche state account is required"
     },
     {
-      "code": 14031,
-      "name": "TranchingNotEnabled",
-      "msg": "Tranching is not enabled for this bank"
+      "code": 6028,
+      "name": "InvalidTrancheConfig",
+      "msg": "Invalid tranche configuration"
     },
     {
-      "code": 14032,
-      "name": "InvalidLeverageFactor",
-      "msg": "Invalid leverage factor - must be at least 10000 (1x)"
+      "code": 6029,
+      "name": "InvalidTrancheMint",
+      "msg": "Invalid tranche mint"
     },
     {
-      "code": 14033,
-      "name": "InsufficientStakedAmount",
-      "msg": "Insufficient staked amount"
+      "code": 6030,
+      "name": "LossesDisabled",
+      "msg": "Vault losses are not enabled"
     },
     {
-      "code": 14034,
-      "name": "JuniorTrancheEmpty",
-      "msg": "Junior tranche has no value"
+      "code": 6031,
+      "name": "WithdrawalQueueNotExpired",
+      "msg": "Withdrawal queue is not yet expired"
     },
     {
-      "code": 14035,
-      "name": "InvalidTrancheConfig",
-      "msg": "Invalid tranche config parameter"
+      "code": 6032,
+      "name": "InvalidWithdrawalQueue",
+      "msg": "Invalid withdrawal queue"
     },
     {
-      "code": 14036,
-      "name": "WithdrawalQueueNotExpired",
-      "msg": "Withdrawal queue lockup period has not expired"
+      "code": 6033,
+      "name": "AssetPriceNotSet",
+      "msg": "Destination asset has no price set; a consensus oracle price is required before swapping"
     },
     {
-      "code": 14037,
-      "name": "InvalidWithdrawalQueue",
-      "msg": "Withdrawal queue entry is not in a valid state"
+      "code": 6034,
+      "name": "AssetHoldingNotEmpty",
+      "msg": "Asset holding still has a balance and cannot be removed"
     },
     {
-      "code": 14038,
-      "name": "InvalidAccount",
-      "msg": "Account does not belong to the expected parent"
+      "code": 6035,
+      "name": "CannotRemoveBaseHolding",
+      "msg": "The base asset holding cannot be removed"
     },
     {
-      "code": 14039,
-      "name": "MissingAccount",
-      "msg": "Required optional account is missing"
+      "code": 6036,
+      "name": "UnauthorizedPriceUpdater",
+      "msg": "Caller is not authorized to trigger an asset price update"
     },
     {
-      "code": 14040,
-      "name": "TrancheWipedOut",
-      "msg": "Junior tranche is wiped out and cannot accept new stakes"
+      "code": 6037,
+      "name": "InvalidStalenessConfig",
+      "msg": "Invalid asset-price staleness threshold"
     },
     {
-      "code": 14041,
-      "name": "VaultLossNotAccepted",
-      "msg": "Vault does not accept losses \u2014 enable losses_accepted before retrying"
+      "code": 6038,
+      "name": "AssetRebalanceRateLimitExceeded",
+      "msg": "Asset was rebalanced too recently"
     },
     {
-      "code": 14042,
-      "name": "CapitalLossExceedsReserve",
-      "msg": "Capital loss exceeds available yielding reserve"
+      "code": 6039,
+      "name": "InvalidShareTokenProgram",
+      "msg": "Share token program does not match the vault/tranche mint configuration"
     },
     {
-      "code": 14043,
-      "name": "RollingWithdrawalLimitExceeded",
-      "msg": "Rolling withdrawal limit exceeded"
+      "code": 6040,
+      "name": "UnauthorizedVaultCreator",
+      "msg": "Caller is not on the vault-creator whitelist"
     },
     {
-      "code": 14044,
-      "name": "VaultAlreadyMigrated",
-      "msg": "Legacy vault has already been migrated"
+      "code": 6041,
+      "name": "InvalidShareMintDecimals",
+      "msg": "Share mint decimals must match the vault accounting decimals"
     },
     {
-      "code": 14045,
-      "name": "InvalidMigrationState",
-      "msg": "Legacy vault migration is incomplete or invalid"
+      "code": 6042,
+      "name": "InvalidFeeExemption",
+      "msg": "Invalid fee-exemption PDA signer or seeds"
     },
     {
-      "code": 14046,
-      "name": "InvalidMigrationMintAuthority",
-      "msg": "Mint authority does not match the expected migration source"
+      "code": 6043,
+      "name": "ExceedsJuniorDepositCap",
+      "msg": "Deposit would exceed the junior tranche deposit cap"
     },
     {
-      "code": 14047,
-      "name": "BankMigrationIncomplete",
-      "msg": "Legacy bank or tranche migration is incomplete \u2014 source accounting and escrow must be fully drained before mint authority transfer"
+      "code": 6044,
+      "name": "InvalidShareSupply",
+      "msg": "Physical share-mint supply does not match effective supply accounting"
     }
   ],
   "types": [
@@ -13546,9 +13459,7 @@ var IDL = {
         "Holdings are addressed by their slot index (1 byte) to keep instruction data",
         "small. To register a brand-new consensus holding, set `mint` to its mint",
         "(and pass the matching `asset_mint` account); the created slot's index is used",
-        "and `holding_index` is ignored. For existing holdings leave `mint` as `None`.",
-        "The price is authoritative only for ConsensusOracle holdings. Pyth and nested-vault",
-        "holdings use the report only for external_amount and retain their live-oracle price."
+        "and `holding_index` is ignored. For existing holdings leave `mint` as `None`."
       ],
       "type": {
         "kind": "struct",
@@ -14425,6 +14336,106 @@ var IDL = {
         ]
       }
     },
+    {
+      "name": "RollingRebalanceLimit",
+      "docs": [
+        "Rolling-window cap on rebalance (Jupiter swap) throughput, expressed as a",
+        "share of current TVL rather than a fixed amount.",
+        "",
+        "Sibling of [`super::withdrawal_limits::RollingWithdrawalLimit`]: same",
+        "window-slide-then-charge mechanics, but the ceiling is recomputed from live",
+        "TVL on every call, so the cap tracks the vault as it grows or shrinks",
+        "instead of going stale at whatever amount the curator last set.",
+        "",
+        "Both swap directions charge the same window \u2014 the cap bounds total value",
+        "routed through Jupiter per window, regardless of which asset is sold."
+      ],
+      "serialization": "bytemuck",
+      "repr": {
+        "kind": "c"
+      },
+      "type": {
+        "kind": "struct",
+        "fields": [
+          {
+            "name": "window_start_ts",
+            "docs": [
+              "Unix timestamp the current window opened."
+            ],
+            "type": "i64"
+          },
+          {
+            "name": "window_duration_seconds",
+            "docs": [
+              "Window length, in seconds (e.g. 3_600 for an hourly limit)."
+            ],
+            "type": "u64"
+          },
+          {
+            "name": "value_in_window",
+            "docs": [
+              "Value rebalanced inside the current window, in the vault's accounting",
+              "unit."
+            ],
+            "type": "u64"
+          },
+          {
+            "name": "window_limit_bps",
+            "docs": [
+              "Cap as a share of TVL, in bps. `0` disables the limit."
+            ],
+            "type": "u16"
+          },
+          {
+            "name": "_padding1",
+            "type": {
+              "array": [
+                "u8",
+                6
+              ]
+            }
+          },
+          {
+            "name": "_padding2",
+            "type": {
+              "array": [
+                "u64",
+                4
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      "name": "RollingRebalanceLimitConfig",
+      "docs": [
+        "Rolling rebalance-limit config applied via [`SetVaultConfigArgs`].",
+        "",
+        "The cap is a share of TVL rather than a fixed amount, so it stays",
+        "meaningful as the vault grows. Both fields must be zero (disable the cap)",
+        "or both non-zero (enable it)."
+      ],
+      "type": {
+        "kind": "struct",
+        "fields": [
+          {
+            "name": "window_limit_bps",
+            "docs": [
+              "Max share of TVL rebalanced inside one window, in bps (`0` disables)."
+            ],
+            "type": "u16"
+          },
+          {
+            "name": "window_duration_seconds",
+            "docs": [
+              "Window length in seconds (`0` only valid when `window_limit_bps` is `0`)."
+            ],
+            "type": "u64"
+          }
+        ]
+      }
+    },
     {
       "name": "SetAssetPriceOracleArgs",
       "type": {
@@ -14610,13 +14621,27 @@ var IDL = {
                 }
               }
             }
-          }
-        ]
-      }
-    },
-    {
-      "name": "TeamAccounting",
-      "serialization": "bytemuck",
+          },
+          {
+            "name": "rebalance_limit",
+            "docs": [
+              "Rolling cap on rebalance (Jupiter swap) throughput. `None` leaves",
+              "unchanged."
+            ],
+            "type": {
+              "option": {
+                "defined": {
+                  "name": "RollingRebalanceLimitConfig"
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    {
+      "name": "TeamAccounting",
+      "serialization": "bytemuck",
       "repr": {
         "kind": "c"
       },
@@ -15293,7 +15318,8 @@ var IDL = {
           {
             "name": "losses_enabled",
             "docs": [
-              "Allows consensus-oracle NAV losses beyond the protocol's small-loss tolerance. Losses inside that tolerance settle without this flag."
+              "Allows consensus-oracle NAV losses beyond the protocol's small-loss",
+              "tolerance. Losses inside that tolerance settle without this flag."
             ],
             "type": {
               "defined": {
@@ -15530,6 +15556,14 @@ var IDL = {
             "name": "senior_fixed_apy_bps",
             "type": "u16"
           },
+          {
+            "name": "junior_floor_apy_bps",
+            "docs": [
+              "Floor APY for the junior tranche, in basis points. Zero disables the",
+              "floor. Shortfalls are funded from the untranched sleeve, never senior."
+            ],
+            "type": "u16"
+          },
           {
             "name": "early_unstake_fee_bps",
             "type": "u16"
@@ -16355,12 +16389,38 @@ var IDL = {
             ],
             "type": "u64"
           },
+          {
+            "name": "junior_floor_apy_bps",
+            "docs": [
+              "Curator-set floor APY for the junior tranche, in basis points. Zero",
+              "disables the floor.",
+              "",
+              "When junior's realized growth falls short of this floor, the shortfall is",
+              "topped up from the *untranched* (regular) sleeve's value, never from the",
+              "senior tranche -- senior's fixed-APY entitlement is settled first and is",
+              "untouched by the floor. The top-up is best-effort: it is capped by the",
+              "untranched sleeve's available value, and any unpaid remainder stays",
+              "outstanding against the durable junior anchor",
+              "(`VaultTrancheState::junior_apy_anchor_share_price`) so it can be paid on",
+              "a later settlement."
+            ],
+            "type": "u16"
+          },
+          {
+            "name": "_padding1",
+            "type": {
+              "array": [
+                "u8",
+                6
+              ]
+            }
+          },
           {
             "name": "_padding2",
             "type": {
               "array": [
                 "u64",
-                13
+                12
               ]
             }
           }
@@ -16438,12 +16498,28 @@ var IDL = {
             ],
             "type": "i64"
           },
+          {
+            "name": "junior_apy_anchor_share_price",
+            "docs": [
+              "Junior share price at the start of the current floor-APY regime. The",
+              "anchor is durable across settlements so an unpaid floor shortfall stays",
+              "outstanding and can be caught up later."
+            ],
+            "type": "u64"
+          },
+          {
+            "name": "junior_apy_anchor_ts",
+            "docs": [
+              "Unix timestamp when the junior floor-APY anchor was set."
+            ],
+            "type": "i64"
+          },
           {
             "name": "_padding2",
             "type": {
               "array": [
                 "u64",
-                29
+                27
               ]
             }
           }
@@ -16461,6 +16537,17 @@ var IDL = {
               "option": "u16"
             }
           },
+          {
+            "name": "junior_floor_apy_bps",
+            "docs": [
+              "Floor APY for the junior tranche, in basis points. Zero disables the",
+              "floor. Setting this starts a fresh regime: any shortfall accrued under",
+              "the previous value is forfeited."
+            ],
+            "type": {
+              "option": "u16"
+            }
+          },
           {
             "name": "early_unstake_fee_bps",
             "type": {
@@ -16743,12 +16830,25 @@ var IDL = {
             ],
             "type": "u64"
           },
+          {
+            "name": "rebalance_limit",
+            "docs": [
+              "Rolling cap on rebalance (Jupiter swap) throughput per window, as a",
+              "share of TVL. Carved out of `_padding1`, so the account layout and size",
+              "are unchanged and existing vaults decode it as disabled."
+            ],
+            "type": {
+              "defined": {
+                "name": "RollingRebalanceLimit"
+              }
+            }
+          },
           {
             "name": "_padding1",
             "type": {
               "array": [
                 "u64",
-                30
+                22
               ]
             }
           },
@@ -17887,6 +17987,7 @@ var CreateTrancheStateBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.vaultCreateTrancheState({
       seniorFixedApyBps: args.seniorFixedApyBps,
+      juniorFloorApyBps: args.juniorFloorApyBps,
       earlyUnstakeFeeBps: args.earlyUnstakeFeeBps,
       standardUnstakeFeeBps: args.standardUnstakeFeeBps,
       targetLockupDurationSecs: args.targetLockupDurationSecs,
@@ -17930,6 +18031,7 @@ var CreateTrancheStateBuilder = class extends VaultBuilderBase {
       seniorShareMint: txArgs.seniorShareMint,
       vaultOracle,
       seniorFixedApyBps: txArgs.seniorFixedApyBps ?? 0,
+      juniorFloorApyBps: txArgs.juniorFloorApyBps ?? 0,
       earlyUnstakeFeeBps: txArgs.earlyUnstakeFeeBps ?? DEFAULT_JUNIOR_EARLY_UNSTAKE_FEE_BPS,
       standardUnstakeFeeBps: txArgs.standardUnstakeFeeBps ?? DEFAULT_JUNIOR_STANDARD_UNSTAKE_FEE_BPS,
       targetLockupDurationSecs: new import_core.BN(
@@ -18005,7 +18107,8 @@ function toAnchorSetVaultConfigArgs(args) {
     lossesEnabled: args.lossesEnabled,
     priceStalenessThresholdSecs: args.priceStalenessThresholdSecs,
     userBurnLimit: args.userBurnLimit,
-    managerPullLimit: args.managerPullLimit
+    managerPullLimit: args.managerPullLimit,
+    rebalanceLimit: args.rebalanceLimit
   };
 }
 function toAnchorConsensusUpdates(updates) {
@@ -18213,6 +18316,12 @@ var SetVaultConfigBuilder = class extends VaultBuilderBase {
           windowDurationSeconds: new import_core4.BN(
             txArgs.managerPullLimit.windowDurationSeconds.toString()
           )
+        } : null,
+        rebalanceLimit: txArgs.rebalanceLimit !== void 0 ? {
+          windowLimitBps: txArgs.rebalanceLimit.windowLimitBps,
+          windowDurationSeconds: new import_core4.BN(
+            txArgs.rebalanceLimit.windowDurationSeconds.toString()
+          )
         } : null
       }
     };
@@ -18466,10 +18575,13 @@ var CrankPerformanceFeesBuilder = class extends VaultBuilderBase {
       vault: txArgs.vault,
       shareMint,
       feeCollector,
+      // The vault fee collector is a role that is routinely a Squads vault
+      // (off-curve PDA), so allow an off-curve owner here too.
       feeCollectorShareAta: (0, import_common18.getAtaAddress)(
         shareMint,
         feeCollector,
-        shareTokenProgram
+        shareTokenProgram,
+        true
       ),
       protocolFeeCollector,
       // The protocol fee recipient is a hardcoded protocol-controlled address
@@ -19195,8 +19307,11 @@ var ExecuteTrancheWithdrawBuilder = class extends VaultBuilderBase {
 
 // src/client/builders/executeWithdraw.ts
 var import_core10 = require("@anchor-lang/core");
-var import_kit7 = require("@solana/kit");
 var import_spl_token11 = require("@solana/spl-token");
+var import_common28 = __toESM(require_dist());
+
+// src/client/builders/externalLiquidity.ts
+var import_kit7 = require("@solana/kit");
 var import_web312 = require("@solana/web3.js");
 var import_common27 = __toESM(require_dist());
 var import_marginfi = __toESM(require_dist2());
@@ -19215,22 +19330,71 @@ function toWeb3AccountMeta(account) {
     isSigner: account.role === import_kit7.AccountRole.READONLY_SIGNER || account.role === import_kit7.AccountRole.WRITABLE_SIGNER
   };
 }
+function resolveExternalWithdraw({
+  externalLiquidity,
+  vault,
+  assetMint,
+  vaultAssetAta,
+  overrides
+}) {
+  const externalWithdrawIxRefs = overrides?.externalWithdrawIxRefs ?? null;
+  const externalLiquiditySource = overrides?.externalLiquiditySource ?? null;
+  const externalWithdrawAccounts = overrides?.externalWithdrawAccounts ?? [];
+  if (externalWithdrawIxRefs != null || externalLiquiditySource != null || overrides?.skipExternalLiquidity) {
+    return {
+      externalWithdrawIxRefs,
+      externalLiquiditySource,
+      externalWithdrawAccounts
+    };
+  }
+  const slot0 = parseMarginfiSlot(externalLiquidity[0]);
+  if (!slot0) {
+    return {
+      externalWithdrawIxRefs: null,
+      externalLiquiditySource: null,
+      externalWithdrawAccounts
+    };
+  }
+  const marginfiAccounts = (0, import_marginfi.marginfiAccountsForMint)(assetMint);
+  if (!marginfiAccounts) {
+    return {
+      externalWithdrawIxRefs: null,
+      externalLiquiditySource: null,
+      externalWithdrawAccounts
+    };
+  }
+  const marginfiClient = new import_marginfi.CpiClient({ accounts: marginfiAccounts });
+  const withdrawRefs = (0, import_common27.createCpiRefs)([
+    marginfiClient.withdraw_cpi({
+      marginfiAccount: slot0.userAccount,
+      authority: vault,
+      destinationTokenAccount: vaultAssetAta
+    })
+  ]);
+  return {
+    externalWithdrawIxRefs: withdrawRefs.refs,
+    externalLiquiditySource: 0,
+    externalWithdrawAccounts: withdrawRefs.accounts
+  };
+}
+
+// src/client/builders/executeWithdraw.ts
 var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
   getIxAccounts(args) {
     return {
-      user: (0, import_common27.toWeb3Pk)(args.user),
-      vault: (0, import_common27.toWeb3Pk)(args.vault),
-      vaultOracle: (0, import_common27.toWeb3Pk)(args.vaultOracle),
-      vaultTrancheState: args.vaultTrancheState ? (0, import_common27.toWeb3Pk)(args.vaultTrancheState) : null,
-      assetMint: (0, import_common27.toWeb3Pk)(args.assetMint),
-      shareMint: (0, import_common27.toWeb3Pk)(args.shareMint),
-      userAssetAta: (0, import_common27.toWeb3Pk)(args.userAssetAta),
-      vaultAssetAta: (0, import_common27.toWeb3Pk)(args.vaultAssetAta),
-      feeVault: (0, import_common27.toWeb3Pk)(args.feeVault),
-      feeVaultAta: (0, import_common27.toWeb3Pk)(args.feeVaultAta),
-      userShareAta: (0, import_common27.toWeb3Pk)(args.userShareAta),
-      assetTokenProgram: (0, import_common27.toWeb3Pk)(args.assetTokenProgram),
-      shareTokenProgram: (0, import_common27.toWeb3Pk)(args.shareTokenProgram)
+      user: (0, import_common28.toWeb3Pk)(args.user),
+      vault: (0, import_common28.toWeb3Pk)(args.vault),
+      vaultOracle: (0, import_common28.toWeb3Pk)(args.vaultOracle),
+      vaultTrancheState: args.vaultTrancheState ? (0, import_common28.toWeb3Pk)(args.vaultTrancheState) : null,
+      assetMint: (0, import_common28.toWeb3Pk)(args.assetMint),
+      shareMint: (0, import_common28.toWeb3Pk)(args.shareMint),
+      userAssetAta: (0, import_common28.toWeb3Pk)(args.userAssetAta),
+      vaultAssetAta: (0, import_common28.toWeb3Pk)(args.vaultAssetAta),
+      feeVault: (0, import_common28.toWeb3Pk)(args.feeVault),
+      feeVaultAta: (0, import_common28.toWeb3Pk)(args.feeVaultAta),
+      userShareAta: (0, import_common28.toWeb3Pk)(args.userShareAta),
+      assetTokenProgram: (0, import_common28.toWeb3Pk)(args.assetTokenProgram),
+      shareTokenProgram: (0, import_common28.toWeb3Pk)(args.shareTokenProgram)
     };
   }
   getIxData(args) {
@@ -19260,7 +19424,7 @@ var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
     ) : this.program.methods.executeWithdraw(data.shareAmount);
     return methods.accountsPartial(
       this.getIxAccounts(args)
-    ).remainingAccounts(args.externalWithdrawAccounts.map(toWeb3AccountMeta)).instruction().then(import_common27.toKitInstruction);
+    ).remainingAccounts(args.externalWithdrawAccounts.map(toWeb3AccountMeta)).instruction().then(import_common28.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const connection = this.program.provider.connection;
@@ -19294,36 +19458,23 @@ var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
       ),
       this.account.fetchVault(txArgs.vault)
     ]);
-    const vaultAssetAta = (0, import_common27.getAtaAddress)(
+    const vaultAssetAta = (0, import_common28.getAtaAddress)(
       txArgs.assetMint,
       txArgs.vault,
       assetTokenProgram,
       true
     );
-    let externalWithdrawIxRefs = txArgs.externalWithdrawIxRefs ?? null;
-    let externalLiquiditySource = txArgs.externalLiquiditySource ?? null;
-    let externalWithdrawAccounts = txArgs.externalWithdrawAccounts ?? [];
-    if (externalWithdrawIxRefs == null && externalLiquiditySource == null && !txArgs.skipExternalLiquidity) {
-      const slot0 = parseMarginfiSlot(vaultData.externalLiquidity[0]);
-      if (slot0) {
-        const marginfiAccounts = (0, import_marginfi.marginfiAccountsForMint)(txArgs.assetMint);
-        if (marginfiAccounts) {
-          const marginfiClient = new import_marginfi.CpiClient({
-            accounts: marginfiAccounts
-          });
-          const withdrawRefs = (0, import_common27.createCpiRefs)([
-            marginfiClient.withdraw_cpi({
-              marginfiAccount: slot0.userAccount,
-              authority: txArgs.vault,
-              destinationTokenAccount: vaultAssetAta
-            })
-          ]);
-          externalWithdrawIxRefs = withdrawRefs.refs;
-          externalLiquiditySource = 0;
-          externalWithdrawAccounts = withdrawRefs.accounts;
-        }
-      }
-    }
+    const {
+      externalWithdrawIxRefs,
+      externalLiquiditySource,
+      externalWithdrawAccounts
+    } = resolveExternalWithdraw({
+      externalLiquidity: vaultData.externalLiquidity,
+      vault: txArgs.vault,
+      assetMint: txArgs.assetMint,
+      vaultAssetAta,
+      overrides: txArgs
+    });
     return {
       user: txArgs.user,
       vault: txArgs.vault,
@@ -19334,16 +19485,16 @@ var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
       shareAmount: new import_core10.BN(txArgs.shareAmount.toString()),
       assetTokenProgram,
       shareTokenProgram,
-      userAssetAta: txArgs.userAssetAta ?? (0, import_common27.getAtaAddress)(txArgs.assetMint, txArgs.user, assetTokenProgram),
+      userAssetAta: txArgs.userAssetAta ?? (0, import_common28.getAtaAddress)(txArgs.assetMint, txArgs.user, assetTokenProgram),
       vaultAssetAta,
       feeVault,
-      feeVaultAta: (0, import_common27.getAtaAddress)(
+      feeVaultAta: (0, import_common28.getAtaAddress)(
         txArgs.assetMint,
         feeVault,
         assetTokenProgram,
         true
       ),
-      userShareAta: txArgs.userShareAta ?? (0, import_common27.getAtaAddress)(txArgs.shareMint, txArgs.user, shareTokenProgram),
+      userShareAta: txArgs.userShareAta ?? (0, import_common28.getAtaAddress)(txArgs.shareMint, txArgs.user, shareTokenProgram),
       externalWithdrawIxRefs,
       externalLiquiditySource,
       externalWithdrawAccounts,
@@ -19354,31 +19505,31 @@ var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
     return txArgs.lookupTables;
   }
   async buildPreambleInstructions(args) {
-    const defaultUserAssetAta = (0, import_common27.getAtaAddress)(
+    const defaultUserAssetAta = (0, import_common28.getAtaAddress)(
       args.assetMint,
       args.user,
       args.assetTokenProgram
     );
-    const payer = (0, import_common27.toWeb3Pk)(args.user);
-    const createUserAssetAta = (0, import_common27.toWeb3Pk)(args.userAssetAta).equals(
-      (0, import_common27.toWeb3Pk)(defaultUserAssetAta)
+    const payer = (0, import_common28.toWeb3Pk)(args.user);
+    const createUserAssetAta = (0, import_common28.toWeb3Pk)(args.userAssetAta).equals(
+      (0, import_common28.toWeb3Pk)(defaultUserAssetAta)
     ) ? (0, import_spl_token11.createAssociatedTokenAccountIdempotentInstruction)(
       payer,
-      (0, import_common27.toWeb3Pk)(args.userAssetAta),
+      (0, import_common28.toWeb3Pk)(args.userAssetAta),
       payer,
-      (0, import_common27.toWeb3Pk)(args.assetMint),
-      (0, import_common27.toWeb3Pk)(args.assetTokenProgram),
+      (0, import_common28.toWeb3Pk)(args.assetMint),
+      (0, import_common28.toWeb3Pk)(args.assetTokenProgram),
       import_spl_token11.ASSOCIATED_TOKEN_PROGRAM_ID
     ) : null;
     const createFeeVaultAta = (0, import_spl_token11.createAssociatedTokenAccountIdempotentInstruction)(
       payer,
-      (0, import_common27.toWeb3Pk)(args.feeVaultAta),
-      (0, import_common27.toWeb3Pk)(args.feeVault),
-      (0, import_common27.toWeb3Pk)(args.assetMint),
-      (0, import_common27.toWeb3Pk)(args.assetTokenProgram),
+      (0, import_common28.toWeb3Pk)(args.feeVaultAta),
+      (0, import_common28.toWeb3Pk)(args.feeVault),
+      (0, import_common28.toWeb3Pk)(args.assetMint),
+      (0, import_common28.toWeb3Pk)(args.assetTokenProgram),
       import_spl_token11.ASSOCIATED_TOKEN_PROGRAM_ID
     );
-    return [createUserAssetAta, createFeeVaultAta].filter((ix) => ix != null).map(import_common27.toKitInstruction);
+    return [createUserAssetAta, createFeeVaultAta].filter((ix) => ix != null).map(import_common28.toKitInstruction);
   }
   async buildPlanExtras(args) {
     return {
@@ -19390,33 +19541,38 @@ var ExecuteWithdrawBuilder = class extends VaultBuilderBase {
 // src/client/builders/fulfillJuniorTrancheWithdraw.ts
 var import_spl_token12 = require("@solana/spl-token");
 var import_web313 = require("@solana/web3.js");
-var import_common28 = __toESM(require_dist());
+var import_common29 = __toESM(require_dist());
 var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
   async getIx(args) {
+    const externalWithdrawIxRefs = args.externalWithdrawIxRefs ?? null;
+    const externalLiquiditySource = args.externalLiquiditySource ?? null;
     const methods = args.addressSeeds ? this.program.methods.fulfillJuniorTrancheWithdrawFeeExempt(
+      externalWithdrawIxRefs,
+      externalLiquiditySource,
       args.addressSeeds.map((seed) => Buffer.from(seed))
-    ) : this.program.methods.fulfillJuniorTrancheWithdraw();
+    ) : this.program.methods.fulfillJuniorTrancheWithdraw(
+      externalWithdrawIxRefs,
+      externalLiquiditySource
+    );
     return methods.accountsPartial({
-      signer: (0, import_common28.toWeb3Pk)(args.signer),
-      owner: (0, import_common28.toWeb3Pk)(args.owner),
-      queuePayer: (0, import_common28.toWeb3Pk)(args.queuePayer),
-      vault: (0, import_common28.toWeb3Pk)(args.vault),
-      vaultOracle: (0, import_common28.toWeb3Pk)(args.vaultOracle),
-      vaultTrancheState: (0, import_common28.toWeb3Pk)(args.vaultTrancheState),
-      withdrawalQueue: (0, import_common28.toWeb3Pk)(args.withdrawalQueue),
-      outputMint: (0, import_common28.toWeb3Pk)(args.outputMint),
-      inputMint: (0, import_common28.toWeb3Pk)(args.inputMint),
-      ownerInputAta: (0, import_common28.toWeb3Pk)(args.ownerInputAta),
-      ownerOutputAta: (0, import_common28.toWeb3Pk)(args.ownerOutputAta),
-      vaultOutputAta: (0, import_common28.toWeb3Pk)(args.vaultOutputAta),
-      feeCollector: (0, import_common28.toWeb3Pk)(args.feeCollector),
-      feeCollectorOutputAta: (0, import_common28.toWeb3Pk)(args.feeCollectorOutputAta),
-      queueInputAta: (0, import_common28.toWeb3Pk)(args.queueInputAta),
-      assetTokenProgram: (0, import_common28.toWeb3Pk)(args.assetTokenProgram),
-      shareTokenProgram: (0, import_common28.toWeb3Pk)(args.shareTokenProgram),
+      signer: (0, import_common29.toWeb3Pk)(args.signer),
+      owner: (0, import_common29.toWeb3Pk)(args.owner),
+      queuePayer: (0, import_common29.toWeb3Pk)(args.queuePayer),
+      vault: (0, import_common29.toWeb3Pk)(args.vault),
+      vaultOracle: (0, import_common29.toWeb3Pk)(args.vaultOracle),
+      vaultTrancheState: (0, import_common29.toWeb3Pk)(args.vaultTrancheState),
+      withdrawalQueue: (0, import_common29.toWeb3Pk)(args.withdrawalQueue),
+      outputMint: (0, import_common29.toWeb3Pk)(args.outputMint),
+      inputMint: (0, import_common29.toWeb3Pk)(args.inputMint),
+      ownerInputAta: (0, import_common29.toWeb3Pk)(args.ownerInputAta),
+      ownerOutputAta: (0, import_common29.toWeb3Pk)(args.ownerOutputAta),
+      vaultOutputAta: (0, import_common29.toWeb3Pk)(args.vaultOutputAta),
+      queueInputAta: (0, import_common29.toWeb3Pk)(args.queueInputAta),
+      assetTokenProgram: (0, import_common29.toWeb3Pk)(args.assetTokenProgram),
+      shareTokenProgram: (0, import_common29.toWeb3Pk)(args.shareTokenProgram),
       associatedTokenProgram: import_spl_token12.ASSOCIATED_TOKEN_PROGRAM_ID,
       systemProgram: import_web313.SystemProgram.programId
-    }).instruction().then(import_common28.toKitInstruction);
+    }).remainingAccounts(args.externalWithdrawAccounts.map(toWeb3AccountMeta)).instruction().then(import_common29.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const connection = this.program.provider.connection;
@@ -19426,9 +19582,9 @@ var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
       [vaultOracle],
       [vaultTrancheState],
       [withdrawalQueue],
-      feeCollector,
       assetTokenProgram,
-      juniorShare
+      juniorShare,
+      vaultData
     ] = await Promise.all([
       this.pda.deriveVaultOraclePda(txArgs.vault),
       this.pda.deriveVaultTrancheStatePda(txArgs.vault),
@@ -19437,7 +19593,6 @@ var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
         txArgs.owner,
         txArgs.queueId
       ),
-      resolveVaultFeeCollector(this.account, txArgs.vault, txArgs.feeCollector),
       resolveHoldingTokenProgram(
         this.account,
         connection,
@@ -19453,10 +19608,28 @@ var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
           mint: txArgs.juniorShareMint,
           tokenProgram: txArgs.shareTokenProgram
         }
-      )
+      ),
+      this.account.fetchVault(txArgs.vault)
     ]);
     const { mint: juniorShareMint, tokenProgram: shareTokenProgram } = juniorShare;
     const queuePda = txArgs.withdrawalQueue ?? withdrawalQueue;
+    const vaultOutputAta = (0, import_common29.getAtaAddress)(
+      txArgs.assetMint,
+      txArgs.vault,
+      assetTokenProgram,
+      true
+    );
+    const {
+      externalWithdrawIxRefs,
+      externalLiquiditySource,
+      externalWithdrawAccounts
+    } = resolveExternalWithdraw({
+      externalLiquidity: vaultData.externalLiquidity,
+      vault: txArgs.vault,
+      assetMint: txArgs.assetMint,
+      vaultAssetAta: vaultOutputAta,
+      overrides: txArgs
+    });
     return {
       signer,
       owner: txArgs.owner,
@@ -19469,50 +19642,45 @@ var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
       inputMint: juniorShareMint,
       assetTokenProgram,
       shareTokenProgram,
-      ownerInputAta: txArgs.ownerInputAta ?? (0, import_common28.getAtaAddress)(juniorShareMint, txArgs.owner, shareTokenProgram),
-      ownerOutputAta: (0, import_common28.getAtaAddress)(
+      ownerInputAta: txArgs.ownerInputAta ?? (0, import_common29.getAtaAddress)(juniorShareMint, txArgs.owner, shareTokenProgram),
+      ownerOutputAta: (0, import_common29.getAtaAddress)(
         txArgs.assetMint,
         txArgs.owner,
         assetTokenProgram
       ),
-      vaultOutputAta: (0, import_common28.getAtaAddress)(
-        txArgs.assetMint,
-        txArgs.vault,
-        assetTokenProgram,
-        true
-      ),
-      feeCollector,
-      feeCollectorOutputAta: (0, import_common28.getAtaAddress)(
-        txArgs.assetMint,
-        feeCollector,
-        assetTokenProgram
-      ),
-      queueInputAta: (0, import_common28.getAtaAddress)(
+      vaultOutputAta,
+      queueInputAta: (0, import_common29.getAtaAddress)(
         juniorShareMint,
         queuePda,
         shareTokenProgram,
         true
       ),
+      externalWithdrawIxRefs,
+      externalLiquiditySource,
+      externalWithdrawAccounts,
       addressSeeds: txArgs.addressSeeds
     };
   }
+  async buildLookupTables(_args, txArgs) {
+    return txArgs.lookupTables;
+  }
   async buildPreambleInstructions(args) {
-    const defaultOwnerInputAta = (0, import_common28.getAtaAddress)(
+    const defaultOwnerInputAta = (0, import_common29.getAtaAddress)(
       args.inputMint,
       args.owner,
       args.shareTokenProgram
     );
-    if (!(0, import_common28.toWeb3Pk)(args.ownerInputAta).equals((0, import_common28.toWeb3Pk)(defaultOwnerInputAta))) {
+    if (!(0, import_common29.toWeb3Pk)(args.ownerInputAta).equals((0, import_common29.toWeb3Pk)(defaultOwnerInputAta))) {
       return [];
     }
     return [
-      (0, import_common28.toKitInstruction)(
+      (0, import_common29.toKitInstruction)(
         (0, import_spl_token12.createAssociatedTokenAccountIdempotentInstruction)(
-          (0, import_common28.toWeb3Pk)(args.signer),
-          (0, import_common28.toWeb3Pk)(args.ownerInputAta),
-          (0, import_common28.toWeb3Pk)(args.owner),
-          (0, import_common28.toWeb3Pk)(args.inputMint),
-          (0, import_common28.toWeb3Pk)(args.shareTokenProgram),
+          (0, import_common29.toWeb3Pk)(args.signer),
+          (0, import_common29.toWeb3Pk)(args.ownerInputAta),
+          (0, import_common29.toWeb3Pk)(args.owner),
+          (0, import_common29.toWeb3Pk)(args.inputMint),
+          (0, import_common29.toWeb3Pk)(args.shareTokenProgram),
           import_spl_token12.ASSOCIATED_TOKEN_PROGRAM_ID
         )
       )
@@ -19533,21 +19701,22 @@ var FulfillJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
 
 // src/client/builders/updateTrancheConfig.ts
 var import_core11 = require("@anchor-lang/core");
-var import_common29 = __toESM(require_dist());
+var import_common30 = __toESM(require_dist());
 var UpdateTrancheConfigBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.vaultUpdateTrancheConfig({
       seniorFixedApyBps: args.seniorFixedApyBps,
+      juniorFloorApyBps: args.juniorFloorApyBps,
       earlyUnstakeFeeBps: args.earlyUnstakeFeeBps,
       standardUnstakeFeeBps: args.standardUnstakeFeeBps,
       targetLockupDurationSecs: args.targetLockupDurationSecs,
       juniorDepositCap: args.juniorDepositCap
     }).accountsPartial({
-      curator: (0, import_common29.toWeb3Pk)(args.curator),
-      vault: (0, import_common29.toWeb3Pk)(args.vault),
-      vaultTrancheState: (0, import_common29.toWeb3Pk)(args.vaultTrancheState),
-      vaultOracle: (0, import_common29.toWeb3Pk)(args.vaultOracle)
-    }).instruction().then(import_common29.toKitInstruction);
+      curator: (0, import_common30.toWeb3Pk)(args.curator),
+      vault: (0, import_common30.toWeb3Pk)(args.vault),
+      vaultTrancheState: (0, import_common30.toWeb3Pk)(args.vaultTrancheState),
+      vaultOracle: (0, import_common30.toWeb3Pk)(args.vaultOracle)
+    }).instruction().then(import_common30.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const [vaultTrancheState] = await this.pda.deriveVaultTrancheStatePda(
@@ -19560,6 +19729,7 @@ var UpdateTrancheConfigBuilder = class extends VaultBuilderBase {
       vaultTrancheState: txArgs.vaultTrancheState ?? vaultTrancheState,
       vaultOracle: txArgs.vaultOracle ?? vaultOracle,
       seniorFixedApyBps: txArgs.seniorFixedApyBps ?? null,
+      juniorFloorApyBps: txArgs.juniorFloorApyBps ?? null,
       earlyUnstakeFeeBps: txArgs.earlyUnstakeFeeBps ?? null,
       standardUnstakeFeeBps: txArgs.standardUnstakeFeeBps ?? null,
       targetLockupDurationSecs: txArgs.targetLockupDurationSecs === void 0 ? null : new import_core11.BN(txArgs.targetLockupDurationSecs.toString()),
@@ -19579,22 +19749,22 @@ var UpdateTrancheConfigBuilder = class extends VaultBuilderBase {
 var import_core12 = require("@anchor-lang/core");
 var import_spl_token13 = require("@solana/spl-token");
 var import_web314 = require("@solana/web3.js");
-var import_common30 = __toESM(require_dist());
+var import_common31 = __toESM(require_dist());
 var ManagerRedepositAssetBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.managerRedepositAsset({
       depositAmount: args.depositAmount,
       externalAmount: args.externalAmount
     }).accountsPartial({
-      manager: (0, import_common30.toWeb3Pk)(args.manager),
-      vault: (0, import_common30.toWeb3Pk)(args.vault),
-      assetMint: (0, import_common30.toWeb3Pk)(args.assetMint),
-      vaultAssetAta: (0, import_common30.toWeb3Pk)(args.vaultAssetAta),
-      managerAssetAta: (0, import_common30.toWeb3Pk)(args.managerAssetAta),
-      assetTokenProgram: (0, import_common30.toWeb3Pk)(args.assetTokenProgram),
+      manager: (0, import_common31.toWeb3Pk)(args.manager),
+      vault: (0, import_common31.toWeb3Pk)(args.vault),
+      assetMint: (0, import_common31.toWeb3Pk)(args.assetMint),
+      vaultAssetAta: (0, import_common31.toWeb3Pk)(args.vaultAssetAta),
+      managerAssetAta: (0, import_common31.toWeb3Pk)(args.managerAssetAta),
+      assetTokenProgram: (0, import_common31.toWeb3Pk)(args.assetTokenProgram),
       associatedTokenProgram: import_spl_token13.ASSOCIATED_TOKEN_PROGRAM_ID,
       systemProgram: import_web314.SystemProgram.programId
-    }).instruction().then(import_common30.toKitInstruction);
+    }).instruction().then(import_common31.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const connection = this.program.provider.connection;
@@ -19611,13 +19781,13 @@ var ManagerRedepositAssetBuilder = class extends VaultBuilderBase {
       depositAmount: new import_core12.BN(txArgs.depositAmount.toString()),
       externalAmount: new import_core12.BN(externalAmount.toString()),
       assetTokenProgram,
-      vaultAssetAta: (0, import_common30.getAtaAddress)(
+      vaultAssetAta: (0, import_common31.getAtaAddress)(
         txArgs.assetMint,
         txArgs.vault,
         assetTokenProgram,
         true
       ),
-      managerAssetAta: (0, import_common30.getAtaAddress)(
+      managerAssetAta: (0, import_common31.getAtaAddress)(
         txArgs.assetMint,
         txArgs.manager,
         assetTokenProgram
@@ -19635,19 +19805,19 @@ var ManagerRedepositAssetBuilder = class extends VaultBuilderBase {
 var import_core13 = require("@anchor-lang/core");
 var import_spl_token14 = require("@solana/spl-token");
 var import_web315 = require("@solana/web3.js");
-var import_common31 = __toESM(require_dist());
+var import_common32 = __toESM(require_dist());
 var ManagerWithdrawAssetBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.managerWithdrawAsset(args.amount).accountsPartial({
-      manager: (0, import_common31.toWeb3Pk)(args.manager),
-      vault: (0, import_common31.toWeb3Pk)(args.vault),
-      assetMint: (0, import_common31.toWeb3Pk)(args.assetMint),
-      vaultAssetAta: (0, import_common31.toWeb3Pk)(args.vaultAssetAta),
-      managerAssetAta: (0, import_common31.toWeb3Pk)(args.managerAssetAta),
-      assetTokenProgram: (0, import_common31.toWeb3Pk)(args.assetTokenProgram),
+      manager: (0, import_common32.toWeb3Pk)(args.manager),
+      vault: (0, import_common32.toWeb3Pk)(args.vault),
+      assetMint: (0, import_common32.toWeb3Pk)(args.assetMint),
+      vaultAssetAta: (0, import_common32.toWeb3Pk)(args.vaultAssetAta),
+      managerAssetAta: (0, import_common32.toWeb3Pk)(args.managerAssetAta),
+      assetTokenProgram: (0, import_common32.toWeb3Pk)(args.assetTokenProgram),
       associatedTokenProgram: import_spl_token14.ASSOCIATED_TOKEN_PROGRAM_ID,
       systemProgram: import_web315.SystemProgram.programId
-    }).instruction().then(import_common31.toKitInstruction);
+    }).instruction().then(import_common32.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const connection = this.program.provider.connection;
@@ -19662,13 +19832,13 @@ var ManagerWithdrawAssetBuilder = class extends VaultBuilderBase {
       assetMint: txArgs.assetMint,
       amount: new import_core13.BN(txArgs.amount.toString()),
       assetTokenProgram,
-      vaultAssetAta: (0, import_common31.getAtaAddress)(
+      vaultAssetAta: (0, import_common32.getAtaAddress)(
         txArgs.assetMint,
         txArgs.vault,
         assetTokenProgram,
         true
       ),
-      managerAssetAta: (0, import_common31.getAtaAddress)(
+      managerAssetAta: (0, import_common32.getAtaAddress)(
         txArgs.assetMint,
         txArgs.manager,
         assetTokenProgram
@@ -19687,7 +19857,7 @@ var import_core14 = require("@anchor-lang/core");
 var import_kit8 = require("@solana/kit");
 var import_spl_token15 = require("@solana/spl-token");
 var import_web316 = require("@solana/web3.js");
-var import_common32 = __toESM(require_dist());
+var import_common33 = __toESM(require_dist());
 var DEFAULT_PYTH_PRICE_MAX_AGE_SECS = 90n;
 function toAssetPriceOracleConfig(args) {
   return {
@@ -19702,7 +19872,7 @@ function toAssetPriceOracleConfig(args) {
 function toAnchorAssetPriceOracleConfig(config) {
   return {
     ...config,
-    priceOracleAccount: (0, import_common32.toWeb3Pk)(config.priceOracleAccount)
+    priceOracleAccount: (0, import_common33.toWeb3Pk)(config.priceOracleAccount)
   };
 }
 function toWeb3AccountMeta2(account) {
@@ -19716,14 +19886,14 @@ var ProtocolInteractionBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.protocolInteraction(args.refs, {
       externalLiquidityIndex: args.externalLiquidityIndex,
-      affectedAssetMint: args.affectedAssetMint ? (0, import_common32.toWeb3Pk)(args.affectedAssetMint) : null
+      affectedAssetMint: args.affectedAssetMint ? (0, import_common33.toWeb3Pk)(args.affectedAssetMint) : null
     }).accountsPartial({
-      hwManager: (0, import_common32.toWeb3Pk)(args.hwManager),
-      vault: (0, import_common32.toWeb3Pk)(args.vault),
-      affectedAssetMint: args.affectedAssetMint ? (0, import_common32.toWeb3Pk)(args.affectedAssetMint) : null,
-      affectedVaultAta: args.affectedVaultAta ? (0, import_common32.toWeb3Pk)(args.affectedVaultAta) : null,
-      affectedTokenProgram: args.affectedTokenProgram ? (0, import_common32.toWeb3Pk)(args.affectedTokenProgram) : null
-    }).remainingAccounts(args.accounts.map(toWeb3AccountMeta2)).instruction().then(import_common32.toKitInstruction);
+      hwManager: (0, import_common33.toWeb3Pk)(args.hwManager),
+      vault: (0, import_common33.toWeb3Pk)(args.vault),
+      affectedAssetMint: args.affectedAssetMint ? (0, import_common33.toWeb3Pk)(args.affectedAssetMint) : null,
+      affectedVaultAta: args.affectedVaultAta ? (0, import_common33.toWeb3Pk)(args.affectedVaultAta) : null,
+      affectedTokenProgram: args.affectedTokenProgram ? (0, import_common33.toWeb3Pk)(args.affectedTokenProgram) : null
+    }).remainingAccounts(args.accounts.map(toWeb3AccountMeta2)).instruction().then(import_common33.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const affectedTokenProgram = txArgs.affectedAssetMint ? txArgs.affectedTokenProgram ?? TOKEN_PROGRAM_ID : null;
@@ -19735,7 +19905,7 @@ var ProtocolInteractionBuilder = class extends VaultBuilderBase {
       accounts: txArgs.accounts,
       affectedAssetMint: txArgs.affectedAssetMint ?? null,
       affectedTokenProgram,
-      affectedVaultAta: txArgs.affectedAssetMint && affectedTokenProgram ? (0, import_common32.getAtaAddress)(
+      affectedVaultAta: txArgs.affectedAssetMint && affectedTokenProgram ? (0, import_common33.getAtaAddress)(
         txArgs.affectedAssetMint,
         txArgs.vault,
         affectedTokenProgram,
@@ -19754,18 +19924,18 @@ var JupiterSwapBuilder = class extends VaultBuilderBase {
         args.destinationPriceOracle
       )
     }).accountsPartial({
-      hwManager: (0, import_common32.toWeb3Pk)(args.hwManager),
-      vault: (0, import_common32.toWeb3Pk)(args.vault),
-      sourceMint: (0, import_common32.toWeb3Pk)(args.sourceMint),
-      destinationMint: (0, import_common32.toWeb3Pk)(args.destinationMint),
-      vaultSourceAta: (0, import_common32.toWeb3Pk)(args.vaultSourceAta),
-      vaultDestinationAta: (0, import_common32.toWeb3Pk)(args.vaultDestinationAta),
-      sourceTokenProgram: (0, import_common32.toWeb3Pk)(args.sourceTokenProgram),
-      destinationTokenProgram: (0, import_common32.toWeb3Pk)(args.destinationTokenProgram),
-      destinationOracleAccount: args.destinationOracleAccount ? (0, import_common32.toWeb3Pk)(args.destinationOracleAccount) : null,
-      vaultOracle: (0, import_common32.toWeb3Pk)(args.vaultOracle),
-      vaultTrancheState: args.vaultTrancheState ? (0, import_common32.toWeb3Pk)(args.vaultTrancheState) : null
-    }).remainingAccounts(args.accounts.map(toWeb3AccountMeta2)).instruction().then(import_common32.toKitInstruction);
+      hwManager: (0, import_common33.toWeb3Pk)(args.hwManager),
+      vault: (0, import_common33.toWeb3Pk)(args.vault),
+      sourceMint: (0, import_common33.toWeb3Pk)(args.sourceMint),
+      destinationMint: (0, import_common33.toWeb3Pk)(args.destinationMint),
+      vaultSourceAta: (0, import_common33.toWeb3Pk)(args.vaultSourceAta),
+      vaultDestinationAta: (0, import_common33.toWeb3Pk)(args.vaultDestinationAta),
+      sourceTokenProgram: (0, import_common33.toWeb3Pk)(args.sourceTokenProgram),
+      destinationTokenProgram: (0, import_common33.toWeb3Pk)(args.destinationTokenProgram),
+      destinationOracleAccount: args.destinationOracleAccount ? (0, import_common33.toWeb3Pk)(args.destinationOracleAccount) : null,
+      vaultOracle: (0, import_common33.toWeb3Pk)(args.vaultOracle),
+      vaultTrancheState: args.vaultTrancheState ? (0, import_common33.toWeb3Pk)(args.vaultTrancheState) : null
+    }).remainingAccounts(args.accounts.map(toWeb3AccountMeta2)).instruction().then(import_common33.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const sourceTokenProgram = txArgs.sourceTokenProgram ?? TOKEN_PROGRAM_ID;
@@ -19786,13 +19956,13 @@ var JupiterSwapBuilder = class extends VaultBuilderBase {
       accounts: txArgs.accounts,
       sourceTokenProgram,
       destinationTokenProgram,
-      vaultSourceAta: (0, import_common32.getAtaAddress)(
+      vaultSourceAta: (0, import_common33.getAtaAddress)(
         txArgs.sourceMint,
         txArgs.vault,
         sourceTokenProgram,
         true
       ),
-      vaultDestinationAta: (0, import_common32.getAtaAddress)(
+      vaultDestinationAta: (0, import_common33.getAtaAddress)(
         txArgs.destinationMint,
         txArgs.vault,
         destinationTokenProgram,
@@ -19801,24 +19971,24 @@ var JupiterSwapBuilder = class extends VaultBuilderBase {
     };
   }
   async buildPreambleInstructions(args) {
-    const payer = (0, import_common32.toWeb3Pk)(args.hwManager);
+    const payer = (0, import_common33.toWeb3Pk)(args.hwManager);
     const createSourceAta = (0, import_spl_token15.createAssociatedTokenAccountIdempotentInstruction)(
       payer,
-      (0, import_common32.toWeb3Pk)(args.vaultSourceAta),
-      (0, import_common32.toWeb3Pk)(args.vault),
-      (0, import_common32.toWeb3Pk)(args.sourceMint),
-      (0, import_common32.toWeb3Pk)(args.sourceTokenProgram),
+      (0, import_common33.toWeb3Pk)(args.vaultSourceAta),
+      (0, import_common33.toWeb3Pk)(args.vault),
+      (0, import_common33.toWeb3Pk)(args.sourceMint),
+      (0, import_common33.toWeb3Pk)(args.sourceTokenProgram),
       import_spl_token15.ASSOCIATED_TOKEN_PROGRAM_ID
     );
     const createDestinationAta = (0, import_spl_token15.createAssociatedTokenAccountIdempotentInstruction)(
       payer,
-      (0, import_common32.toWeb3Pk)(args.vaultDestinationAta),
-      (0, import_common32.toWeb3Pk)(args.vault),
-      (0, import_common32.toWeb3Pk)(args.destinationMint),
-      (0, import_common32.toWeb3Pk)(args.destinationTokenProgram),
+      (0, import_common33.toWeb3Pk)(args.vaultDestinationAta),
+      (0, import_common33.toWeb3Pk)(args.vault),
+      (0, import_common33.toWeb3Pk)(args.destinationMint),
+      (0, import_common33.toWeb3Pk)(args.destinationTokenProgram),
       import_spl_token15.ASSOCIATED_TOKEN_PROGRAM_ID
     );
-    return [createSourceAta, createDestinationAta].map(import_common32.toKitInstruction);
+    return [createSourceAta, createDestinationAta].map(import_common33.toKitInstruction);
   }
   async buildLookupTables(_args, txArgs) {
     return txArgs.lookupTables;
@@ -19854,24 +20024,24 @@ var JupiterSwapBuilder = class extends VaultBuilderBase {
 var import_core15 = require("@anchor-lang/core");
 var import_spl_token16 = require("@solana/spl-token");
 var import_web317 = require("@solana/web3.js");
-var import_common33 = __toESM(require_dist());
+var import_common34 = __toESM(require_dist());
 var RequestJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
   async getIx(args) {
     return this.program.methods.requestJuniorTrancheWithdraw(args.queueId, args.shareAmount).accountsPartial({
-      user: (0, import_common33.toWeb3Pk)(args.user),
-      payer: (0, import_common33.toWeb3Pk)(args.payer),
-      vault: (0, import_common33.toWeb3Pk)(args.vault),
-      vaultOracle: (0, import_common33.toWeb3Pk)(args.vaultOracle),
-      vaultTrancheState: (0, import_common33.toWeb3Pk)(args.vaultTrancheState),
-      withdrawalQueue: (0, import_common33.toWeb3Pk)(args.withdrawalQueue),
-      outputMint: (0, import_common33.toWeb3Pk)(args.outputMint),
-      inputMint: (0, import_common33.toWeb3Pk)(args.inputMint),
-      userInputAta: (0, import_common33.toWeb3Pk)(args.userInputAta),
-      queueInputAta: (0, import_common33.toWeb3Pk)(args.queueInputAta),
-      shareTokenProgram: (0, import_common33.toWeb3Pk)(args.shareTokenProgram),
+      user: (0, import_common34.toWeb3Pk)(args.user),
+      payer: (0, import_common34.toWeb3Pk)(args.payer),
+      vault: (0, import_common34.toWeb3Pk)(args.vault),
+      vaultOracle: (0, import_common34.toWeb3Pk)(args.vaultOracle),
+      vaultTrancheState: (0, import_common34.toWeb3Pk)(args.vaultTrancheState),
+      withdrawalQueue: (0, import_common34.toWeb3Pk)(args.withdrawalQueue),
+      outputMint: (0, import_common34.toWeb3Pk)(args.outputMint),
+      inputMint: (0, import_common34.toWeb3Pk)(args.inputMint),
+      userInputAta: (0, import_common34.toWeb3Pk)(args.userInputAta),
+      queueInputAta: (0, import_common34.toWeb3Pk)(args.queueInputAta),
+      shareTokenProgram: (0, import_common34.toWeb3Pk)(args.shareTokenProgram),
       associatedTokenProgram: import_spl_token16.ASSOCIATED_TOKEN_PROGRAM_ID,
       systemProgram: import_web317.SystemProgram.programId
-    }).instruction().then(import_common33.toKitInstruction);
+    }).instruction().then(import_common34.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const payer = txArgs.payer ?? txArgs.user;
@@ -19907,8 +20077,8 @@ var RequestJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
       queueId: txArgs.queueId,
       shareAmount: new import_core15.BN(txArgs.shareAmount.toString()),
       shareTokenProgram,
-      userInputAta: txArgs.userInputAta ?? (0, import_common33.getAtaAddress)(juniorShareMint, txArgs.user, shareTokenProgram),
-      queueInputAta: (0, import_common33.getAtaAddress)(
+      userInputAta: txArgs.userInputAta ?? (0, import_common34.getAtaAddress)(juniorShareMint, txArgs.user, shareTokenProgram),
+      queueInputAta: (0, import_common34.getAtaAddress)(
         juniorShareMint,
         queuePda,
         shareTokenProgram,
@@ -19933,7 +20103,7 @@ var RequestJuniorTrancheWithdrawBuilder = class extends VaultBuilderBase {
 var import_core16 = require("@anchor-lang/core");
 var import_spl_token17 = require("@solana/spl-token");
 var import_web318 = require("@solana/web3.js");
-var import_common34 = __toESM(require_dist());
+var import_common35 = __toESM(require_dist());
 var DEFAULT_PYTH_PRICE_MAX_AGE_SECS2 = 90n;
 function toAssetPriceOracleConfig2(args) {
   return {
@@ -19948,7 +20118,7 @@ function toAssetPriceOracleConfig2(args) {
 function toAnchorAssetPriceOracleConfig2(config) {
   return {
     ...config,
-    priceOracleAccount: (0, import_common34.toWeb3Pk)(config.priceOracleAccount)
+    priceOracleAccount: (0, import_common35.toWeb3Pk)(config.priceOracleAccount)
   };
 }
 var VaultReallocationBuilder = class extends VaultBuilderBase {
@@ -19957,35 +20127,35 @@ var VaultReallocationBuilder = class extends VaultBuilderBase {
       amount: args.amount,
       assetPriceOracle: toAnchorAssetPriceOracleConfig2(args.assetPriceOracle)
     }).accountsPartial({
-      manager: (0, import_common34.toWeb3Pk)(args.manager),
-      allocationVault: (0, import_common34.toWeb3Pk)(args.allocationVault),
-      sourceVault: args.sourceVault ? (0, import_common34.toWeb3Pk)(args.sourceVault) : null,
-      sourceVaultOracle: args.sourceVaultOracle ? (0, import_common34.toWeb3Pk)(args.sourceVaultOracle) : null,
-      destinationVault: (0, import_common34.toWeb3Pk)(args.destinationVault),
-      destinationVaultOracle: (0, import_common34.toWeb3Pk)(args.destinationVaultOracle),
-      mint: (0, import_common34.toWeb3Pk)(args.mint),
-      sourceShareMint: args.sourceShareMint ? (0, import_common34.toWeb3Pk)(args.sourceShareMint) : null,
-      destinationShareMint: (0, import_common34.toWeb3Pk)(args.destinationShareMint),
-      allocationMintAta: (0, import_common34.toWeb3Pk)(args.allocationMintAta),
-      sourceVaultMintAta: args.sourceVaultMintAta ? (0, import_common34.toWeb3Pk)(args.sourceVaultMintAta) : null,
-      destinationVaultMintAta: (0, import_common34.toWeb3Pk)(args.destinationVaultMintAta),
-      destinationFeeVault: (0, import_common34.toWeb3Pk)(args.destinationFeeVault),
-      destinationFeeVaultMintAta: (0, import_common34.toWeb3Pk)(args.destinationFeeVaultMintAta),
-      allocationSourceShareAta: args.allocationSourceShareAta ? (0, import_common34.toWeb3Pk)(args.allocationSourceShareAta) : null,
-      allocationDestinationShareAta: (0, import_common34.toWeb3Pk)(
+      manager: (0, import_common35.toWeb3Pk)(args.manager),
+      allocationVault: (0, import_common35.toWeb3Pk)(args.allocationVault),
+      sourceVault: args.sourceVault ? (0, import_common35.toWeb3Pk)(args.sourceVault) : null,
+      sourceVaultOracle: args.sourceVaultOracle ? (0, import_common35.toWeb3Pk)(args.sourceVaultOracle) : null,
+      destinationVault: (0, import_common35.toWeb3Pk)(args.destinationVault),
+      destinationVaultOracle: (0, import_common35.toWeb3Pk)(args.destinationVaultOracle),
+      mint: (0, import_common35.toWeb3Pk)(args.mint),
+      sourceShareMint: args.sourceShareMint ? (0, import_common35.toWeb3Pk)(args.sourceShareMint) : null,
+      destinationShareMint: (0, import_common35.toWeb3Pk)(args.destinationShareMint),
+      allocationMintAta: (0, import_common35.toWeb3Pk)(args.allocationMintAta),
+      sourceVaultMintAta: args.sourceVaultMintAta ? (0, import_common35.toWeb3Pk)(args.sourceVaultMintAta) : null,
+      destinationVaultMintAta: (0, import_common35.toWeb3Pk)(args.destinationVaultMintAta),
+      destinationFeeVault: (0, import_common35.toWeb3Pk)(args.destinationFeeVault),
+      destinationFeeVaultMintAta: (0, import_common35.toWeb3Pk)(args.destinationFeeVaultMintAta),
+      allocationSourceShareAta: args.allocationSourceShareAta ? (0, import_common35.toWeb3Pk)(args.allocationSourceShareAta) : null,
+      allocationDestinationShareAta: (0, import_common35.toWeb3Pk)(
         args.allocationDestinationShareAta
       ),
-      sourceVaultTrancheState: args.sourceVaultTrancheState ? (0, import_common34.toWeb3Pk)(args.sourceVaultTrancheState) : null,
-      destinationVaultTrancheState: args.destinationVaultTrancheState ? (0, import_common34.toWeb3Pk)(args.destinationVaultTrancheState) : null,
-      assetOracleAccount: args.assetOracleAccount ? (0, import_common34.toWeb3Pk)(args.assetOracleAccount) : null,
-      assetTokenProgram: (0, import_common34.toWeb3Pk)(args.assetTokenProgram),
-      sourceShareTokenProgram: (0, import_common34.toWeb3Pk)(args.sourceShareTokenProgram),
-      destinationShareTokenProgram: (0, import_common34.toWeb3Pk)(
+      sourceVaultTrancheState: args.sourceVaultTrancheState ? (0, import_common35.toWeb3Pk)(args.sourceVaultTrancheState) : null,
+      destinationVaultTrancheState: args.destinationVaultTrancheState ? (0, import_common35.toWeb3Pk)(args.destinationVaultTrancheState) : null,
+      assetOracleAccount: args.assetOracleAccount ? (0, import_common35.toWeb3Pk)(args.assetOracleAccount) : null,
+      assetTokenProgram: (0, import_common35.toWeb3Pk)(args.assetTokenProgram),
+      sourceShareTokenProgram: (0, import_common35.toWeb3Pk)(args.sourceShareTokenProgram),
+      destinationShareTokenProgram: (0, import_common35.toWeb3Pk)(
         args.destinationShareTokenProgram
       ),
       associatedTokenProgram: import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID,
       systemProgram: import_web318.SystemProgram.programId
-    }).instruction().then(import_common34.toKitInstruction);
+    }).instruction().then(import_common35.toKitInstruction);
   }
   async deriveIxArgs(txArgs) {
     const assetTokenProgram = txArgs.assetTokenProgram ?? TOKEN_PROGRAM_ID;
@@ -20018,33 +20188,33 @@ var VaultReallocationBuilder = class extends VaultBuilderBase {
       assetTokenProgram,
       sourceShareTokenProgram,
       destinationShareTokenProgram,
-      allocationMintAta: (0, import_common34.getAtaAddress)(
+      allocationMintAta: (0, import_common35.getAtaAddress)(
         txArgs.mint,
         txArgs.allocationVault,
         assetTokenProgram,
         true
       ),
-      sourceVaultMintAta: sourceVault ? (0, import_common34.getAtaAddress)(txArgs.mint, sourceVault, assetTokenProgram, true) : null,
-      destinationVaultMintAta: (0, import_common34.getAtaAddress)(
+      sourceVaultMintAta: sourceVault ? (0, import_common35.getAtaAddress)(txArgs.mint, sourceVault, assetTokenProgram, true) : null,
+      destinationVaultMintAta: (0, import_common35.getAtaAddress)(
         txArgs.mint,
         txArgs.destinationVault,
         assetTokenProgram,
         true
       ),
       destinationFeeVault,
-      destinationFeeVaultMintAta: (0, import_common34.getAtaAddress)(
+      destinationFeeVaultMintAta: (0, import_common35.getAtaAddress)(
         txArgs.mint,
         destinationFeeVault,
         assetTokenProgram,
         true
       ),
-      allocationSourceShareAta: sourceShareMint && sourceVault ? (0, import_common34.getAtaAddress)(
+      allocationSourceShareAta: sourceShareMint && sourceVault ? (0, import_common35.getAtaAddress)(
         sourceShareMint,
         txArgs.allocationVault,
         sourceShareTokenProgram,
         true
       ) : null,
-      allocationDestinationShareAta: (0, import_common34.getAtaAddress)(
+      allocationDestinationShareAta: (0, import_common35.getAtaAddress)(
         txArgs.destinationShareMint,
         txArgs.allocationVault,
         destinationShareTokenProgram,
@@ -20053,38 +20223,38 @@ var VaultReallocationBuilder = class extends VaultBuilderBase {
     };
   }
   async buildPreambleInstructions(args) {
-    const payer = (0, import_common34.toWeb3Pk)(args.manager);
+    const payer = (0, import_common35.toWeb3Pk)(args.manager);
     const instructions2 = [
       (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
         payer,
-        (0, import_common34.toWeb3Pk)(args.allocationMintAta),
-        (0, import_common34.toWeb3Pk)(args.allocationVault),
-        (0, import_common34.toWeb3Pk)(args.mint),
-        (0, import_common34.toWeb3Pk)(args.assetTokenProgram),
+        (0, import_common35.toWeb3Pk)(args.allocationMintAta),
+        (0, import_common35.toWeb3Pk)(args.allocationVault),
+        (0, import_common35.toWeb3Pk)(args.mint),
+        (0, import_common35.toWeb3Pk)(args.assetTokenProgram),
         import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
       ),
       (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
         payer,
-        (0, import_common34.toWeb3Pk)(args.destinationVaultMintAta),
-        (0, import_common34.toWeb3Pk)(args.destinationVault),
-        (0, import_common34.toWeb3Pk)(args.mint),
-        (0, import_common34.toWeb3Pk)(args.assetTokenProgram),
+        (0, import_common35.toWeb3Pk)(args.destinationVaultMintAta),
+        (0, import_common35.toWeb3Pk)(args.destinationVault),
+        (0, import_common35.toWeb3Pk)(args.mint),
+        (0, import_common35.toWeb3Pk)(args.assetTokenProgram),
         import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
       ),
       (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
         payer,
-        (0, import_common34.toWeb3Pk)(args.destinationFeeVaultMintAta),
-        (0, import_common34.toWeb3Pk)(args.destinationFeeVault),
-        (0, import_common34.toWeb3Pk)(args.mint),
-        (0, import_common34.toWeb3Pk)(args.assetTokenProgram),
+        (0, import_common35.toWeb3Pk)(args.destinationFeeVaultMintAta),
+        (0, import_common35.toWeb3Pk)(args.destinationFeeVault),
+        (0, import_common35.toWeb3Pk)(args.mint),
+        (0, import_common35.toWeb3Pk)(args.assetTokenProgram),
         import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
       ),
       (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
         payer,
-        (0, import_common34.toWeb3Pk)(args.allocationDestinationShareAta),
-        (0, import_common34.toWeb3Pk)(args.allocationVault),
-        (0, import_common34.toWeb3Pk)(args.destinationShareMint),
-        (0, import_common34.toWeb3Pk)(args.destinationShareTokenProgram),
+        (0, import_common35.toWeb3Pk)(args.allocationDestinationShareAta),
+        (0, import_common35.toWeb3Pk)(args.allocationVault),
+        (0, import_common35.toWeb3Pk)(args.destinationShareMint),
+        (0, import_common35.toWeb3Pk)(args.destinationShareTokenProgram),
         import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
       )
     ];
@@ -20092,23 +20262,23 @@ var VaultReallocationBuilder = class extends VaultBuilderBase {
       instructions2.push(
         (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
           payer,
-          (0, import_common34.toWeb3Pk)(args.sourceVaultMintAta),
-          (0, import_common34.toWeb3Pk)(args.sourceVault),
-          (0, import_common34.toWeb3Pk)(args.mint),
-          (0, import_common34.toWeb3Pk)(args.assetTokenProgram),
+          (0, import_common35.toWeb3Pk)(args.sourceVaultMintAta),
+          (0, import_common35.toWeb3Pk)(args.sourceVault),
+          (0, import_common35.toWeb3Pk)(args.mint),
+          (0, import_common35.toWeb3Pk)(args.assetTokenProgram),
           import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
         ),
         (0, import_spl_token17.createAssociatedTokenAccountIdempotentInstruction)(
           payer,
-          (0, import_common34.toWeb3Pk)(args.allocationSourceShareAta),
-          (0, import_common34.toWeb3Pk)(args.allocationVault),
-          (0, import_common34.toWeb3Pk)(args.sourceShareMint),
-          (0, import_common34.toWeb3Pk)(args.sourceShareTokenProgram),
+          (0, import_common35.toWeb3Pk)(args.allocationSourceShareAta),
+          (0, import_common35.toWeb3Pk)(args.allocationVault),
+          (0, import_common35.toWeb3Pk)(args.sourceShareMint),
+          (0, import_common35.toWeb3Pk)(args.sourceShareTokenProgram),
           import_spl_token17.ASSOCIATED_TOKEN_PROGRAM_ID
         )
       );
     }
-    return instructions2.map(import_common34.toKitInstruction);
+    return instructions2.map(import_common35.toKitInstruction);
   }
   async buildPlanExtras(args) {
     return {
@@ -20213,7 +20383,7 @@ var VaultClient = class {
   async sendTransaction(payer, plan, extraSigners = []) {
     const { blockhash, lastValidBlockHeight } = await this.provider.connection.getLatestBlockhash("confirmed");
     const tx = new import_web319.Transaction().add(
-      ...plan.instructions.map(import_common35.fromKitInstruction)
+      ...plan.instructions.map(import_common36.fromKitInstruction)
     );
     tx.feePayer = payer.publicKey;
     tx.recentBlockhash = blockhash;
@@ -20240,11 +20410,11 @@ var VaultClient = class {
     const { blockhash } = await this.provider.connection.getLatestBlockhash(
       "confirmed"
     );
-    const lookupTableAccounts = plan.lookupTables?.length ? await (0, import_common35.fetchLookupTables)(this.provider.connection, plan.lookupTables) : [];
+    const lookupTableAccounts = plan.lookupTables?.length ? await (0, import_common36.fetchLookupTables)(this.provider.connection, plan.lookupTables) : [];
     const message2 = new import_web319.TransactionMessage({
       payerKey: payer.publicKey,
       recentBlockhash: blockhash,
-      instructions: plan.instructions.map(import_common35.fromKitInstruction)
+      instructions: plan.instructions.map(import_common36.fromKitInstruction)
     }).compileToV0Message(lookupTableAccounts);
     const tx = new import_web319.VersionedTransaction(message2);
     const result = await this.provider.connection.simulateTransaction(tx, {
@@ -20322,7 +20492,11 @@ function loadKeypair(keypairPath) {
   const raw = import_fs.default.readFileSync(resolveKeypairPath(keypairPath), "utf-8");
   return import_web320.Keypair.fromSecretKey(new Uint8Array(JSON.parse(raw)));
 }
+var ENV_AGNOSTIC_ROLES = /* @__PURE__ */ new Set(["fulfiller", "rebalancer"]);
 function defaultKeypairPath(env, role = "vault") {
+  if (ENV_AGNOSTIC_ROLES.has(role)) {
+    return `~/.config/solana/${role}.json`;
+  }
   return `~/.config/solana/${role}-${env}.json`;
 }
 function createVaultClient(env, opts = {}) {
@@ -20340,11 +20514,11 @@ function createVaultClient(env, opts = {}) {
     client,
     provider,
     payer,
-    signer: (0, import_common36.fromWeb3Pk)(payer.publicKey)
+    signer: (0, import_common37.fromWeb3Pk)(payer.publicKey)
   };
 }
 function keypairAddress(keypairPath) {
-  return (0, import_common36.fromWeb3Pk)(loadKeypair(keypairPath).publicKey);
+  return (0, import_common37.fromWeb3Pk)(loadKeypair(keypairPath).publicKey);
 }
 
 // src/utils/math.ts
@@ -20482,7 +20656,7 @@ async function prepareVaultTransaction(args) {
 // src/utils/token.ts
 var import_spl_token18 = require("@solana/spl-token");
 var import_web322 = require("@solana/web3.js");
-var import_common37 = __toESM(require_dist());
+var import_common38 = __toESM(require_dist());
 async function createTokenMintIxs(connection, payer, authority, decimals, tokenProgram = import_spl_token18.TOKEN_2022_PROGRAM_ID) {
   const mint = import_web322.Keypair.generate();
   const lamports = await (0, import_spl_token18.getMinimumBalanceForRentExemptMint)(connection);
@@ -20527,7 +20701,7 @@ async function createTokenMint(connection, payer, decimals, tokenProgram = impor
   return mint.publicKey;
 }
 async function mintTokensTo(connection, payer, mint, destination, amount, tokenProgram = import_spl_token18.TOKEN_2022_PROGRAM_ID, allowOwnerOffCurve = false) {
-  const tokenProgramPk = (0, import_common37.asWeb3PublicKey)(tokenProgram);
+  const tokenProgramPk = (0, import_common38.asWeb3PublicKey)(tokenProgram);
   const ata = (0, import_spl_token18.getAssociatedTokenAddressSync)(
     mint,
     destination,
@@ -20806,7 +20980,7 @@ async function getTotalOutstandingYield(accountNames, start, end) {
 }
 
 // src/services/withdrawalQueueService.ts
-var import_common38 = __toESM(require_dist());
+var import_common39 = __toESM(require_dist());
 function bnToBigInt(value) {
   return BigInt(value.toString());
 }
@@ -20827,7 +21001,7 @@ var WithdrawalQueueService = class {
     const program = this.client.program.account;
     const accounts2 = await program.vaultWithdrawalQueue.all();
     return accounts2.map(
-      (entry) => this.toSnapshot((0, import_common38.fromWeb3Pk)(entry.publicKey), entry.account)
+      (entry) => this.toSnapshot((0, import_common39.fromWeb3Pk)(entry.publicKey), entry.account)
     );
   }
   /** Withdrawal queues for a single vault. */
@@ -20868,7 +21042,7 @@ var WithdrawalQueueService = class {
   async fulfill(signer, queue) {
     const plan = await this.client.tx.fulfillJuniorTrancheWithdraw.getTx({
       owner: queue.owner,
-      signer: (0, import_common38.fromWeb3Pk)(signer.publicKey),
+      signer: (0, import_common39.fromWeb3Pk)(signer.publicKey),
       queuePayer: queue.payer,
       vault: queue.vault,
       withdrawalQueue: queue.pda,
@@ -20901,6 +21075,9 @@ var WithdrawalQueueService = class {
         continue;
       }
       try {
+        log?.(
+          `fulfilling ${queue.pda} \u2014 paying ${queue.inputAmount} junior shares worth of ${queue.outputMint} to owner ${queue.owner}`
+        );
         const sig = await this.fulfill(signer, queue);
         summary.fulfilled += 1;
         summary.signatures.push(sig);
@@ -20919,12 +21096,12 @@ var WithdrawalQueueService = class {
     const a = account;
     return {
       pda,
-      vault: (0, import_common38.fromWeb3Pk)(a.parties.vault),
-      owner: (0, import_common38.fromWeb3Pk)(a.parties.owner),
-      payer: (0, import_common38.fromWeb3Pk)(a.parties.payer),
+      vault: (0, import_common39.fromWeb3Pk)(a.parties.vault),
+      owner: (0, import_common39.fromWeb3Pk)(a.parties.owner),
+      payer: (0, import_common39.fromWeb3Pk)(a.parties.payer),
       queueId: a.header.queueId,
-      inputMint: (0, import_common38.fromWeb3Pk)(a.mints.inputMint),
-      outputMint: (0, import_common38.fromWeb3Pk)(a.mints.outputMint),
+      inputMint: (0, import_common39.fromWeb3Pk)(a.mints.inputMint),
+      outputMint: (0, import_common39.fromWeb3Pk)(a.mints.outputMint),
       inputAmount: bnToBigInt(a.request.inputAmount),
       requestTs: bnToNumber(a.request.requestTs),
       expiryTs: bnToNumber(a.request.expiryTs)
@@ -20934,7 +21111,7 @@ var WithdrawalQueueService = class {
 
 // src/services/oracleService.ts
 var import_kit11 = require("@solana/kit");
-var import_common39 = __toESM(require_dist());
+var import_common40 = __toESM(require_dist());
 var SYSTEM_PROGRAM = "11111111111111111111111111111111";
 var DEFAULT_PRICE_STALENESS_THRESHOLD_SECS2 = 86400n;
 var PRICE_ORACLE_TYPES_BY_INDEX = [
@@ -20998,7 +21175,7 @@ var OracleService = class {
    */
   async updateAssetConsensusPrice(signer, args, log) {
     const plan = await this.client.tx.updateConsensusOracle.getTx({
-      signer: (0, import_common39.fromWeb3Pk)(signer.publicKey),
+      signer: (0, import_common40.fromWeb3Pk)(signer.publicKey),
       vault: args.vault,
       updates: args.updates,
       assetMint: args.assetMint,
@@ -21014,7 +21191,7 @@ var OracleService = class {
   /** Settle the vault NAV from its current holdings (permissionless). */
   async crankNav(cranker, args, log) {
     const plan = await this.client.tx.crankNav.getTx({
-      cranker: (0, import_common39.fromWeb3Pk)(cranker.publicKey),
+      cranker: (0, import_common40.fromWeb3Pk)(cranker.publicKey),
       vault: args.vault,
       vaultTrancheState: args.vaultTrancheState
     });
@@ -21087,7 +21264,7 @@ var OracleService = class {
   /** Re-price one live-oracle holding from its bound Pyth/nested-vault account. */
   async refreshAssetPrice(updater, args, log) {
     const plan = await this.client.tx.updateAssetPrice.getTx({
-      updater: (0, import_common39.fromWeb3Pk)(updater.publicKey),
+      updater: (0, import_common40.fromWeb3Pk)(updater.publicKey),
       vault: args.vault,
       mint: args.mint,
       oracleAccount: args.oracleAccount,
@@ -21209,10 +21386,10 @@ function toBigInt2(value) {
 
 // src/services/consensusOracle/utils/holdings.ts
 var import_web323 = require("@solana/web3.js");
-var import_common40 = __toESM(require_dist());
+var import_common41 = __toESM(require_dist());
 function selectReportableHoldings(holdings, excludedMints = /* @__PURE__ */ new Set()) {
   return holdings.map((holding, holdingIndex) => ({ holding, holdingIndex })).filter(({ holding }) => {
-    const mint = (0, import_common40.fromWeb3Pk)(holding.mint);
+    const mint = (0, import_common41.fromWeb3Pk)(holding.mint);
     return mint !== SYSTEM_PROGRAM2 && !excludedMints.has(mint.toString()) && REPORTABLE_ORACLE_VARIANTS.has(
       variantName2(holding.priceOracleType).toLowerCase()
     );
@@ -21308,7 +21485,7 @@ async function collectSamples(read, { samples, minSamples, onError }) {
 
 // src/services/consensusOracle/pipeline/dryRunSettlement.ts
 var import_web325 = require("@solana/web3.js");
-var import_common41 = __toESM(require_dist());
+var import_common42 = __toESM(require_dist());
 
 // src/services/consensusOracle/settlement/settlementSimulator.ts
 var import_kit12 = require("@solana/kit");
@@ -21608,21 +21785,27 @@ function settleVault(args) {
       args.grossNav,
       args.nowTs
     );
+    const trancheValueBeforeFees = args.tranche.junior.value + args.tranche.senior.value;
+    const juniorFees = settleShareClassPerformanceFee(
+      args.tranche.junior,
+      args.performanceFeeBps,
+      args.protocolFeeBps
+    );
+    const juniorFloorTopup = applyJuniorFloorTopup(
+      args.tranche,
+      regularGrossValue,
+      args.nowTs
+    );
     regularValue = settleFixedApyNav({
       currentSharePrice: args.currentSharePrice,
-      reportedNav: regularGrossValue,
+      reportedNav: regularGrossValue - juniorFloorTopup,
       nowTs: args.nowTs,
       totalSupply: args.totalSupply,
       fixedApyBps: args.fixedApyBps,
       anchorSharePrice: args.apyAnchorSharePrice,
       anchorTs: args.apyAnchorTs
     });
-    settledAccountingNav = regularValue + args.tranche.junior.value + args.tranche.senior.value;
-    const juniorFees = settleShareClassPerformanceFee(
-      args.tranche.junior,
-      args.performanceFeeBps,
-      args.protocolFeeBps
-    );
+    settledAccountingNav = regularValue + trancheValueBeforeFees + juniorFloorTopup;
     const regularFees = settleRegularPerformanceFee(
       regularValue,
       args.totalSupply,
@@ -21743,6 +21926,31 @@ function seniorEntitlement(tranche, nowTs) {
   );
   return targetValue > tranche.senior.value ? targetValue - tranche.senior.value : 0n;
 }
+function applyJuniorFloorTopup(tranche, availableRegularValue, nowTs) {
+  if (tranche.juniorApyAnchorTs <= 0n) {
+    tranche.juniorApyAnchorSharePrice = tranche.junior.sharePrice;
+    tranche.juniorApyAnchorTs = tranche.lastSettledTs > 0n ? tranche.lastSettledTs : nowTs;
+  }
+  if (tranche.juniorFloorApyBps === 0 || tranche.juniorApyAnchorSharePrice === 0n || tranche.junior.totalSupply === 0n || tranche.juniorApyAnchorTs <= 0n || nowTs <= tranche.juniorApyAnchorTs) {
+    return 0n;
+  }
+  const targetPrice = applyEffectiveApy(
+    tranche.juniorApyAnchorSharePrice,
+    tranche.juniorFloorApyBps,
+    nowTs - tranche.juniorApyAnchorTs
+  );
+  const targetValue = mulDiv2(
+    targetPrice,
+    tranche.junior.totalSupply,
+    DEFAULT_SHARE_PRICE
+  );
+  const shortfall = targetValue > tranche.junior.value ? targetValue - tranche.junior.value : 0n;
+  const topup = shortfall < availableRegularValue ? shortfall : availableRegularValue;
+  if (topup === 0n) return 0n;
+  tranche.junior.value += topup;
+  refreshShareClass(tranche.junior);
+  return topup;
+}
 function settleShareClassPerformanceFee(shareClass, performanceFeeBps, protocolFeeBps) {
   refreshShareClass(shareClass);
   const grossPrice = shareClass.sharePrice;
@@ -21963,9 +22171,12 @@ function decodeTrancheState(decoded, args, warnings, blockers) {
     junior,
     senior,
     seniorFixedApyBps: number(decoded.config.seniorFixedApyBps),
+    juniorFloorApyBps: number(decoded.config.juniorFloorApyBps),
     lastSettledTs: bigint(decoded.lastSettledTs),
     seniorApyAnchorSharePrice: bigint(decoded.seniorApyAnchorSharePrice),
-    seniorApyAnchorTs: bigint(decoded.seniorApyAnchorTs)
+    seniorApyAnchorTs: bigint(decoded.seniorApyAnchorTs),
+    juniorApyAnchorSharePrice: bigint(decoded.juniorApyAnchorSharePrice),
+    juniorApyAnchorTs: bigint(decoded.juniorApyAnchorTs)
   };
 }
 function decodeShareClass(value) {
@@ -22338,7 +22549,7 @@ async function simulateDryRunSettlement({
     oracleData: oracleState.data,
     trancheState,
     updates,
-    signer: (0, import_common41.fromWeb3Pk)(signer.publicKey),
+    signer: (0, import_common42.fromWeb3Pk)(signer.publicKey),
     nowTs: nowSecs,
     physicalShareSupply: supplies[0],
     physicalJuniorSupply: tranchingEnabled ? supplies[1] : void 0,
@@ -22347,7 +22558,7 @@ async function simulateDryRunSettlement({
 }
 
 // src/services/consensusOracle/pipeline/holdingUpdates.ts
-var import_common42 = __toESM(require_dist());
+var import_common43 = __toESM(require_dist());
 async function buildUpdates(yieldTracker, reportableHoldings, inputs) {
   const updates = [];
   for (const entry of reportableHoldings) {
@@ -22357,7 +22568,7 @@ async function buildUpdates(yieldTracker, reportableHoldings, inputs) {
 }
 async function buildHoldingUpdate(yieldTracker, entry, inputs) {
   const { holding, holdingIndex } = entry;
-  const mint = (0, import_common42.fromWeb3Pk)(holding.mint);
+  const mint = (0, import_common43.fromWeb3Pk)(holding.mint);
   const mintKey = mint.toString();
   const oracleType = variantName2(holding.priceOracleType).toLowerCase();
   let usd;
@@ -22407,13 +22618,13 @@ async function resolveTrackedAmounts(yieldTracker, cfg, decimals) {
     cfg.yieldAccountNames
   );
   return {
-    principalAmount: tracked.principal > 0 ? (0, import_common42.fromUiAmount)(tracked.principal, decimals) : 0n,
-    yieldAmount: tracked.outstandingYield > 0 ? (0, import_common42.fromUiAmount)(tracked.outstandingYield, decimals) : 0n
+    principalAmount: tracked.principal > 0 ? (0, import_common43.fromUiAmount)(tracked.principal, decimals) : 0n,
+    yieldAmount: tracked.outstandingYield > 0 ? (0, import_common43.fromUiAmount)(tracked.outstandingYield, decimals) : 0n
   };
 }
 
 // src/services/consensusOracle/pipeline/livePriceRefresh.ts
-var import_common43 = __toESM(require_dist());
+var import_common44 = __toESM(require_dist());
 async function refreshLiveOraclePrices({
   oracle,
   signer,
@@ -22432,7 +22643,7 @@ async function refreshLiveOraclePrices({
   for (const holding of vaultState.holdings) {
     const oracleType = variantName2(holding.priceOracleType).toLowerCase();
     if (!LIVE_ORACLE_VARIANTS.has(oracleType)) continue;
-    const mint = (0, import_common43.fromWeb3Pk)(holding.mint);
+    const mint = (0, import_common44.fromWeb3Pk)(holding.mint);
     if (mint.toString() === SYSTEM_PROGRAM2) continue;
     const activeAmount = toBigInt2(holding.localAmount) + toBigInt2(holding.externalAmount);
     if (activeAmount === 0n) continue;
@@ -22447,7 +22658,7 @@ async function refreshLiveOraclePrices({
       );
       continue;
     }
-    const oracleAccount = (0, import_common43.fromWeb3Pk)(holding.priceOracleAccount);
+    const oracleAccount = (0, import_common44.fromWeb3Pk)(holding.priceOracleAccount);
     if (oracleAccount.toString() === SYSTEM_PROGRAM2) {
       log(
         `vault ${vault}: cannot refresh ${mint}; ${oracleType} holding has no oracle account`
@@ -22471,15 +22682,15 @@ async function refreshLiveOraclePrices({
 }
 
 // src/services/consensusOracle/pipeline/pricingInputs.ts
-var import_common44 = __toESM(require_dist());
+var import_common45 = __toESM(require_dist());
 async function gatherPricingInputs(deps, target, vaultState, reportableHoldings, log = () => {
 }) {
-  const manager = (0, import_common44.fromWeb3Pk)(vaultState.roles.manager);
+  const manager = (0, import_common45.fromWeb3Pk)(vaultState.roles.manager);
   const consensusMints = reportableHoldings.filter(
     ({ holding }) => variantName2(holding.priceOracleType).toLowerCase() === CONSENSUS_ORACLE_VARIANT
-  ).map(({ holding }) => (0, import_common44.fromWeb3Pk)(holding.mint));
+  ).map(({ holding }) => (0, import_common45.fromWeb3Pk)(holding.mint));
   const baseHolding = vaultState.holdings.find((h) => coerceBool3(h.isBase));
-  const baseMint = baseHolding ? (0, import_common44.fromWeb3Pk)(baseHolding.mint) : consensusMints[0];
+  const baseMint = baseHolding ? (0, import_common45.fromWeb3Pk)(baseHolding.mint) : consensusMints[0];
   if (!baseMint) {
     throw new Error(`vault has no holdings \u2014 cannot determine base asset`);
   }
@@ -22572,11 +22783,11 @@ function reconcilePositionSnapshots(snapshots, vault, log) {
 }
 
 // src/services/consensusOracle/pipeline/receiptMints.ts
-var import_common45 = __toESM(require_dist());
+var import_common46 = __toESM(require_dist());
 async function fetchReceiptMints(client, vault, vaultState) {
   const receiptMints = /* @__PURE__ */ new Set();
   if (vaultState.mint) {
-    receiptMints.add((0, import_common45.fromWeb3Pk)(vaultState.mint).toString());
+    receiptMints.add((0, import_common46.fromWeb3Pk)(vaultState.mint).toString());
   }
   if (!coerceBool3(vaultState.tranchingEnabled)) return receiptMints;
   const trancheState = await client.account.fetchVaultTrancheStateForVault(
@@ -22584,19 +22795,19 @@ async function fetchReceiptMints(client, vault, vaultState) {
     { fresh: true }
   );
   receiptMints.add(
-    (0, import_common45.fromWeb3Pk)(trancheState.config.juniorMint).toString()
+    (0, import_common46.fromWeb3Pk)(trancheState.config.juniorMint).toString()
   );
   receiptMints.add(
-    (0, import_common45.fromWeb3Pk)(trancheState.config.seniorMint).toString()
+    (0, import_common46.fromWeb3Pk)(trancheState.config.seniorMint).toString()
   );
   return receiptMints;
 }
 
 // src/services/consensusOracle/pipeline/settlement.ts
-var import_common47 = __toESM(require_dist());
+var import_common48 = __toESM(require_dist());
 
 // src/services/consensusOracle/pipeline/yieldAccounts.ts
-var import_common46 = __toESM(require_dist());
+var import_common47 = __toESM(require_dist());
 async function assertNoUnconfirmedYieldPayments(yieldTracker, target) {
   const accountNames = [
     ...new Set(
@@ -22636,7 +22847,7 @@ async function withDiscoveredYieldAccounts(yieldTracker, target, vaultState, exc
   );
   if (namesToAttach.length === 0) return target;
   const baseHolding = vaultState.holdings.find((holding) => {
-    const mint = (0, import_common46.fromWeb3Pk)(holding.mint).toString();
+    const mint = (0, import_common47.fromWeb3Pk)(holding.mint).toString();
     return coerceBool3(holding.isBase) && !excludedMints.has(mint);
   });
   if (!baseHolding) {
@@ -22644,7 +22855,7 @@ async function withDiscoveredYieldAccounts(yieldTracker, target, vaultState, exc
       `vault ${target.vault}: tagged yield accounts found but no base holding is available`
     );
   }
-  const baseMint = (0, import_common46.fromWeb3Pk)(baseHolding.mint);
+  const baseMint = (0, import_common47.fromWeb3Pk)(baseHolding.mint);
   const holdings = [...target.holdings ?? []];
   const existingIndex = holdings.findIndex(
     (holding) => holding.mint.toString() === baseMint.toString()
@@ -22735,7 +22946,7 @@ async function logProspectiveApy({
     );
     const prospectiveNav = vaultState.holdings.reduce(
       (sum, holding, holdingIndex) => {
-        const mint = (0, import_common47.fromWeb3Pk)(holding.mint).toString();
+        const mint = (0, import_common48.fromWeb3Pk)(holding.mint).toString();
         if (mint === SYSTEM_PROGRAM2) return sum;
         const update = updatesByIndex.get(holdingIndex);
         const localAmount = toBigInt2(holding.localAmount);
@@ -23244,7 +23455,7 @@ function createLiveConsensusOracleDeps(connection, opts = {}) {
 }
 
 // src/services/consensusOracle/consensusOracleService.ts
-var import_common48 = __toESM(require_dist());
+var import_common49 = __toESM(require_dist());
 var ConsensusOracleService = class {
   constructor(client, deps) {
     this.client = client;
@@ -23280,7 +23491,7 @@ var ConsensusOracleService = class {
       receiptMints
     );
     const filteredCount = vaultState.holdings.filter(
-      (holding) => receiptMints.has((0, import_common48.fromWeb3Pk)(holding.mint).toString())
+      (holding) => receiptMints.has((0, import_common49.fromWeb3Pk)(holding.mint).toString())
     ).length;
     if (filteredCount > 0) {
       log(
@@ -23456,9 +23667,12 @@ async function runLiveConsensusOracle(env, oracleSigner, opts = {}) {
 // src/services/externalLiquidityIntegrityService.ts
 var import_kit15 = require("@solana/kit");
 var import_web328 = require("@solana/web3.js");
-var import_common49 = __toESM(require_dist());
+var import_common50 = __toESM(require_dist());
 var import_marginfi3 = __toESM(require_dist2());
 var DEFAULT_MIN_AMOUNT_UI = 1;
+var DEFAULT_TARGET_LOCAL_BPS = 100;
+var DEFAULT_REBALANCE_BAND_BPS = 2e3;
+var BPS_DENOMINATOR3 = 10000n;
 function toRawAmount(uiAmount, decimals) {
   return BigInt(Math.floor(uiAmount * 10 ** decimals));
 }
@@ -23475,7 +23689,7 @@ function parseActiveSlots(externalLiquidity) {
     if (discriminant === 0) continue;
     if (discriminant !== 1) continue;
     const pubkeyBytes = new Uint8Array(data.slice(8, 40));
-    const userAccount = (0, import_common49.toAddress)(new import_web328.PublicKey(pubkeyBytes));
+    const userAccount = (0, import_common50.toAddress)(new import_web328.PublicKey(pubkeyBytes));
     results.push({ index: i, source: "marginfi", userAccount });
   }
   return results;
@@ -23495,26 +23709,50 @@ function pubkeyStr(value) {
 function isZeroPubkey2(pk) {
   return !pk || /^1+$/.test(pk) || pk === "11111111111111111111111111111111";
 }
+function planRebalance(params) {
+  const { localAmount, externalAmount, targetLocalBps, rebalanceBandBps, minRaw } = params;
+  const total = localAmount + externalAmount;
+  const targetLocal = total * BigInt(Math.round(targetLocalBps)) / BPS_DENOMINATOR3;
+  const band = targetLocal * BigInt(Math.round(rebalanceBandBps)) / BPS_DENOMINATOR3;
+  const threshold = band > minRaw ? band : minRaw;
+  if (localAmount > targetLocal) {
+    const amount2 = localAmount - targetLocal;
+    if (amount2 < threshold) return null;
+    return { direction: "deposit", amount: amount2, targetLocal };
+  }
+  const shortfall = targetLocal - localAmount;
+  if (shortfall < threshold) return null;
+  const amount = shortfall < externalAmount ? shortfall : externalAmount;
+  if (amount < minRaw) return null;
+  return { direction: "withdraw", amount, targetLocal };
+}
 var ExternalLiquidityIntegrityService = class {
   constructor(client) {
     this.client = client;
   }
   /**
-   * Scan all vaults and deposit any idle local balance into configured external
-   * liquidity positions. Non-fatal per vault — errors are logged and counted.
+   * Scan all vaults and rebalance each holding toward its target local share.
+   * Non-fatal per vault — errors are logged and counted.
    */
   async runAll(hwManager, opts = {}) {
     const log = opts.log ?? (() => {
     });
     const dryRun = opts.dryRun ?? false;
     const minAmountUi = opts.minAmountUi ?? DEFAULT_MIN_AMOUNT_UI;
-    if (dryRun) log("DRY RUN \u2014 deposits will be simulated, not sent");
-    log(`Minimum deposit: ${minAmountUi} token(s) (~$${minAmountUi})`);
+    const targetLocalBps = opts.targetLocalBps ?? DEFAULT_TARGET_LOCAL_BPS;
+    const rebalanceBandBps = opts.rebalanceBandBps ?? DEFAULT_REBALANCE_BAND_BPS;
+    if (dryRun) log("DRY RUN \u2014 rebalances will be simulated, not sent");
+    log(`Minimum rebalance: ${minAmountUi} token(s) (~$${minAmountUi})`);
+    log(`Target local share: ${targetLocalBps / 100}% of each holding`);
+    log(
+      `Rebalance band: ${rebalanceBandBps / 100}% of target (${targetLocalBps * (1 - rebalanceBandBps / 1e4) / 100}%\u2013${targetLocalBps * (1 + rebalanceBandBps / 1e4) / 100}% of holding)`
+    );
     const allVaults = await this.client.account.fetchAllVaults({ fresh: true });
     log(`Discovered ${allVaults.length} vault(s) on-chain`);
     const summary = {
       vaultsProcessed: 0,
       totalDeposited: 0,
+      totalWithdrawn: 0,
       totalSkipped: 0,
       totalFailed: 0,
       dryRun
@@ -23525,25 +23763,29 @@ var ExternalLiquidityIntegrityService = class {
         vaultState,
         hwManager,
         log,
-        { dryRun, minAmountUi }
+        { dryRun, minAmountUi, targetLocalBps, rebalanceBandBps }
       );
       summary.vaultsProcessed++;
       summary.totalDeposited += result.deposited;
+      summary.totalWithdrawn += result.withdrawn;
       summary.totalSkipped += result.skipped;
       summary.totalFailed += result.failed;
     }
     return summary;
   }
   /**
-   * Process a single vault: for each active external liquidity slot, deposit
-   * any holdings that have a non-zero local_amount.
+   * Process a single vault: for each active external liquidity slot, move each
+   * holding's balance toward the target local/external split.
    */
   async processVault(vault, vaultState, hwManager, log, opts = {}) {
     const dryRun = opts.dryRun ?? false;
     const minAmountUi = opts.minAmountUi ?? DEFAULT_MIN_AMOUNT_UI;
+    const targetLocalBps = opts.targetLocalBps ?? DEFAULT_TARGET_LOCAL_BPS;
+    const rebalanceBandBps = opts.rebalanceBandBps ?? DEFAULT_REBALANCE_BAND_BPS;
     const result = {
       vault,
       deposited: 0,
+      withdrawn: 0,
       skipped: 0,
       failed: 0,
       signatures: []
@@ -23553,7 +23795,7 @@ var ExternalLiquidityIntegrityService = class {
       result.skipped++;
       return result;
     }
-    const hwManagerAddress = (0, import_common49.fromWeb3Pk)(hwManager.publicKey);
+    const hwManagerAddress = (0, import_common50.fromWeb3Pk)(hwManager.publicKey);
     const vaultPk = new import_web328.PublicKey(vault.toString());
     const registeredHwManager = pubkeyStr(
       vaultState.roles.hwManager
@@ -23573,24 +23815,33 @@ var ExternalLiquidityIntegrityService = class {
       }
       const holdings = vaultState.holdings.filter((h) => {
         const mint = pubkeyStr(h.mint);
-        return !isZeroPubkey2(mint) && toBigInt3(h.localAmount) > 0n;
+        if (isZeroPubkey2(mint)) return false;
+        return toBigInt3(h.localAmount) > 0n || toBigInt3(h.externalAmount) > 0n;
       });
       if (holdings.length === 0) {
-        log(`Vault ${vault} slot ${slot.index}: no local balance to deploy`);
+        log(`Vault ${vault} slot ${slot.index}: no balance to rebalance`);
         result.skipped++;
         continue;
       }
       for (const holding of holdings) {
         const mintAddress = (0, import_kit15.address)(pubkeyStr(holding.mint));
         const localAmount = toBigInt3(holding.localAmount);
+        const externalAmount = toBigInt3(holding.externalAmount);
         const decimals = Number(holding.decimals ?? 0);
         const minRaw = toRawAmount(minAmountUi, decimals);
-        if (localAmount < minRaw) {
+        const plan = planRebalance({
+          localAmount,
+          externalAmount,
+          targetLocalBps,
+          rebalanceBandBps,
+          minRaw
+        });
+        if (!plan) {
           log(
-            `Vault ${vault} slot ${slot.index}: mint ${mintAddress} has ${formatUi(
-              localAmount,
+            `Vault ${vault} slot ${slot.index}: mint ${mintAddress} within band (local ${formatUi(localAmount, decimals)}, external ${formatUi(
+              externalAmount,
               decimals
-            )} < minimum ${minAmountUi} \u2014 skipping`
+            )}) \u2014 skipping`
           );
           result.skipped++;
           continue;
@@ -23604,31 +23855,36 @@ var ExternalLiquidityIntegrityService = class {
           continue;
         }
         log(
-          `Vault ${vault} slot ${slot.index}: ${dryRun ? "simulating deposit of" : "depositing"} ${localAmount} of mint ${mintAddress} into marginfi`
+          `Vault ${vault} slot ${slot.index}: ${dryRun ? "simulating " : ""}${plan.direction} of ${formatUi(plan.amount, decimals)} ${mintAddress} (local ${formatUi(localAmount, decimals)} \u2192 target ${formatUi(
+            plan.targetLocal,
+            decimals
+          )})`
         );
         try {
-          const outcome = await this.depositIntoMarginfi({
+          const outcome = await this.rebalanceMarginfi({
             vault,
             vaultPk,
             hwManager,
             hwManagerAddress,
             slot,
             mintAddress,
-            amount: localAmount,
+            direction: plan.direction,
+            amount: plan.amount,
             marginfiAccounts,
             dryRun,
             log
           });
           if (outcome.signature) {
             log(
-              `Vault ${vault} slot ${slot.index}: deposit tx ${outcome.signature}`
+              `Vault ${vault} slot ${slot.index}: ${plan.direction} tx ${outcome.signature}`
             );
             result.signatures.push(outcome.signature);
           }
-          result.deposited++;
+          if (plan.direction === "deposit") result.deposited++;
+          else result.withdrawn++;
         } catch (err) {
           log(
-            `Vault ${vault} slot ${slot.index}: deposit failed \u2014 ${err.message}`
+            `Vault ${vault} slot ${slot.index}: ${plan.direction} failed \u2014 ${err.message}`
           );
           result.failed++;
         }
@@ -23636,48 +23892,60 @@ var ExternalLiquidityIntegrityService = class {
     }
     return result;
   }
-  async depositIntoMarginfi(params) {
+  /**
+   * Move `amount` of `mintAddress` between the vault's own token account and
+   * its Marginfi position, in `direction`, through `protocol_interaction`.
+   */
+  async rebalanceMarginfi(params) {
     const {
       vault,
       hwManager,
       hwManagerAddress,
       slot,
       mintAddress,
+      direction,
       amount,
       marginfiAccounts,
       dryRun = false,
       log = () => {
       }
     } = params;
-    const marginfiClient = new import_marginfi3.CpiClient();
+    const marginfiClient = new import_marginfi3.CpiClient({
+      accounts: marginfiAccounts
+    });
     const { getAtaAddress: getAtaAddress16 } = await Promise.resolve().then(() => __toESM(require_dist()));
-    const signerTokenAccount = getAtaAddress16(
+    const vaultAta = getAtaAddress16(
       mintAddress,
       vault,
       marginfiAccounts.tokenProgram,
       true
     );
-    const depositRefs = (0, import_common49.createCpiRefs)([
-      marginfiClient.deposit_cpi({
+    const cpiRefs = (0, import_common50.createCpiRefs)([
+      direction === "deposit" ? marginfiClient.deposit_cpi({
+        marginfiAccount: slot.userAccount,
+        authority: vault,
+        signerTokenAccount: vaultAta,
+        amount
+      }) : marginfiClient.withdraw_cpi({
         marginfiAccount: slot.userAccount,
         authority: vault,
-        signerTokenAccount,
+        destinationTokenAccount: vaultAta,
         amount
       })
     ]);
     const ix = await this.client.tx.protocolInteraction.getIx({
       hwManager: hwManagerAddress,
       vault,
-      refs: depositRefs.refs,
+      refs: cpiRefs.refs,
       externalLiquidityIndex: slot.index,
       affectedAssetMint: mintAddress,
-      affectedVaultAta: signerTokenAccount,
+      affectedVaultAta: vaultAta,
       affectedTokenProgram: marginfiAccounts.tokenProgram,
-      accounts: depositRefs.accounts
+      accounts: cpiRefs.accounts
     });
     const plan = {
       instructions: [ix],
-      ...depositRefs.lookupTables?.length ? { lookupTables: depositRefs.lookupTables } : {}
+      ...cpiRefs.lookupTables?.length ? { lookupTables: cpiRefs.lookupTables } : {}
     };
     if (dryRun) {
       const sim = await this.client.simulateTransaction(hwManager, plan);
@@ -23685,9 +23953,7 @@ var ExternalLiquidityIntegrityService = class {
         log(`  | ${line}`);
       }
       if (sim.err) {
-        throw new Error(
-          `simulation failed: ${JSON.stringify(sim.err)}`
-        );
+        throw new Error(`simulation failed: ${JSON.stringify(sim.err)}`);
       }
       log(
         `Vault ${vault} slot ${slot.index}: simulation OK (${sim.unitsConsumed ?? "?"} CU)`
@@ -23697,9 +23963,408 @@ var ExternalLiquidityIntegrityService = class {
     return { signature: await this.client.sendTransaction(hwManager, plan) };
   }
 };
+
+// src/services/idleLiquidityService.ts
+var import_kit16 = require("@solana/kit");
+var import_spl_token19 = require("@solana/spl-token");
+var import_web329 = require("@solana/web3.js");
+var import_common51 = __toESM(require_dist());
+var import_jupiter3 = __toESM(require_dist3());
+var IDLE_RESERVE_FLOOR_BPS = 400;
+var IDLE_RESERVE_TARGET_BPS = 500;
+var DEFAULT_SLIPPAGE_BPS = 30;
+var DEFAULT_CU_PRICE_MICRO_LAMPORTS = 1e4;
+var DEFAULT_MAX_ACCOUNTS = 20;
+var COMPUTE_UNIT_LIMIT = 12e5;
+var ASSET_REBALANCE_COOLDOWN_SECS = 60;
+function toBigInt4(value) {
+  if (typeof value === "bigint") return value;
+  if (value !== null && value !== void 0) return BigInt(String(value));
+  return 0n;
+}
+function pubkeyStr2(value) {
+  if (typeof value === "string") return value;
+  if (value && typeof value.toBase58 === "function") {
+    return value.toBase58();
+  }
+  return String(value);
+}
+function coerceBool4(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") return value !== 0;
+  const inner = value?.[0];
+  if (typeof inner === "number") return inner !== 0;
+  return false;
+}
+function formatUi2(raw, decimals) {
+  return (Number(raw) / 10 ** decimals).toFixed(Math.min(decimals, 6));
+}
+function readHolding(raw) {
+  const h = raw;
+  return {
+    mint: pubkeyStr2(h.mint),
+    price: toBigInt4(h.price),
+    decimals: Number(h.decimals ?? 0),
+    localAmount: toBigInt4(h.localAmount),
+    externalAmount: toBigInt4(h.externalAmount),
+    lastUpdateTs: Number(toBigInt4(h.lastUpdateTs)),
+    lastRebalanceTs: Number(toBigInt4(h.lastRebalanceTs))
+  };
+}
+function findHolding2(vaultState, mint) {
+  const holdings = vaultState.holdings ?? [];
+  return holdings.map(readHolding).find((h) => h.mint === mint);
+}
+function holdingValue2(holding, amount) {
+  return amount * holding.price / 10n ** BigInt(holding.decimals);
+}
+var IdleLiquidityService = class {
+  constructor(client) {
+    this.client = client;
+  }
+  /** Current unix time in seconds (override in tests). */
+  now() {
+    return Math.floor(Date.now() / 1e3);
+  }
+  /**
+   * Top up the vault's idle USDC reserve if it has fallen below the floor.
+   * Never throws for an expected no-op — inspect `status` on the result.
+   */
+  async run(vault, hwManager, opts = {}) {
+    const log = opts.log ?? (() => {
+    });
+    const vaultState = await this.client.account.fetchVault(vault, {
+      fresh: true
+    });
+    const registeredHwManager = pubkeyStr2(
+      vaultState.roles.hwManager
+    );
+    if (registeredHwManager !== hwManager.publicKey.toBase58()) {
+      throw new Error(
+        `Signer ${hwManager.publicKey.toBase58()} is not the vault hw_manager ${registeredHwManager}`
+      );
+    }
+    const assessment = this.assess(vault, vaultState, log);
+    if (assessment.result) return assessment.result;
+    const { usdc, pst, base } = assessment;
+    const pstInput = this.sizePstInput(base.shortfallUsdc, usdc, pst);
+    if (pstInput === 0n) {
+      const reason = "top-up rounds to zero PST";
+      return { ...base, status: "above-floor", reason };
+    }
+    const cap = opts.maxPstInput !== void 0 && opts.maxPstInput < pst.localAmount ? opts.maxPstInput : pst.localAmount;
+    if (pstInput > cap) {
+      const reason = `top-up needs ${formatUi2(
+        pstInput,
+        pst.decimals
+      )} PST but only ${formatUi2(cap, pst.decimals)} is available`;
+      log(`Vault ${vault}: ${reason} \u2014 skipping`);
+      return { ...base, status: "insufficient-pst", reason };
+    }
+    const jupiter = new import_jupiter3.JupiterSwapClient(
+      (0, import_kit16.createSolanaRpc)(this.client.provider.connection.rpcEndpoint)
+    );
+    let quote;
+    try {
+      quote = await jupiter.getQuote({
+        inputMint: import_common51.PST_MINT,
+        outputMint: import_common51.USDC_MINT,
+        amount: pstInput,
+        slippageBps: opts.slippageBps ?? DEFAULT_SLIPPAGE_BPS,
+        maxAccounts: DEFAULT_MAX_ACCOUNTS
+      });
+    } catch (err) {
+      log(`Vault ${vault}: Jupiter quote failed \u2014 ${err.message}`);
+      return { ...base, status: "failed", reason: err.message };
+    }
+    log(
+      `Vault ${vault}: swapping ${formatUi2(
+        quote.inputAmount,
+        pst.decimals
+      )} PST -> ${formatUi2(
+        quote.outputAmount,
+        usdc.decimals
+      )} USDC (price impact ${quote.priceImpactPct})`
+    );
+    try {
+      const outcome = await this.executeSwap({
+        vault,
+        vaultState,
+        hwManager,
+        jupiter,
+        quote,
+        cuPriceMicroLamports: opts.cuPriceMicroLamports ?? DEFAULT_CU_PRICE_MICRO_LAMPORTS,
+        dryRun: opts.dryRun ?? false,
+        log
+      });
+      return {
+        ...base,
+        status: outcome.signature ? "swapped" : "simulated",
+        reason: outcome.signature ? `swapped in ${outcome.signature}` : "dry run \u2014 simulation succeeded, nothing submitted",
+        pstSpent: quote.inputAmount,
+        usdcReceived: quote.outputAmount,
+        ...outcome.signature ? { signature: outcome.signature } : {}
+      };
+    } catch (err) {
+      log(`Vault ${vault}: swap failed \u2014 ${err.message}`);
+      return { ...base, status: "failed", reason: err.message };
+    }
+  }
+  // ── Assessment ──────────────────────────────────────────────────────────
+  /**
+   * Decide whether a top-up is warranted. Returns either a terminal `result`
+   * (nothing to do) or the holdings and sizing needed to build the swap.
+   */
+  assess(vault, vaultState, log) {
+    const tvl = toBigInt4(
+      vaultState.accounting?.tvl
+    );
+    const empty = {
+      vault,
+      tvl,
+      idleValue: 0n,
+      idleBps: 0,
+      shortfallUsdc: 0n,
+      pstSpent: 0n,
+      usdcReceived: 0n
+    };
+    if (tvl === 0n) {
+      const reason = "vault TVL is zero";
+      log(`Vault ${vault}: ${reason} \u2014 skipping`);
+      return { result: { ...empty, status: "no-tvl", reason } };
+    }
+    const usdc = findHolding2(vaultState, import_common51.USDC_MINT);
+    const pst = findHolding2(vaultState, import_common51.PST_MINT);
+    if (!usdc || !pst) {
+      const reason = `vault has no ${usdc ? "PST" : "USDC"} holding`;
+      log(`Vault ${vault}: ${reason} \u2014 skipping`);
+      return { result: { ...empty, status: "missing-holding", reason } };
+    }
+    const stalenessThreshold = this.stalenessThresholdSecs(vaultState);
+    const now = this.now();
+    for (const [name, holding] of [
+      ["USDC", usdc],
+      ["PST", pst]
+    ]) {
+      if (holding.price === 0n) {
+        const reason = `${name} holding has no price set`;
+        log(`Vault ${vault}: ${reason} \u2014 skipping`);
+        return { result: { ...empty, status: "stale-price", reason } };
+      }
+      if (now - holding.lastUpdateTs > stalenessThreshold) {
+        const reason = `${name} holding price is stale (last update ${holding.lastUpdateTs})`;
+        log(`Vault ${vault}: ${reason} \u2014 skipping`);
+        return { result: { ...empty, status: "stale-price", reason } };
+      }
+    }
+    const idleAmount = usdc.localAmount + usdc.externalAmount;
+    const idleValue = holdingValue2(usdc, idleAmount);
+    const idleBps = Number(idleValue * 10000n / tvl);
+    const base = { ...empty, idleValue, idleBps };
+    log(
+      `Vault ${vault}: idle USDC ${formatUi2(
+        idleAmount,
+        usdc.decimals
+      )} = ${idleBps}bps of TVL (floor ${IDLE_RESERVE_FLOOR_BPS}bps, target ${IDLE_RESERVE_TARGET_BPS}bps)`
+    );
+    if (idleBps >= IDLE_RESERVE_FLOOR_BPS) {
+      const reason = `idle USDC ${idleBps}bps is at or above the ${IDLE_RESERVE_FLOOR_BPS}bps floor`;
+      return { result: { ...base, status: "above-floor", reason } };
+    }
+    for (const [name, holding] of [
+      ["USDC", usdc],
+      ["PST", pst]
+    ]) {
+      if (holding.lastRebalanceTs !== 0 && now < holding.lastRebalanceTs + ASSET_REBALANCE_COOLDOWN_SECS) {
+        const reason = `${name} holding is in its rebalance cooldown until ${holding.lastRebalanceTs + ASSET_REBALANCE_COOLDOWN_SECS}`;
+        log(`Vault ${vault}: ${reason} \u2014 skipping`);
+        return { result: { ...base, status: "rebalance-cooldown", reason } };
+      }
+    }
+    const targetValue = tvl * BigInt(IDLE_RESERVE_TARGET_BPS) / 10000n;
+    let shortfallValue = targetValue - idleValue;
+    const allowance = this.remainingRebalanceAllowance(vaultState, tvl, now);
+    if (allowance !== void 0 && allowance < shortfallValue) {
+      if (allowance === 0n) {
+        const reason = "rolling rebalance limit is exhausted for this window";
+        log(`Vault ${vault}: ${reason} \u2014 skipping`);
+        return { result: { ...base, status: "rebalance-limit", reason } };
+      }
+      log(
+        `Vault ${vault}: rolling rebalance limit caps this run at ${allowance} of ${shortfallValue} accounting units`
+      );
+      shortfallValue = allowance;
+    }
+    const shortfallUsdc = shortfallValue * 10n ** BigInt(usdc.decimals) / usdc.price;
+    if (shortfallUsdc <= 0n) {
+      const reason = "computed shortfall rounds to zero";
+      return { result: { ...base, status: "above-floor", reason } };
+    }
+    if (pst.localAmount === 0n) {
+      const reason = "vault holds no local PST";
+      log(`Vault ${vault}: ${reason} \u2014 skipping`);
+      return {
+        result: { ...base, shortfallUsdc, status: "insufficient-pst", reason }
+      };
+    }
+    return { usdc, pst, base: { ...base, shortfallUsdc } };
+  }
+  /**
+   * Value still chargeable against the vault's rolling rebalance window, in
+   * accounting units. `undefined` when the cap is disabled (unlimited).
+   */
+  remainingRebalanceAllowance(vaultState, tvl, now) {
+    const limit = vaultState.accounting?.rebalanceLimit;
+    const bps = Number(toBigInt4(limit?.windowLimitBps));
+    if (!limit || bps === 0) return void 0;
+    const windowStartTs = Number(toBigInt4(limit.windowStartTs));
+    const windowDuration = Number(toBigInt4(limit.windowDurationSeconds));
+    const consumed = windowStartTs === 0 || now >= windowStartTs + windowDuration ? 0n : toBigInt4(limit.valueInWindow);
+    const ceiling = tvl * BigInt(bps) / 10000n;
+    return ceiling > consumed ? ceiling - consumed : 0n;
+  }
+  /**
+   * PST input that buys `shortfallUsdc` at the holdings' recorded prices.
+   * Both prices share the vault's accounting unit, so this is a straight
+   * value conversion; slippage is absorbed by landing slightly under target.
+   */
+  sizePstInput(shortfallUsdc, usdc, pst) {
+    const shortfallValue = holdingValue2(usdc, shortfallUsdc);
+    return shortfallValue * 10n ** BigInt(pst.decimals) / pst.price;
+  }
+  stalenessThresholdSecs(vaultState) {
+    const configured = Number(
+      toBigInt4(
+        vaultState.config?.priceStalenessThresholdSecs
+      )
+    );
+    return configured > 0 ? configured : DEFAULT_PRICE_STALENESS_THRESHOLD_SECS;
+  }
+  // ── Execution ───────────────────────────────────────────────────────────
+  /**
+   * Token program owning a mint. Read from the chain rather than from the
+   * holding's enum so a Token-2022 mint can never be passed to the classic
+   * program (and vice versa).
+   */
+  async mintTokenProgram(mint) {
+    const account = await this.client.provider.connection.getAccountInfo(
+      new import_web329.PublicKey(mint),
+      "confirmed"
+    );
+    if (!account) throw new Error(`Mint account not found: ${mint}`);
+    if (!account.owner.equals(import_spl_token19.TOKEN_PROGRAM_ID) && !account.owner.equals(import_spl_token19.TOKEN_2022_PROGRAM_ID)) {
+      throw new Error(
+        `Unsupported token program ${account.owner.toBase58()} for mint ${mint}`
+      );
+    }
+    return (0, import_common51.fromWeb3Pk)(account.owner);
+  }
+  /**
+   * Build, simulate, and (unless `dryRun`) submit the `jupiter_swap`.
+   *
+   * Built as a versioned transaction here rather than through
+   * `client.sendTransaction`, because a Jupiter route needs address lookup
+   * tables and a raised compute-unit limit to fit.
+   */
+  async executeSwap(params) {
+    const {
+      vault,
+      vaultState,
+      hwManager,
+      jupiter,
+      quote,
+      cuPriceMicroLamports,
+      dryRun,
+      log
+    } = params;
+    const signer = (0, import_common51.fromWeb3Pk)(hwManager.publicKey);
+    const [sourceTokenProgram, destinationTokenProgram] = await Promise.all([
+      this.mintTokenProgram(import_common51.PST_MINT),
+      this.mintTokenProgram(import_common51.USDC_MINT)
+    ]);
+    const jupiterCpi = await jupiter.getSwapCpiData(quote, vault, {
+      payer: signer
+    });
+    const { accounts: accounts2, refs, lookupTables } = (0, import_common51.createCpiRefs)([jupiterCpi]);
+    const vaultTrancheState = coerceBool4(
+      vaultState.tranchingEnabled
+    ) ? (await this.client.pda.deriveVaultTrancheStatePda(vault))[0] : void 0;
+    const plan = await this.client.tx.jupiterSwap.getTx({
+      hwManager: signer,
+      vault,
+      sourceMint: import_common51.PST_MINT,
+      destinationMint: import_common51.USDC_MINT,
+      refs,
+      accounts: accounts2,
+      sourceTokenProgram,
+      destinationTokenProgram,
+      vaultTrancheState,
+      lookupTables
+    });
+    const connection = this.client.provider.connection;
+    const instructions2 = [
+      import_web329.ComputeBudgetProgram.setComputeUnitLimit({ units: COMPUTE_UNIT_LIMIT }),
+      ...cuPriceMicroLamports > 0 ? [
+        import_web329.ComputeBudgetProgram.setComputeUnitPrice({
+          microLamports: cuPriceMicroLamports
+        })
+      ] : [],
+      ...(jupiterCpi.preInstructions ?? []).map(import_common51.fromKitInstruction),
+      ...plan.instructions.map(import_common51.fromKitInstruction)
+    ];
+    const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash("confirmed");
+    const lookupTableAccounts = await (0, import_common51.fetchLookupTables)(
+      connection,
+      plan.lookupTables ?? []
+    );
+    const message2 = new import_web329.TransactionMessage({
+      payerKey: hwManager.publicKey,
+      recentBlockhash: blockhash,
+      instructions: instructions2
+    }).compileToV0Message(lookupTableAccounts);
+    const transaction = new import_web329.VersionedTransaction(message2);
+    transaction.sign([hwManager]);
+    const simulation = await connection.simulateTransaction(transaction, {
+      sigVerify: true,
+      commitment: "confirmed"
+    });
+    if (simulation.value.err) {
+      for (const line of simulation.value.logs ?? []) log(`  | ${line}`);
+      throw new Error(
+        `simulation failed: ${JSON.stringify(simulation.value.err)}`
+      );
+    }
+    log(
+      `Vault ${vault}: simulation OK (${simulation.value.unitsConsumed ?? "?"} CU)`
+    );
+    if (dryRun) {
+      log(`Vault ${vault}: dry run \u2014 transaction NOT submitted`);
+      return {};
+    }
+    const signature = await connection.sendRawTransaction(
+      transaction.serialize(),
+      { skipPreflight: false, maxRetries: 5 }
+    );
+    const confirmation = await connection.confirmTransaction(
+      { signature, blockhash, lastValidBlockHeight },
+      "confirmed"
+    );
+    if (confirmation.value.err) {
+      throw new Error(
+        `transaction ${signature} failed: ${JSON.stringify(
+          confirmation.value.err
+        )}`
+      );
+    }
+    this.client.applyCacheInvalidations(plan);
+    log(`Vault ${vault}: swap tx ${signature}`);
+    return { signature };
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ASSET_DECIMALS,
+  ASSET_REBALANCE_COOLDOWN_SECS,
   AccountClient,
   ActivateCircuitBreakerBuilder,
   CONSENSUS_ORACLE_VARIANT,
@@ -23710,15 +24375,20 @@ var ExternalLiquidityIntegrityService = class {
   CreateAssetHoldingBuilder,
   CreateTrancheStateBuilder,
   CreateVaultBuilder,
+  DEFAULT_CU_PRICE_MICRO_LAMPORTS,
   DEFAULT_JUNIOR_EARLY_UNSTAKE_FEE_BPS,
   DEFAULT_JUNIOR_STANDARD_UNSTAKE_FEE_BPS,
   DEFAULT_JUNIOR_WITHDRAWAL_LOCKUP_SECS,
   DEFAULT_MAX_ACCEPTABLE_APY_BPS,
+  DEFAULT_MAX_ACCOUNTS,
   DEFAULT_MIN_AMOUNT_UI,
   DEFAULT_ORACLE_STALENESS_THRESHOLD_SECS,
   DEFAULT_PRICE_ORACLE_ACCOUNT,
   DEFAULT_PRICE_STALENESS_SECS,
   DEFAULT_PRICE_STALENESS_THRESHOLD_SECS,
+  DEFAULT_REBALANCE_BAND_BPS,
+  DEFAULT_SLIPPAGE_BPS,
+  DEFAULT_TARGET_LOCAL_BPS,
   DEFAULT_VAULT_ID,
   DisableCircuitBreakerBuilder,
   EXTERNAL_POSITION_SAMPLES,
@@ -23732,6 +24402,9 @@ var ExternalLiquidityIntegrityService = class {
   FEE_VAULT_CACHE_CATEGORY,
   FulfillJuniorTrancheWithdrawBuilder,
   IDL,
+  IDLE_RESERVE_FLOOR_BPS,
+  IDLE_RESERVE_TARGET_BPS,
+  IdleLiquidityService,
   InitializeVaultRolesBuilder,
   JupiterBalanceSource,
   JupiterPriceSource,
@@ -23845,6 +24518,7 @@ var ExternalLiquidityIntegrityService = class {
   mintTokensTo,
   mostFrequent,
   parseExternalLiquidityRefs,
+  planRebalance,
   prepareVaultTransaction,
   priceInAccountingUnit,
   readI64LE,