Deflex SDK frozen since 2023 as Haystack Router inherits the order-routing stack

2026-08-19

sdk · dex · defi · npm · discovery · web · algorand · updated

Deflex SDK frozen since 2023 as Haystack Router inherits the order-routing stack

A package that stopped three years ago

The npm page for @deflex/deflex-sdk-js presents a healthy-looking project: 23 releases, an MIT license, and a README full of runnable TypeScript. The registry metadata tells a different story. Version 2.0.5, published October 31, 2023, is the last release ever cut, and zero packages depend on it. The GitHub repository its homepage points to returns 404 — an Internet Archive snapshot proves the repo still existed as of April 2025 — so the tarball that npm still serves is a frozen snapshot of a protocol that has since been acquired, renamed, and partly switched off.

What Deflex built: the 'Liquidity Ocean'

Deflex branded itself 'The Algorand Liquidity Ocean', and the name captured a real problem: Algorand DeFi liquidity is split across many exchanges — Tinyman, Pact, Algofi, Humble — each with its own pools and prices. Two protocols answered that. An order router splits a market swap across several pools and routes through intermediate tokens to find the cheapest execution. A limit-order protocol lets a user pay assets into a smart-contract escrow and have the order filled later at a target price, drawing liquidity from any supported [DEX](/glossary/decentralized-exchange "A peer-to-peer marketplace built on Algorand where users can trade ASAs directly from their wallets without relying on a centralized intermediary (lik") rather than only matching against other limit orders. The suite was built by the teams behind the Defly wallet and Alammex, announced in December 2022, and audited twice before it changed hands — by Vantage Point in November 2022 and Ulam Labs in April 2023.

An SDK was needed because of two Algorand mechanics. A wallet must opt in to a smart contract — register its willingness to interact — before calling it, and a route touching several pools executes as a transaction group, a bundle that settles atomically in a single block so every leg succeeds or none does. The package wrapped both, and its API surface is best read as a checklist of what a developer integrating multi-DEX swaps would otherwise have to hand-build:

Concept	Real-World Implication
App opt-in handling (`requiredAppOptIns`)	On Algorand a wallet must register with each contract before calling it; the SDK returned the list of applications every route needed and built the opt-in transactions itself
Atomic transaction-group assembly	A multi-pool route must settle as one unit in one block; `getSwapQuoteTransactions` produced the exact signed bundle that executes every leg or none
Fixed-input and fixed-output quotes	`getFixedInputSwapQuote` priced 'spend exactly X' and `getFixedOutputSwapQuote` priced 'receive exactly Y' — the two ways a trader can bound a swap against slippage
Limit-order clients	`DeflexLimitOrderPlatformClient` created and cancelled orders; `DeflexLimitOrderFillerClient` filled them — the full lifecycle of the escrow protocol

A rename and a reset under TxnLab

In July 2025, TxnLab acquired Deflex — a deal the Algorand Foundation recorded in its monthly ecosystem report as an 'order-routing algorithm for better swaps'. The SDK lineage then moved through three npm names in eight months: @txnlab/deflex-sdk-js (July 2025), @txnlab/deflex (deprecated in January 2026 with a final 1.9.0 release), and the current @txnlab/haystack-router, version 2.0.5, with 525 downloads in the last month. The migration is deliberately mechanical. Per the repo's migration guide, the client class changes from DeflexClient to RouterClient, type names change, the quote endpoint moves to hayrouter.txnlab.dev/api, and everything else — methods, parameters, routing logic — is unchanged. The weekly download pattern shows the shift in progress:

Chart: Weekly npm downloads across the Deflex SDK lineage

What survived, what didn't, and what a developer should weigh

The order router is alive: the protocol's V2.2 application received application calls as recently as today from an unidentified counterparty, and the Haystack Router docs describe routing across multiple DEXs at a default 10-basis-point fee on the output. Two things a developer would check before integrating look less reassuring. The limit-order protocol is switched off — the docs state plainly that 'limit orders are currently disabled and no longer supported' — and its [on-chain](/glossary/on-chain "Describes transactions that are recorded and permanently stored on a blockchain ledger, making them publicly visible and tamper-resistant.") registry preserves the record: 2,407 orders filled, 7,853 cancelled, 15 left open. That is real historical usage, not current functionality. And the two audits, as noted above, both predate the acquisition; nothing in the documentation indicates the current V2.2 contract was re-audited after TxnLab took control.

A second tension is structural. TxnLab is simultaneously the router's maintainer and the operator of Haystack, the mobile DeFi app that is its most visible consumer — and the quote service itself is a TxnLab-run API gated by an API key, with a free-tier key (60 requests per minute) hardcoded into the docs. The on-chain routing is permissionless; the path-finding that feeds it is not. Add DeFiLlama's snapshot of $16 [total value locked](/glossary/total-value-locked "A key metric measuring the overall health of the DeFi ecosystem. It represents the total fiat value of all ALGO and ASAs currently deposited or 'locke") against Deflex (its peak was $90 in November 2024), and the protocol's historical importance to Algorand DeFi is not the same as its current scale.

That said, independent builders are still wiring into the router: a middleware package published in November 2025 lets taxed 'First Stage' assets swap through it, and GoPlausible's Algorand [MCP](/glossary/mcp-model-context-protocol "An open standard that gives an AI model tools to interact with external systems. In VibeKit's case, an MCP server exposes blockchain operations (deplo") server exposes Haystack Router as a tool for AI-agent DEX aggregation. For a developer starting today, the path is clear — install @txnlab/haystack-router, follow the mechanical rename, and treat the frozen original package as an artifact. What is worth weighing is what the acquisition did not refresh: audit coverage on the current contract, the centralized quote API, and the retired limit-order product.

Source

Source: https://www.npmjs.com/package/@deflex/deflex-sdk-js