v0.1.0-pre.018

2026-07-24 19:34:54 +02:00
parent 3e1d034633
commit f965fcc58a
14 changed files with 8604 additions and 123 deletions
--- a/kb-lib/Cargo.toml
+++ b/kb-lib/Cargo.toml
@@ -1,5 +1,5 @@
 # file: kb-lib/Cargo.toml
-# version: 10
+# version: 11

 [package]
 name = "kb-lib"
@@ -9,6 +9,7 @@ license.workspace = true
 publish.workspace = true

 [dependencies]
+bytemuck.workspace = true
 base64.workspace = true
 borsh.workspace = true
 borsh_0_10.workspace = true
@@ -31,7 +32,12 @@ solana-stake-interface.workspace = true
 solana-system-interface.workspace = true
 solana-vote-interface.workspace = true
 solana-zk-elgamal-proof-interface.workspace = true
+solana-zk-sdk-pod.workspace = true
 spl-associated-token-account-interface.workspace = true
+spl-token-group-interface.workspace = true
+spl-token-metadata-interface.workspace = true
+spl-token-2022-interface.workspace = true
+spl-token-confidential-transfer-proof-extraction.workspace = true
 spl-memo-interface.workspace = true
 tracing.workspace = true
 ts-rs.workspace = true
@@ -42,7 +48,6 @@ solana-ed25519-program.workspace = true
 solana-secp256k1-program.workspace = true
 solana-secp256r1-program.workspace = true
 spl-elgamal-registry-interface.workspace = true
-spl-token-2022-interface.workspace = true
 spl-token-interface.workspace = true

 [lints]
--- a/kb-lib/src/executor.rs
+++ b/kb-lib/src/executor.rs
@@ -1,5 +1,5 @@
 // file: kb-lib/src/executor.rs
-// version: 5
+// version: 6

 //! Consolidated executor modules.

@@ -507,6 +507,206 @@ pub use self::spl::EX_SPL_MEMO_ADD_MEMO_OPERATION;
 pub use self::spl::EX_SPL_MEMO_MAX_MESSAGE_BYTES;
 /// Exposes the SPL Memo signer bound.
 pub use self::spl::EX_SPL_MEMO_MAX_SIGNERS;
+/// Exposes `EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_APPROVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BATCH_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_BATCH_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES`.
+pub use self::spl::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES`.
+pub use self::spl::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES`.
+pub use self::spl::EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES`.
+pub use self::spl::EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_MINT_TO_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PAUSE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_PAUSE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REALLOCATE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_REALLOCATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_RESUME_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_RESUME_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REVOKE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_REVOKE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES`.
+pub use self::spl::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES;
+/// Exposes `EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_TRANSFER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::spl::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION;
 /// Exposes the reserved `spl/account_compression` executor.
 pub use self::spl::ExSplAccountCompressionExecutor;
 /// Exposes the typed SPL ATA execution intent.
@@ -535,10 +735,48 @@ pub use self::spl::ExSplNoopExecutor;
 pub use self::spl::ExSplSinglePoolExecutor;
 /// Exposes the reserved `spl/stake_pool` executor.
 pub use self::spl::ExSplStakePoolExecutor;
-/// Exposes the reserved `spl/token2022` executor.
+/// Exposes `ExSplToken2022ExecutionIntent`.
+pub use self::spl::ExSplToken2022ExecutionIntent;
+/// Exposes `ExSplToken2022Executor`.
 pub use self::spl::ExSplToken2022Executor;
+/// Exposes `ExSplToken2022Operation`.
+pub use self::spl::ExSplToken2022Operation;
+/// Exposes `ExSplTokenAmount`.
+pub use self::spl::ExSplTokenAmount;
+/// Exposes `ExSplTokenAuthority`.
+pub use self::spl::ExSplTokenAuthority;
+/// Exposes `ExSplTokenAuthorityType`.
+pub use self::spl::ExSplTokenAuthorityType;
+/// Exposes `ExSplTokenConfidentialExecutorSupport`.
+pub use self::spl::ExSplTokenConfidentialExecutorSupport;
+/// Exposes `ExSplTokenConfidentialMintBurnOperation`.
+pub use self::spl::ExSplTokenConfidentialMintBurnOperation;
+/// Exposes `ExSplTokenConfidentialOperation`.
+pub use self::spl::ExSplTokenConfidentialOperation;
+/// Exposes `ExSplTokenConfidentialProofKind`.
+pub use self::spl::ExSplTokenConfidentialProofKind;
+/// Exposes `ExSplTokenConfidentialProofLocation`.
+pub use self::spl::ExSplTokenConfidentialProofLocation;
+/// Exposes `ExSplTokenConfidentialProofReference`.
+pub use self::spl::ExSplTokenConfidentialProofReference;
+/// Exposes `ExSplTokenDecryptableBalance`.
+pub use self::spl::ExSplTokenDecryptableBalance;
+/// Exposes `ExSplTokenDefaultAccountState`.
+pub use self::spl::ExSplTokenDefaultAccountState;
+/// Exposes `ExSplTokenElGamalCiphertext`.
+pub use self::spl::ExSplTokenElGamalCiphertext;
+/// Exposes `ExSplTokenElGamalPubkey`.
+pub use self::spl::ExSplTokenElGamalPubkey;
 /// Exposes the reserved `spl/token` executor.
 pub use self::spl::ExSplTokenExecutor;
+/// Exposes `ExSplTokenMetadataField`.
+pub use self::spl::ExSplTokenMetadataField;
+/// Exposes `ExSplTokenMultiplier`.
+pub use self::spl::ExSplTokenMultiplier;
+/// Exposes `ExSplTokenSingleOperation`.
+pub use self::spl::ExSplTokenSingleOperation;
+/// Exposes `executor_spl_token2022_validate_confidential_proof_references`.
+pub use self::spl::executor_spl_token2022_validate_confidential_proof_references;
 /// Exposes the reserved `stable/swap_hylo_exchange` executor.
 pub use self::stable::ExStableSwapHyloExchangeExecutor;
 /// Exposes the reserved `stable/swap_jupiter_stable` executor.
@@ -616,16 +854,26 @@ pub(crate) use self::solana::executor_solana_core_zk_elgamal_build_prepared_plan
 pub(crate) use self::spl::EX_SPL_ATA_TRACING_TARGET;
 /// Canonical SPL Memo tracing target.
 pub(crate) use self::spl::EX_SPL_MEMO_TRACING_TARGET;
+/// Maximum ordered multisig signer occurrences for SPL Token-2022.
+pub(crate) use self::spl::EX_SPL_TOKEN2022_MAX_MULTISIG_SIGNERS;
+/// Maximum transfer-fee source account count for SPL Token-2022.
+pub(crate) use self::spl::EX_SPL_TOKEN2022_MAX_TRANSFER_FEE_SOURCE_ACCOUNTS;
+/// Maximum UI amount byte length for SPL Token-2022.
+pub(crate) use self::spl::EX_SPL_TOKEN2022_MAX_UI_AMOUNT_BYTES;
+/// Canonical SPL Token-2022 tracing target.
+pub(crate) use self::spl::EX_SPL_TOKEN2022_TRACING_TARGET;
 /// Internal SPL ATA plan builder.
 pub(crate) use self::spl::executor_spl_ata_build_prepared_plan;
 /// Internal SPL Memo plan builder.
 pub(crate) use self::spl::executor_spl_memo_build_prepared_plan;
+/// Internal SPL Token-2022 prepared-plan builder.
+pub(crate) use self::spl::executor_spl_token2022_build_prepared_plan;

 #[cfg(test)]
 mod reserved_executor_tests {
    #[test]
    fn every_reserved_executor_is_registered_and_builds_only_an_empty_plan() {
-        let executors: [&dyn crate::ExApiInstructionExecutor; 101] = [
+        let executors: [&dyn crate::ExApiInstructionExecutor; 100] = [
            &crate::ExAdapterSaberDecimalWrapperExecutor,
            &crate::ExAdminJupiterLockExecutor,
            &crate::ExAdminPumpFeesExecutor,
@@ -709,7 +957,6 @@ mod reserved_executor_tests {
            &crate::ExSplSinglePoolExecutor,
            &crate::ExSplStakePoolExecutor,
            &crate::ExSplTokenExecutor,
-            &crate::ExSplToken2022Executor,
            &crate::ExStableSwapHyloExchangeExecutor,
            &crate::ExStableSwapJupiterStableExecutor,
            &crate::ExStableSwapNumeraireExecutor,
@@ -728,7 +975,7 @@ mod reserved_executor_tests {
            &crate::ExWalletJupiterApeproSmartWalletExecutor,
            &crate::ExWeightedSwapStabbleExecutor,
        ];
-        assert_eq!(executors.len(), 101);
+        assert_eq!(executors.len(), 100);
        for executor in executors {
            assert!(!executor.program_ids().is_empty());
            for program_id in executor.program_ids() {
--- a/kb-lib/src/executor/spl.rs
+++ b/kb-lib/src/executor/spl.rs
@@ -1,5 +1,5 @@
 // file: kb-lib/src/executor/spl.rs
-// version: 4
+// version: 5

 //! `spl` executor family.

@@ -12,6 +12,7 @@ mod single_pool;
 mod stake_pool;
 mod token;
 mod token2022;
+
 /// Exposes the reserved `spl/account_compression` executor.
 pub use self::account_compression::ExSplAccountCompressionExecutor;
 /// Exposes the idempotent ATA creation operation code.
@@ -56,8 +57,246 @@ pub use self::single_pool::ExSplSinglePoolExecutor;
 pub use self::stake_pool::ExSplStakePoolExecutor;
 /// Exposes the reserved `spl/token` executor.
 pub use self::token::ExSplTokenExecutor;
-/// Exposes the reserved `spl/token2022` executor.
+/// Exposes `EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_APPROVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BATCH_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_BATCH_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES`.
+pub use self::token2022::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES`.
+pub use self::token2022::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES`.
+pub use self::token2022::EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES`.
+pub use self::token2022::EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_MINT_TO_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PAUSE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_PAUSE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REALLOCATE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_REALLOCATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_RESUME_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_RESUME_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REVOKE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_REVOKE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES`.
+pub use self::token2022::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES;
+/// Exposes `EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_TRANSFER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::token2022::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `ExSplToken2022ExecutionIntent`.
+pub use self::token2022::ExSplToken2022ExecutionIntent;
+/// Exposes `ExSplToken2022Executor`.
 pub use self::token2022::ExSplToken2022Executor;
+/// Exposes `ExSplToken2022Operation`.
+pub use self::token2022::ExSplToken2022Operation;
+/// Exposes `ExSplTokenAmount`.
+pub use self::token2022::ExSplTokenAmount;
+/// Exposes `ExSplTokenAuthority`.
+pub use self::token2022::ExSplTokenAuthority;
+/// Exposes `ExSplTokenAuthorityType`.
+pub use self::token2022::ExSplTokenAuthorityType;
+/// Exposes `ExSplTokenConfidentialExecutorSupport`.
+pub use self::token2022::ExSplTokenConfidentialExecutorSupport;
+/// Exposes `ExSplTokenConfidentialMintBurnOperation`.
+pub use self::token2022::ExSplTokenConfidentialMintBurnOperation;
+/// Exposes `ExSplTokenConfidentialOperation`.
+pub use self::token2022::ExSplTokenConfidentialOperation;
+/// Exposes `ExSplTokenConfidentialProofKind`.
+pub use self::token2022::ExSplTokenConfidentialProofKind;
+/// Exposes `ExSplTokenConfidentialProofLocation`.
+pub use self::token2022::ExSplTokenConfidentialProofLocation;
+/// Exposes `ExSplTokenConfidentialProofReference`.
+pub use self::token2022::ExSplTokenConfidentialProofReference;
+/// Exposes `ExSplTokenDecryptableBalance`.
+pub use self::token2022::ExSplTokenDecryptableBalance;
+/// Exposes `ExSplTokenDefaultAccountState`.
+pub use self::token2022::ExSplTokenDefaultAccountState;
+/// Exposes `ExSplTokenElGamalCiphertext`.
+pub use self::token2022::ExSplTokenElGamalCiphertext;
+/// Exposes `ExSplTokenElGamalPubkey`.
+pub use self::token2022::ExSplTokenElGamalPubkey;
+/// Exposes `ExSplTokenMetadataField`.
+pub use self::token2022::ExSplTokenMetadataField;
+/// Exposes `ExSplTokenMultiplier`.
+pub use self::token2022::ExSplTokenMultiplier;
+/// Exposes `ExSplTokenSingleOperation`.
+pub use self::token2022::ExSplTokenSingleOperation;
+/// Exposes `executor_spl_token2022_validate_confidential_proof_references`.
+pub use self::token2022::executor_spl_token2022_validate_confidential_proof_references;

 /// Canonical SPL ATA tracing target.
 pub(crate) use self::associated_token_account::EX_SPL_ATA_TRACING_TARGET;
@@ -67,3 +306,13 @@ pub(crate) use self::associated_token_account::executor_spl_ata_build_prepared_p
 pub(crate) use self::memo::EX_SPL_MEMO_TRACING_TARGET;
 /// Internal SPL Memo plan builder.
 pub(crate) use self::memo::executor_spl_memo_build_prepared_plan;
+/// Maximum ordered multisig signer occurrences for SPL Token-2022.
+pub(crate) use self::token2022::EX_SPL_TOKEN2022_MAX_MULTISIG_SIGNERS;
+/// Maximum transfer-fee source account count for SPL Token-2022.
+pub(crate) use self::token2022::EX_SPL_TOKEN2022_MAX_TRANSFER_FEE_SOURCE_ACCOUNTS;
+/// Maximum UI amount byte length for SPL Token-2022.
+pub(crate) use self::token2022::EX_SPL_TOKEN2022_MAX_UI_AMOUNT_BYTES;
+/// Canonical SPL Token-2022 tracing target.
+pub(crate) use self::token2022::EX_SPL_TOKEN2022_TRACING_TARGET;
+/// Internal SPL Token-2022 prepared-plan builder.
+pub(crate) use self::token2022::executor_spl_token2022_build_prepared_plan;
--- a/kb-lib/src/executor/spl/token2022.rs
+++ b/kb-lib/src/executor/spl/token2022.rs
@@ -1,49 +1,261 @@
 // file: kb-lib/src/executor/spl/token2022.rs
-// version: 2
+// version: 3

-//! Reserved executor for `spl_token2022`.
+//! SPL Token-2022 executor.

-/// Reserved executor for the `spl_token2022` program surface.
-#[derive(Clone, Debug, Default)]
-pub struct ExSplToken2022Executor;
+mod builder;
+mod confidential;
+mod constants;
+mod executor;
+mod intent;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG`.
+pub use self::confidential::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES`.
+pub use self::confidential::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES`.
+pub use self::confidential::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG`.
+pub use self::confidential::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG;
+/// Exposes `EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES`.
+pub use self::confidential::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES`.
+pub use self::confidential::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES`.
+pub use self::confidential::EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES`.
+pub use self::confidential::EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES;
+/// Exposes `ExSplTokenConfidentialExecutorSupport`.
+pub use self::confidential::ExSplTokenConfidentialExecutorSupport;
+/// Exposes `ExSplTokenConfidentialMintBurnOperation`.
+pub use self::confidential::ExSplTokenConfidentialMintBurnOperation;
+/// Exposes `ExSplTokenConfidentialOperation`.
+pub use self::confidential::ExSplTokenConfidentialOperation;
+/// Exposes `ExSplTokenConfidentialProofKind`.
+pub use self::confidential::ExSplTokenConfidentialProofKind;
+/// Exposes `ExSplTokenConfidentialProofLocation`.
+pub use self::confidential::ExSplTokenConfidentialProofLocation;
+/// Exposes `ExSplTokenConfidentialProofReference`.
+pub use self::confidential::ExSplTokenConfidentialProofReference;
+/// Exposes `ExSplTokenDecryptableBalance`.
+pub use self::confidential::ExSplTokenDecryptableBalance;
+/// Exposes `ExSplTokenElGamalCiphertext`.
+pub use self::confidential::ExSplTokenElGamalCiphertext;
+/// Exposes `ExSplTokenElGamalPubkey`.
+pub use self::confidential::ExSplTokenElGamalPubkey;
+/// Exposes `executor_spl_token2022_validate_confidential_proof_references`.
+pub use self::confidential::executor_spl_token2022_validate_confidential_proof_references;
+/// Exposes `ExSplToken2022Executor`.
+pub use self::executor::ExSplToken2022Executor;
+/// Exposes `EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_APPROVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BATCH_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_BATCH_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_MINT_TO_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PAUSE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_PAUSE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REALLOCATE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_REALLOCATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_RESUME_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_RESUME_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REVOKE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_REVOKE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES`.
+pub use self::intent::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES;
+/// Exposes `EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_TRANSFER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::intent::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `ExSplToken2022ExecutionIntent`.
+pub use self::intent::ExSplToken2022ExecutionIntent;
+/// Exposes `ExSplToken2022Operation`.
+pub use self::intent::ExSplToken2022Operation;
+/// Exposes `ExSplTokenAmount`.
+pub use self::intent::ExSplTokenAmount;
+/// Exposes `ExSplTokenAuthority`.
+pub use self::intent::ExSplTokenAuthority;
+/// Exposes `ExSplTokenAuthorityType`.
+pub use self::intent::ExSplTokenAuthorityType;
+/// Exposes `ExSplTokenDefaultAccountState`.
+pub use self::intent::ExSplTokenDefaultAccountState;
+/// Exposes `ExSplTokenMetadataField`.
+pub use self::intent::ExSplTokenMetadataField;
+/// Exposes `ExSplTokenMultiplier`.
+pub use self::intent::ExSplTokenMultiplier;
+/// Exposes `ExSplTokenSingleOperation`.
+pub use self::intent::ExSplTokenSingleOperation;

-impl crate::ExApiInstructionExecutor for crate::ExSplToken2022Executor {
-    fn executor_name(&self) -> &'static str {
-        return "kb_executor_spl_token2022";
-    }
-
-    fn executor_version(&self) -> &'static str {
-        return env!("CARGO_PKG_VERSION");
-    }
-
-    fn program_ids(&self) -> &'static [&'static str] {
-        return &[kb_program_ids::SPL_TOKEN2022_PROGRAM_ID];
-    }
-
-    fn supports_request(
-        &self,
-        request: &crate::ExApiExecutionRequest,
-    ) -> crate::ExApiExecutionSupport {
-        if crate::ExApiInstructionExecutor::handles_program_id(self, &request.program_id) {
-            return crate::ExApiExecutionSupport::Maybe;
-        }
-        return crate::ExApiExecutionSupport::No;
-    }
-
-    fn build_plan(
-        &self,
-        _request: &crate::ExApiExecutionRequest,
-    ) -> kb_core::Result<crate::ExApiExecutionPlan> {
-        let payload_json = match crate::executor_api_serialize_payload_json(
-            &serde_json::json!({"status":"reserved_executor","surface":"spl_token2022"}),
-        ) {
-            std::result::Result::Ok(serialized) => serialized,
-            std::result::Result::Err(error) => return std::result::Result::Err(error),
-        };
-        return std::result::Result::Ok(crate::ExApiExecutionPlan {
-            executor_name: "kb_executor_spl_token2022".to_string(),
-            instruction_count: 0,
-            payload_json,
-        });
-    }
-}
+/// Internal SPL Token-2022 prepared-plan builder.
+pub(crate) use self::builder::executor_spl_token2022_build_prepared_plan;
+/// Maximum ordered multisig signer occurrences.
+pub(crate) use self::constants::EX_SPL_TOKEN2022_MAX_MULTISIG_SIGNERS;
+/// Maximum transfer-fee source account count.
+pub(crate) use self::constants::EX_SPL_TOKEN2022_MAX_TRANSFER_FEE_SOURCE_ACCOUNTS;
+/// Maximum UI amount byte length.
+pub(crate) use self::constants::EX_SPL_TOKEN2022_MAX_UI_AMOUNT_BYTES;
+/// Canonical SPL Token-2022 tracing target.
+pub(crate) use self::constants::EX_SPL_TOKEN2022_TRACING_TARGET;
--- a/kb-lib/src/executor/spl/token2022/builder.rs
+++ b/kb-lib/src/executor/spl/token2022/builder.rs
--- a/kb-lib/src/executor/spl/token2022/confidential.rs
+++ b/kb-lib/src/executor/spl/token2022/confidential.rs
@@ -0,0 +1,601 @@
+// file: kb-lib/src/executor/spl/token2022/confidential.rs
+// version: 8
+
+//! Audited Confidential Transfer execution contracts.
+
+use ts_rs::TS; // rust-rules: derive-import
+
+/// Maximum number of proof references accepted by one confidential operation.
+pub const EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES: usize = 5;
+/// Exact byte length of an ElGamal public key accepted from callers.
+pub const EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES: usize = 32;
+/// Exact byte length of one decryptable authenticated balance ciphertext.
+pub const EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES: usize = 36;
+/// Exact byte length of one ElGamal ciphertext accepted from callers.
+pub const EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES: usize = 64;
+/// Token-2022 outer tag shared by all Confidential Transfer instructions.
+pub const EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG: u8 = 27;
+/// Confidential Transfer subtag published for `TransferWithFee`.
+pub const EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG: u8 = 13;
+/// Exact payload bytes after the two instruction discriminants for `TransferWithFee`.
+pub const EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES: usize =
+    EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES
+        + (EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES * 2)
+        + EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES;
+/// Exact total Token-2022 instruction-data bytes for `TransferWithFee`.
+pub const EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES: usize =
+    2 + EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES;
+
+/// Caller-generated ElGamal public key encoded as lowercase or uppercase hexadecimal.
+#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenElGamalPubkey.ts"
+)]
+pub struct ExSplTokenElGamalPubkey(pub std::string::String);
+
+impl ExSplTokenElGamalPubkey {
+    pub(crate) fn parse(
+        &self,
+    ) -> Result<solana_zk_sdk_pod::encryption::elgamal::PodElGamalPubkey, std::string::String> {
+        let bytes = match decode_exact_hex(
+            &self.0,
+            EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES,
+            "ElGamal public key",
+        ) {
+            Ok(value) => value,
+            Err(error) => return Err(error),
+        };
+        let array = match <[u8; EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES]>::try_from(bytes.as_slice())
+        {
+            Ok(value) => value,
+            Err(_) => return Err("ElGamal public key has an invalid length".to_owned()),
+        };
+        return Ok(bytemuck::pod_read_unaligned(array.as_slice()));
+    }
+}
+
+/// Caller-generated decryptable balance encoded as hexadecimal bytes.
+#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenDecryptableBalance.ts"
+)]
+pub struct ExSplTokenDecryptableBalance(pub std::string::String);
+
+impl ExSplTokenDecryptableBalance {
+    pub(crate) fn parse(
+        &self,
+    ) -> Result<solana_zk_sdk_pod::encryption::auth_encryption::PodAeCiphertext, std::string::String>
+    {
+        let bytes = match decode_exact_hex(
+            &self.0,
+            EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES,
+            "decryptable balance",
+        ) {
+            Ok(value) => value,
+            Err(error) => return Err(error),
+        };
+        let array =
+            match <[u8; EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES]>::try_from(bytes.as_slice()) {
+                Ok(value) => value,
+                Err(_) => return Err("decryptable balance has an invalid length".to_owned()),
+            };
+        return Ok(bytemuck::pod_read_unaligned(array.as_slice()));
+    }
+}
+
+/// Caller-generated ElGamal ciphertext encoded as hexadecimal bytes.
+#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenElGamalCiphertext.ts"
+)]
+pub struct ExSplTokenElGamalCiphertext(pub std::string::String);
+
+impl ExSplTokenElGamalCiphertext {
+    pub(crate) fn parse(
+        &self,
+    ) -> Result<solana_zk_sdk_pod::encryption::elgamal::PodElGamalCiphertext, std::string::String>
+    {
+        let bytes = match decode_exact_hex(
+            &self.0,
+            EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES,
+            "ElGamal ciphertext",
+        ) {
+            Ok(value) => value,
+            Err(error) => return Err(error),
+        };
+        let array =
+            match <[u8; EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES]>::try_from(bytes.as_slice()) {
+                Ok(value) => value,
+                Err(_) => return Err("ElGamal ciphertext has an invalid length".to_owned()),
+            };
+        return Ok(bytemuck::pod_read_unaligned(array.as_slice()));
+    }
+}
+
+fn decode_exact_hex(
+    value: &str,
+    expected_bytes: usize,
+    label: &str,
+) -> Result<std::vec::Vec<u8>, std::string::String> {
+    if value.len() != expected_bytes.saturating_mul(2) {
+        return Err(format!(
+            "{label} must contain exactly {expected_bytes} bytes encoded as hexadecimal"
+        ));
+    }
+    let input = value.as_bytes();
+    let mut output = std::vec::Vec::with_capacity(expected_bytes);
+    let mut index = 0usize;
+    while index < input.len() {
+        let high = match decode_hex_nibble(input[index]) {
+            Some(v) => v,
+            None => return Err(format!("{label} contains a non-hexadecimal character")),
+        };
+        let low = match decode_hex_nibble(input[index + 1]) {
+            Some(v) => v,
+            None => return Err(format!("{label} contains a non-hexadecimal character")),
+        };
+        output.push((high << 4) | low);
+        index += 2;
+    }
+    return Ok(output);
+}
+
+fn decode_hex_nibble(value: u8) -> Option<u8> {
+    return match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        b'A'..=b'F' => Some(value - b'A' + 10),
+        _ => None,
+    };
+}
+
+/// Proof statement required by a Confidential Transfer operation.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialProofKind.ts"
+)]
+pub enum ExSplTokenConfidentialProofKind {
+    /// ElGamal public-key validity.
+    PubkeyValidity,
+    /// Zero-ciphertext proof used before account closure.
+    ZeroCiphertext,
+    /// Ciphertext-commitment equality.
+    CiphertextCommitmentEquality,
+    /// Ciphertext-ciphertext equality used by confidential fee withdrawals.
+    CiphertextCiphertextEquality,
+    /// Batched grouped-ciphertext validity with three decryption handles.
+    BatchedGroupedCiphertext3HandlesValidity,
+    /// Batched grouped-ciphertext validity with two decryption handles.
+    BatchedGroupedCiphertext2HandlesValidity,
+    /// Percentage-with-fee sigma proof.
+    PercentageWithFee,
+    /// Batched 64-bit range proof.
+    BatchedRangeProofU64,
+    /// Batched 128-bit range proof.
+    BatchedRangeProofU128,
+    /// Batched 256-bit range proof.
+    BatchedRangeProofU256,
+}
+
+/// Explicit source for one already-generated zero-knowledge proof statement.
+#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "snake_case", tag = "mode")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialProofLocation.ts"
+)]
+pub enum ExSplTokenConfidentialProofLocation {
+    /// Relative transaction offset of a separate ZK proof-program instruction.
+    InstructionOffset {
+        /// Non-zero signed relative instruction offset.
+        offset: i8,
+    },
+    /// Account containing a previously verified proof context state.
+    ContextStateAccount {
+        /// Proof context-state account.
+        account: crate::MdPubkey,
+    },
+}
+
+impl ExSplTokenConfidentialProofLocation {
+    /// Validates the mode-specific proof-location contract.
+    pub fn validate(&self) -> Result<(), std::string::String> {
+        return match self {
+            Self::InstructionOffset { offset } if *offset == 0 => Err(
+                "an inline proof instruction offset must be non-zero; zero is reserved for a context-state account"
+                    .to_owned(),
+            ),
+            Self::InstructionOffset { .. } | Self::ContextStateAccount { .. } => Ok(()),
+        };
+    }
+}
+
+/// One proof requirement paired with its explicit location.
+#[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialProofReference.ts"
+)]
+pub struct ExSplTokenConfidentialProofReference {
+    /// Exact proof statement required by the Token-2022 builder.
+    pub kind: ExSplTokenConfidentialProofKind,
+    /// Inline-instruction or context-state source.
+    pub location: ExSplTokenConfidentialProofLocation,
+}
+
+/// Audited Confidential Transfer operation surface.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialOperation.ts"
+)]
+pub enum ExSplTokenConfidentialOperation {
+    /// Initialize confidential-transfer mint configuration.
+    InitializeMint,
+    /// Update confidential-transfer mint configuration.
+    UpdateMint,
+    /// Configure a token account with an ElGamal key.
+    ConfigureAccount,
+    /// Approve a configured account.
+    ApproveAccount,
+    /// Empty the available ciphertext before closing an account.
+    EmptyAccount,
+    /// Deposit public tokens into pending confidential balance.
+    Deposit,
+    /// Withdraw confidential balance into public balance.
+    Withdraw,
+    /// Transfer confidentially without a transfer fee.
+    Transfer,
+    /// Apply pending balance credits.
+    ApplyPendingBalance,
+    /// Enable confidential credits.
+    EnableConfidentialCredits,
+    /// Disable confidential credits.
+    DisableConfidentialCredits,
+    /// Enable non-confidential credits.
+    EnableNonConfidentialCredits,
+    /// Disable non-confidential credits.
+    DisableNonConfidentialCredits,
+    /// Transfer confidentially with fee proofs.
+    TransferWithFee,
+    /// Configure an account through an ElGamal Registry account.
+    ConfigureAccountWithRegistry,
+}
+
+impl ExSplTokenConfidentialOperation {
+    /// Returns the ordered proof statements required by the official builder.
+    pub fn required_proofs(&self) -> &'static [ExSplTokenConfidentialProofKind] {
+        return match self {
+            Self::ConfigureAccount | Self::ConfigureAccountWithRegistry => {
+                &[ExSplTokenConfidentialProofKind::PubkeyValidity]
+            },
+            Self::EmptyAccount => &[ExSplTokenConfidentialProofKind::ZeroCiphertext],
+            Self::Withdraw => &[
+                ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                ExSplTokenConfidentialProofKind::BatchedRangeProofU64,
+            ],
+            Self::Transfer => &[
+                ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                ExSplTokenConfidentialProofKind::BatchedRangeProofU128,
+            ],
+            Self::TransferWithFee => &[
+                ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                ExSplTokenConfidentialProofKind::PercentageWithFee,
+                ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext2HandlesValidity,
+                ExSplTokenConfidentialProofKind::BatchedRangeProofU256,
+            ],
+            Self::InitializeMint
+            | Self::UpdateMint
+            | Self::ApproveAccount
+            | Self::Deposit
+            | Self::ApplyPendingBalance
+            | Self::EnableConfidentialCredits
+            | Self::DisableConfidentialCredits
+            | Self::EnableNonConfidentialCredits
+            | Self::DisableNonConfidentialCredits => &[],
+        };
+    }
+
+    /// Indicates whether the Token-2022 instruction can be constructed without secret material.
+    pub fn executor_support(&self) -> ExSplTokenConfidentialExecutorSupport {
+        return match self {
+            Self::InitializeMint
+            | Self::UpdateMint
+            | Self::ApproveAccount
+            | Self::Deposit
+            | Self::ApplyPendingBalance
+            | Self::EnableConfidentialCredits
+            | Self::DisableConfidentialCredits
+            | Self::EnableNonConfidentialCredits
+            | Self::DisableNonConfidentialCredits => {
+                ExSplTokenConfidentialExecutorSupport::PublicBuilderReady
+            },
+            Self::ConfigureAccount
+            | Self::EmptyAccount
+            | Self::Withdraw
+            | Self::Transfer
+            | Self::TransferWithFee
+            | Self::ConfigureAccountWithRegistry => {
+                ExSplTokenConfidentialExecutorSupport::RequiresCallerGeneratedCryptographicInputs
+            },
+        };
+    }
+}
+
+/// Audited Confidential Mint/Burn operation surface.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialMintBurnOperation.ts"
+)]
+pub enum ExSplTokenConfidentialMintBurnOperation {
+    /// Initialize the mint extension with supply encryption material.
+    InitializeMint,
+    /// Rotate the supply ElGamal public key.
+    RotateSupplyElGamalPubkey,
+    /// Replace the caller-maintained decryptable supply.
+    UpdateDecryptableSupply,
+    /// Mint tokens directly into a confidential token account.
+    Mint,
+    /// Burn tokens from a confidential token account.
+    Burn,
+    /// Aggregate the pending burn ciphertext into confidential supply.
+    ApplyPendingBurn,
+}
+
+impl ExSplTokenConfidentialMintBurnOperation {
+    /// Returns the published subdiscriminant.
+    pub fn subtag(&self) -> u8 {
+        return match self {
+            Self::InitializeMint => 0,
+            Self::RotateSupplyElGamalPubkey => 1,
+            Self::UpdateDecryptableSupply => 2,
+            Self::Mint => 3,
+            Self::Burn => 4,
+            Self::ApplyPendingBurn => 5,
+        };
+    }
+
+    /// Returns the ordered proof statements required by the official builder.
+    pub fn required_proofs(&self) -> &'static [ExSplTokenConfidentialProofKind] {
+        return match self {
+            Self::RotateSupplyElGamalPubkey => {
+                &[ExSplTokenConfidentialProofKind::CiphertextCiphertextEquality]
+            },
+            Self::Mint | Self::Burn => &[
+                ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                ExSplTokenConfidentialProofKind::BatchedRangeProofU128,
+            ],
+            Self::InitializeMint | Self::UpdateDecryptableSupply | Self::ApplyPendingBurn => &[],
+        };
+    }
+
+    /// Classifies whether the caller must supply cryptographic material.
+    pub fn executor_support(&self) -> ExSplTokenConfidentialExecutorSupport {
+        return match self {
+            Self::UpdateDecryptableSupply | Self::ApplyPendingBurn => {
+                ExSplTokenConfidentialExecutorSupport::PublicBuilderReady
+            },
+            Self::InitializeMint | Self::RotateSupplyElGamalPubkey | Self::Mint | Self::Burn => {
+                ExSplTokenConfidentialExecutorSupport::RequiresCallerGeneratedCryptographicInputs
+            },
+        };
+    }
+}
+
+/// Executor-readiness classification established by the Confidential Transfer audit.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_executor_spl_token_2022/confidential/ExSplTokenConfidentialExecutorSupport.ts"
+)]
+pub enum ExSplTokenConfidentialExecutorSupport {
+    /// The builder needs only public fields and ordinary authorities.
+    PublicBuilderReady,
+    /// The caller must provide ciphertexts, decryptable balances and/or proof data generated outside this executor.
+    RequiresCallerGeneratedCryptographicInputs,
+}
+
+/// Validates an ordered proof-reference list against the audited operation contract.
+pub fn executor_spl_token2022_validate_confidential_proof_references(
+    operation: ExSplTokenConfidentialOperation,
+    references: &[ExSplTokenConfidentialProofReference],
+) -> Result<(), std::string::String> {
+    let required = operation.required_proofs();
+    if references.len() > EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES {
+        return Err("too many confidential proof references".to_owned());
+    }
+    if references.len() != required.len() {
+        return Err(
+            "confidential proof reference count does not match the operation contract".to_owned()
+        );
+    }
+    for (index, reference) in references.iter().enumerate() {
+        if let Err(error) = reference.location.validate() {
+            return Err(error);
+        }
+        if reference.kind != required[index] {
+            return Err(
+                "confidential proof references are not in the official builder order".to_owned()
+            );
+        }
+    }
+    return Ok(());
+}
+
+#[cfg(test)]
+mod tests {
+
+    #[test]
+    fn audit_partitions_public_builders_from_caller_generated_cryptographic_inputs() {
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::Deposit.executor_support(),
+            super::ExSplTokenConfidentialExecutorSupport::PublicBuilderReady
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::Transfer.executor_support(),
+            super::ExSplTokenConfidentialExecutorSupport::RequiresCallerGeneratedCryptographicInputs
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::ConfigureAccountWithRegistry.executor_support(),
+            super::ExSplTokenConfidentialExecutorSupport::RequiresCallerGeneratedCryptographicInputs
+        );
+    }
+
+    #[test]
+    fn opaque_public_inputs_require_exact_hex_lengths() {
+        let pubkey = super::ExSplTokenElGamalPubkey(
+            "11".repeat(super::EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES),
+        );
+        assert!(pubkey.parse().is_ok());
+        let balance = super::ExSplTokenDecryptableBalance(
+            "22".repeat(super::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES),
+        );
+        assert!(balance.parse().is_ok());
+        assert!(super::ExSplTokenElGamalPubkey("00".repeat(31)).parse().is_err());
+        assert!(super::ExSplTokenDecryptableBalance("zz".repeat(36)).parse().is_err());
+        let ciphertext = super::ExSplTokenElGamalCiphertext(
+            "33".repeat(super::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES),
+        );
+        assert!(ciphertext.parse().is_ok());
+        assert!(super::ExSplTokenElGamalCiphertext("33".repeat(63)).parse().is_err());
+    }
+
+    #[test]
+    fn proof_inventory_preserves_official_transfer_and_fee_order() {
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::Transfer.required_proofs(),
+            &[
+                super::ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                super::ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                super::ExSplTokenConfidentialProofKind::BatchedRangeProofU128,
+            ]
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::TransferWithFee.required_proofs(),
+            &[
+                super::ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                super::ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                super::ExSplTokenConfidentialProofKind::PercentageWithFee,
+                super::ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext2HandlesValidity,
+                super::ExSplTokenConfidentialProofKind::BatchedRangeProofU256,
+            ]
+        );
+    }
+
+    #[test]
+    fn transfer_with_fee_audit_matches_official_wire_and_requires_no_extra_token_payload_ciphertext()
+     {
+        assert_eq!(super::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG, 27);
+        assert_eq!(super::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG, 13);
+        assert_eq!(super::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES, 169);
+        assert_eq!(
+            super::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES,
+            171
+        );
+        assert_eq!(
+            core::mem::size_of::<
+                spl_token_2022_interface::extension::confidential_transfer::instruction::TransferWithFeeInstructionData,
+            >(),
+            super::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialOperation::TransferWithFee.required_proofs().len(),
+            super::EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES
+        );
+        let decryptable_balance = super::ExSplTokenDecryptableBalance(
+            "44".repeat(super::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES),
+        );
+        let auditor_ciphertext_lo = super::ExSplTokenElGamalCiphertext(
+            "55".repeat(super::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES),
+        );
+        let auditor_ciphertext_hi = super::ExSplTokenElGamalCiphertext(
+            "66".repeat(super::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES),
+        );
+        assert!(decryptable_balance.parse().is_ok());
+        assert!(auditor_ciphertext_lo.parse().is_ok());
+        assert!(auditor_ciphertext_hi.parse().is_ok());
+    }
+
+    #[test]
+    fn confidential_mint_burn_audit_matches_published_subtags_proofs_and_support() {
+        assert_eq!(super::ExSplTokenConfidentialMintBurnOperation::InitializeMint.subtag(), 0);
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::RotateSupplyElGamalPubkey.subtag(),
+            1
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::UpdateDecryptableSupply.subtag(),
+            2
+        );
+        assert_eq!(super::ExSplTokenConfidentialMintBurnOperation::Mint.subtag(), 3);
+        assert_eq!(super::ExSplTokenConfidentialMintBurnOperation::Burn.subtag(), 4);
+        assert_eq!(super::ExSplTokenConfidentialMintBurnOperation::ApplyPendingBurn.subtag(), 5);
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::RotateSupplyElGamalPubkey
+                .required_proofs(),
+            &[super::ExSplTokenConfidentialProofKind::CiphertextCiphertextEquality]
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::Mint.required_proofs(),
+            &[
+                super::ExSplTokenConfidentialProofKind::CiphertextCommitmentEquality,
+                super::ExSplTokenConfidentialProofKind::BatchedGroupedCiphertext3HandlesValidity,
+                super::ExSplTokenConfidentialProofKind::BatchedRangeProofU128,
+            ]
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::Burn.required_proofs(),
+            super::ExSplTokenConfidentialMintBurnOperation::Mint.required_proofs()
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::ApplyPendingBurn.executor_support(),
+            super::ExSplTokenConfidentialExecutorSupport::PublicBuilderReady
+        );
+        assert_eq!(
+            super::ExSplTokenConfidentialMintBurnOperation::Mint.executor_support(),
+            super::ExSplTokenConfidentialExecutorSupport::RequiresCallerGeneratedCryptographicInputs
+        );
+    }
+
+    #[test]
+    fn proof_locations_keep_inline_and_context_state_modes_unambiguous() {
+        let context_account = crate::MdPubkey("11111111111111111111111111111111".to_owned());
+        let references = vec![super::ExSplTokenConfidentialProofReference {
+            kind: super::ExSplTokenConfidentialProofKind::ZeroCiphertext,
+            location: super::ExSplTokenConfidentialProofLocation::ContextStateAccount {
+                account: context_account,
+            },
+        }];
+        assert!(
+            super::executor_spl_token2022_validate_confidential_proof_references(
+                super::ExSplTokenConfidentialOperation::EmptyAccount,
+                &references
+            )
+            .is_ok()
+        );
+        let invalid = vec![super::ExSplTokenConfidentialProofReference {
+            kind: super::ExSplTokenConfidentialProofKind::ZeroCiphertext,
+            location: super::ExSplTokenConfidentialProofLocation::InstructionOffset { offset: 0 },
+        }];
+        assert!(
+            super::executor_spl_token2022_validate_confidential_proof_references(
+                super::ExSplTokenConfidentialOperation::EmptyAccount,
+                &invalid
+            )
+            .is_err()
+        );
+    }
+}
--- a/kb-lib/src/executor/spl/token2022/constants.rs
+++ b/kb-lib/src/executor/spl/token2022/constants.rs
@@ -0,0 +1,13 @@
+// file: kb-lib/src/executor/spl/token2022/constants.rs
+// version: 5
+
+//! Local constants for the `kb_executor_spl_token_2022` crate. Program identifiers live in `kb_program_ids`.
+
+/// Maximum number of ordered multisig signer occurrences.
+pub(crate) const EX_SPL_TOKEN2022_MAX_MULTISIG_SIGNERS: usize = 11;
+/// Maximum UI amount string length accepted before transaction assembly.
+pub(crate) const EX_SPL_TOKEN2022_MAX_UI_AMOUNT_BYTES: usize = 255;
+/// Maximum ordered token accounts accepted by transfer-fee harvest or withdraw builders.
+pub(crate) const EX_SPL_TOKEN2022_MAX_TRANSFER_FEE_SOURCE_ACCOUNTS: usize = 255;
+/// Canonical tracing target for this crate.
+pub(crate) const EX_SPL_TOKEN2022_TRACING_TARGET: &str = "kb-lib.executor.spl.token2022";
--- a/kb-lib/src/executor/spl/token2022/executor.rs
+++ b/kb-lib/src/executor/spl/token2022/executor.rs
@@ -0,0 +1,333 @@
+// file: kb-lib/src/executor/spl/token2022/executor.rs
+// version: 20
+
+//! Exact Token-2022 capability dispatch and typed plan construction.
+
+/// Token-2022 executor implementation.
+#[derive(Clone, Debug, Default)]
+pub struct ExSplToken2022Executor;
+
+impl crate::ExSplToken2022Executor {
+    fn exact_capability(
+        &self,
+        program_id: &crate::MdProgramId,
+        operation_code: &str,
+    ) -> crate::ExApiExecutionCapability {
+        if program_id.0 != kb_program_ids::SPL_TOKEN2022_PROGRAM_ID {
+            return crate::ExApiExecutionCapability::unsupported(
+                "execution_spl_token_2022_program_not_owned",
+                format!("program {} is not owned by kb_executor_spl_token_2022", program_id.0),
+            );
+        }
+        if crate::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES.contains(&operation_code) {
+            return crate::ExApiExecutionCapability::supported(operation_code);
+        }
+        if operation_code == crate::EX_SPL_TOKEN2022_BATCH_OPERATION {
+            return crate::ExApiExecutionCapability::unsupported(
+                "execution_spl_token_2022_batch_builder_unavailable",
+                "Token-2022 Batch is decode-only because spl-token-2022-interface 3.1.1 publishes no official Batch builder",
+            );
+        }
+        if matches!(
+            operation_code,
+            "spl_token_2022.initialize_mint_with_rent"
+                | "spl_token_2022.initialize_account_with_rent"
+                | "spl_token_2022.initialize_multisig_with_rent"
+                | "spl_token_2022.initialize_account2"
+        ) {
+            return crate::ExApiExecutionCapability::unsupported(
+                "execution_spl_token_2022_historical_variant_decode_only",
+                format!(
+                    "SPL Token operation {operation_code} is an obsolete historical initialization variant; use the current no-Rent operation"
+                ),
+            );
+        }
+        return crate::ExApiExecutionCapability::unsupported(
+            "execution_spl_token_2022_operation_unsupported",
+            format!("SPL Token operation {operation_code} is not implemented"),
+        );
+    }
+}
+
+impl crate::ExApiTypedInstructionExecutor for crate::ExSplToken2022Executor {
+    type Intent = crate::ExSplToken2022ExecutionIntent;
+
+    fn capability(
+        &self,
+        program_id: &crate::MdProgramId,
+        operation_code: &str,
+    ) -> crate::ExApiExecutionCapability {
+        return self.exact_capability(program_id, operation_code);
+    }
+
+    fn build_prepared_plan(
+        &self,
+        intent: &Self::Intent,
+    ) -> kb_core::Result<crate::ExApiPreparedExecutionPlan> {
+        let program_id =
+            crate::MdProgramId(std::string::String::from(kb_program_ids::SPL_TOKEN2022_PROGRAM_ID));
+        return match self.exact_capability(&program_id, intent.operation.operation_code()) {
+            crate::ExApiExecutionCapability::Supported { operation_code: _ } => {
+                crate::executor_spl_token2022_build_prepared_plan(intent)
+            },
+            crate::ExApiExecutionCapability::Unsupported { reason_code, reason } => {
+                std::result::Result::Err(kb_core::Error::new(reason_code, reason))
+            },
+        };
+    }
+}
+
+impl crate::ExApiInstructionExecutor for crate::ExSplToken2022Executor {
+    fn executor_name(&self) -> &'static str {
+        return "kb_executor_spl_token_2022";
+    }
+
+    fn executor_version(&self) -> &'static str {
+        return env!("CARGO_PKG_VERSION");
+    }
+
+    fn program_ids(&self) -> &'static [&'static str] {
+        return &[kb_program_ids::SPL_TOKEN2022_PROGRAM_ID];
+    }
+
+    fn supports_request(
+        &self,
+        request: &crate::ExApiExecutionRequest,
+    ) -> crate::ExApiExecutionSupport {
+        return match self.exact_capability(&request.program_id, &request.operation_code) {
+            crate::ExApiExecutionCapability::Supported { operation_code: _ } => {
+                crate::ExApiExecutionSupport::Yes
+            },
+            crate::ExApiExecutionCapability::Unsupported { reason_code: _, reason: _ } => {
+                crate::ExApiExecutionSupport::No
+            },
+        };
+    }
+
+    fn build_plan(
+        &self,
+        request: &crate::ExApiExecutionRequest,
+    ) -> kb_core::Result<crate::ExApiExecutionPlan> {
+        match self.exact_capability(&request.program_id, &request.operation_code) {
+            crate::ExApiExecutionCapability::Supported { operation_code: _ } => {},
+            crate::ExApiExecutionCapability::Unsupported { reason_code, reason } => {
+                return std::result::Result::Err(kb_core::Error::new(reason_code, reason));
+            },
+        }
+        let intent = match serde_json::from_str::<crate::ExSplToken2022ExecutionIntent>(
+            &request.payload_json,
+        ) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => {
+                return std::result::Result::Err(kb_core::Error::new(
+                    "execution_spl_token_2022_intent_deserialize_failed",
+                    error.to_string(),
+                ));
+            },
+        };
+        if intent.operation.operation_code() != request.operation_code.as_str() {
+            return std::result::Result::Err(kb_core::Error::new(
+                "execution_operation_code_mismatch",
+                format!(
+                    "request operation {} does not match typed intent operation {}",
+                    request.operation_code,
+                    intent.operation.operation_code()
+                ),
+            ));
+        }
+        let prepared =
+            match crate::ExApiTypedInstructionExecutor::build_prepared_plan(self, &intent) {
+                std::result::Result::Ok(value) => value,
+                std::result::Result::Err(error) => return std::result::Result::Err(error),
+            };
+        let payload_value = match serde_json::to_value(&prepared) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => {
+                return std::result::Result::Err(kb_core::Error::new(
+                    "execution_spl_token_2022_plan_serialize_failed",
+                    error.to_string(),
+                ));
+            },
+        };
+        let payload_json = match crate::executor_api_serialize_payload_json(&payload_value) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        };
+        return std::result::Result::Ok(crate::ExApiExecutionPlan {
+            executor_name: std::string::String::from("kb_executor_spl_token_2022"),
+            instruction_count: prepared.instructions.len(),
+            payload_json,
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    fn request(program_id: &str, operation_code: &str) -> crate::ExApiExecutionRequest {
+        return crate::ExApiExecutionRequest {
+            program_id: crate::MdProgramId(program_id.to_string()),
+            operation_code: operation_code.to_string(),
+            payload_json: std::string::String::from("{}"),
+        };
+    }
+
+    #[test]
+    fn exact_capabilities_cover_current_and_recent_operations_only() {
+        let executor = crate::ExSplToken2022Executor;
+        for operation_code in crate::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES {
+            let request = request(kb_program_ids::SPL_TOKEN2022_PROGRAM_ID, operation_code);
+            assert_eq!(
+                crate::ExApiInstructionExecutor::supports_request(&executor, &request),
+                crate::ExApiExecutionSupport::Yes
+            );
+        }
+        for operation_code in [
+            "spl_token_2022.initialize_mint_with_rent",
+            "spl_token_2022.initialize_account_with_rent",
+            "spl_token_2022.initialize_multisig_with_rent",
+            "spl_token_2022.initialize_account2",
+        ] {
+            let capability = crate::ExApiTypedInstructionExecutor::capability(
+                &executor,
+                &crate::MdProgramId(kb_program_ids::SPL_TOKEN2022_PROGRAM_ID.to_string()),
+                operation_code,
+            );
+            match capability {
+                crate::ExApiExecutionCapability::Unsupported { reason_code, reason: _ } => {
+                    assert_eq!(
+                        reason_code,
+                        "execution_spl_token_2022_historical_variant_decode_only"
+                    );
+                },
+                crate::ExApiExecutionCapability::Supported { operation_code: _ } => {
+                    panic!("historical variant must be decode-only");
+                },
+            }
+        }
+    }
+
+    #[test]
+    fn program_dispatch_is_exact() {
+        let executor = crate::ExSplToken2022Executor;
+        let foreign = request(
+            kb_program_ids::SPL_TOKEN_PROGRAM_ID,
+            crate::EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION,
+        );
+        assert_eq!(
+            crate::ExApiInstructionExecutor::supports_request(&executor, &foreign),
+            crate::ExApiExecutionSupport::No
+        );
+    }
+
+    #[test]
+    fn machine_readable_matrix_matches_executor_policy() {
+        let matrix = serde_json::from_str::<serde_json::Value>(include_str!(
+            "../../../../../docs/SPL_TOKEN2022_MATRIX.json"
+        ))
+        .unwrap_or_else(|error| panic!("matrix parsing failed: {error}"));
+        let instructions = matrix["instructions"]
+            .as_array()
+            .unwrap_or_else(|| panic!("matrix instructions must be an array"));
+        let extension_types = matrix["extensionTypes"]
+            .as_array()
+            .unwrap_or_else(|| panic!("matrix extensionTypes must be an array"));
+        let matrix_names = instructions
+            .iter()
+            .chain(extension_types.iter())
+            .filter_map(|instruction| return instruction["name"].as_str())
+            .collect::<std::collections::BTreeSet<_>>();
+        assert_eq!(instructions.len(), 48);
+        for operation_code in crate::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES {
+            let name = operation_code
+                .strip_prefix("spl_token_2022.")
+                .unwrap_or_else(|| panic!("invalid operation code {operation_code}"));
+            let matrix_name = match name {
+                "initialize_interest_bearing_mint" | "update_interest_bearing_rate" => {
+                    "interest_bearing_mint_extension"
+                },
+                "initialize_transfer_fee_config"
+                | "set_transfer_fee"
+                | "transfer_checked_with_fee"
+                | "withdraw_withheld_tokens_from_mint"
+                | "withdraw_withheld_tokens_from_accounts"
+                | "harvest_withheld_tokens_to_mint" => "transfer_fee_extension",
+                "initialize_default_account_state" | "update_default_account_state" => {
+                    "default_account_state_extension"
+                },
+                "enable_required_transfer_memos" | "disable_required_transfer_memos" => {
+                    "memo_transfer_extension"
+                },
+                "enable_cpi_guard" | "disable_cpi_guard" => "cpi_guard_extension",
+                "initialize_transfer_hook" | "update_transfer_hook" => "transfer_hook_extension",
+                "initialize_metadata_pointer" | "update_metadata_pointer" => {
+                    "metadata_pointer_extension"
+                },
+                "initialize_group_pointer" | "update_group_pointer" => "group_pointer_extension",
+                "initialize_group_member_pointer" | "update_group_member_pointer" => {
+                    "group_member_pointer_extension"
+                },
+                "initialize_token_metadata"
+                | "update_token_metadata_field"
+                | "remove_token_metadata_key" => "token_metadata",
+                "initialize_token_group" | "update_token_group_max_size" => "token_group",
+                "initialize_token_group_member" => "token_group_member",
+                "initialize_scaled_ui_amount" | "update_scaled_ui_amount_multiplier" => {
+                    "scaled_ui_amount_extension"
+                },
+                "initialize_pausable_config" | "pause" | "resume" => "pausable_extension",
+                "initialize_permissioned_burn"
+                | "permissioned_burn"
+                | "permissioned_burn_checked"
+                | "permissioned_confidential_burn" => "permissioned_burn_extension",
+                "initialize_confidential_transfer_mint"
+                | "update_confidential_transfer_mint"
+                | "apply_pending_confidential_balance"
+                | "approve_confidential_transfer_account"
+                | "deposit_confidential_tokens"
+                | "enable_confidential_credits"
+                | "disable_confidential_credits"
+                | "enable_non_confidential_credits"
+                | "disable_non_confidential_credits"
+                | "configure_confidential_transfer_account"
+                | "configure_confidential_transfer_account_with_registry"
+                | "empty_confidential_transfer_account"
+                | "withdraw_confidential_tokens"
+                | "transfer_confidential_tokens"
+                | "transfer_confidential_tokens_with_fee" => "confidential_transfer_extension",
+                "initialize_confidential_transfer_fee_config"
+                | "enable_confidential_transfer_fee_harvest"
+                | "disable_confidential_transfer_fee_harvest"
+                | "harvest_confidential_withheld_tokens_to_mint"
+                | "withdraw_confidential_withheld_tokens_from_mint"
+                | "withdraw_confidential_withheld_tokens_from_accounts" => {
+                    "confidential_transfer_fee_extension"
+                },
+                "initialize_confidential_mint_burn_mint"
+                | "rotate_confidential_supply_elgamal_pubkey"
+                | "update_confidential_decryptable_supply"
+                | "apply_pending_confidential_burn"
+                | "confidential_mint"
+                | "confidential_burn" => "confidential_mint_burn_extension",
+                _ => name,
+            };
+            assert!(
+                matrix_names.contains(matrix_name),
+                "matrix is missing supported operation {name}"
+            );
+        }
+        assert!(matrix_names.contains("batch"));
+        let batch = crate::ExApiTypedInstructionExecutor::capability(
+            &crate::ExSplToken2022Executor,
+            &crate::MdProgramId(kb_program_ids::SPL_TOKEN2022_PROGRAM_ID.to_string()),
+            crate::EX_SPL_TOKEN2022_BATCH_OPERATION,
+        );
+        match batch {
+            crate::ExApiExecutionCapability::Unsupported { reason_code, reason: _ } => {
+                assert_eq!(reason_code, "execution_spl_token_2022_batch_builder_unavailable");
+            },
+            crate::ExApiExecutionCapability::Supported { operation_code: _ } => {
+                panic!("Batch must remain decode-only");
+            },
+        }
+    }
+}
--- a/kb-lib/src/executor/spl/token2022/intent.rs
+++ b/kb-lib/src/executor/spl/token2022/intent.rs
--- a/kb-lib/src/lib.rs
+++ b/kb-lib/src/lib.rs
@@ -1,5 +1,5 @@
 // file: kb-lib/src/lib.rs
-// version: 20
+// version: 21

 //! Consolidated decoder, executor, materializer and shared model library.
 #![warn(missing_docs)]
@@ -577,6 +577,206 @@ pub use self::executor::EX_SPL_MEMO_ADD_MEMO_OPERATION;
 pub use self::executor::EX_SPL_MEMO_MAX_MESSAGE_BYTES;
 /// Exposes the SPL Memo signer bound.
 pub use self::executor::EX_SPL_MEMO_MAX_SIGNERS;
+/// Exposes `EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_AMOUNT_TO_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BALANCE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_APPLY_PENDING_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_APPROVE_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_APPROVE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_APPROVE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_APPROVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BATCH_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_BATCH_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_CLOSE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_EXTERNAL_TAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_INSTRUCTION_DATA_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_PAYLOAD_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIDENTIAL_TRANSFER_WITH_FEE_SUBTAG;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_CONFIGURE_CONFIDENTIAL_TRANSFER_ACCOUNT_WITH_REGISTRY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES`.
+pub use self::executor::EX_SPL_TOKEN2022_DECRYPTABLE_BALANCE_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DEPOSIT_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DISABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DISABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DISABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_DISABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES`.
+pub use self::executor::EX_SPL_TOKEN2022_ELGAMAL_CIPHERTEXT_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES`.
+pub use self::executor::EX_SPL_TOKEN2022_ELGAMAL_PUBKEY_BYTES;
+/// Exposes `EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_EMPTY_CONFIDENTIAL_TRANSFER_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ENABLE_CONFIDENTIAL_TRANSFER_FEE_HARVEST_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ENABLE_CPI_GUARD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ENABLE_NON_CONFIDENTIAL_CREDITS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ENABLE_REQUIRED_TRANSFER_MEMOS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_FREEZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_GET_ACCOUNT_DATA_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_HARVEST_CONFIDENTIAL_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_HARVEST_WITHHELD_TOKENS_TO_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_MINT_BURN_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_IMMUTABLE_OWNER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_INTEREST_BEARING_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_MULTISIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_NON_TRANSFERABLE_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_PAUSABLE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_PERMANENT_DELEGATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_SCALED_UI_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_MEMBER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_GROUP_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_TOKEN_METADATA_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_FEE_CONFIG_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_INITIALIZE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES`.
+pub use self::executor::EX_SPL_TOKEN2022_MAX_CONFIDENTIAL_PROOF_REFERENCES;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_MINT_TO_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_MINT_TO_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_MINT_TO_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PAUSE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_PAUSE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_PERMISSIONED_BURN_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_PERMISSIONED_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_PERMISSIONED_CONFIDENTIAL_BURN_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REALLOCATE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_REALLOCATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_REMOVE_TOKEN_METADATA_KEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_RESUME_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_RESUME_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_REVOKE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_REVOKE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_ROTATE_CONFIDENTIAL_SUPPLY_ELGAMAL_PUBKEY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_SET_AUTHORITY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_SET_TRANSFER_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES`.
+pub use self::executor::EX_SPL_TOKEN2022_SUPPORTED_OPERATION_CODES;
+/// Exposes `EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_SYNC_NATIVE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_THAW_ACCOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_TRANSFER_CHECKED_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_TRANSFER_CHECKED_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_TRANSFER_CONFIDENTIAL_TOKENS_WITH_FEE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_TRANSFER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_TRANSFER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UI_AMOUNT_TO_AMOUNT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UNWRAP_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_DECRYPTABLE_SUPPLY_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_CONFIDENTIAL_TRANSFER_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_DEFAULT_ACCOUNT_STATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_GROUP_MEMBER_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_GROUP_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_INTEREST_BEARING_RATE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_METADATA_POINTER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_SCALED_UI_AMOUNT_MULTIPLIER_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_TOKEN_GROUP_MAX_SIZE_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_TOKEN_METADATA_FIELD_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_UPDATE_TRANSFER_HOOK_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_TOKENS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_CONFIDENTIAL_WITHHELD_TOKENS_FROM_MINT_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_EXCESS_LAMPORTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_ACCOUNTS_OPERATION;
+/// Exposes `EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION`.
+pub use self::executor::EX_SPL_TOKEN2022_WITHDRAW_WITHHELD_TOKENS_FROM_MINT_OPERATION;
 /// Exposes the reserved `ExAdapterSaberDecimalWrapperExecutor` implementation.
 pub use self::executor::ExAdapterSaberDecimalWrapperExecutor;
 /// Exposes the reserved `ExAdminJupiterLockExecutor` implementation.
@@ -841,10 +1041,46 @@ pub use self::executor::ExSplNoopExecutor;
 pub use self::executor::ExSplSinglePoolExecutor;
 /// Exposes the reserved `ExSplStakePoolExecutor` implementation.
 pub use self::executor::ExSplStakePoolExecutor;
-/// Exposes the reserved `ExSplToken2022Executor` implementation.
+/// Exposes `ExSplToken2022ExecutionIntent`.
+pub use self::executor::ExSplToken2022ExecutionIntent;
+/// Exposes `ExSplToken2022Executor`.
 pub use self::executor::ExSplToken2022Executor;
+/// Exposes `ExSplToken2022Operation`.
+pub use self::executor::ExSplToken2022Operation;
+/// Exposes `ExSplTokenAmount`.
+pub use self::executor::ExSplTokenAmount;
+/// Exposes `ExSplTokenAuthority`.
+pub use self::executor::ExSplTokenAuthority;
+/// Exposes `ExSplTokenAuthorityType`.
+pub use self::executor::ExSplTokenAuthorityType;
+/// Exposes `ExSplTokenConfidentialExecutorSupport`.
+pub use self::executor::ExSplTokenConfidentialExecutorSupport;
+/// Exposes `ExSplTokenConfidentialMintBurnOperation`.
+pub use self::executor::ExSplTokenConfidentialMintBurnOperation;
+/// Exposes `ExSplTokenConfidentialOperation`.
+pub use self::executor::ExSplTokenConfidentialOperation;
+/// Exposes `ExSplTokenConfidentialProofKind`.
+pub use self::executor::ExSplTokenConfidentialProofKind;
+/// Exposes `ExSplTokenConfidentialProofLocation`.
+pub use self::executor::ExSplTokenConfidentialProofLocation;
+/// Exposes `ExSplTokenConfidentialProofReference`.
+pub use self::executor::ExSplTokenConfidentialProofReference;
+/// Exposes `ExSplTokenDecryptableBalance`.
+pub use self::executor::ExSplTokenDecryptableBalance;
+/// Exposes `ExSplTokenDefaultAccountState`.
+pub use self::executor::ExSplTokenDefaultAccountState;
+/// Exposes `ExSplTokenElGamalCiphertext`.
+pub use self::executor::ExSplTokenElGamalCiphertext;
+/// Exposes `ExSplTokenElGamalPubkey`.
+pub use self::executor::ExSplTokenElGamalPubkey;
 /// Exposes the reserved `ExSplTokenExecutor` implementation.
 pub use self::executor::ExSplTokenExecutor;
+/// Exposes `ExSplTokenMetadataField`.
+pub use self::executor::ExSplTokenMetadataField;
+/// Exposes `ExSplTokenMultiplier`.
+pub use self::executor::ExSplTokenMultiplier;
+/// Exposes `ExSplTokenSingleOperation`.
+pub use self::executor::ExSplTokenSingleOperation;
 /// Exposes the reserved `ExStableSwapHyloExchangeExecutor` implementation.
 pub use self::executor::ExStableSwapHyloExchangeExecutor;
 /// Exposes the reserved `ExStableSwapJupiterStableExecutor` implementation.
@@ -883,6 +1119,8 @@ pub use self::executor::ExWeightedSwapStabbleExecutor;
 pub use self::executor::executor_api_serialize_payload_json;
 /// Exposes the pretty JSON payload serializer.
 pub use self::executor::executor_api_serialize_payload_json_pretty;
+/// Exposes `executor_spl_token2022_validate_confidential_proof_references`.
+pub use self::executor::executor_spl_token2022_validate_confidential_proof_references;
 /// Stable native and SPL administration materializer.
 pub use self::materializer::MtAdminMaterializer;
 /// Stable decoded observation materializer contract used by the common pipeline.
@@ -1452,6 +1690,14 @@ pub(crate) use self::executor::EX_SOLANA_CORE_TRACING_TARGET;
 pub(crate) use self::executor::EX_SPL_ATA_TRACING_TARGET;
 /// Canonical SPL Memo tracing target.
 pub(crate) use self::executor::EX_SPL_MEMO_TRACING_TARGET;
+/// Maximum ordered multisig signer occurrences for SPL Token-2022.
+pub(crate) use self::executor::EX_SPL_TOKEN2022_MAX_MULTISIG_SIGNERS;
+/// Maximum transfer-fee source account count for SPL Token-2022.
+pub(crate) use self::executor::EX_SPL_TOKEN2022_MAX_TRANSFER_FEE_SOURCE_ACCOUNTS;
+/// Maximum UI amount byte length for SPL Token-2022.
+pub(crate) use self::executor::EX_SPL_TOKEN2022_MAX_UI_AMOUNT_BYTES;
+/// Canonical SPL Token-2022 tracing target.
+pub(crate) use self::executor::EX_SPL_TOKEN2022_TRACING_TARGET;
 /// Crate-root access to `build_prepared_plan` from `address_lookup_table`.
 pub(crate) use self::executor::executor_solana_core_address_lookup_table_build_prepared_plan;
 /// Crate-root access to `build_prepared_plan` from `builder`.
@@ -1492,6 +1738,8 @@ pub(crate) use self::executor::executor_solana_core_zk_elgamal_build_prepared_pl
 pub(crate) use self::executor::executor_spl_ata_build_prepared_plan;
 /// Internal SPL Memo plan builder.
 pub(crate) use self::executor::executor_spl_memo_build_prepared_plan;
+/// Internal SPL Token-2022 prepared-plan builder.
+pub(crate) use self::executor::executor_spl_token2022_build_prepared_plan;
 /// Canonical processor name for the native and SPL administration materializer.
 pub(crate) use self::materializer::MT_ADMIN_PROCESSOR_NAME;
 /// Canonical tracing target for the native and SPL administration materializer.
--- a/kb-lib/src/model/nomenclature.rs
+++ b/kb-lib/src/model/nomenclature.rs
@@ -1,5 +1,5 @@
 // file: kb-lib/src/model/nomenclature.rs
-// version: 4
+// version: 5

 //! Shared protocol, surface, and event nomenclature types.

@@ -31,12 +31,18 @@ pub struct MdSurfaceCode(pub std::string::String);

 /// Event name without surface prefix.
 #[derive(Clone, Debug, Eq, PartialEq, Hash, serde::Deserialize, serde::Serialize, TS)]
-#[ts(export, export_to = "../frontend/ts/bindings/kb_lib/model/nomenclature/EventName.ts")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_lib/model/nomenclature/EventName.ts"
+)]
 pub struct MdEventName(pub std::string::String);

 /// Canonical event code in `<surface_code>.<event_name>` format.
 #[derive(Clone, Debug, Eq, PartialEq, Hash, serde::Deserialize, serde::Serialize, TS)]
-#[ts(export, export_to = "../frontend/ts/bindings/kb_lib/model/nomenclature/EventCode.ts")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_lib/model/nomenclature/EventCode.ts"
+)]
 pub struct MdEventCode(pub std::string::String);

 /// High-level event family.
--- a/kb-lib/src/model/solana.rs
+++ b/kb-lib/src/model/solana.rs
@@ -1,5 +1,5 @@
 // file: kb-lib/src/model/solana.rs
-// version: 4
+// version: 5

 //! Shared Solana primitive wrapper types.

@@ -39,5 +39,8 @@ pub struct MdPubkey(pub std::string::String);

 /// Stable top-level or inner instruction path.
 #[derive(Clone, Debug, Eq, PartialEq, Hash, serde::Deserialize, serde::Serialize, TS)]
-#[ts(export, export_to = "../frontend/ts/bindings/kb_lib/model/solana/InstructionPath.ts")]
+#[ts(
+    export,
+    export_to = "../frontend/ts/bindings/kb_lib/model/solana/InstructionPath.ts"
+)]
 pub struct MdInstructionPath(pub std::string::String);