@dfm-fi/agent 0.2.1964 → 0.2.1967

package/dist/mcp-server.js

@@ -70,7 +70,8 @@ import { DEFAULT_OWNER_KEY_PATH, ownerKeyPath, policyUpdateNotice, runCreateAppW
 import { getTestWalletPubkey, signBase64Transaction } from './signing.js';
 import { ONBOARDING_ORDER, ensureIdentityWallet, fundingNextStep, mintAndStoreKey, resolveAvatar, runOnboard } from './onboarding.js';
 import { makeIdentityGuard, makeKeyOwnerLookup, makeSessionFetch, onboardingApi } from './onboarding-api.js';
-import { existingOwnerKey, runOwnerAction } from './owner-actions.js';
+import { existingOwnerKey, fetchOwnQuote, runOwnerAction } from './owner-actions.js';
+import { runOwnerRebalance } from './owner-rebalance.js';
 import { Connection } from '@solana/web3.js';
 import { buildWalletIdentity, resolveZapStatusWallet, withActingWalletAlias, withPortfolioWalletAlias, } from './wallet-identity.js';
 const config = loadConfig();
@@ -189,6 +190,45 @@ async function ownerSignLocally(res, input) {
         resolveAlt: async (k) => (await conn.getAddressLookupTable(k)).value,
     }, input));
 }
+/**
+ * Agent-owned app wallet + local owner key: run the converge through the
+ * owner lane (sandwich legs signed HERE after local verification, CPI legs by
+ * DFM's signer). Null when there is no local owner key or the server says the
+ * wallet is not agent-owned (409) — the caller keeps the normal path.
+ */
+async function ownerRebalanceLocally(vault, slippageBps) {
+    const key = existingOwnerKey();
+    if (!key)
+        return null;
+    await assertSameIdentity();
+    const conn = new Connection(config.rpcUrl || 'https://api.mainnet-beta.solana.com', 'confirmed');
+    try {
+        return text(await runOwnerRebalance({
+            key,
+            appWallet: async () => (await api.getOperatingWallet())?.operatingWalletAddress,
+            prepare: (i) => onboardApi.prepareOwnerAction(i),
+            submit: (id, sig) => onboardApi.submitOwnerAction(id, sig),
+            resolveAlt: async (k) => (await conn.getAddressLookupTable(k)).value,
+            ownQuote: (q) => fetchOwnQuote(q),
+            awaitLanded: async (sig) => {
+                for (let i = 0; i < 40; i++) {
+                    const st = (await conn.getSignatureStatuses([sig])).value[0];
+                    if (st?.err)
+                        throw new Error(`rebalance leg ${sig} reverted: ${JSON.stringify(st.err)}`);
+                    if (st?.confirmationStatus === 'confirmed' || st?.confirmationStatus === 'finalized')
+                        return;
+                    await new Promise((r) => setTimeout(r, 1500));
+                }
+                throw new Error(`rebalance leg ${sig} not confirmed after 60 s — check it before re-running`);
+            },
+        }, { vault, ...(slippageBps !== undefined ? { slippageBps } : {}) }));
+    }
+    catch (e) {
+        if (/DFM API 409\b.*agent-owned|only for agent-owned/i.test(e.message))
+            return null;
+        return errText(`rebalance_to_targets failed (agent-owned app wallet): ${e.message}`);
+    }
+}
 function ownerApprovalOr(res, what, where) {
     if (res && typeof res === 'object' && 'ownerSignature' in res && res.ownerSignature) {
         return errText(`not executed: your app wallet is yours (user-owned), so this ${what} needs your one-click approval in the app — open https://app.dfm.finance → ${where}.`);
@@ -1588,6 +1628,10 @@ async ({ vault, slippageBps, confirmPhrase }) => {
     const write = writeGate();
     if (!write.ok)
         return write.result;
+    // Agent-owned app wallet: the owner key signs sandwich legs after local verification.
+    const owned = await ownerRebalanceLocally(vault, slippageBps);
+    if (owned)
+        return owned;
     return keylessWrite('rebalance_to_targets', { vault, slippageBps });
 });
 // ─── Start ────────────────────────────────────────────────────────────────

package/dist/owner-actions.d.ts

@@ -28,6 +28,10 @@ export type OwnerActionInput = {
 } | {
     kind: 'close_empty';
     destination?: 'sign_in_wallet' | 'app_wallet';
+} | {
+    kind: 'rebalance';
+    vault: string;
+    slippageBps?: number;
 };
 export interface OwnerRpcRequest {
     status: 'awaiting_owner_signature';

package/dist/owner-actions.js

@@ -95,9 +95,12 @@ export async function runOwnerAction(deps, input) {
     else if (input.kind === 'withdraw_asset') {
         verifyWithdrawIxs(payer, ixs, { appWallet: app, signInWallet: deps.signInWallet, mint: input.mint, ...(input.amount ? { amount: input.amount } : {}) });
     }
-    else {
+    else if (input.kind === 'close_empty') {
         verifyCloseIxs(payer, ixs, { appWallet: app, destination: input.destination === 'sign_in_wallet' ? deps.signInWallet : app });
     }
+    else {
+        throw new Error('refusing to sign: a rebalance leg goes through runOwnerRebalance (owner-rebalance.ts)');
+    }
     const res = await deps.submit(r.requestId, deps.key.sign(payload));
     return {
         status: 'complete',

package/dist/owner-rebalance-verify.d.ts

@@ -0,0 +1,58 @@
+/**
+ * INDEPENDENT decoding of an owner-signed REBALANCE SANDWICH leg (agent-owned
+ * app wallets). The owner key is all the authority there is, so this file —
+ * not DFM's server — decides whether the leg is safe to sign. Accepted, and
+ * nothing else (fail closed):
+ *
+ *   ComputeBudget (same bounds as a swap) · ATA create(-idempotent) paid by the
+ *   app wallet for the LEG WALLET only · ONE SOL float app → leg wallet, equal
+ *   to BEGIN's declared float and ≤ 0.005 SOL · at most ONE dtf_vault
+ *   `approve_token_delegate` before BEGIN (authority = app wallet, this vault,
+ *   the vault's input-mint ATA, delegate = rebalancer_config PDA of this vault,
+ *   amount == BEGIN's amount_in) · dtf_rebalancer BEGIN → Jupiter → END,
+ *   contiguous, exactly once, manager lane (no session key), this vault, END
+ *   pairing BEGIN's accounts · Jupiter `route` / `shared_accounts_route` whose
+ *   authority is the leg wallet, source/destination the leg wallet's ATAs of
+ *   BEGIN's mints, input == amount_in, no platform fee · after END only the
+ *   Pump volume-account close (leg wallet) + its rent back to the app wallet
+ *   (≤ 2,000,000 lamports).
+ *
+ * The app wallet may appear ONLY as the payer/authority slot of those
+ * instructions (and as the destination of the rent reclaim): anywhere else its
+ * signature would be lent to a program this file did not vet.
+ *
+ * Vault-side accounts (vault, config, vault ATAs) may come from the vault's
+ * lookup table — the RPC serves those, so they are compared but NOT relied on
+ * alone: every one is re-derived on-chain (approve pins delegate = the config
+ * PDA of DTF_REBALANCER_PROGRAM_ID and token_account = the vault's canonical
+ * ATA; BEGIN/END re-derive the config seeds and the canonical ATAs; both
+ * require vault.vault_admin == the app wallet). Program ids and every signer
+ * position are static keys (`key()`), so a lying RPC cannot move authority.
+ */
+import { type TransactionInstruction } from '@solana/web3.js';
+export declare const DTF_VAULT_PROGRAM = "96garpVfmLBkvK33fh7f5edfe85UbhmZ6K67freykxsC";
+/** The LIVE dtf_rebalancer id (rotates on a self-funded redeploy → `DFM_REBALANCER_PROGRAM_ID` overrides; a stale pin fails closed). */
+export declare const DEFAULT_REBALANCER_PROGRAM = "CpaZpZrugfc4MC4h3hoFRYrSZgd7G3puzqVZ8a4KMpGH";
+export declare const PUMP_AMM_PROGRAM = "pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA";
+export declare const MAX_LEG_FLOAT_LAMPORTS = 5000000n;
+export declare const MAX_SPEND_ALLOWANCE = 2000000n;
+export declare const APPROVE_DISC: Buffer<ArrayBuffer>;
+export declare const BEGIN_DISC: Buffer<ArrayBuffer>;
+export declare const END_DISC: Buffer<ArrayBuffer>;
+export declare function rebalancerProgramId(): string;
+export declare const rebalancerConfigOf: (vault: string, program?: string) => string;
+export interface RebalanceLegExpect {
+    appWallet: string;
+    legWallet: string;
+    vault: string;
+}
+/** What the leg does, read from the bytes — the caller prices it against its own quote. */
+export interface RebalanceLegFacts {
+    inputMint: string;
+    outputMint: string;
+    amountIn: bigint;
+    minOut: bigint;
+    approved: boolean;
+}
+export declare function verifyRebalanceLegIxs(payer: string, ixs: TransactionInstruction[], e: RebalanceLegExpect): RebalanceLegFacts;
+//# sourceMappingURL=owner-rebalance-verify.d.ts.map

package/dist/owner-rebalance-verify.js

@@ -0,0 +1,193 @@
+/**
+ * INDEPENDENT decoding of an owner-signed REBALANCE SANDWICH leg (agent-owned
+ * app wallets). The owner key is all the authority there is, so this file —
+ * not DFM's server — decides whether the leg is safe to sign. Accepted, and
+ * nothing else (fail closed):
+ *
+ *   ComputeBudget (same bounds as a swap) · ATA create(-idempotent) paid by the
+ *   app wallet for the LEG WALLET only · ONE SOL float app → leg wallet, equal
+ *   to BEGIN's declared float and ≤ 0.005 SOL · at most ONE dtf_vault
+ *   `approve_token_delegate` before BEGIN (authority = app wallet, this vault,
+ *   the vault's input-mint ATA, delegate = rebalancer_config PDA of this vault,
+ *   amount == BEGIN's amount_in) · dtf_rebalancer BEGIN → Jupiter → END,
+ *   contiguous, exactly once, manager lane (no session key), this vault, END
+ *   pairing BEGIN's accounts · Jupiter `route` / `shared_accounts_route` whose
+ *   authority is the leg wallet, source/destination the leg wallet's ATAs of
+ *   BEGIN's mints, input == amount_in, no platform fee · after END only the
+ *   Pump volume-account close (leg wallet) + its rent back to the app wallet
+ *   (≤ 2,000,000 lamports).
+ *
+ * The app wallet may appear ONLY as the payer/authority slot of those
+ * instructions (and as the destination of the rent reclaim): anywhere else its
+ * signature would be lent to a program this file did not vet.
+ *
+ * Vault-side accounts (vault, config, vault ATAs) may come from the vault's
+ * lookup table — the RPC serves those, so they are compared but NOT relied on
+ * alone: every one is re-derived on-chain (approve pins delegate = the config
+ * PDA of DTF_REBALANCER_PROGRAM_ID and token_account = the vault's canonical
+ * ATA; BEGIN/END re-derive the config seeds and the canonical ATAs; both
+ * require vault.vault_admin == the app wallet). Program ids and every signer
+ * position are static keys (`key()`), so a lying RPC cannot move authority.
+ */
+import { PublicKey } from '@solana/web3.js';
+import { createHash } from 'node:crypto';
+import { atasOf, checkComputeBudget, JUP_ROUTE, JUP_SHARED_ROUTE, JUPITER_V6, key, PROTOCOL_WALLET, refuse } from './owner-tx-verify.js';
+export const DTF_VAULT_PROGRAM = '96garpVfmLBkvK33fh7f5edfe85UbhmZ6K67freykxsC';
+/** The LIVE dtf_rebalancer id (rotates on a self-funded redeploy → `DFM_REBALANCER_PROGRAM_ID` overrides; a stale pin fails closed). */
+export const DEFAULT_REBALANCER_PROGRAM = 'CpaZpZrugfc4MC4h3hoFRYrSZgd7G3puzqVZ8a4KMpGH';
+export const PUMP_AMM_PROGRAM = 'pAMMBay6oceH9fJKBRHGP5D4bD4sWpmSwMn52FMfXEA';
+export const MAX_LEG_FLOAT_LAMPORTS = 5000000n;
+export const MAX_SPEND_ALLOWANCE = 2000000n;
+const SYSTEM = '11111111111111111111111111111111';
+const COMPUTE = 'ComputeBudget111111111111111111111111111111';
+const ATA_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';
+const disc = (n) => createHash('sha256').update(`global:${n}`).digest().subarray(0, 8);
+export const APPROVE_DISC = disc('approve_token_delegate');
+export const BEGIN_DISC = disc('rebalance_leg_begin_owner');
+export const END_DISC = disc('rebalance_leg_end_owner');
+export function rebalancerProgramId() {
+    return process.env.DFM_REBALANCER_PROGRAM_ID?.trim() || DEFAULT_REBALANCER_PROGRAM;
+}
+export const rebalancerConfigOf = (vault, program = rebalancerProgramId()) => PublicKey.findProgramAddressSync([Buffer.from('rebalancer'), new PublicKey(vault).toBuffer()], new PublicKey(program))[0].toBase58();
+const at = (ix, i) => ix.keys[i]?.pubkey.toBase58() ?? refuse(`missing account #${i}`);
+const hasDisc = (ix, d) => !!ix && Buffer.from(ix.data).subarray(0, 8).equals(d);
+export function verifyRebalanceLegIxs(payer, ixs, e) {
+    const app = e.appWallet;
+    const leg = e.legWallet;
+    const REB = rebalancerProgramId();
+    if (payer !== app)
+        refuse('fee payer is not the app wallet');
+    if (leg === app || leg === PROTOCOL_WALLET)
+        refuse('the second signer is not a throwaway leg wallet');
+    checkComputeBudget(ixs);
+    const b = ixs.findIndex((ix) => ix.programId.toBase58() === REB && hasDisc(ix, BEGIN_DISC));
+    if (b < 0)
+        refuse('no rebalance_leg_begin_owner of the pinned dtf_rebalancer');
+    const begin = ixs[b];
+    const jup = ixs[b + 1];
+    const end = ixs[b + 2];
+    if (!jup || jup.programId.toBase58() !== JUPITER_V6)
+        refuse('BEGIN is not followed by Jupiter');
+    if (!end || end.programId.toBase58() !== REB || !hasDisc(end, END_DISC))
+        refuse('Jupiter is not followed by END');
+    // BEGIN — accounts (IDL): authority, factory, vault, config, session_key(opt), input ATA, output ATA,
+    // src_mint, dst_mint, leg_wallet, wallet_src, wallet_dst, token_program, token_program_2022(opt), sysvar.
+    const config = rebalancerConfigOf(e.vault, REB);
+    if (key(begin, 0) !== app)
+        refuse('BEGIN authority is not the app wallet');
+    if (at(begin, 2) !== e.vault)
+        refuse('BEGIN names another vault');
+    if (at(begin, 3) !== config)
+        refuse('BEGIN config is not this vault’s rebalancer_config');
+    if (at(begin, 4) !== REB)
+        refuse('a session key on the owner lane');
+    const inputMint = at(begin, 7);
+    const outputMint = at(begin, 8);
+    const inAta = at(begin, 5);
+    const outAta = at(begin, 6);
+    if (!atasOf(e.vault, inputMint).includes(inAta) || !atasOf(e.vault, outputMint).includes(outAta))
+        refuse('BEGIN does not use the vault’s canonical ATAs');
+    if (key(begin, 9) !== leg)
+        refuse('BEGIN leg wallet is not the second signer');
+    if (!atasOf(leg, inputMint).includes(at(begin, 10)) || !atasOf(leg, outputMint).includes(at(begin, 11)))
+        refuse('BEGIN wallet_src/wallet_dst are not the leg wallet’s canonical accounts');
+    const bd = Buffer.from(begin.data);
+    if (bd.length !== 50)
+        refuse('BEGIN params have an unexpected size');
+    const amountIn = bd.readBigUInt64LE(8);
+    const minOut = bd.readBigUInt64LE(16);
+    const float = bd.readBigUInt64LE(34);
+    const allowance = bd.readBigUInt64LE(42);
+    if (amountIn <= 0n)
+        refuse('BEGIN amount_in is zero');
+    if (float > MAX_LEG_FLOAT_LAMPORTS)
+        refuse(`a leg float of ${float} lamports`);
+    if (allowance > MAX_SPEND_ALLOWANCE)
+        refuse(`a spend allowance of ${allowance} lamports`);
+    // END — authority, vault, config, session_key(opt), input ATA, output ATA, dst_mint, leg_wallet, …
+    if (key(end, 0) !== app || at(end, 1) !== e.vault || at(end, 2) !== config || at(end, 3) !== REB)
+        refuse('END does not pair with BEGIN');
+    if (at(end, 4) !== inAta || at(end, 5) !== outAta || at(end, 6) !== outputMint || key(end, 7) !== leg)
+        refuse('END does not pair with BEGIN');
+    checkLegJupiter(jup, { leg, inputMint, outputMint, amountIn });
+    let floats = 0;
+    let approved = false;
+    let pumpClosed = false;
+    ixs.forEach((ix, i) => {
+        const p = ix.programId.toBase58();
+        const d = Buffer.from(ix.data);
+        const appAt = ix.keys.flatMap((m, j) => (m.pubkey.toBase58() === app ? [j] : []));
+        const appOnlyAt = (...ok) => { if (appAt.some((j) => !ok.includes(j)))
+            refuse(`the app wallet is lent to instruction ${i} (${p})`); };
+        if (i === b || i === b + 2)
+            return appOnlyAt(0);
+        if (i === b + 1)
+            return appOnlyAt();
+        if (p === COMPUTE)
+            return appOnlyAt();
+        if (p === ATA_PROGRAM) {
+            if (!(d.length === 0 || (d.length === 1 && (d[0] === 0 || d[0] === 1))))
+                refuse('unexpected associated-token instruction');
+            if (key(ix, 0) !== app)
+                refuse('an account creation not paid by the app wallet');
+            if (at(ix, 2) !== leg)
+                refuse('creates a token account for someone other than the leg wallet');
+            return appOnlyAt(0);
+        }
+        if (p === SYSTEM) {
+            if (d.length !== 12 || d.readUInt32LE(0) !== 2)
+                refuse('a system instruction other than a transfer');
+            const lamports = d.readBigUInt64LE(4);
+            if (i < b && key(ix, 0) === app && key(ix, 1) === leg && lamports === float && ++floats === 1)
+                return appOnlyAt(0);
+            if (i > b + 2 && pumpClosed && key(ix, 0) === leg && key(ix, 1) === app && lamports <= MAX_SPEND_ALLOWANCE)
+                return appOnlyAt(1);
+            refuse(`an unexpected SOL transfer (instruction ${i})`);
+        }
+        if (p === DTF_VAULT_PROGRAM) {
+            if (i > b || approved || !hasDisc(ix, APPROVE_DISC) || d.length !== 16)
+                refuse('an unexpected dtf_vault instruction');
+            if (key(ix, 0) !== app || at(ix, 2) !== e.vault || at(ix, 3) !== inAta)
+                refuse('the approve is not the vault admin on this vault’s input ATA');
+            if (at(ix, 4) !== config)
+                refuse('the approve delegate is not this vault’s rebalancer_config');
+            if (d.readBigUInt64LE(8) !== amountIn)
+                refuse('the approve amount differs from BEGIN’s amount_in');
+            approved = true;
+            return appOnlyAt(0);
+        }
+        if (p === PUMP_AMM_PROGRAM && i > b + 2 && !pumpClosed) {
+            // close_user_volume_accumulator: [wallet(signer), accumulator(w), eventAuthority, program] — same shape the server asserts.
+            if (ix.keys.length !== 4 || key(ix, 0) !== leg || !ix.keys[0].isSigner)
+                refuse('a malformed Pump volume-account close');
+            pumpClosed = true;
+            return appOnlyAt();
+        }
+        refuse(`unexpected instruction ${i} (${p})`);
+    });
+    if (float > 0n && floats !== 1)
+        refuse('the leg float transfer is missing');
+    return { inputMint, outputMint, amountIn, minOut, approved };
+}
+/** Jupiter on the leg wallet: authority, source and destination are the leg wallet's; input == amount_in; no platform fee. */
+function checkLegJupiter(ix, e) {
+    const d = Buffer.from(ix.data);
+    const tag = d.subarray(0, 8).toString('hex');
+    if ((tag !== JUP_ROUTE && tag !== JUP_SHARED_ROUTE) || d.length < 27)
+        refuse('an unsupported Jupiter instruction');
+    const t = d.length - 19;
+    if (d.readBigUInt64LE(t) !== e.amountIn)
+        refuse('the route input differs from BEGIN’s amount_in');
+    if (d[t + 18] !== 0)
+        refuse('a platform fee on a rebalance leg');
+    const [auth, src, dst] = tag === JUP_ROUTE ? [1, 2, 3] : [2, 3, 6];
+    if (key(ix, auth) !== e.leg)
+        refuse('the route authority is not the leg wallet');
+    if (!atasOf(e.leg, e.inputMint).includes(at(ix, src)))
+        refuse('the route source is not the leg wallet’s input account');
+    if (!atasOf(e.leg, e.outputMint).includes(at(ix, dst)))
+        refuse('the route output does not land in the leg wallet');
+    if (ix.keys.some((m) => m.isSigner && m.pubkey.toBase58() !== e.leg))
+        refuse('a foreign signer inside the route');
+}
+//# sourceMappingURL=owner-rebalance-verify.js.map

package/dist/owner-rebalance.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `rebalance_to_targets` for an AGENT-owned app wallet (this machine holds the
+ * P-256 owner key). The API plans ONE converge leg per call against live
+ * balances and either
+ *   • returns it as an owner request — the rebalance SANDWICH, leg wallet
+ *     already signed by the server, app-wallet slot empty — which is decoded
+ *     here (owner-rebalance-verify.ts), priced against an INDEPENDENT Jupiter
+ *     quote, and only then signed with the owner key and relayed; or
+ *   • executes it itself (a CPI leg through DFM's policy-bound signer); or
+ *   • reports there is nothing left (converged / cleanup / pending).
+ * The loop re-plans after every leg and waits out the 5 s on-chain cooldown.
+ */
+import { type OwnerActionDeps } from './owner-actions.js';
+export declare const MAX_REBALANCE_STEPS = 12;
+export declare const LEG_COOLDOWN_MS = 6000;
+/** Default leg slippage the agent prices the server's `min_out` against (the tool caps it at 300). */
+export declare const DEFAULT_REBALANCE_SLIPPAGE_BPS = 100;
+export interface OwnerRebalanceDeps extends Pick<OwnerActionDeps, 'key' | 'appWallet' | 'prepare' | 'submit' | 'resolveAlt' | 'ownQuote'> {
+    ownQuote: NonNullable<OwnerActionDeps['ownQuote']>;
+    /**
+     * Resolves once the signature is CONFIRMED without error, throws on a revert
+     * or timeout. The next leg is re-planned from live balances, so planning on
+     * top of an unconfirmed leg would size it against stale holdings.
+     */
+    awaitLanded(signature: string): Promise<void>;
+    sleep?(ms: number): Promise<void>;
+}
+export interface OwnerRebalanceLeg {
+    signature: string;
+    via: 'sandwich (owner key)' | 'cpi (DFM signer)';
+    inputMint?: string;
+    outputMint?: string;
+    amountIn?: string;
+    approvedDelegation?: boolean;
+}
+/** `min_out` must clear the independent quote after the requested slippage, minus the same drift a swap tolerates. */
+export declare function minOutFloor(ownOut: bigint, slippageBps: number): bigint;
+export declare function runOwnerRebalance(deps: OwnerRebalanceDeps, input: {
+    vault: string;
+    slippageBps?: number;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=owner-rebalance.d.ts.map

package/dist/owner-rebalance.js

@@ -0,0 +1,74 @@
+/**
+ * `rebalance_to_targets` for an AGENT-owned app wallet (this machine holds the
+ * P-256 owner key). The API plans ONE converge leg per call against live
+ * balances and either
+ *   • returns it as an owner request — the rebalance SANDWICH, leg wallet
+ *     already signed by the server, app-wallet slot empty — which is decoded
+ *     here (owner-rebalance-verify.ts), priced against an INDEPENDENT Jupiter
+ *     quote, and only then signed with the owner key and relayed; or
+ *   • executes it itself (a CPI leg through DFM's policy-bound signer); or
+ *   • reports there is nothing left (converged / cleanup / pending).
+ * The loop re-plans after every leg and waits out the 5 s on-chain cooldown.
+ */
+import { checkOwnerRpcRequest } from './owner-actions.js';
+import { QUOTE_DRIFT_BPS, decodeTx } from './owner-tx-verify.js';
+import { verifyRebalanceLegIxs } from './owner-rebalance-verify.js';
+export const MAX_REBALANCE_STEPS = 12;
+export const LEG_COOLDOWN_MS = 6_000;
+/** Default leg slippage the agent prices the server's `min_out` against (the tool caps it at 300). */
+export const DEFAULT_REBALANCE_SLIPPAGE_BPS = 100;
+/** `min_out` must clear the independent quote after the requested slippage, minus the same drift a swap tolerates. */
+export function minOutFloor(ownOut, slippageBps) {
+    return (ownOut * BigInt(10_000 - slippageBps) * (10000n - QUOTE_DRIFT_BPS)) / 100000000n;
+}
+export async function runOwnerRebalance(deps, input) {
+    const slippageBps = input.slippageBps ?? DEFAULT_REBALANCE_SLIPPAGE_BPS;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const app = await deps.appWallet();
+    if (!app)
+        throw new Error('refusing to sign: no app wallet for this owner');
+    const legs = [];
+    for (let step = 0; step < MAX_REBALANCE_STEPS; step++) {
+        if (step > 0)
+            await sleep(LEG_COOLDOWN_MS);
+        const prepared = await deps.prepare({ kind: 'rebalance', vault: input.vault, ...(input.slippageBps !== undefined ? { slippageBps } : {}) });
+        if (prepared.status === 'rebalance_done' || prepared.status === 'nothing_to_do') {
+            return { status: 'complete', converged: true, legs, result: prepared.result ?? prepared.reason };
+        }
+        if (prepared.status === 'executed') {
+            legs.push({ signature: String(prepared.signature), via: 'cpi (DFM signer)' });
+            await deps.awaitLanded(String(prepared.signature));
+            continue;
+        }
+        if (prepared.status !== 'awaiting_owner_signature')
+            throw new Error(`unexpected rebalance step status ${String(prepared.status)}`);
+        const r = prepared;
+        const payload = checkOwnerRpcRequest(r);
+        if (r.appWallet !== app)
+            throw new Error('refusing to sign: the request is for a different app wallet than this owner’s');
+        const { payer, ixs, legWallet } = await decodeTx(r.body.params.transaction, deps.resolveAlt, { legSigner: true });
+        if (!legWallet)
+            throw new Error('refusing to sign: a rebalance leg without its leg wallet');
+        const facts = verifyRebalanceLegIxs(payer, ixs, { appWallet: app, legWallet, vault: input.vault });
+        const ownOut = await deps.ownQuote({
+            inputMint: facts.inputMint, outputMint: facts.outputMint, amountRaw: facts.amountIn.toString(), slippageBps,
+        });
+        const floor = minOutFloor(ownOut, slippageBps);
+        if (ownOut <= 0n || facts.minOut < floor) {
+            throw new Error(`refusing to sign: the leg's min_out ${facts.minOut} is below the independent quote floor ${floor} (slippage ${slippageBps} bps)`);
+        }
+        const res = await deps.submit(r.requestId, deps.key.sign(payload));
+        if (!res.signature)
+            throw new Error('the owner-signed leg was relayed but Privy returned no signature');
+        legs.push({
+            signature: String(res.signature), via: 'sandwich (owner key)', inputMint: facts.inputMint, outputMint: facts.outputMint,
+            amountIn: facts.amountIn.toString(), approvedDelegation: facts.approved,
+        });
+        await deps.awaitLanded(res.signature);
+    }
+    return {
+        status: 'pending', converged: false, legs,
+        note: `stopped after ${MAX_REBALANCE_STEPS} legs; re-run rebalance_to_targets to continue from the live balances`,
+    };
+}
+//# sourceMappingURL=owner-rebalance.js.map

package/dist/owner-tx-verify.d.ts

@@ -14,6 +14,7 @@ export declare const JUP_ROUTE: string;
 export declare const JUP_SHARED_ROUTE: string;
 /** ATA under either token program (the verifier never trusts a server-claimed program). */
 export declare function ataOf(owner: string, mint: string, program?: string): string;
+export declare const atasOf: (owner: string, mint: string) => string[];
 export type AltResolver = (key: PublicKey) => Promise<AddressLookupTableAccount | null>;
 /**
  * Which account positions of each decoded instruction are STATIC keys (review
@@ -23,10 +24,23 @@ export type AltResolver = (key: PublicKey) => Promise<AddressLookupTableAccount
  * an instruction can carry the mask along.
  */
 export declare const STATIC_MASK: WeakMap<TransactionInstruction, boolean[]>;
-export declare function decodeTx(txB64: string, resolveAlt: AltResolver): Promise<{
+/**
+ * `legSigner` (rebalance sandwich only): the message may carry exactly ONE more
+ * signer, static key #1, whose signature must ALREADY be on the wire and verify
+ * over these exact message bytes (the server pre-signs the throwaway leg
+ * wallet); the app wallet's slot #0 must still be empty. Everything that
+ * signer may do is then checked by the rebalance verifier.
+ */
+export declare function decodeTx(txB64: string, resolveAlt: AltResolver, opts?: {
+    legSigner?: boolean;
+}): Promise<{
     payer: string;
     ixs: TransactionInstruction[];
+    legWallet?: string;
 }>;
+export declare const refuse: (why: string) => never;
+/** A CHECKED account: must exist and be a static key of the message (S24). */
+export declare const key: (ix: TransactionInstruction, i: number) => string;
 export interface SwapExpect {
     appWallet: string;
     inputMint: string;

package/dist/owner-tx-verify.js

@@ -29,7 +29,7 @@
  * UNVERIFIED limits (fail closed): Jupiter `route_v2` / token-ledger variants
  * and exact-out routes are refused, not decoded.
  */
-import { createHash } from 'node:crypto';
+import { createHash, createPublicKey, verify as verifySig } from 'node:crypto';
 import { PublicKey, TransactionMessage, VersionedTransaction } from '@solana/web3.js';
 export const PROTOCOL_WALLET = '9GjEBsZ1Cos2J6inmgwhBKv9pXGNtLSJ7xQ9xZb29bET';
 export const MAX_SWAP_SOL_FEE_LAMPORTS = 50000000n;
@@ -54,7 +54,7 @@ export const JUP_SHARED_ROUTE = disc('shared_accounts_route');
 export function ataOf(owner, mint, program = TOKEN) {
     return PublicKey.findProgramAddressSync([new PublicKey(owner).toBuffer(), new PublicKey(program).toBuffer(), new PublicKey(mint).toBuffer()], new PublicKey(ATA_PROGRAM))[0].toBase58();
 }
-const atasOf = (owner, mint) => [ataOf(owner, mint, TOKEN), ataOf(owner, mint, TOKEN22)];
+export const atasOf = (owner, mint) => [ataOf(owner, mint, TOKEN), ataOf(owner, mint, TOKEN22)];
 /**
  * Which account positions of each decoded instruction are STATIC keys (review
  * S24). A lookup table's contents are served by an RPC the agent does not
@@ -63,9 +63,28 @@ const atasOf = (owner, mint) => [ataOf(owner, mint, TOKEN), ataOf(owner, mint, T
  * an instruction can carry the mask along.
  */
 export const STATIC_MASK = new WeakMap();
-export async function decodeTx(txB64, resolveAlt) {
+/**
+ * `legSigner` (rebalance sandwich only): the message may carry exactly ONE more
+ * signer, static key #1, whose signature must ALREADY be on the wire and verify
+ * over these exact message bytes (the server pre-signs the throwaway leg
+ * wallet); the app wallet's slot #0 must still be empty. Everything that
+ * signer may do is then checked by the rebalance verifier.
+ */
+export async function decodeTx(txB64, resolveAlt, opts = {}) {
     const tx = VersionedTransaction.deserialize(Buffer.from(txB64, 'base64'));
-    if (tx.message.header.numRequiredSignatures !== 1) {
+    const nSig = tx.message.header.numRequiredSignatures;
+    let legWallet;
+    if (opts.legSigner && nSig === 2) {
+        const leg = tx.message.staticAccountKeys[1];
+        const sig = tx.signatures[1];
+        if (!sig || !ed25519Verifies(leg.toBytes(), tx.message.serialize(), sig)) {
+            throw new Error('refusing to sign: the leg wallet signature is missing or does not verify over this transaction');
+        }
+        if (tx.signatures[0]?.some((b) => b !== 0))
+            throw new Error('refusing to sign: the app wallet slot is already signed');
+        legWallet = leg.toBase58();
+    }
+    else if (nSig !== 1) {
         throw new Error('refusing to sign: the transaction needs a signer other than the app wallet');
     }
     const nStatic = tx.message.staticAccountKeys.length;
@@ -82,13 +101,23 @@ export async function decodeTx(txB64, resolveAlt) {
             throw new Error('refusing to sign: a program loaded from a lookup table');
         STATIC_MASK.set(msg.instructions[i], c.accountKeyIndexes.map((idx) => idx < nStatic));
     });
-    return { payer: msg.payerKey.toBase58(), ixs: msg.instructions };
+    return { payer: msg.payerKey.toBase58(), ixs: msg.instructions, ...(legWallet ? { legWallet } : {}) };
+}
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+function ed25519Verifies(pub, message, signature) {
+    try {
+        const key = createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, Buffer.from(pub)]), format: 'der', type: 'spki' });
+        return verifySig(null, Buffer.from(message), key, Buffer.from(signature));
+    }
+    catch {
+        return false;
+    }
 }
-const refuse = (why) => {
+export const refuse = (why) => {
     throw new Error(`refusing to sign: ${why}`);
 };
 /** A CHECKED account: must exist and be a static key of the message (S24). */
-const key = (ix, i) => {
+export const key = (ix, i) => {
     const mask = STATIC_MASK.get(ix);
     if (!mask || mask[i] !== true || !ix.keys[i])
         refuse(`a checked account (#${i} of ${ix.programId.toBase58()}) is not a static key of the transaction`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dfm-fi/agent",
-  "version": "0.2.1964",
+  "version": "0.2.1967",
   "description": "DFM v2 MCP server — drive the full fund launch → deposit → redeem (+ manage) lifecycle from an AI agent against the live API.",
   "homepage": "https://app.dfm.finance/docs/agent",
   "mcpName": "io.github.DFM-Finance/dfm-agent",
@@ -55,7 +55,7 @@
     "lint": "eslint .",
     "example:read": "tsx src/examples/list-and-status.ts",
     "example:lifecycle": "tsx src/examples/launch-deposit-redeem.ts",
-    "test": "npm run build && node scripts/smoke-signing.mjs && node scripts/smoke-signing-v1.mjs &&node scripts/smoke-cli.mjs && node scripts/smoke-keyless.mjs && node scripts/smoke-zap-options.mjs && tsx src/who-pays.test.ts && tsx src/wallet-identity.test.ts && tsx src/money-path.test.ts && tsx src/control-flow.test.ts && tsx src/create-flow.metadata.test.ts && tsx src/manager-flow.reconfigure.test.ts && tsx src/recovery-flow.deadleg.test.ts && tsx src/zap-v2-flow.pending.test.ts && tsx src/mcp-server.confirm-gate.test.ts && tsx src/app-wallet-owner.test.ts && tsx src/onboarding.test.ts && tsx src/default-avatar.test.ts && tsx src/client-header.test.ts"
+    "test": "npm run build && node scripts/smoke-signing.mjs && node scripts/smoke-signing-v1.mjs &&node scripts/smoke-cli.mjs && node scripts/smoke-keyless.mjs && node scripts/smoke-zap-options.mjs && tsx src/who-pays.test.ts && tsx src/wallet-identity.test.ts && tsx src/money-path.test.ts && tsx src/control-flow.test.ts && tsx src/create-flow.metadata.test.ts && tsx src/manager-flow.reconfigure.test.ts && tsx src/recovery-flow.deadleg.test.ts && tsx src/zap-v2-flow.pending.test.ts && tsx src/mcp-server.confirm-gate.test.ts && tsx src/app-wallet-owner.test.ts && tsx src/onboarding.test.ts && tsx src/default-avatar.test.ts && tsx src/client-header.test.ts && tsx src/owner-actions.test.ts && tsx src/owner-rebalance.test.ts"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.32.1",