SDK and Authority Boundaries
ameba-sdk is the current-only TypeScript and Rust integration surface for Amoeba Spread RC41. It is pinned by the Lean/Edge service, Petri, and the website.
Package entrypoints
Section titled “Package entrypoints”| Entry point | Purpose |
|---|---|
ameba-sdk/client |
Consumer-neutral HTTP reads and signed-transaction submission. |
ameba-sdk/protocol |
Current deployment identity, strict account decoders, PDA derivation, native builders, and portable writer/swap/Flat plan validation. |
ameba-sdk/operator |
Narrow current deployment/discovery and oracle-funding exports for controlled operator use. |
ameba-sdk/petri |
Shell-free adapter for the public Petri command manifest. |
What the SDK validates
Section titled “What the SDK validates”The protocol package owns the exact current:
- deployment and ProgramData identity;
- account lengths, discriminators, versions, stored bumps, and embedded parent identities;
- collective writer tags 220 through 248;
- collective DLMM tags 252 through 255;
- native instruction bytes and account-meta order;
- finalized-observation and prepared-plan digests;
- Light Token Flat custody and grouped cold-account load/transfer batches.
Unknown or removed instruction bytes are not compatibility aliases. They fail through the program’s generic invalid-instruction path before payload decoding or account access.
What the SDK does not decide
Section titled “What the SDK does not decide”Portable operation plans contain no independent financial formulas. The SDK does not decide reserve, payout, auction fills, close withdrawals, settlement liabilities, or oracle-security exposure.
Lean admits and explains semantic intent. The SDK reconstructs the exact current protocol operation. Spread recomputes or fully verifies every money-moving fact.
Finalized observation rule
Section titled “Finalized observation rule”Wallet software must independently reread every ordered account in a prepared plan at finalized commitment, verify the exact Devnet genesis and deployed program, compare the observation digest, rebuild the instructions, and only then sign.
Prepared batches are ordered, bounded, and single-use. A stale observation, changed account, mismatched byte, missing signer, altered writable set, expired blockhash, or deployment mismatch fails closed.
Current package identity
Section titled “Current package identity”The current SDK repository commit is f1a6d85342089e83f2bb751851125b8523b3ae58, pinned to Spread v0.1.0-rc.41 at commit deca99b480ec757d00d51c7c442ebf386d721c2f.
For runtime identity and readiness, read Current Devnet Release.