Get started

covr for market makers

covr lets people earn on JitoSOL by selling covered calls. A holder picks a sell price (the strike) and a date. They lock their JitoSOL and get paid USDC upfront. Market makers buy those calls.

These docs are for desks that want to buy those calls. They cover:

• the @covrfun/maker-sdk TypeScript package;
• covr's RFQ gateway, where desks bid;
• the on-chain program, where every trade settles.

#How a trade works

1. A customer asks for a quote: sell 1 JitoSOL at $180 by 30 October.
2. covr's gateway sends that request (an RFQ) to every connected desk.
3. Desks send a sealed, signed bid within 3 seconds. The highest price wins.
4. The winner signs an executable quote. The customer signs the fill on Solana.
5. The program takes the premium from the desk's USDC vault, pays it to the customer minus covr's fee, and locks the customer's JitoSOL.
6. At expiry the desk decides. If JitoSOL is above the strike, the desk exercises: it pays the strike in USDC and receives the JitoSOL. If not, the JitoSOL goes back to the customer.

On each position the most a desk can lose is the premium it paid. It needs the premium in its vault at fill and the strike at exercise. Capital and settlement has the full money flow.

#What the SDK does

The SDK builds instructions, signs gateway messages and speaks the gateway's WebSocket protocol. It does not price, hold keys, pick an RPC or submit transactions. Those stay with you.

Every function wraps covr's own reviewed code. covr's tests check that each builder emits the same bytes as covr's own builders. They also check that each signed message passes the gateway's verifiers. The package ships golden vectors, so you can check your own signer the same way.

#Status

#Where to start

Get started

Quickstart

Go from nothing to watching real RFQs arrive. You register your maker on chain, get a gateway token from covr, and run the example bot in dry-run mode. Dry run signs bids locally and sends nothing.

Time: about 30 minutes, plus covr's reply with your token.

#What you need

#1. Choose your keys

#2. Install

Start in a new, empty folder.

mkdir covr-maker && cd covr-maker
npm init -y && npm pkg set type=module
npm install @covrfun/maker-sdk ethers@6.17.0 @solana/kit@8.2.0 @solana-program/token@0.16.1
npm install -D tsx@4.20.6

#3. Check your signer

Before your keys sign anything, prove your signing stack matches covr's. The package ships signed test vectors made with a public throwaway key. Digests must match exactly, and each signature must recover to the vector key. Custom signers has a script that checks both.

#4. Register your maker

Registration is one transaction. Your quote key signs a grant and your authority sends it. You need three small files.

keys.ts loads your two keys:

import { readFile } from 'node:fs/promises';
import { Wallet } from 'ethers';
import { createKeyPairSignerFromBytes } from '@solana/kit';

// Your Solana authority: a keypair JSON file in the solana-keygen format.
export const authority = await createKeyPairSignerFromBytes(
  Uint8Array.from(JSON.parse(await readFile(process.env.AUTHORITY_KEYPAIR!, 'utf8'))),
);

// Your quote key. A Wallet keeps this short. In production, use a KMS adapter (see Custom signers).
export const quoteSigner = new Wallet(process.env.MAKER_QUOTE_KEY!);

send.ts signs instructions with your authority and waits for finalized:

// send.ts: one helper the guides reuse. Your authority pays fees and signs.
import {
  appendTransactionMessageInstructions, createSolanaRpc, createSolanaRpcSubscriptions,
  createTransactionMessage, getSignatureFromTransaction, pipe, sendAndConfirmTransactionFactory,
  setTransactionMessageFeePayerSigner, setTransactionMessageLifetimeUsingBlockhash,
  signTransactionMessageWithSigners, assertIsTransactionWithBlockhashLifetime,
  type Instruction, type KeyPairSigner,
} from '@solana/kit';

const rpc = createSolanaRpc(process.env.RPC_URL!);
const rpcSubscriptions = createSolanaRpcSubscriptions(process.env.RPC_WS_URL!);
const sendAndConfirm = sendAndConfirmTransactionFactory({ rpc, rpcSubscriptions });

export async function send(authority: KeyPairSigner, ...instructions: Instruction[]) {
  const { value: blockhash } = await rpc.getLatestBlockhash({ commitment: 'finalized' }).send();
  const message = pipe(
    createTransactionMessage({ version: 0 }),
    m => setTransactionMessageFeePayerSigner(authority, m),
    m => setTransactionMessageLifetimeUsingBlockhash(blockhash, m),
    m => appendTransactionMessageInstructions(instructions, m),
  );
  const tx = await signTransactionMessageWithSigners(message);
  assertIsTransactionWithBlockhashLifetime(tx);
  await sendAndConfirm(tx, { commitment: 'finalized' });
  return getSignatureFromTransaction(tx);
}

register.ts registers your maker:

import { signRegistrationGrant, registerMakerV3 } from '@covrfun/maker-sdk';
import { authority, quoteSigner } from './keys.ts';
import { send } from './send.ts';

const makerEthAddress = quoteSigner.address;

// The quote key grants your authority the right to register it. Checked locally before sending.
const grant = await signRegistrationGrant(quoteSigner, authority.address);
const { maker, instruction } = await registerMakerV3({
  authority: authority.address, makerEthAddress, signature: grant.signature,
});
console.log('registered', { maker, makerEthAddress, authority: authority.address }, await send(authority, instruction));

Run it:

AUTHORITY_KEYPAIR=./authority.json MAKER_QUOTE_KEY=0x<quote private key> \
RPC_URL=https://<your rpc> RPC_WS_URL=wss://<your rpc> \
npx tsx register.ts

#5. Get your gateway token

Send covr:

• your quote key address (0x…);
• your Solana authority address.

covr checks your Maker account on chain and sends you the gateway URL and a bearer token. Keep the token secret.

#6. Dry run the example bot

Copy the bot out of the package and run it. With no MAKER_QUOTE_KEY it signs with a throwaway key and only logs.

cp -r node_modules/@covrfun/maker-sdk/examples/maker ./maker
GATEWAY_WS_URL=wss://<provided by covr> \
GATEWAY_TOKEN=<your token> \
RPC_URL=https://<your rpc> \
SPREAD_BPS=500 \
npx tsx maker/index.ts

For each JitoSOL RFQ the bot reads the RFQ and its market, prices it with a placeholder, signs a bid and logs it:

DRY_RUN would send bid_intent {"auctionId":"…","maker":"0x…","price":"…", …}

Note one market address from these lines. You need it for the mint policy in setup.

If the socket closes straight away, check the close code:

#Next steps

1. Register and fund: finish setup steps 2 to 8.
2. Replace the pricing stub: referencePremiumE18() in maker/index.ts.
3. Run the example bot live, in practice mode.
4. Work through the Go-live checklist.

Concepts

How an RFQ works

Every covr order is a short sealed-bid auction. A customer asks for a price. Desks bid. The best bid wins and signs a quote the customer can fill on chain.

#The parties

#Timeline of one RFQ

Customer            Gateway                  Desk                     Program
   │  ask for quote     │                        │                          │
   ├───────────────────►│   rfq (feed)           │                          │
   │                    ├───────────────────────►│                          │
   │                    │◄───────────────────────┤ GET /api/rfqs/<id>       │
   │                    │◄───────────────────────┤ bid_intent (signed)      │
   │                    │  collect 3 s, rank     │                          │
   │                    ├───────────────────────►│ award (best price only)  │
   │                    │◄───────────────────────┤ quote (signed, nonce)    │
   │◄───────────────────┤  executable quote      │                          │
   ├─────────────────────────────────────────────────────────────────────►│ fill_v3 (customer signs)
   │                    │                        │   premium from desk vault, JitoSOL locked
   │                    │   no fill message: the desk watches its position account on chain

#Two signatures, two jobs

A desk signs twice per won order.

1. Bid intent. A sealed bid: price and RFQ terms, signed with your quote key. It commits you to a price but cannot be filled.
2. Quote. Only the winner signs this. It adds a nonce and a validity time and binds the customer's wallet. The program fills against this signature.

Both are EIP-712 typed data in a domain that belongs to that one market. A signature for one market never verifies on another. See Signing and nonces.

#Answer every award

If you win, answer within the award window. Send either a quote or an award_decline.

• A decline, a disconnect or any failed quote passes the award to the next-best bid at once.
• A silent winner holds the award until the 6 s deadline. The customer then gets no quote.

#"OK" is not a fill

When the gateway accepts your quote it replies "OK". That only means the customer can now see it. The customer may never sign. No fill message follows. A fill shows up only on chain, as your position account. See Fills and exercise.

#Practice mode

Until covr lists your desk on its markets, the gateway checks your bids and then refuses them with:

Bid intent verified but not entered: this market does not list this maker yet

Test the parts practice mode cannot reach yourself: replay awards against your own code, and rehearse exercise with the exercise guide. See also Gateway: practice mode.

#Next

• Capital and settlement: what your vault pays, and when.
• Gateway messages: every field of every message.

Concepts

Capital and settlement

Your desk holds USDC in one vault on chain. The program takes the premium from it when an order fills. It takes the strike from it only if you exercise. Nothing is escrowed per position.

#Money flow of one position

#The formulas

All amounts are integers in atoms, a token's smallest unit. USDC has 6 decimals (1 USDC = 10^6 atoms). JitoSOL has 9 (1 JitoSOL = 10^9 atoms).

priceE18 is USDC per one whole token, scaled by 10^18. strikeE8 is USD per token, scaled by 10^8. Gross premium and strike payment must both come out as whole USDC atoms. If they don't, the program refuses the fill. Use exactPriceAtOrBelow to round your price down to one that pays exactly.

#Worked example

A customer sells 1 JitoSOL at a $180 strike. You bid 3.40 USDC per token. The market fee is 10% (feeBps = 1000).

import { grossPremium, fee, writerPremium, strikePayment } from '@covrfun/maker-sdk';

const atoms = 1_000_000_000n;                 // 1 JitoSOL
const priceE18 = 3_400_000_000_000_000_000n;  // 3.40 USDC per token
const strikeE8 = 18_000_000_000n;             // $180

const gross = grossPremium(atoms, priceE18, 9); // 3_400_000n   = 3.40 USDC leaves your vault at fill
fee(gross, 1000);                               // 340_000n     = 0.34 USDC to the fee owner
writerPremium(gross, 1000);                     // 3_060_000n   = 3.06 USDC to the customer
strikePayment(atoms, strikeE8, 9);              // 180_000_000n = 180 USDC if you exercise
console.log(gross, fee(gross, 1000), writerPremium(gross, 1000), strikePayment(atoms, strikeE8, 9));

Break-even is strike plus premium per token. The most you can lose on a position is the premium.

#What your vault must hold

The program does not set the strike aside when a position opens. You decide how much strike to cover:

• Fully funded. Keep every open strike in the vault. Simple and safe.
• Just in time. Keep premiums in the vault and top it up before you exercise. Positions on one market all expire together, and the exercise window is 60 to 3,600 seconds, so plan the top-up ahead.

#Limits you set on yourself

Six on-chain limits cap your risk. You set all of them with your authority.

A fill that would break any limit fails on chain. Change the exposure limit later with setExposureLimit, and the mint policy with updateMintPolicyV1.

The program adds one limit of its own: one JitoSOL fill can be worth at most 2 SOL of stake-pool value. On 15 October 2026 the pool rate was 1.306 SOL per JitoSOL, so the cap was 1.53 JitoSOL. It shrinks as JitoSOL earns staking yield. Larger fills fail with JitoSolOrderLimit.

#Next

• Register and fund: set these up on chain.
• Fills and exercise: detect fills and exercise in time.

Concepts

Signing and nonces

Your desk has two keys. Keep them apart.

The quote key never touches SOL or USDC directly. The authority owns your accounts and your vault. You can also name an operator: a second Solana key that may exercise for you without holding the authority.

#EIP-712, one domain per market

Every message is EIP-712 typed data. The domain is:

The verifyingContract commits to every term of the market: program, deployment, collateral, strike, expiry, fee and more. So a bid or quote signed for one market can never be replayed on another. Always build the domain from the market account you read yourself:

import { decodeMarketV3, quoteDomain } from '@covrfun/maker-sdk';

const market = await decodeMarketV3(marketAddress, rawAccountBytes); // read at finalized, owner checked
const domain = quoteDomain(market);

#Low-s signatures only

The program rejects a signature whose s value is in the upper half of the curve order. signIntent, signQuote and signRegistrationGrant check this for you. If you sign another way, run assertCanonicalSignature on the result. Most libraries already produce low-s signatures.

#Nonces

Every quote carries a nonce: an unsigned 64-bit integer you choose. The nonce names the position the quote can open. Your position account address is derived from your quote key and that nonce. So each nonce can open at most one position, ever, across all markets.

The program accepts a quote only when:

nonce >= min_nonce  and  nonce != 2^64 - 1

min_nonce lives in your Maker account. Read it with decodeMaker.

#Rules for a safe nonce journal

1. Never reuse a nonce. Keep a counter that only goes up.
2. Write before you sign. Before you sign a quote, durably record its nonce, its full terms and the cash it could cost. Use fsync or a database commit.
3. Start at or above min_nonce. On startup, read your Maker account and start at the larger of your journal and min_nonce.
4. One writer per journal. Two processes on one journal will hand out the same nonce.

The example bot does all four. It keeps an append-only JSON-lines journal and takes a lock file. See Run the example bot.

#Unknown outcomes

A quote request that times out may still have reached the gateway. The same holds for a socket that dies while sending it. The SDK reports these as OutcomeUnknownError, never as "not sent".

Treat that quote as live until one of these is true:

• your position account for that nonce exists (it filled), or
• its validUntil has passed and no fill landed.

Keep its cash held until then. The SDK also refuses any further request for that RFQ, so a late reply cannot be mistaken for a new one.

#Cancelling signed quotes

The gateway has no withdrawal route for desks. You stop quotes on chain, two ways:

• Pause your mint policy. Every fill on that mint fails until you re-enable it. Your authority or a hot watcher key can do it.
• Raise min_nonce with configureMaker. Every quote below the new floor can never fill. The floor never goes down.

configureMaker sets both operator and minNonce. Pass your current operator to keep it. See Cancel quotes.

Concepts

Markets

A market is one on-chain account that fixes every term of a covered call except size and price.

#Market terms

#Reading a market

Each RFQ names its market address. Read the account yourself at finalized commitment, check its owner is the covr program, then decode it:

import { PROGRAM_ID, decodeMarketV3 } from '@covrfun/maker-sdk';
import { address, createSolanaRpc } from '@solana/kit';

const rpc = createSolanaRpc(process.env.RPC_URL!);
const { value } = await rpc
  .getAccountInfo(address(marketAddress), { commitment: 'finalized', encoding: 'base64' })
  .send();
if (!value || value.owner !== PROGRAM_ID) throw Error('not a covr market');
const market = await decodeMarketV3(marketAddress, Buffer.from(value.data[0], 'base64'));
if (market.settlementMode !== 0 || market.paused) return; // skip

decodeMarketV3 checks the layout, the mainnet genesis hash, USDC as payment, covr's deployment id, and that the address is the right PDA for its creator and salt.

There is no market list for desks. You learn about a market from the RFQ that names it.

#Size rules

RFQ quantities arrive as decimal strings scaled to 18 decimals. Convert with atomsFromWire(quantity, decimals). Each quantity is a multiple of the market's minimum lot (minimumExactLot), so the strike payment is always a whole USDC atom.

#Creating markets

Any wallet can create a market with createMarketV3. The program checks:

• expiry is 60 seconds to 90 days away;
• the window is 60 to 3,600 seconds;
• the fee is at most 1,000 bps.

Guides

Register and fund

Set up your maker on chain. Your Solana authority signs every step and pays the rent. Do this once.

Before you start:

• You registered in the Quickstart (step 1).
• Your authority holds about 0.02 SOL for rent and fees.
• Your authority's USDC associated token account holds what you want to deposit.
• You have one covr JitoSOL market address, from a dry-run RFQ.

#The steps

Send one step at a time. Each send waits for finalized before the next.

#Environment

The setup script reuses keys.ts and send.ts from the Quickstart and reads:

Deposits come from your authority's USDC associated token account.

#Steps 2 to 8

Save as setup.ts and run it with npx tsx setup.ts. The amounts are examples. Each step creates an account once: if a later step fails, comment out the steps that already landed before you run it again. Pick your own limits. All amounts are in atoms, the token's smallest unit: 1 JitoSOL is 10^9 atoms and 1 USDC is 10^6 atoms.

import {
  JITOSOL_MINT, PROGRAM_ID, TOKEN_PROGRAM, USDC_MINT,
  initializeVault, initializeExposureV3, decodeMarketV3, mintPolicySettingsFor,
  initializeMintPolicyV1, bootstrapMintUsageV1, setPremiumBudget, deposit, decodeMaker, deriveMaker,
} from '@covrfun/maker-sdk';
import { createSolanaRpc, address } from '@solana/kit';
import { findAssociatedTokenPda, getCreateAssociatedTokenIdempotentInstructionAsync } from '@solana-program/token';
import { authority, quoteSigner } from './keys.ts';
import { send } from './send.ts';

const rpc = createSolanaRpc(process.env.RPC_URL!);
const makerEthAddress = quoteSigner.address;
const anyJitoSolMarket = process.env.MARKET!;  // a covr JitoSOL market, from an RFQ in your dry run
const watcher = process.env.WATCHER;           // a hot key that may pause your mint policy
if (!watcher) throw Error('WATCHER is required: a hot key that can pause this policy (changing it later needs an authority-signed updateMintPolicyV1)');
const [usdcSource] = await findAssociatedTokenPda({      // your authority's USDC account
  owner: authority.address, mint: address(USDC_MINT), tokenProgram: address(TOKEN_PROGRAM),
});
const { maker } = await deriveMaker(makerEthAddress);
const jitoSol = { mint: JITOSOL_MINT, program: TOKEN_PROGRAM, decimals: 9 };

// 2. USDC vault. Its premium budget starts disabled, which means no cap.
const { vault, instruction: openVault } = await initializeVault({ authority: authority.address, maker });
await send(authority, openVault);

// 3. Exposure: cap on open JitoSOL atoms across all markets (here 5 JitoSOL).
const { instruction: exposure } = await initializeExposureV3({
  authority: authority.address, makerEthAddress, collateral: jitoSol, limitAtoms: 5_000_000_000n,
});
await send(authority, exposure);

// 4. Mint policy, bound to the terms of any JitoSOL market.
const acct = await rpc.getAccountInfo(address(anyJitoSolMarket), { commitment: 'finalized', encoding: 'base64' }).send();
if (!acct.value || acct.value.owner !== PROGRAM_ID) throw Error('not a covr market');
const market = await decodeMarketV3(anyJitoSolMarket, Buffer.from(acct.value.data[0], 'base64'));
const settings = mintPolicySettingsFor(market, {
  watcher,
  maxOrderAtoms: 1_000_000_000n,         // 1 JitoSOL per fill
  maxReservedAtoms: 5_000_000_000n,      // 5 JitoSOL open at once
  maxReservedStrikeUsdc: 1_000_000_000n, // 1,000 USDC of strikes open at once
});
const { instruction: policy } = await initializeMintPolicyV1({
  authority: authority.address, maker, collateral: JITOSOL_MINT, settings,
});
await send(authority, policy);

// 5. Bootstrap usage. Fills on this mint fail until this runs.
const { instruction: bootstrap } = await bootstrapMintUsageV1({
  authority: authority.address, makerEthAddress, collateral: JITOSOL_MINT,
});
await send(authority, bootstrap);

// 6. Optional: lifetime cap on gross premium paid (here 500 USDC).
const { instruction: budget } = await setPremiumBudget({
  authority: authority.address, maker, enabled: true, limit: 500_000_000n,
});
await send(authority, budget);

// 7. Fund the vault (here 1,000 USDC).
const { instruction: fund } = await deposit({ authority: authority.address, maker, source: usdcSource, amount: 1_000_000_000n });
await send(authority, fund);

// 8. Your JitoSOL token account, owned by the authority. Exercise delivers here.
await send(authority, await getCreateAssociatedTokenIdempotentInstructionAsync({
  payer: authority, owner: authority.address, mint: address(JITOSOL_MINT),
}));

// Check: read your Maker account back.
const makerAcct = await rpc.getAccountInfo(maker, { commitment: 'finalized', encoding: 'base64' }).send();
if (!makerAcct.value || makerAcct.value.owner !== PROGRAM_ID) throw Error('maker account missing');
const decoded = await decodeMaker(maker, Buffer.from(makerAcct.value.data[0], 'base64'), makerEthAddress);
console.log({ maker, vault, minNonce: decoded.minNonce, authority: decoded.authority });

#Why the mint policy needs a market

A mint policy is bound to two values that every covr JitoSOL market shares:

• the terms id, which names the settlement rules (ordinary markets all share one);
• the profile hash, a fingerprint of the JitoSOL mint and its settings.

mintPolicySettingsFor copies both from the market you pass. Any covr JitoSOL market works.

#Check your setup

• decodeMaker returns your authority and minNonce 0.
• Your vault holds the USDC you deposited.

Your desk is now ready for practice mode.

#Next

• Cancel quotes: know how to stop before you start.
• Run the example bot live, in practice mode.

Guides

Run the example bot

The package ships a complete example maker. It listens to the JitoSOL feed, bids, answers awards, journals every quote and reconciles fills on chain. Use it to learn the flow, then build your own or harden it.

#Settings

#From dry run to practice mode

1. Finish Register and fund.
2. Replace referencePremiumE18() in maker/index.ts with your model.
3. Run with your quote key and a journal:

GATEWAY_WS_URL=wss://<provided by covr> GATEWAY_TOKEN=<your token> \
RPC_URL=https://<your rpc> SPREAD_BPS=500 \
MAKER_QUOTE_KEY=0x<your quote key> NONCE_JOURNAL=./quotes.jsonl \
DRY_RUN=0 npx tsx maker/index.ts

Until covr lists your desk, each bid comes back as:

Bid intent verified but not entered: this market does not list this maker yet

That means your token, signature, terms and asset all passed. Practice mode stops there: it never tests the bid deadline, awards, quotes, your journal or exercise. See Practice mode. Once covr lists your desk, the same bot starts winning.

#What it does for each RFQ

1. Reads GET /api/rfqs/<id> and checks the RFQ matches the feed.
2. Reads the market from your RPC, checks the owner and skips paused or stock markets.
3. Signs a bid intent in that market's domain and sends it.
4. On an award, checks the intent equals the one it signed. It declines at once if not, or if less than 500 ms of the award window is left.
5. Journals the nonce, the full quote terms and the cash at risk, and fsyncs. Only then it signs and sends the quote.
6. Every 5 seconds, checks each open quote on chain and journals the result.

#The journal and its lock

In live mode the bot writes one JSON line per event: reserve, signed, sent, settled. On restart it reads the journal back, lists every open quote and never reuses a nonce. A line it cannot read stops it.

It also takes <NONCE_JOURNAL>.lock. A second live bot on the same journal refuses to start. A clean stop (Ctrl-C or SIGTERM) removes the lock. After a crash the lock stays on purpose: make sure no other bot uses the journal, then delete it.

#Reconnects

The bot reconnects with capped exponential backoff and jitter: 1 second, doubling to 30. Bids from the old connection are dropped. Signed quotes keep being checked on chain.

Guides

Fills and exercise

The gateway never tells you about a fill. You find fills on chain. Then, at expiry, you exercise the positions that are worth it before the window closes.

#Find your fills

Each quote opens at most one position. Its address comes from your quote key and the quote's nonce:

import { derivePosition, JITOSOL_MINT } from '@covrfun/maker-sdk';

const { position } = await derivePosition(makerEthAddress, nonce, JITOSOL_MINT);

For every quote in your journal, read that address at finalized commitment:

Read the position and your Maker account in one getMultipleAccounts call, so both come from the same slot. decodePositionV3 trusts the slot you pass; it cannot tell if the two reads came from different slots.

#Exercise

Exercising pays the strike and delivers the JitoSOL, so it only makes sense when JitoSOL is worth more than the strike. The premium is already spent either way. The decision is yours; the rules are fixed by the market:

Every position on a market expires at the same moment. Fund the vault for all strikes you plan to pay before expiry, and leave time to land every transaction inside the window.

#Customer token accounts

The exercise pays the customer into their token accounts. The program refuses a customer account that someone else could control: one with a delegate, or with a close authority other than the customer. The customer controls their own accounts and could change or close one to block your exercise. So the exercise creates fresh token accounts for the customer, owned by the customer, in the same transaction. covr's own maker does the same.

#Full example

exerciseV3Instructions returns the whole transaction body, in order:

1. a compute-unit limit of 400,000 (the default 200,000 is not enough);
2. two fresh customer token accounts (USDC and JitoSOL);
3. exercise_v3, paying the strike from your vault and sending the JitoSOL to your authority's token account (setup step 8).

Do not add a second compute-unit limit: the transaction would be refused. You may add a priority fee.

The job signs with one key: your authority or your operator. It needs no quote key. Save this as signer.ts next to send.ts:

import { readFile } from 'node:fs/promises';
import { createKeyPairSignerFromBytes } from '@solana/kit';

// The one key this job signs with: your authority, your operator (exercise) or your watcher (pause).
// It needs no quote key, so an exercise or pause box never holds one.
export const signer = await createKeyPairSignerFromBytes(
  Uint8Array.from(JSON.parse(await readFile(process.env.SIGNER_KEYPAIR!, 'utf8'))),
);

Then exercise.ts:

import {
  PROGRAM_ID, WRITER_ACCOUNT_SPACE,
  deriveMaker, derivePosition, decodeMarketV3, decodePositionV3, exerciseV3Instructions,
} from '@covrfun/maker-sdk';
import { address, createSolanaRpc } from '@solana/kit';
import { signer } from './signer.ts'; // your authority or your operator
import { send } from './send.ts';

const rpc = createSolanaRpc(process.env.RPC_URL!);
const makerEthAddress = process.env.MAKER_ETH_ADDRESS!; // your quote key's 0x address
const makerAuthority = process.env.MAKER_AUTHORITY!;    // your authority's address, pinned in config
const nonce = BigInt(process.env.NONCE!);               // this position's nonce, from your journal
const marketAddress = process.env.POSITION_MARKET!;     // this position's market, from your journal
const b64 = (data: readonly [string, string]) => Buffer.from(data[0], 'base64');

// 1. Read the market, then the position and your Maker account in ONE finalized call.
const m = await rpc.getAccountInfo(address(marketAddress), { commitment: 'finalized', encoding: 'base64' }).send();
if (!m.value || m.value.owner !== PROGRAM_ID) throw Error('not a covr market');
const market = await decodeMarketV3(marketAddress, b64(m.value.data));
const { maker } = await deriveMaker(makerEthAddress);
const { position } = await derivePosition(makerEthAddress, nonce, market.collateral);
const { context, value } = await rpc
  .getMultipleAccounts([position, maker], { commitment: 'finalized', encoding: 'base64' })
  .send();
const [posAcct, makerAcct] = value;
if (!posAcct || !makerAcct || posAcct.owner !== PROGRAM_ID || makerAcct.owner !== PROGRAM_ID)
  throw Error('position not found: this quote did not fill, or the position is closed');
const decoded = await decodePositionV3({
  position: { address: position, data: b64(posAcct.data) },
  maker: { address: maker, data: b64(makerAcct.data) },
  slot: context.slot, makerEthAddress, makerAuthority, nonce, collateral: market,
});
if (decoded.status !== 'open') throw Error(`position is ${decoded.status}`);

// 2. One transaction: compute limit, two fresh customer token accounts, exercise_v3.
//    The JitoSOL goes to your authority's token account (setup step 8) by default.
const rent = await rpc.getMinimumBalanceForRentExemption(BigInt(WRITER_ACCOUNT_SPACE), { commitment: 'finalized' }).send();
const { instructions } = await exerciseV3Instructions({
  market, position: decoded, authority: signer.address, rentLamports: rent,
});
console.log('exercised', await send(signer, ...instructions));

Run it once per position, with that position's market and nonce from your journal:

SIGNER_KEYPAIR=./operator.json MAKER_ETH_ADDRESS=0x<quote key address> MAKER_AUTHORITY=<authority address> \
POSITION_MARKET=<this position's market> NONCE=<this position's nonce> \
RPC_URL=https://<your rpc> RPC_WS_URL=wss://<your rpc> npx tsx exercise.ts

With a priority fee added, the transaction is 1,111 bytes at most when the signer also pays the fee, within Solana's 1,232-byte limit. With a separate fee payer it is 1,207 bytes, which leaves no room for a Jito tip.

Each exercise funds two fresh customer token accounts: about 0.003 SOL at current rent, which the customer, not you, can later reclaim.

#Release

If you do not exercise, nothing more is needed from you. After the window closes, anyone can call release_v3. The JitoSOL goes back to the customer, and your exposure and mint usage are freed for new orders. The customer, covr or you can send it.

To free your limits sooner, send it yourself with releaseV3Instructions. Like exercise, it creates a fresh customer-owned JitoSOL account in the same transaction, and sets a 400,000 compute-unit limit.

Guides

Cancel quotes

You have two brakes. Use the pause first. Use the nonce floor when you also need old quotes dead for good.

The gateway has no withdrawal route for desks. These on-chain brakes are how you stop.

#When to use them

• Your pricing went wrong.
• Your quote key may be exposed: see If your quote key leaks. Raising the floor is not enough there.
• The market moved sharply and you want nothing outstanding.

A quote the gateway admits is valid for at most 60 seconds anyway. The brakes are for when you cannot wait 60 seconds.

#Pause the mint policy

The pause is fast and reversible. It can be signed by a watcher: a hot key you name in the policy settings, so your cold authority does not need to be online. Set one with mintPolicySettingsFor(market, { watcher, … }) at setup, or later with an authority-signed updateMintPolicyV1.

Read the policy's current generation first: the pause applies only to the version you read. If another update lands first, re-read and resend.

It signs with one key, your watcher or your authority, using signer.ts from Fills and exercise. Save as pause.ts:

import { JITOSOL_MINT, PROGRAM_ID, TOKEN_PROGRAM, decodeMintPolicy, deriveMaker, deriveMintPolicy, pauseMintPolicyV1 } from '@covrfun/maker-sdk';
import { createSolanaRpc } from '@solana/kit';
import { signer } from './signer.ts'; // your watcher (or your authority)
import { send } from './send.ts';

const rpc = createSolanaRpc(process.env.RPC_URL!);
const makerEthAddress = process.env.MAKER_ETH_ADDRESS!; // your quote key's 0x address
const makerAuthority = process.env.MAKER_AUTHORITY!;    // your authority's address
const { maker } = await deriveMaker(makerEthAddress);
const { policy } = await deriveMintPolicy(maker, JITOSOL_MINT);

// Read the policy's current generation: the pause applies only to the version you read.
// 'confirmed' is fine here: a stale generation only fails with MintPolicyGeneration (6012).
const { value } = await rpc.getAccountInfo(policy, { commitment: 'confirmed', encoding: 'base64' }).send();
if (!value || value.owner !== PROGRAM_ID) throw Error('mint policy missing');
const current = await decodeMintPolicy(policy, Buffer.from(value.data[0], 'base64'), {
  authority: makerAuthority, maker,
  collateral: { mint: JITOSOL_MINT, program: TOKEN_PROGRAM, decimals: 9 },
});

const { instruction } = await pauseMintPolicyV1({
  signer: signer.address, maker, collateral: JITOSOL_MINT, expectedGeneration: current.generation,
});
console.log('paused', await send(signer, instruction));

SIGNER_KEYPAIR=./watcher.json MAKER_ETH_ADDRESS=0x<quote key address> MAKER_AUTHORITY=<authority address> \
RPC_URL=https://<your rpc> RPC_WS_URL=wss://<your rpc> npx tsx pause.ts

To resume, your authority sends updateMintPolicyV1 with the same settings and enabled: true.

#Raise the nonce floor

Raising min_nonce cancels every quote below the new floor, permanently. Only your authority can do it.

Stop your bot (or pause the policy) first. Otherwise a quote signed while you raise the floor can land above it and stay live. Save this as cancel.ts next to keys.ts and send.ts, and run it with NEXT_NONCE=<next nonce from your journal> plus your usual key and RPC variables. configureMaker sets both the operator and the floor, so read the current operator first and pass it back.

import { PROGRAM_ID, configureMaker, decodeMaker, deriveMaker } from '@covrfun/maker-sdk';
import { createSolanaRpc } from '@solana/kit';
import { authority, quoteSigner } from './keys.ts'; // only the authority can call configureMaker
import { send } from './send.ts';

// The next nonce your journal would hand out. Stop your bot (or pause the policy) before reading it.
const nextJournalNonce = BigInt(process.env.NEXT_NONCE!);
const makerEthAddress = quoteSigner.address;

const rpc = createSolanaRpc(process.env.RPC_URL!);
const { maker } = await deriveMaker(makerEthAddress);

// Read the current operator and floor: configureMaker replaces BOTH.
const { value } = await rpc.getAccountInfo(maker, { commitment: 'finalized', encoding: 'base64' }).send();
if (!value || value.owner !== PROGRAM_ID) throw Error('maker account missing');
const current = await decodeMaker(maker, Buffer.from(value.data[0], 'base64'), makerEthAddress);

// Every nonce your journal ever handed out is below nextJournalNonce.
// Raising the floor to it cancels all of them.
const minNonce = nextJournalNonce > current.minNonce ? nextJournalNonce : current.minNonce;
const { instruction } = await configureMaker({
  authority: authority.address,
  makerEthAddress,
  operator: current.operator, // keep the operator; the zero key would revoke it
  minNonce,
});
console.log('floor raised to', minNonce, await send(authority, instruction));

Set the floor to the next nonce your journal would hand out. That cancels everything you have signed and leaves you free to keep quoting, unless your quote key leaked.

#After a raise

1. Sign new quotes only at or above the new floor. The example bot re-reads the floor every 5 seconds and moves its counter up.
2. A quote below the floor may have filled before the raise landed. Keep its cash held until you check its position account. See Fills and exercise.

Guides

Custom signers (KMS and HSM)

Every SDK signing function takes a signer: any object with one method.

interface TypedDataSigner {
  signTypedData(
    domain: TypedDataDomain,
    types: Record<string, TypedDataField[]>,
    value: Record<string, unknown>,
  ): Promise<string>; // 65-byte signature, 0x-hex
}

An ethers Wallet fits as is. For production, keep the quote key in a KMS or HSM and wrap it.

#Wrap a KMS

Most KMS products sign a 32-byte digest and return r and s with no recovery byte. This adapter:

1. hashes the EIP-712 message;
2. asks your KMS to sign the digest;
3. folds s into the lower half, which the program requires;
4. finds the recovery byte by checking which one recovers your quote key.

import { Signature, TypedDataEncoder, recoverAddress, toBeHex, zeroPadValue } from 'ethers';
import { assertCanonicalSignature, type TypedDataSigner } from '@covrfun/maker-sdk';

const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n; // secp256k1 order

/** Wrap any KMS or HSM that signs a 32-byte digest and returns r and s (no v). */
export function kmsSigner(
  quoteKeyAddress: string,
  signDigest: (digest: string) => Promise<{ r: bigint; s: bigint }>,
): TypedDataSigner {
  return {
    async signTypedData(domain, types, value) {
      const digest = TypedDataEncoder.hash(domain, types, value);
      let { r, s } = await signDigest(digest);
      if (s > N / 2n) s = N - s; // the program accepts low-s only
      const rHex = zeroPadValue(toBeHex(r), 32), sHex = zeroPadValue(toBeHex(s), 32);
      for (const v of [27, 28] as const) {
        const signature = Signature.from({ r: rHex, s: sHex, v }).serialized;
        if (recoverAddress(digest, signature).toLowerCase() === quoteKeyAddress.toLowerCase()) {
          assertCanonicalSignature(signature);
          return signature;
        }
      }
      throw Error('KMS signature does not recover to the quote key');
    },
  };
}

signIntent and signQuote check the result again. They refuse a signature that does not recover to the maker named in the message, or one with a high s.

#Prove it with the golden vectors

The package ships vectors/golden-vectors.json. It holds every message type a desk signs, already signed with a public throwaway key:

privateKey = keccak256(utf8("covr-maker-sdk-golden-vectors-v1"))
address    = 0x7B99e6A7407Fe0058119F4f13494C0b9cec35738

Each entry carries standard eth_signTypedData_v4 JSON (domain, types, primaryType, message), the expected digest and the expected signature. Feed the typed data to your stack and compare:

• Digests must match exactly. A different digest means your encoding differs from covr's.
• Signatures match exactly only for deterministic signers (RFC 6979), such as ethers. Many KMS and HSM services pick a random nonce. Their signatures differ from the vectors and are still valid. For those, check that each signature recovers to the vector address and passes assertCanonicalSignature.

import { readFile } from 'node:fs/promises';
import { createRequire } from 'node:module';
import { Wallet, TypedDataEncoder, keccak256, recoverAddress, toUtf8Bytes } from 'ethers';
import { assertCanonicalSignature } from '@covrfun/maker-sdk';

const require = createRequire(import.meta.url);
const file = require.resolve('@covrfun/maker-sdk/vectors/golden-vectors.json');
const v = JSON.parse(await readFile(file, 'utf8'));

// The vectors' throwaway key. Replace this signer with your KMS or HSM adapter.
const signer = new Wallet(keccak256(toUtf8Bytes(v.key.seed)));

for (const name of ['registration', 'bidIntent', 'quote', 'withdrawal']) {
  const { domain, types, message } = v[name].typedData;
  const { EIP712Domain, ...signedTypes } = types; // ethers derives the domain type itself
  void EIP712Domain;
  const digest = TypedDataEncoder.hash(domain, signedTypes, message);
  const signature = await signer.signTypedData(domain, signedTypes, message);
  if (digest !== v[name].digest) { console.log(name.padEnd(12), 'DIGEST MISMATCH', digest); continue; }
  assertCanonicalSignature(signature); // throws on a high-s signature
  const recovers = recoverAddress(digest, signature) === v.key.address;
  // Deterministic signers (RFC 6979, like ethers) reproduce the vector exactly.
  // A random-nonce KMS gives a different, equally valid signature: it must still recover.
  console.log(name.padEnd(12), signature === v[name].signature ? 'match' : recovers ? 'valid (recovers)' : 'SIGNATURE MISMATCH');
}

Expected output:

registration match
bidIntent    match
quote        match
withdrawal   match

To test your KMS adapter itself, import the throwaway key into a test KMS key and wrap it with kmsSigner. Then run the same loop, checking the digest exactly and the signature by recovery.

Guides

Go-live checklist

Work through this before covr lists your desk.

#Keys

• Your quote key lives in a KMS or HSM, and your adapter matches every golden vector.
• Your authority is in cold or well-guarded storage. It is needed for setup, deposits, withdrawals, configureMaker, re-enabling a paused policy, and exercise (unless an operator exercises).
• Optional: an operator key, set with configureMaker, exercises so the authority can stay offline.
• Your gateway token is stored as a secret, never in code or logs.

#On chain

• All eight setup steps are finalized.
• Your exposure, mint policy caps and premium budget match the risk you want. The premium limits cap what forged fills from a leaked quote key could cost; forged early closes stop only when you retire the key.
• Your vault holds enough USDC for the premiums you expect, plus the strikes you plan to pay or a tested top-up plan.
• Your authority's JitoSOL token account exists, for exercise deliveries (setup step 8).

#Quoting

• Your pricing replaced the example's stub.
• Bids use exactPriceAtOrBelow, so every premium is a whole USDC atom.
• Every nonce is journaled durably before its quote is signed, and only one process writes each journal.
• On start you read min_nonce and begin at or above it.
• You answer every award with a quote or award_decline.
• You treat OutcomeUnknownError as a possibly live quote.
• You reconnect with backoff after every closed event.

#Fills and expiry

• A reconciler finds fills on chain, because the gateway sends no fill message.
• An exercise job runs at each market's expiry and lands inside the window, which can be as short as 60 seconds.
• The exercise job uses exerciseV3Instructions, which creates fresh customer token accounts and sets the compute limit in the same transaction.

#Emergencies

• Your mint policy names a watcher key, kept hot, so you can pause without the authority. Set it at setup: changing it later needs your authority.
• You have rehearsed pausing the policy and raising min_nonce, and know who holds the authority at 3 a.m.
• You alert on gateway disconnects, refused bids, unresolved quotes and a low vault balance.
• You ran in practice mode for at least a day with no unexplained refusals.
• You tested what practice mode cannot reach: awards, quotes, your journal, fill detection and exercise. See Practice mode.

SDK reference

SDK overview

@covrfun/maker-sdk is the TypeScript toolkit a market-making desk uses to quote covr's covered calls on Solana. It derives and decodes your on-chain accounts, builds every setup and settlement instruction, signs gateway messages with your quote key, does the exact USDC arithmetic the program does, and speaks the gateway's WebSocket protocol.

#Install

npm install @covrfun/maker-sdk

If your own code imports ethers or @solana/kit, install the exact versions the SDK depends on, so both share one copy:

npm install ethers@6.17.0 @solana/kit@8.2.0

Runtime dependencies, pinned to exact versions (the source and the built package.json pin the same three):

#Design principles

• It builds and signs. It never prices. There is no pricing model and no default price anywhere. Every price is an argument you pass. exactPriceAtOrBelow only rounds your price to one the program can settle exactly.
• It never holds keys. Signing functions take a TypedDataSigner: an ethers Wallet or your KMS or HSM adapter. Nothing loads a key from disk or the environment.
• It never picks an RPC. No function reads the chain. You read accounts from your own RPC at finalized commitment, check their owner, and pass the bytes to the decoders.
• It never submits. Builders return @solana/kit instructions. Your pipeline adds them to a transaction, signs with your Solana authority and sends.
• No environment. The SDK reads no environment variable. Mainnet identities are literals in constants.
• Exact or refuse. Amounts that the program would refuse make the SDK throw. Nothing is rounded except the protocol fee, which rounds down as the program does.
• covr's own code. The decoders, the signers and most builders call the same code covr's own maker and gateway use. The vault, premium budget, deposit, withdraw and exposure-limit encoders, and the fresh writer account recipe of the exit helpers, are the SDK's own and are tested byte for byte against covr's.

#The Deployment argument

Every function that derives, decodes or builds against a program address takes an optional last argument d: Deployment, defaulting to MAINNET. Pass another Deployment only for a local validator or tests.

import { deriveMaker, MAINNET, type Deployment } from '@covrfun/maker-sdk';

declare const localProgramId: string; // a program you deployed to a local validator
const local: Deployment = { ...MAINNET, programAddress: localProgramId };

const onMainnet = await deriveMaker('0x7B99e6A7407Fe0058119F4f13494C0b9cec35738');
const onLocal = await deriveMaker('0x7B99e6A7407Fe0058119F4f13494C0b9cec35738', local);

The other program-facing functions take no d. quoteDomain, fillV3, exerciseV3, releaseV3, fundRestrictedExerciseV3, completePendingDeliveryV3, exerciseV3Instructions and releaseV3Instructions read the program and deployment from the decoded market you pass, so they follow the Deployment you decoded it with.

#Every export

The package exports 93 values and 28 types.

#Constants

#Signing

#Setup

#Markets

#Quoting

#Settlement

#Gateway client

SDK reference

Constants

Public mainnet identities, signing-domain inputs and gateway timing that the SDK exports. Every value here is a literal or is computed once when the module loads. Nothing reads the environment, an RPC or a key.

#Summary

#PROGRAM_ID

The covered-call program on Solana mainnet. Every builder targets it unless you pass another Deployment.

export declare const PROGRAM_ID: string;

• Value: 8ZpbTPnDECPTDGN5VHHKH5gfer6EUTnRHcFwfUAbkJDg
• Meaning: owner of every Maker, MakerOriginV1, MarketV3, PositionV3, Exposure, PremiumBudget, MintPolicyV1 and MintUsageV1 account the SDK derives. Vaults are different: your USDC vault, each position's collateral vault and its strike escrow are SPL token accounts owned by their token program, with a program-derived address as token authority (your Maker account for the USDC vault).
• Where it matters: check that every account you read (Maker, MarketV3, PositionV3) is owned by this address before you decode it. The decoders do not see the account owner.

import { PROGRAM_ID } from '@covrfun/maker-sdk';

declare const account: { owner: string; data: Uint8Array } | null;

if (!account || account.owner !== PROGRAM_ID) throw new Error('not a covr program account');

#DEPLOYMENT_ID

The 32-byte deployment identity bound into every EIP-712 verifyingContract and stored in every MarketV3 account (bytes 237 to 269).

export declare const DEPLOYMENT_ID: string;

• Value: 0x13a01f9d69929d8b65db7e9a6cc0805075876a8a66664e4ef30dd26f635527e2
• Meaning: separates this deployment's signatures from any other deployment of the same code. A grant or quote signed for one deployment never verifies on another.
• Where it matters: registrationGrantDomain, quoteDomain and decodeMarketV3, which refuses a market whose stored deployment id differs.

#GENESIS_HASH

Solana mainnet's genesis hash.

export declare const GENESIS_HASH: string;

• Value: 5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d
• Meaning: every MarketV3 and PositionV3 account stores it. The decoders require it.
• Where it matters: decodeMarketV3 refuses any market whose stored genesis is not this value, even if you pass a Deployment with another genesisHash. The program pins the same value.

#USDC_MINT

The only payment mint. Premiums, fees and strikes are all paid in it.

export declare const USDC_MINT: string;

• Value: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
• Where it matters: your maker vault holds this mint. deposit moves it from your own token account.

#USDC_DECIMALS

Decimals of USDC_MINT. One USDC is 1_000_000 atoms.

export declare const USDC_DECIMALS: number;

• Value: 6
• Where it matters: every ...Usdc amount in the SDK is in USDC atoms (10^-6 USDC).

#JITOSOL_MINT

The JitoSOL mint, the collateral desks quote today.

export declare const JITOSOL_MINT: string;

• Value: J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn
• Decimals: 9 (one JitoSOL is 1_000_000_000 atoms).
• Where it matters: GatewayClient.connect subscribes to this asset when you pass no assets.

#JITO_STAKE_POOL

The Jito stake pool account. The program requires it as a read-only extra account on every fill whose collateral is JitoSOL.

export declare const JITO_STAKE_POOL: string;

• Value: Jito4APyf642JPZPx3hGc6WWJ8zPKtRbRs4P815Awbb
• Where it matters: fillV3 appends it for JitoSOL markets and refuses any other pool address.

#TOKEN_PROGRAM

The SPL Token program. It owns the USDC mint and your vault.

export declare const TOKEN_PROGRAM: string;

• Value: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA
• Where it matters: the program field of a CollateralIdentity for a classic SPL mint such as JitoSOL.

#TOKEN_2022_PROGRAM

The Token-2022 program. Markets accept collateral owned by either token program.

export declare const TOKEN_2022_PROGRAM = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";

• Value: TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb
• Type: the string literal itself, not string (unlike TOKEN_PROGRAM).

#CHAIN_ID

The EIP-712 chainId used in every covr signing domain and in every RFQ, intent and quote.

export declare const CHAIN_ID: number;

• Value: 2000000001
• Meaning: a private venue discriminator. It is not an EVM chain id and not a Solana cluster id.
• Where it matters: wallets and KMS policies that whitelist chain ids must allow this value.

#MAINNET

The default Deployment: mainnet program, deployment id and genesis hash. The object is frozen.

export declare const MAINNET: Deployment;

• Value:

{
  "programAddress": "8ZpbTPnDECPTDGN5VHHKH5gfer6EUTnRHcFwfUAbkJDg",
  "deploymentId": "0x13a01f9d69929d8b65db7e9a6cc0805075876a8a66664e4ef30dd26f635527e2",
  "genesisHash": "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d"
}

• Where it matters: it is the default last argument of every function that takes a Deployment. See the convention.

#EIP712_DOMAIN_BASE

The name, version and chainId shared by every covr EIP-712 domain. Each real domain adds its own verifyingContract: one for the registration grant, one per market. The object is frozen.

export declare const EIP712_DOMAIN_BASE: Readonly<{
    name: string;
    version: string;
    chainId: number;
}>;

• Value: { name: 'SOL Covered Calls', version: '1', chainId: 2000000001 }
• Where it matters: you never sign with this object alone. Use registrationGrantDomain or quoteDomain. See Signing.

#ORDINARY_TERMS_ID

The termsId of every ordinary market (settlement mode 0, atomic exercise): sha256("COVR:ORDINARY-ATOMIC:1\0"), as 0x-hex.

export declare const ORDINARY_TERMS_ID: string;

• Value: 0xddae69a8d6ba258eb6501331627a583ee6951df68af6a50760d0a038c0a8379d
• Where it matters: a mint policy holds one terms id. A policy built from an ordinary market (with mintPolicySettingsFor) carries this value and admits fills only in ordinary markets.

#RESTRICTED_TERMS_ID

The termsId of restricted markets (settlement mode 1, fund then deliver) with the approved 7-day cancellation timeout: sha256("COVR:RESTRICTED-PENDING:1\0" || 0x01 || u64_le(604800)), as 0x-hex.

export declare const RESTRICTED_TERMS_ID: string;

• Value: 0xeedfb6068a9b748d45b3341000c743a4b758460d05a852c8473e9fa0469bd7e1

#RESTRICTED_CANCELLATION_TIMEOUT_SECONDS

The only cancellation timeout a restricted market may carry: 7 days.

export declare const RESTRICTED_CANCELLATION_TIMEOUT_SECONDS: bigint;

• Value: 604800n (seconds)
• Where it matters: createRestrictedMarketV3 defaults to it and refuses any other value. decodeMarketV3 decodes restricted markets against it.

#REGISTRATION_SCOPE

The scope string hashed into the registration grant's verifyingContract.

export declare const REGISTRATION_SCOPE: string;

• Value: 'registration-v3'
• Where it matters: registrationGrantDomain derives verifyingContract = last20(keccak256("deployment-v2" || deploymentId || programId || "registration-v3")). For mainnet that is 0xd2d2b887d02b01d3a4371c7b77f96c3880513b4e.

#assetAlias

Computes the 20-byte wire alias of a mint. Use it to match an RFQ's asset to a mint, or to subscribe to a feed by mint.

RFQs, intents and quotes name tokens by this alias, not by the Solana mint. The alias is the last 20 bytes of keccak256 over the mint's 32 public-key bytes, as lowercase 0x-hex. It is an identifier only, never an EVM contract.

export declare function assetAlias(mint: string): string;

Returns: string. 0x plus 40 lowercase hex characters.

Throws: SolanaError from @solana/kit when mint is not a valid base58 address.

import { assetAlias, JITOSOL_MINT, JITOSOL_ALIAS } from '@covrfun/maker-sdk';

console.log(assetAlias(JITOSOL_MINT) === JITOSOL_ALIAS); // true

#JITOSOL_ALIAS

The wire alias of JITOSOL_MINT.

export declare const JITOSOL_ALIAS: string;

• Value: 0x43127405c3191a0b63a5f3d845f616ffea348c68
• Where it matters: asset, collateralAsset and assetAddress of every JitoSOL RFQ, intent and quote. The JitoSOL feed path is /rfqs/0x43127405c3191a0b63a5f3d845f616ffea348c68.

#USDC_ALIAS

The wire alias of USDC_MINT.

export declare const USDC_ALIAS: string;

• Value: 0x5ce3bf3a31af18be40ba30f721101b4341690186
• Where it matters: the usd field of every RFQ, intent and quote.

#GATEWAY_MAX_FRAME_BYTES

The largest WebSocket frame the gateway accepts, in bytes. The client also uses it as its own inbound limit.

export declare const GATEWAY_MAX_FRAME_BYTES = 16384;

• Value: 16384 (16 KiB)
• Where it matters: GatewayClient refuses to send a request whose JSON frame is larger, and closes a socket that receives a larger frame. A signed bid intent or quote frame is under 1 KiB (844 and 931 bytes in the golden vectors).

#COLLECT_MS

How long an opening auction collects sealed bid intents, in milliseconds from RFQ creation.

export declare const COLLECT_MS = 3000;

• Value: 3000 ms
• Meaning: closesAt = createdAt + 3000. A bid intent's validUntil must be later than ceil(closesAt / 1000).

#AWARD_MS

How long the winning maker has to answer an award with a signed quote, in milliseconds.

export declare const AWARD_MS = 3000;

• Value: 3000 ms
• Meaning: each award's awardUntil = min(award time + 3000, hardDeadline), rounded down to a whole millisecond. A decline, a disconnect or a failed answer passes the award to the next bidder at once.

#TOTAL_MS

The auction's hard deadline, in milliseconds from RFQ creation.

export declare const TOTAL_MS = 6000;

• Value: 6000 ms
• Meaning: hardDeadline = createdAt + 6000. No award is made and no quote is admitted after it.

#REVIEW_SECONDS

The longest life a quote may have, in seconds, measured on the gateway's clock when it admits the quote.

export declare const REVIEW_SECONDS = 60;

• Value: 60 s
• Meaning: the gateway admits a quote only if now < validUntil <= now + 60. defaultIntentValidUntil also uses it: min(option expiry, ceil(hardDeadline / 1000) + 60).

SDK reference

Signing

Your quote key is a secp256k1 key with an Ethereum-style 0x… address. It signs four kinds of EIP-712 typed data: the one-time registration grant, sealed bid intents, executable quotes, and quote withdrawals (a route not served to desks). This page covers the signer shape the SDK accepts, the signature rule the program enforces, how covr builds its domains, and how to prove your signer against the golden vectors before you sign anything real.

#TypedDataSigner

The signer interface every signing function takes. An ethers Wallet satisfies it as is. For a KMS, HSM or remote signing service, write a small adapter.

export interface TypedDataSigner {
    signTypedData(domain: TypedDataDomain, types: Record<string, TypedDataField[]>, value: Record<string, unknown>): Promise<string>;
}

TypedDataDomain and TypedDataField are the ethers v6 types.

Returns: Promise<string>. The 65-byte signature r || s || v as 0x plus 130 hex characters, with v in {27, 28} and s in the low half of the curve order.

Every SDK signing function checks the result with assertCanonicalSignature, then recovers the signer with ethers.verifyTypedData and refuses a signature that does not recover to the expected key. It returns the signature lowercased.

#Writing a KMS or HSM adapter

Most KMS and HSM services sign a 32-byte digest and return a DER signature without v. Your adapter must:

1. Compute the EIP-712 digest: TypedDataEncoder.hash(domain, types, value) from ethers.
2. Ask the KMS to sign that digest.
3. Decode the DER r and s. If s > n/2, replace it with n - s (n is the secp256k1 order).
4. Find v in {27, 28}: the one for which recovery gives your key's address.
5. Return 0x + r (32 bytes) + s (32 bytes) + v (1 byte), all hex.

import { Signature, TypedDataEncoder, recoverAddress, type TypedDataDomain, type TypedDataField } from 'ethers';
import { assertCanonicalSignature, type TypedDataSigner } from '@covrfun/maker-sdk';

// Your KMS call: signs a 32-byte digest, returns r and s as 0x-hex (32 bytes each).
declare function kmsSignDigest(digest: string): Promise<{ r: string; s: string }>;
declare const quoteKeyAddress: string; // your quote key's 0x address

const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;

export const kmsSigner: TypedDataSigner & { address: string } = {
  address: quoteKeyAddress,
  async signTypedData(
    domain: TypedDataDomain,
    types: Record<string, TypedDataField[]>,
    value: Record<string, unknown>,
  ): Promise<string> {
    const digest = TypedDataEncoder.hash(domain, types, value);
    const { r, s } = await kmsSignDigest(digest);
    const sValue = BigInt(s);
    const low = sValue > N / 2n ? N - sValue : sValue;
    const lowS = '0x' + low.toString(16).padStart(64, '0');
    for (const v of [27, 28] as const) {
      const signature = Signature.from({ r, s: lowS, v }).serialized;
      if (recoverAddress(digest, signature).toLowerCase() === quoteKeyAddress.toLowerCase()) {
        assertCanonicalSignature(signature);
        return signature;
      }
    }
    throw new Error('KMS signature does not recover to the quote key');
  },
};

#What your signer receives

The SDK converts each wire object to its EIP-712 value before it calls your signer. Fields not listed pass through unchanged.

The golden vectors show both forms side by side: wire (or rpc.params) and typedData.message.

#assertCanonicalSignature

Throws unless a signature is in the exact form the program accepts. Call it on any signature your own code produces before you send or submit it.

export declare function assertCanonicalSignature(signature: string): void;

Returns: void.

Throws:

n/2 is 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a0. The Solana secp256k1 recovery syscall alone would accept the high-s twin of a valid signature. The program refuses it, and so does this check.

import { assertCanonicalSignature } from '@covrfun/maker-sdk';

declare const signature: string; // from your own signing path

assertCanonicalSignature(signature); // throws on high-s, v not in {27,28}, or bad length

#How covr domains are built

Every covr domain has the same name, version and chainId (EIP712_DOMAIN_BASE) and its own verifyingContract:

verifyingContract = last 20 bytes of keccak256(
  "deployment-v2" || deploymentId (32 bytes) || programId (32 bytes) || scope
)

The scope depends on what is signed:

The market terms follow the literal in this order: market address (32 bytes); version, settlementMode, collateralDecimals, paymentDecimals (1 byte each); creator, collateral, collateralProgram, payment, paymentProgram, feeOwner, genesisHash (32 bytes each); deploymentId, termsId, profileHash (32 bytes each); salt (u64 LE), expiry (i64 LE), window (u64 LE), strikeE8 (u64 LE), maxQuantityAtoms (u64 LE), feeBps (u16 LE).

So a market's domain commits to every term. A signature for one market never verifies for another market. The paused flag and the PDA bump are not part of the scope, so pausing a market does not change its domain.

#Golden vectors

The package ships vectors/golden-vectors.json, importable as @covrfun/maker-sdk/vectors/golden-vectors.json. It holds fixed inputs and the exact bytes covr's own code produces for them. Use it to prove that your EIP-712 encoder and your signer produce what the gateway and the program verify.

All signatures in the file come from a throwaway key that is public by construction:

privateKey = keccak256(utf8("covr-maker-sdk-golden-vectors-v1"))
address    = 0x7B99e6A7407Fe0058119F4f13494C0b9cec35738

#How to verify your signer

Check three things for each typed-data vector (registration, bidIntent, quote, withdrawal):

1. Digest. Your EIP-712 encoder gives digest for typedData (drop EIP712Domain from types if your library adds it itself). This proves your types, domain and value encoding.
2. Signature format. Sign typedData with your own key. The result passes assertCanonicalSignature and recovers to your quote key's address.
3. Signature bytes (deterministic signers only). If your stack can load the throwaway key and signs with RFC 6979 (ethers does), the signature equals signature byte for byte. Many KMS and HSM services use a random nonce. Their signatures differ from the vector and are still valid: rely on checks 1 and 2.

Then check the domains and the encoding the SDK computes for you:

4. marketDomain(market, bytes of accountDataBase64) equals domain for both market vectors.
5. encodeCancellationRequestV1(request) equals encodedHex.

#Example: verify with ethers

This script runs as is under Node 24, which strips TypeScript types itself: node verify-vectors.ts. With the tsx dev tool (npm install -D tsx) you can also run npx tsx verify-vectors.ts. Replace mySigner with your adapter.

import { readFileSync } from 'node:fs';
import { createRequire } from 'node:module';
import { TypedDataEncoder, Wallet, keccak256, toUtf8Bytes, verifyTypedData } from 'ethers';
import {
  assertCanonicalSignature,
  encodeCancellationRequestV1,
  marketDomain,
  type TypedDataSigner,
} from '@covrfun/maker-sdk';

const require = createRequire(import.meta.url);
const vectors = JSON.parse(
  readFileSync(require.resolve('@covrfun/maker-sdk/vectors/golden-vectors.json'), 'utf8'),
);

// The public throwaway key. Never use it for anything else.
const throwaway = new Wallet(keccak256(toUtf8Bytes(vectors.key.seed)));
if (throwaway.address !== vectors.key.address) throw new Error('key derivation differs');

// Replace with your KMS/HSM adapter and its address.
const mySigner: TypedDataSigner & { address: string } = throwaway;

for (const name of ['registration', 'bidIntent', 'quote', 'withdrawal']) {
  const { types: allTypes, domain, message } = vectors[name].typedData;
  const { EIP712Domain: _ignored, ...types } = allTypes;

  // 1. Digest: proves your types, domain and value encoding.
  if (TypedDataEncoder.hash(domain, types, message) !== vectors[name].digest)
    throw new Error(`${name}: digest differs`);

  // 2. Format: canonical, and recovers to your key.
  const signature = await mySigner.signTypedData(domain, types, message);
  assertCanonicalSignature(signature);
  if (verifyTypedData(domain, types, message, signature) !== mySigner.address)
    throw new Error(`${name}: signature does not recover to your key`);

  // 3. Bytes: only for a deterministic (RFC 6979) signer holding the throwaway key.
  const reference = await throwaway.signTypedData(domain, types, message);
  if (reference !== vectors[name].signature) throw new Error(`${name}: signature bytes differ`);
}

// 4. Market domains from raw account bytes.
for (const name of ['ordinaryMarketDomain', 'restrictedMarketDomain']) {
  const raw = new Uint8Array(Buffer.from(vectors[name].accountDataBase64, 'base64'));
  const domain = await marketDomain(vectors[name].market, raw);
  if (domain.verifyingContract !== vectors[name].verifyingContract)
    throw new Error(`${name}: domain differs`);
}

// 5. Cancellation request encoding.
const r = vectors.cancellationRequest.request;
const encoded = encodeCancellationRequestV1({
  ...r,
  intentGeneration: BigInt(r.intentGeneration),
  refundStrikeUsdc: BigInt(r.refundStrikeUsdc),
  returnCollateralAtoms: BigInt(r.returnCollateralAtoms),
  validUntil: BigInt(r.validUntil),
});
if ('0x' + Buffer.from(encoded).toString('hex') !== vectors.cancellationRequest.encodedHex)
  throw new Error('cancellation encoding differs');

console.log('all golden vectors verified');

SDK reference

Setup

On-chain setup and upkeep for a maker: derive your accounts, register your quote key, open and fund your USDC vault, set the caps the program enforces on every fill, and later change them or withdraw. Every function here builds an instruction, computes an address or decodes bytes you read. None signs a transaction, reads the chain or submits anything. The program re-checks every authority and amount.

#Setup sequence

Your Solana authority signs and pays rent for every step. Confirm each step at finalized commitment before you send the next.

A fill passes the exposure, premium budget, mint policy, mint usage and origin accounts to the program, so steps 1 to 5 must exist before any fill can land. Step 7 funds the premium the vault pays at fill and the strike it pays at exercise.

#Sending a setup instruction

Builders return a @solana/kit instruction. Its accounts carry roles (0 read-only, 1 writable, 2 read-only signer, 3 writable signer) but no signer objects. Add it to a transaction with your own pipeline and sign with your authority.

import {
  appendTransactionMessageInstructions,
  createSolanaRpc,
  createTransactionMessage,
  pipe,
  setTransactionMessageFeePayerSigner,
  setTransactionMessageLifetimeUsingBlockhash,
  signTransactionMessageWithSigners,
  type TransactionSigner,
} from '@solana/kit';
import { initializeVault, deriveMaker } from '@covrfun/maker-sdk';

declare const authority: TransactionSigner; // your Solana authority
declare const quoteKeyAddress: string; // your 0x quote key address
const rpc = createSolanaRpc('https://<your rpc>');

const { maker } = await deriveMaker(quoteKeyAddress);
const { instruction } = await initializeVault({ authority: authority.address, maker });
const { value: blockhash } = await rpc.getLatestBlockhash({ commitment: 'finalized' }).send();

const message = pipe(
  createTransactionMessage({ version: 0 }),
  m => setTransactionMessageFeePayerSigner(authority, m),
  m => setTransactionMessageLifetimeUsingBlockhash(blockhash, m),
  m => appendTransactionMessageInstructions([instruction], m),
);
const signed = await signTransactionMessageWithSigners(message);
// Simulate, send and confirm `signed` with your own RPC at finalized commitment.

Builders that return recommendedComputeUnitLimit expect you to prepend a compute-unit-limit instruction with at least that value, and to simulate first.

#Later changes

Signed by the same authority, at any time after setup:

Read your current state with decodeMaker, decodeMintPolicy and decodeMintUsage.

#deriveMaker

Derives your Maker account and its MakerOriginV1 record from your quote key address. Use it to find the maker address every other setup builder takes.

export declare function deriveMaker(makerEthAddress: string, d?: Deployment): Promise<{
    maker: Address;
    makerBump: number;
    origin: Address;
    originBump: number;
}>;

Returns: maker, the PDA ["maker", 20 address bytes]; origin, the PDA ["maker-origin-v1", maker]; and their bumps.

Throws:

import { deriveMaker } from '@covrfun/maker-sdk';

const { maker, origin } = await deriveMaker('0x7B99e6A7407Fe0058119F4f13494C0b9cec35738');
// maker  = 6cHK5gxK31ksD3fX7ZPPP6FqBw5CR8vHWehrvLGNx3of
// origin = 4gHXS1EcizH1hp2CNVBLLAHn7ibMc8Ddp13g8ghGaYnb

#decodeMaker

Decodes your Maker account and proves the bytes belong to your quote key. Use it to read your on-chain nonce floor (minNonce) and operator.

export declare function decodeMaker(makerAddress: string, raw: Uint8Array, makerEthAddress: string, d?: Deployment): Promise<DecodedMakerAccount>;

Returns: DecodedMakerAccount. minNonce is the floor every fill compares a quote nonce to: sign new quotes with nonces at or above it.

Throws:

import { createSolanaRpc, address } from '@solana/kit';
import { decodeMaker, deriveMaker, PROGRAM_ID } from '@covrfun/maker-sdk';

declare const quoteKeyAddress: string;
const rpc = createSolanaRpc('https://<your rpc>');

const { maker } = await deriveMaker(quoteKeyAddress);
const { value } = await rpc
  .getAccountInfo(address(maker), { commitment: 'finalized', encoding: 'base64' })
  .send();
if (!value || value.owner !== PROGRAM_ID) throw new Error('Maker account missing');
const decoded = await decodeMaker(maker, new Uint8Array(Buffer.from(value.data[0], 'base64')), quoteKeyAddress);
console.log('nonce floor', decoded.minNonce);

#deriveVault

Derives your USDC vault and your PremiumBudget account.

export declare function deriveVault(maker: string, d?: Deployment): Promise<{
    vault: Address<string>;
    premiumBudget: Address<string>;
}>;

Returns: vault, the PDA ["stable", maker, USDC mint], a USDC token account whose token authority is your Maker account; premiumBudget, the PDA ["premium-budget", maker, USDC mint].

Throws: SolanaError from @solana/kit when maker or d.programAddress is not a valid address.

import { deriveMaker, deriveVault } from '@covrfun/maker-sdk';

declare const quoteKeyAddress: string;
const { maker } = await deriveMaker(quoteKeyAddress);
const { vault, premiumBudget } = await deriveVault(maker);

#deriveExposure

Derives your Exposure account for one collateral mint. One Exposure covers that mint across every market.

export declare function deriveExposure(maker: string, collateral: string, d?: Deployment): Promise<Address>;

Returns: the PDA ["exposure", maker, collateral].

Throws: SolanaError when an address is not valid base58.

import { deriveExposure, deriveMaker, JITOSOL_MINT } from '@covrfun/maker-sdk';

declare const quoteKeyAddress: string;
const { maker } = await deriveMaker(quoteKeyAddress);
const exposure = await deriveExposure(maker, JITOSOL_MINT);

#deriveMintPolicy

Derives your MintPolicyV1 and MintUsageV1 accounts for one collateral mint.

export declare function deriveMintPolicy(maker: string, collateral: string, d?: Deployment): Promise<{
    policy: Address;
    usage: Address;
}>;

Returns: policy, the PDA ["mint-policy", maker, collateral]; usage, the PDA ["mint-usage", maker, collateral].

Throws:

import { deriveMaker, deriveMintPolicy, JITOSOL_MINT } from '@covrfun/maker-sdk';

declare const quoteKeyAddress: string;
const { maker } = await deriveMaker(quoteKeyAddress);
const { policy, usage } = await deriveMintPolicy(maker, JITOSOL_MINT);

#deriveMarket

Derives a MarketV3 address from its creator and salt. Use it to pick a free salt before createMarketV3, or to check an address you were given.

export declare function deriveMarket(creator: string, salt: bigint, d?: Deployment): Promise<{
    market: Address<string>;
    bump: import("@solana/kit").ProgramDerivedAddressBump;
}>;

Returns: market, the PDA ["market-v3", creator, salt as u64 little-endian], and its bump.

Throws:

import { deriveMarket } from '@covrfun/maker-sdk';

declare const creator: string;
const { market } = await deriveMarket(creator, 1n);

#derivePosition

Derives the PositionV3 a fill of your quote with a given nonce creates, plus its collateral vault, strike escrow, policy and usage. Use it to watch the chain for your fills: the gateway sends no fill message.

export declare function derivePosition(makerEthAddress: string, nonce: bigint, collateral: string, d?: Deployment): Promise<Readonly<import("../settlement/position-v3.js").PositionV3Addresses>>;

Returns: a frozen object with maker, position (PDA ["position", 20 address bytes, nonce u64 LE]), collateralVault (["collateral", position]), strikeEscrow (["strike-escrow-v3", position]), policy, usage, and a ...Bump for each.

The position address depends only on your quote key and the nonce, not on the market. One nonce can open at most one position across all your markets, so never reuse a nonce.

Throws:

import { derivePosition, JITOSOL_MINT } from '@covrfun/maker-sdk';

declare const quoteKeyAddress: string;
const { position } = await derivePosition(quoteKeyAddress, 1001n, JITOSOL_MINT);
// A PositionV3 at `position` owned by the program means quote nonce 1001 filled.

#REGISTER_TYPES

The EIP-712 types of the registration grant: one bytes32 authority field. The object is frozen.

export declare const REGISTER_TYPES: Readonly<{
    Register: {
        name: string;
        type: string;
    }[];
}>;

• Value: { Register: [{ name: 'authority', type: 'bytes32' }] }
• Where it matters: signRegistrationGrant signs with it. Your own signer must use exactly this type to match the program's digest.

#registrationGrantDomain

Returns the EIP-712 domain of the registration grant for a deployment.

export declare function registrationGrantDomain(d?: Deployment): TypedDataDomain;

Returns: TypedDataDomain (ethers): name: 'SOL Covered Calls', version: '1', chainId: 2000000001, and verifyingContract = last20(keccak256("deployment-v2" || deploymentId || programId || "registration-v3")). On mainnet verifyingContract is 0xd2d2b887d02b01d3a4371c7b77f96c3880513b4e.

Throws:

import { registrationGrantDomain } from '@covrfun/maker-sdk';

const domain = registrationGrantDomain();
// { name: 'SOL Covered Calls', version: '1', chainId: 2000000001,
//   verifyingContract: '0xd2d2b887d02b01d3a4371c7b77f96c3880513b4e' }

#registrationGrantMessage

Builds the grant's message: your Solana authority's 32 public-key bytes as bytes32.

export declare function registrationGrantMessage(authority: string): {
    authority: string;
};

Returns: { authority }, the key's 32 bytes as 0x + 64 hex characters.

Throws:

import { registrationGrantMessage } from '@covrfun/maker-sdk';

registrationGrantMessage('4bBXSXQzPMFD7ayeSiMd1SYHjnCtxLTSyfis5VVu7kWh');
// { authority: '0x3554b5709c9cf550f27084d8e693104bafaa5eec4a51e3555818c69136da1a76' }

#signRegistrationGrant

Signs the registration grant with your quote key. The grant lets your Solana authority register that quote key on chain, once.

export declare function signRegistrationGrant(signer: TypedDataSigner, authority: string, d?: Deployment): Promise<{
    signature: string;
    signer: string;
    domain: TypedDataDomain;
    types: {
        Register: {
            name: string;
            type: string;
        }[];
    };
    message: {
        authority: string;
    };
}>;

Returns: signature (lowercase 0x-hex, 65 bytes); signer, the checksummed address the signature recovers to; and the exact domain, types and message that were signed.

The function does not compare signer with any expected key. Check it equals your quote key address before you register.

Throws:

• Every error of registrationGrantMessage and registrationGrantDomain.
• Any error your signer throws.
• assertCanonicalSignature errors when the signer returns a malformed or high-s signature.

import { signRegistrationGrant, type TypedDataSigner } from '@covrfun/maker-sdk';

declare const quoteKey: TypedDataSigner & { address: string };
declare const authority: string; // your Solana authority

const grant = await signRegistrationGrant(quoteKey, authority);
if (grant.signer !== quoteKey.address) throw new Error('grant signed by the wrong key');

#registerMakerV3

Builds register_maker_v3, which creates your Maker and MakerOriginV1 accounts. It verifies the grant locally first, so a wrong domain, key or authority fails before you pay any fee.

export declare function registerMakerV3(input: RegisterMakerV3Input, d?: Deployment): Promise<{
    maker: Address;
    origin: Address;
    instruction: Instruction<string, readonly (import("@solana/kit").AccountLookupMeta<string, string> | AccountMeta<string>)[]> & {
        accounts: AccountMeta[];
        data: Uint8Array;
    };
}>;

Returns: maker, origin, and the instruction. Accounts: authority (writable signer), maker (writable), origin (writable), System program. Data: the 8-byte discriminator, the 20 address bytes, the 65 signature bytes.

On chain the program verifies the grant again and creates a 117-byte Maker with no operator (the zero key) and min_nonce = 0. The authority and the quote key can never change afterwards.

Throws:

import { registerMakerV3, signRegistrationGrant, type TypedDataSigner } from '@covrfun/maker-sdk';

declare const quoteKey: TypedDataSigner & { address: string };
declare const authority: string;

const grant = await signRegistrationGrant(quoteKey, authority);
const { maker, instruction } = await registerMakerV3({
  authority,
  makerEthAddress: quoteKey.address,
  signature: grant.signature,
});
// Your authority signs and sends `instruction`.

#initializeVault

Builds initialize_vault, which creates your USDC vault and your PremiumBudget. The budget starts disabled: no lifetime premium cap applies until you call setPremiumBudget.

export declare function initializeVault(input: {
    authority: string;
    maker: string;
}, d?: Deployment): Promise<{
    vault: Address<string>;
    premiumBudget: Address<string>;
    instruction: SdkInstruction;
}>;

Returns: vault, premiumBudget and an SdkInstruction. Accounts: authority (writable signer), maker, USDC mint, vault (writable), Token program, System program, premiumBudget (writable).

Throws:

import { deriveMaker, initializeVault } from '@covrfun/maker-sdk';

declare const authority: string;
declare const quoteKeyAddress: string;
const { maker } = await deriveMaker(quoteKeyAddress);
const { vault, instruction } = await initializeVault({ authority, maker });

#setPremiumBudget

Builds set_premium_budget, which sets an absolute lifetime ceiling on the gross premium your vault pays, summed across every collateral.

export declare function setPremiumBudget(input: {
    authority: string;
    maker: string;
    enabled: boolean;
    limit: bigint;
}, d?: Deployment): Promise<{
    premiumBudget: Address<string>;
    instruction: SdkInstruction;
}>;

Returns: premiumBudget and an SdkInstruction. Accounts: authority (read-only signer), maker, USDC mint, premiumBudget (writable). Data: discriminator, enabled (1 byte), limit (u64 LE).

The cap compares against everything spent since the budget was created. Changing it never resets spent. While enabled, a fill fails when spent + gross premium > limit. A limit below what you have already spent blocks every fill.

Throws:

import { setPremiumBudget } from '@covrfun/maker-sdk';

declare const authority: string;
declare const maker: string;
// Cap lifetime gross premium at 50,000 USDC.
const { instruction } = await setPremiumBudget({ authority, maker, enabled: true, limit: 50_000_000_000n });

#deposit

Builds deposit, which moves USDC from a token account you own into your vault.

export declare function deposit(input: {
    authority: string;
    maker: string;
    source: string;
    amount: bigint;
}, d?: Deployment): Promise<{
    vault: Address<string>;
    instruction: SdkInstruction;
}>;

Returns: vault and an SdkInstruction. Accounts: authority (read-only signer), maker, USDC mint, vault (writable), source (writable), Token program.

Throws:

The program also requires the source's token owner to be the authority.

import { deposit } from '@covrfun/maker-sdk';

declare const authority: string;
declare const maker: string;
declare const myUsdcAccount: string; // your USDC token account
// Deposit 10,000 USDC.
const { instruction } = await deposit({ authority, maker, source: myUsdcAccount, amount: 10_000_000_000n });

#withdraw

Builds withdraw, which moves USDC from your vault to a USDC token account you own.

export declare function withdraw(input: {
    authority: string;
    maker: string;
    destination: string;
    amount: bigint;
}, d?: Deployment): Promise<{
    vault: Address<string>;
    instruction: SdkInstruction;
}>;

Returns: vault and an SdkInstruction. Accounts: authority (read-only signer), maker, USDC mint, vault (writable), destination (writable), Token program. These are the program's deposit accounts, with the destination in the slot a deposit uses for its source. The program pays out under your Maker account's authority.

Throws:

The program also requires amount > 0, the destination's mint to be USDC and its owner to be the authority.

import { withdraw } from '@covrfun/maker-sdk';

declare const authority: string;
declare const maker: string;
declare const myUsdcAccount: string; // your USDC token account
// Withdraw 1,000 USDC.
const { instruction } = await withdraw({ authority, maker, destination: myUsdcAccount, amount: 1_000_000_000n });

#initializeExposureV3

Builds initialize_exposure_v3, which creates the Exposure account for one collateral mint: a cap on the collateral atoms held across all your open positions on that mint.

export declare function initializeExposureV3(input: {
    authority: string;
    makerEthAddress: string;
    collateral: CollateralIdentity;
    limitAtoms: bigint;
}, d?: Deployment): Promise<{
    maker: Address;
    exposure: Address;
    recommendedComputeUnitLimit: 200000;
    instruction: import("../settlement/ordinary-v3.js").OrdinaryV3Instruction;
}>;

Returns: maker, exposure, recommendedComputeUnitLimit (200,000) and the instruction. Accounts: authority (writable signer), maker, collateral mint, exposure (writable), System program. Data: discriminator, limitAtoms (u64 LE).

A fill fails when the open atoms on this mint plus the fill's atoms would exceed limitAtoms.

Throws:

import { initializeExposureV3, JITOSOL_MINT, TOKEN_PROGRAM } from '@covrfun/maker-sdk';

declare const authority: string;
declare const quoteKeyAddress: string;
// At most 100 JitoSOL open at once.
const { exposure, instruction, recommendedComputeUnitLimit } = await initializeExposureV3({
  authority,
  makerEthAddress: quoteKeyAddress,
  collateral: { mint: JITOSOL_MINT, program: TOKEN_PROGRAM, decimals: 9 },
  limitAtoms: 100_000_000_000n,
});

#setExposureLimit

Builds set_exposure_limit, which replaces the cap initializeExposureV3 set for one collateral. It takes the same input.

export declare function setExposureLimit(input: {
    authority: string;
    makerEthAddress: string;
    collateral: CollateralIdentity;
    limitAtoms: bigint;
}, d?: Deployment): Promise<{
    maker: Address;
    exposure: Address;
    instruction: SdkInstruction;
}>;

Returns: maker, exposure and an SdkInstruction. Accounts: authority (read-only signer), maker, collateral mint, exposure (writable). Data: discriminator, limitAtoms (u64 LE).

The cap gates new fills only. Positions already open above a lowered cap stay open.

Throws:

import { setExposureLimit, JITOSOL_MINT, TOKEN_PROGRAM } from '@covrfun/maker-sdk';

declare const authority: string;
declare const quoteKeyAddress: string;
// Lower the JitoSOL cap to 50 JitoSOL open at once.
const { instruction } = await setExposureLimit({
  authority,
  makerEthAddress: quoteKeyAddress,
  collateral: { mint: JITOSOL_MINT, program: TOKEN_PROGRAM, decimals: 9 },
  limitAtoms: 50_000_000_000n,
});

#mintPolicySettingsFor

Builds mint policy settings bound to one market's termsId and profileHash, with your caps. Pass a decoded market. The result goes to initializeMintPolicyV1.

export declare function mintPolicySettingsFor(market: {
    termsId: Uint8Array;
    profileHash: Uint8Array;
}, caps: {
    watcher?: string;
    enabled?: boolean;
    maxOrderAtoms: bigint;
    maxReservedAtoms: bigint;
    maxReservedStrikeUsdc: bigint;
    lifetimePremiumLimitUsdc?: bigint;
}): MintPolicySettingsV1;

Returns: MintPolicySettingsV1. lifetimePremiumLimitEnabled is true exactly when you passed lifetimePremiumLimitUsdc. termsId and profileHash are copies.

A policy holds one termsId, so one mint is quoted in ordinary markets or in restricted markets, never both. The policy also admits only markets with the same profileHash (the mint's committed token profile).

Throws: nothing. It validates nothing; initializeMintPolicyV1 does.

import { mintPolicySettingsFor, type DecodedMarketV3 } from '@covrfun/maker-sdk';

declare const market: DecodedMarketV3; // from decodeMarketV3
const settings = mintPolicySettingsFor(market, {
  maxOrderAtoms: 1_000_000_000n, // 1 JitoSOL per fill (the program caps a fill at 2 SOL of value)
  maxReservedAtoms: 100_000_000_000n, // 100 JitoSOL open
  maxReservedStrikeUsdc: 25_000_000_000n, // 25,000 USDC of strike open
});

#initializeMintPolicyV1

Builds initialize_mint_policy_v1, which creates your MintPolicyV1 (generation 1) and MintUsageV1 for one collateral mint.

export declare function initializeMintPolicyV1(input: {
    authority: string;
    maker: string;
    collateral: string;
    settings: MintPolicySettingsV1;
}, d?: Deployment): Promise<{
    policy: Address;
    usage: Address;
    instruction: Instruction<string, readonly (import("@solana/kit").AccountLookupMeta<string, string> | AccountMeta<string>)[]> & {
        accounts: AccountMeta[];
        data: Uint8Array;
    };
}>;

Returns: policy, usage and the instruction. Accounts: authority (writable signer), maker, collateral mint, USDC mint, policy (writable), usage (writable), System program. Data: discriminator, then the settings (watcher 32, enabled 1, termsId 32, profileHash 32, maxOrderAtoms u64, maxReservedAtoms u64, maxReservedStrikeUsdc u64, lifetimePremiumLimitEnabled 1, lifetimePremiumLimitUsdc u64).

Fills on this mint still fail until bootstrapMintUsageV1 runs.

Throws:

import { initializeMintPolicyV1, JITOSOL_MINT, type MintPolicySettingsV1 } from '@covrfun/maker-sdk';

declare const authority: string;
declare const maker: string;
declare const settings: MintPolicySettingsV1; // from mintPolicySettingsFor
const { policy, usage, instruction } = await initializeMintPolicyV1({
  authority,
  maker,
  collateral: JITOSOL_MINT,
  settings,
});

#updateMintPolicyV1

Builds update_mint_policy_v1, which replaces every setting of one mint policy. It applies only if the policy is still at expectedGeneration; the generation then goes up by one.

export declare function updateMintPolicyV1(input: {
    authority: string;
    maker: string;
    collateral: string;
    expectedGeneration: bigint;
    settings: MintPolicySettingsV1;
}, d?: Deployment): Promise<{
    policy: Address;
    usage: Address;
    instruction: Instruction<string, readonly (import("@solana/kit").AccountLookupMeta<string, string> | AccountMeta<string>)[]> & {
        accounts: AccountMeta[];
        data: Uint8Array;
    };
}>;

Returns: policy, usage and the instruction. Accounts: authority (read-only signer), maker, collateral mint, USDC mint, policy (writable), usage. Data: discriminator, expectedGeneration (u64 LE), then the settings as in initializeMintPolicyV1.

If another update or a pause landed first, the generation has moved and the program refuses yours. Read the policy again and rebuild.

Throws: