@deeeed/metamask-harness 0.80.0 → 0.81.0

package/dist/funding-execution-context.js

@@ -35,6 +35,7 @@ const CLAIM_DIFF_FIELDS = [
   "operationCounts"
 ];
 const trustedActionContexts = /* @__PURE__ */ new WeakSet();
+const fixturePolicySources = /* @__PURE__ */ new WeakMap();
 const fundingSources = /* @__PURE__ */ new WeakMap();
 const CURRENT_FUNDING_REGISTRY_SHA256 = "d4416e0e8a812a0e2f1798ae6f901a5820f7ee0b9783cfa5d515d0c7863ea80e";
 const PREVIOUS_FUNDING_REGISTRY_SHA256 = "7e79ee2a5f7bdde0a5548208cb2eab55881575cc7d826ee5f7acdbf15d49609c";
@@ -141,7 +142,70 @@ async function loadTrustedMutationBase(options) {
   });
   return trusted;
 }
+const FIXTURE_POLICY_LANE = "fixture-policy";
+const fixturePolicyMarker = (field) => sha256(`${FIXTURE_POLICY_LANE}:${field}`);
+function fixturePolicyMutationBase(options) {
+  if (!path.isAbsolute(options.artifactsDir)) {
+    throw new Error("Runner artifactsDir must be absolute before a mutation context is created.");
+  }
+  const rootRecipeSha256 = normalizeRecipeDigest(digestRecipeDocument(options.rootRecipe));
+  const base = deepFreeze({
+    runId: sha256(canonical({ lane: FIXTURE_POLICY_LANE, artifactsDir: options.artifactsDir, rootRecipeSha256 })),
+    rootRecipeSha256,
+    requestSha256: fixturePolicyMarker("request"),
+    preflightSha256: fixturePolicyMarker("preflight"),
+    releaseProofSha256: fixturePolicyMarker("release-proof"),
+    balanceProofSha256: fixturePolicyMarker("balance-proof"),
+    fundingRequirementsSha256: fixturePolicyMarker("requirements"),
+    runtimeArtifactSha256: fixturePolicyMarker("runtime-artifact"),
+    runtimeTreeSha256: fixturePolicyMarker("runtime-tree"),
+    registrySha256: fixturePolicyMarker("registry"),
+    profileId: FIXTURE_POLICY_LANE,
+    domain: "perps",
+    client: "extension",
+    proofLane: FIXTURE_POLICY_LANE,
+    targetId: FIXTURE_POLICY_LANE,
+    subjectDigest: fixturePolicyMarker("subject"),
+    selectedIdentitySha256: "",
+    runtimeSessionId: "",
+    cdpPort: 0,
+    cdpTargetId: "",
+    extensionOrigin: "",
+    operations: [],
+    budgets: [],
+    requirements: []
+  });
+  fixturePolicySources.set(base, { artifactsDir: options.artifactsDir });
+  return base;
+}
+function isFixturePolicyBase(base) {
+  return base?.proofLane === FIXTURE_POLICY_LANE;
+}
+async function authorizeFixturePolicyPlan(base, plan) {
+  const source = fixturePolicySources.get(base);
+  if (!source) throw new Error("Fixture-policy plan authorization requires the runner-created context.");
+  const executionPlanSha256 = normalizeRecipeDigest(plan.digest);
+  await mkdir(source.artifactsDir, { recursive: true, mode: 448 });
+  const artifactsDir = await realpath(source.artifactsDir);
+  const artifactsIdentitySha256 = await directoryIdentity(artifactsDir);
+  const executionLedgerRoot = path.join(artifactsDir, "mutation-ledger");
+  await ensurePrivateDirectory(artifactsDir, executionLedgerRoot);
+  const runId = sha256(canonical({
+    lane: FIXTURE_POLICY_LANE,
+    rootRecipeSha256: base.rootRecipeSha256,
+    executionPlanSha256,
+    artifactsIdentitySha256
+  }));
+  const authorized = deepFreeze({ ...base, runId, executionPlanSha256, artifactsIdentitySha256 });
+  fixturePolicySources.set(authorized, {
+    ...source,
+    executionLedgerRoot,
+    executionClaimSha256: sha256(canonical({ kind: "fixture-policy-execution-claim", runId, executionPlanSha256 }))
+  });
+  return authorized;
+}
 async function authorizeTrustedMutationPlan(base, plan, testIo = {}) {
+  if (isFixturePolicyBase(base)) return authorizeFixturePolicyPlan(base, plan);
   const source = fundingSources.get(base);
   if (!source) throw new Error("Funding plan authorization requires the original runner-verified context.");
   const executionPlanSha256 = normalizeRecipeDigest(plan.digest);
@@ -228,6 +292,20 @@ async function authorizeTrustedMutationPlan(base, plan, testIo = {}) {
   return authorized;
 }
 async function trustedMutationForAction(base, recipe, selectedIdentitySha256) {
+  if (isFixturePolicyBase(base)) {
+    const source2 = fixturePolicySources.get(base);
+    if (!source2?.executionLedgerRoot || !source2.executionClaimSha256) {
+      throw new Error("External mutation requires an authorized run-owned execution ledger.");
+    }
+    const trusted2 = deepFreeze({
+      ...base,
+      recipeSha256: normalizeRecipeDigest(digestRecipeDocument(recipe)),
+      executionLedgerRoot: source2.executionLedgerRoot,
+      executionClaimSha256: source2.executionClaimSha256
+    });
+    trustedActionContexts.add(trusted2);
+    return trusted2;
+  }
   if (!selectedIdentitySha256 || !SHA256.test(selectedIdentitySha256)) {
     throw new Error(
       "External mutation requires a successful same-run metamask.wallet.import selected identity proof. Next: run metamask.wallet.import before the mutation node."
@@ -1442,8 +1520,11 @@ function deepFreeze(value) {
   return value;
 }
 export {
+  FIXTURE_POLICY_LANE,
   authorizeTrustedMutationPlan,
+  fixturePolicyMutationBase,
   fundingOptionsFromCli,
+  isFixturePolicyBase,
   loadTrustedMutationBase,
   selectedIdentityFromWalletImport,
   serializeTrustedMutationContext,

package/dist/mm-harness-cli.js

@@ -4,10 +4,10 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { Command } from "commander";
-import { color, withCommandJournal, JsonStreamWriter, detectAdapter } from "@farmslot/recipe-cli/harness";
+import { color, withCommandJournal, JsonStreamWriter, detectAdapter, handleCallHelp } from "@farmslot/recipe-cli/harness";
 import { handleUpdate, maybeNudge } from "./commands/update.js";
 import { handlePin } from "./commands/pin.js";
-import { handleCallHelp } from "./commands/call.js";
+import { metaMaskEngine } from "./engine.js";
 import { handleHelp } from "./commands/help.js";
 import { handleTutorial } from "./commands/tutorial.js";
 import { handleSetupBase } from "./commands/setup-base.js";
@@ -1231,6 +1231,6 @@ if (hasPassthroughHelp(rawArgv)) {
 }
 if (isCallActionHelp(rawArgv)) {
   const callHelp = REAL.find((command) => command.name === "call")?.helpText ?? "";
-  process.exit(await handleCallHelp(rawArgv.slice(1), callHelp));
+  process.exit(await handleCallHelp(rawArgv.slice(1), callHelp, { catalog: metaMaskEngine }));
 }
 await program.parseAsync(process.argv);

package/dist/performance-observation.js

@@ -15,9 +15,7 @@ const sessions = /* @__PURE__ */ new Map();
 const DEFAULT_MAX_DURATION_MS = 5 * 60 * 1e3;
 const MAX_DURATION_MS = 60 * 60 * 1e3;
 const gzipAsync = promisify(gzip);
-function startRunPerformanceObservation(adapter, target, artifactsDir, env, ports = {}) {
-  const observer = getAdapterSurface(adapter).observation?.performance;
-  if (!observer) return void 0;
+function startRunPerformanceObservation(observer, { target, artifactsDir, env, ports }) {
   const key = path.resolve(artifactsDir);
   const session = {
     observer,

package/dist/recipe-assistance-context.js

@@ -1,11 +1,10 @@
 import fs from "node:fs";
 import { createHash } from "node:crypto";
 import { loadRecipeLibraries, resolveRecipeDependencies, rootResolutionRef } from "@farmslot/recipe-runner";
-import { isSensitiveKey, CliError, isRecord, optionStrings, EXIT } from "@farmslot/recipe-cli/harness";
+import { isSensitiveKey, CliError, describeManifestActions, isRecord, optionStrings, EXIT, resolveLibrarySources, validateRunRecipeStatic } from "@farmslot/recipe-cli/harness";
 import { resolveActionManifest } from "./manifest.js";
-import { describeManifestActions } from "./commands/manifest.js";
 import { recipeComposition } from "@farmslot/recipe-cli";
-import { resolveMetaMaskLibrarySources, validateRunRecipeStatic } from "./commands/run-engine.js";
+import { metaMaskEngine } from "./engine.js";
 import { MAX_ADVICE_STATE_BYTES } from "./recipe-assistance-rubric.js";
 function digest(value) {
   return createHash("sha256").update(value).digest("hex");
@@ -46,7 +45,7 @@ async function buildAdviceContext(input) {
   const task = readInput(input.task);
   if (!input.recipe) throw new CliError("Advice requires a recipe. Next: use recipe-quality plan before authoring.", EXIT.usage);
   readInput(input.recipe);
-  const validated = await validateRunRecipeStatic(input.recipe, input.adapter, input.options ?? {}, input.params);
+  const validated = await validateRunRecipeStatic(metaMaskEngine, input.recipe, input.adapter, input.options ?? {}, input.params);
   if (validated.usageError || !validated.schemaValid || !isRecord(validated.recipe)) {
     const detail = validated.usageError?.message ?? validated.findings.map((finding) => finding.message).join("; ");
     throw new CliError(`Recipe is not statically valid: ${detail}. Next: run mm-harness run ${input.recipe} --plan --adapter ${input.adapter}.`, EXIT.validation);
@@ -56,7 +55,7 @@ async function buildAdviceContext(input) {
   const dependencies = resolveRecipeDependencies({ rootRef: rootResolutionRef(rootDigest), root: validated.recipe, rootSource: { kind: "recipe-file", trust: "unknown", digest: rootDigest }, recipes: library.recipes });
   const composition = recipeComposition(validated.recipe, dependencies.recipes);
   const { manifest, actionSources } = await resolveActionManifest(input.adapter, void 0, validated.librarySources);
-  const catalog = describeManifestActions(manifest, actionSources);
+  const catalog = describeManifestActions(metaMaskEngine, manifest, actionSources);
   const used = new Set(composition.actions);
   const actions = catalog.filter((action) => used.has(action.name)).map(({ name, description, schema, capabilities }) => ({ name, description, schema, capabilities }));
   const domains = new Set(composition.actions.map((name) => name.split(".").slice(0, -1).join(".")));
@@ -108,12 +107,12 @@ async function buildPlanningContext(input) {
     throw new CliError("Planning requires 1\u201320 non-empty acceptanceCriteria strings. Next: supply a focused JSON task.", EXIT.validation);
   }
   const criteria = task.acceptanceCriteria;
-  const sources = await resolveMetaMaskLibrarySources(optionStrings(input.options ?? {}, "library"));
+  const sources = await resolveLibrarySources(metaMaskEngine, optionStrings(input.options ?? {}, "library"));
   const library = await loadRecipeLibraries(sources ?? [], { adapter: input.adapter });
   const { manifest, actionSources } = await resolveActionManifest(input.adapter, void 0, sources);
   const candidates = [
     ...[...library.recipes.values()].map((recipe) => ({ id: `recipe:${recipe.ref}`, kind: "recipe", ref: recipe.ref, description: typeof recipe.document.description === "string" ? recipe.document.description : "", parameters: recipe.document.paramsSchema, source: recipe.source, provenance: recipe.provenance, shadows: recipe.shadows })),
-    ...describeManifestActions(manifest, actionSources).map((action) => ({ id: `action:${action.name}`, kind: "action", ref: action.name, description: action.description, parameters: action.schema, capabilities: action.capabilities, source: action.source, sourceTier: action.sourceTier, shadows: action.shadows }))
+    ...describeManifestActions(metaMaskEngine, manifest, actionSources).map((action) => ({ id: `action:${action.name}`, kind: "action", ref: action.name, description: action.description, parameters: action.schema, capabilities: action.capabilities, source: action.source, sourceTier: action.sourceTier, shadows: action.shadows }))
   ];
   const terms = new Set(criteria.join(" ").toLowerCase().match(/[a-z][a-z_]{3,}/gu) ?? []);
   const score = (candidate) => [...new Set(`${candidate.ref} ${candidate.description}`.toLowerCase().match(/[a-z][a-z_]{3,}/gu) ?? [])].filter((word) => terms.has(word)).length;

package/dist/runner.js

@@ -23,6 +23,7 @@ import {
   runnerDir
 } from "./paths.js";
 import {
+  isFixturePolicyBase,
   selectedIdentityFromWalletImport,
   trustedMutationForAction
 } from "./funding-execution-context.js";
@@ -166,7 +167,7 @@ function withTrustedMutationContext(adapters, base, externalMutationActions) {
         throw error;
       });
       if (invalidatesIdentity) selectedIdentitySha256 = void 0;
-      const selected = selectedIdentityFromWalletImport(entry.action, result, base);
+      const selected = isFixturePolicyBase(base) ? void 0 : selectedIdentityFromWalletImport(entry.action, result, base);
       if (selected) {
         if (base && base.selectedIdentitySha256 !== selected) {
           throw new Error("Same-run wallet identity changed after its trusted import proof.");

package/docs/CONTRIBUTING.md

@@ -79,8 +79,10 @@ context, prepare) and `readiness.ts` (doctor and status). Do not add
 command-local platform ladders for surface-owned behavior:
 - `launch` dispatches through `AdapterSurface.launch` (the device platforms
   share `src/commands/launch/device.ts` through a `DeviceLaunchProfile`);
-- `run`/`call` read `run`, `recording`, `diagnostics`, `observation` and
-  `sourceFingerprint`;
+- `run`/`call` come from `@farmslot/recipe-cli/harness` and read `run`,
+  `recording`, `diagnostics`, `observation` and `sourceFingerprint`;
+  mm-harness hands them its engine (`src/engine.ts`) and its device targeting
+  and plan steps (`src/cli.ts`);
 - the runner reads `actions` (manifest, bundled semantic actions, live adapter
   scripts, `cdp.target`, the `ui.*` transport, adapter wrappers, input checks);
 - `install`/`verify`/`cleanup` read `harness`, `agentic-runtime.json` reads

package/docs/RECIPES.md

@@ -245,9 +245,37 @@ Use the snapshot recipe's `history` object to bound existing record dates and
 `capture_path` to separate evidence when composing calls. Market sampling does
 not repeatedly fetch history.
 
-The two live recipes require explicit `confirm_live=true`. The trusted runner
-must also verify the exact consented funding request, preflight, release proof,
-and contained balance proof. Market placement declares the exact provider and
+Perps orders follow one rule on Mobile, Extension and Core
+(`library/actions/shared/perps/order-policy.mjs`), checked before dispatch:
+
+- Testnet: allowed with no funding proof.
+- Mainnet: only from a synced fixture account (`wallet-fixture.json`), as a 1x
+  isolated market order with `close_immediately: true`, and the node must
+  declare `network: mainnet`. The $15 limit bounds the size the controller would
+  submit: (amount + one size step × price) × (1 + max slippage). Anything else
+  is refused with `PERPS_MAINNET_ORDER_REFUSED`, naming each broken limit, and
+  no order is sent.
+- `close_immediately: true` needs a market order from a flat market: no
+  position and no resting order in it. Positions are netted per market, so the
+  close takes the market's whole position; don't share a fixture account's
+  market with a concurrent run. The action closes the opened position itself
+  and proves the market flat. On mainnet it also checks the position opened
+  isolated 1x and within $15. A placement that fails after dispatch has its
+  position closed too.
+- The account and network the rule allowed are rechecked around the flat-market
+  reads, before dispatch and before any close; if either changed, nothing is
+  sent or closed.
+- Core still needs `CORE_PERPS_ALLOW_MAINNET_WRITES=1` for any mainnet write.
+
+On the Extension, a run without funding files gets that rule through the
+fixture-policy lane: the runner binds the run and a run-owned execution ledger
+(`<artifacts>/mutation-ledger`), and each mutation completes the context from
+the live app, so receipts and resume work as in a funded run. The funding files
+below remain the stricter release lane.
+
+The two live recipes require explicit `confirm_live=true`. A funded run's
+trusted runner must also verify the exact consented funding request, preflight,
+release proof, and contained balance proof. Market placement declares the exact provider and
 network; background placement and cancellation refuse a mismatch without
 toggling it. Immediately before publication and dispatch, the action also reads
 the current visible Perps Home balance and requires the runner-trusted minimum.

package/library/actions/core/perps/_controller.mjs

@@ -6,7 +6,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 import { walletFixturePath } from '../../harness-exports.mjs';
-import { readFixtureAccounts } from '../wallet/_fixture-accounts.mjs';
+import { readFixtureAccounts } from '../../shared/wallet/fixture-accounts.mjs';
+import { createRewardsClient, rewardsApiUrl } from './_rewards.mjs';
 
 function controllerEntry(projectRoot) {
   return pathToFileURL(path.join(projectRoot, 'packages/perps-controller/src/index.ts')).href;
@@ -70,7 +71,7 @@ function buildInfrastructure(stubbed, input, rewardsSource) {
     ...(terminalApi ? { terminalApi } : {}),
     rewards: {
       getPerpsDiscountForAccount: (caipAccountId, baseFeeBips) =>
-        rewardsDiscount(rewardsSource.messenger, caipAccountId, baseFeeBips),
+        rewardsSource.messenger.call(REWARDS_DISCOUNT_ACTION, caipAccountId, baseFeeBips),
     },
   };
 }
@@ -79,28 +80,19 @@ function buildInfrastructure(stubbed, input, rewardsSource) {
 //
 // The clients answer the rewards dependency through the messenger's
 // RewardsController:getPerpsDiscountForAccount (extension perps-controller-init,
-// mobile mobileInfrastructure). Core has no RewardsController, so the handler
-// exists when the node supplies rewards_discount_bips, or when a driver
-// registers one on rootMessenger. Without a handler the answer is null: the
-// controller's "no discount known yet".
+// mobile mobileInfrastructure). Core has no RewardsController, so the headless
+// wallet registers one: the rewards client (_rewards.mjs) asks the rewards API
+// for the selected fixture account, as Mobile's RewardsController does. A node's
+// rewards_discount_bips replaces that answer, to prove a discount the fixture
+// accounts (non-VIP) cannot get from the backend.
 //
 // The controller asks for the discount with the account's CAIP id, built from
 // the wallet's selected network (NetworkController:getState and
-// getNetworkClientById). A supplied discount therefore comes with the network a
-// fresh client wallet starts on, Ethereum mainnet; without one the headless
-// controller keeps having no NetworkController, as before.
+// getNetworkClientById), so the wallet also answers those with the network a
+// fresh client wallet starts on, Ethereum mainnet.
 
 const REWARDS_DISCOUNT_ACTION = 'RewardsController:getPerpsDiscountForAccount';
 
-async function rewardsDiscount(rootMessenger, caipAccountId, baseFeeBips) {
-  if (!rootMessenger) return null;
-  try {
-    return await rootMessenger.call(REWARDS_DISCOUNT_ACTION, caipAccountId, baseFeeBips);
-  } catch (error) {
-    if (String(error?.message ?? '').includes(`${REWARDS_DISCOUNT_ACTION} has not been registered`)) return null;
-    throw error;
-  }
-}
 
 /**
  * The rewards discount a node supplies, in basis points (0-10000), or undefined.
@@ -119,9 +111,13 @@ export function requestedRewardsDiscountBips(input) {
 
 const REWARDS_NETWORK_ACTIONS = ['NetworkController:getState', 'NetworkController:getNetworkClientById'];
 
-function registerRewardsHandler(rootMessenger, childMessenger, discountBips) {
-  if (discountBips === undefined) return;
-  rootMessenger.registerActionHandler(REWARDS_DISCOUNT_ACTION, async () => discountBips);
+function registerRewardsHandler(rootMessenger, childMessenger, discountBips, rewardsClient) {
+  rootMessenger.registerActionHandler(
+    REWARDS_DISCOUNT_ACTION,
+    discountBips === undefined
+      ? (caipAccountId, baseFeeBips) => rewardsClient.getPerpsDiscountForAccount(caipAccountId, baseFeeBips)
+      : async () => discountBips,
+  );
   rootMessenger.registerActionHandler('NetworkController:getState', () => ({
     selectedNetworkClientId: 'mainnet',
   }));
@@ -228,11 +224,6 @@ async function resolveSignerFromFixture(input) {
   return { account: selected.signer, address: selected.address };
 }
 
-/** The address a read acts on (no signing required). */
-async function requireAccountAddress(input) {
-  return (await selectAccount(input)).address;
-}
-
 let cached = null;
 
 /**
@@ -286,7 +277,8 @@ export function requireRuntimeExport(moduleNamespace, exportName, sourceLabel) {
 export async function getCoreController(input) {
   const projectRoot = input.context?.projectRoot;
   if (!projectRoot) throw new Error('core adapter requires context.projectRoot.');
-  const accountAddress = await requireAccountAddress(input);
+  const selected = await selectAccount(input);
+  const accountAddress = selected.address;
   const network = resolveNetwork(input);
   const terminalApi = resolveTerminalApi(input);
   const terminalApiKey = JSON.stringify(terminalApi ?? null);
@@ -341,7 +333,10 @@ export async function getCoreController(input) {
     parent: rootMessenger,
   });
   registerSelectedAccountHandler(rootMessenger, messenger, accountAddress);
-  registerRewardsHandler(rootMessenger, messenger, rewardsDiscountBips);
+  // An address outside the fixture has no signer, so the client answers null:
+  // no subscription, as on Mobile for an account that never signed in.
+  const rewardsClient = createRewardsClient({ signer: selected.signer, baseUrl: rewardsApiUrl() });
+  registerRewardsHandler(rootMessenger, messenger, rewardsDiscountBips, rewardsClient);
   rewardsSource.messenger = rootMessenger;
 
   // Default testnet. Mainnet only on explicit node.network: "mainnet" — mainnet
@@ -386,6 +381,7 @@ export async function getCoreController(input) {
     accountAddress,
     terminalApiKey,
     rewardsDiscountBips,
+    rewardsClient,
   };
   return { ...cached, accountAddress };
 }

package/library/actions/core/perps/_rewards.mjs

@@ -0,0 +1,186 @@
+// Headless rewards client for the core Perps controller's `rewards` dependency.
+// It makes the calls Mobile's RewardsController makes to answer
+// getPerpsDiscountForAccount: public opt-in check, mobile-login with a
+// personal_sign over `rewards,<address>,<unix seconds>`, then GET /vip/fees.
+// The session token stays in memory and is never printed. Mobile also gates the
+// call on its remote VIP feature flag (off: null); core has no remote flags, so
+// the client answers as Mobile does with VIP enabled.
+
+// Mobile's default outside production builds (METAMASK_ENVIRONMENT=dev on farm
+// slots), from AppConstants.REWARDS_API_URL.UAT.
+export const DEFAULT_REWARDS_API_URL = 'https://rewards.uat-api.cx.metamask.io';
+
+const CLIENT_ID = 'mm-harness-core';
+
+// Mobile's rewards-data-service DEFAULT_REQUEST_TIMEOUT_MS. A stalled backend
+// must not hold a fee calculation (and the order behind it) open.
+const REQUEST_TIMEOUT_MS = 10_000;
+
+export function rewardsApiUrl(env = process.env) {
+  return (env.CORE_PERPS_REWARDS_API_URL?.trim() || DEFAULT_REWARDS_API_URL).replace(/\/+$/u, '');
+}
+
+/**
+ * Mobile's VIP math (RewardsController #getVipPerpsDiscountBips): the backend
+ * returns an absolute builder fee, converted to a discount off `baseFeeBips`.
+ *
+ * @param vipFees - The /vip/fees body.
+ * @param baseFeeBips - The perps MetaMask builder base fee in bips.
+ * @returns Discount bips; 0 without a VIP fee; null for an unusable fee.
+ */
+export function vipDiscountBips(vipFees, baseFeeBips) {
+  if (!vipFees?.fees || !(vipFees.vipTier > 0)) return 0;
+  const raw = vipFees.fees.hyperliquid?.builderFeeBips;
+  if (raw === undefined || raw === null) return 0;
+  const builderFeeBips = Number.parseFloat(raw);
+  if (!Number.isFinite(builderFeeBips) || builderFeeBips < 0) return null;
+  const discount = Math.round(10000 * (1 - builderFeeBips / baseFeeBips));
+  return discount >= 0 && discount <= 10000 ? discount : 0;
+}
+
+// An error response keeps only its status and the fields the client acts on:
+// the body itself may echo the request, credentials included, and controller
+// logs print error messages.
+class RewardsApiError extends Error {
+  constructor(method, route, status, body) {
+    super(`rewards API ${method} ${route} returned ${status}.`);
+    this.status = status;
+    const data = parseErrorBody(body);
+    this.invalidTimestamp = /Invalid timestamp/u.test(String(data?.message ?? ''));
+    this.serverTimestampMs = Number(data?.serverTimestamp);
+  }
+}
+
+function parseErrorBody(body) {
+  try {
+    return JSON.parse(body);
+  } catch (error) {
+    // A non-JSON error page carries no field the client acts on; the status
+    // already says what failed.
+    if (error instanceof SyntaxError) return null;
+    throw error;
+  }
+}
+
+/**
+ * @param options.signer - viem account of the selected fixture account, or null.
+ * @param options.baseUrl - Rewards API base URL.
+ * @param options.fetchImpl - fetch, injectable for tests.
+ * @param options.now - clock in ms, injectable for tests.
+ * @param options.timeoutMs - per-request deadline, headers and body included.
+ * @returns The `rewards` platform dependency plus `calls`, one entry per
+ * answered request, for action output.
+ */
+export function createRewardsClient({
+  signer,
+  baseUrl,
+  fetchImpl = fetch,
+  now = Date.now,
+  timeoutMs = REQUEST_TIMEOUT_MS,
+}) {
+  const calls = [];
+  let feesPromise;
+
+  async function request(method, route, { body, token } = {}) {
+    const response = await fetchImpl(`${baseUrl}${route}`, {
+      method,
+      headers: {
+        'Content-Type': 'application/json',
+        'rewards-client-id': CLIENT_ID,
+        ...(token ? { 'rewards-access-token': token } : {}),
+      },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    const text = await response.text();
+    if (!response.ok) throw new RewardsApiError(method, route, response.status, text);
+    return JSON.parse(text);
+  }
+
+  async function login(address, timestamp, retried = false) {
+    const message = `rewards,${address},${timestamp}`;
+    const signature = await signer.signMessage({ message });
+    try {
+      return await request('POST', '/auth/mobile-login', { body: { account: address, timestamp, signature } });
+    } catch (error) {
+      // Mobile re-signs once with the server clock when the backend rejects ours.
+      if (
+        !(error instanceof RewardsApiError) || retried || !error.invalidTimestamp ||
+        !Number.isFinite(error.serverTimestampMs)
+      ) {
+        throw error;
+      }
+      return login(address, Math.floor(error.serverTimestampMs / 1000), true);
+    }
+  }
+
+  // Mobile's silent auth: skip login only when the public opt-in check says the
+  // account never opted in, and read a 401 from login as not opted in.
+  async function openSession(address) {
+    let optedIn;
+    try {
+      const status = await request('POST', '/public/rewards/ois', { body: { addresses: [address] } });
+      optedIn = status?.ois?.[0];
+    } catch (error) {
+      // Mobile logs in anyway when the opt-in check fails: login answers the
+      // same question. A failure to reach the backend at all still throws.
+      if (!(error instanceof RewardsApiError)) throw error;
+    }
+    if (optedIn === false) return { optedIn: false };
+    let sessionId;
+    try {
+      ({ sessionId } = await login(address, Math.floor(now() / 1000)));
+    } catch (error) {
+      if (error instanceof RewardsApiError && error.status === 401) return { optedIn: false };
+      throw error;
+    }
+    if (typeof sessionId !== 'string' || !sessionId) {
+      throw new Error('rewards API mobile-login returned no sessionId.');
+    }
+    return { optedIn: true, token: sessionId };
+  }
+
+  // One login and one /vip/fees read per process (Mobile caches the fees for
+  // five minutes; an action process is shorter). The token is fresh, so the
+  // 403 re-login Mobile needs for a stored token does not arise here.
+  async function vipFees(address) {
+    const session = await openSession(address);
+    if (!session.optedIn) return session;
+    return { optedIn: true, fees: await request('GET', '/vip/fees', { token: session.token }) };
+  }
+
+  async function getPerpsDiscountForAccount(caipAccountId, baseFeeBips) {
+    // Lowercase, as Mobile's internal accounts store EVM addresses; the backend
+    // matches addresses case-insensitively.
+    const address = String(caipAccountId).split(':')[2]?.toLowerCase();
+    const record = (entry) => {
+      calls.push({ caipAccountId, baseFeeBips, ...entry });
+      return entry.discountBips;
+    };
+    if (!(Number.isFinite(baseFeeBips) && baseFeeBips > 0)) {
+      return record({ discountBips: null, reason: 'invalid-base-fee' });
+    }
+    // Only the selected fixture account can sign in; any other account has no
+    // subscription here, which Mobile also answers with null.
+    if (!signer || address !== signer.address.toLowerCase()) {
+      return record({ discountBips: null, reason: 'no-signer-for-account' });
+    }
+    feesPromise ??= vipFees(address);
+    let result;
+    try {
+      result = await feesPromise;
+    } catch (error) {
+      // Not cached: the next fee calculation asks the backend again.
+      feesPromise = undefined;
+      throw error;
+    }
+    if (!result.optedIn) return record({ discountBips: null, reason: 'not-opted-in' });
+    return record({
+      discountBips: vipDiscountBips(result.fees, baseFeeBips),
+      vipTier: result.fees.vipTier,
+      builderFeeBips: result.fees.fees?.hyperliquid?.builderFeeBips ?? null,
+    });
+  }
+
+  return { getPerpsDiscountForAccount, calls };
+}

package/library/actions/core/perps/close_positions.mjs

@@ -19,7 +19,7 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-async function waitForPositionsAbsent(controller, accountAddress, symbols, timeoutMs) {
+export async function waitForPositionsAbsent(controller, accountAddress, symbols, timeoutMs) {
   const deadline = Date.now() + timeoutMs;
   let positions = [];
   for (;;) {