@pafi-dev/core 0.7.0 → 0.7.1

package/dist/index.d.cts

@@ -100,6 +100,22 @@ declare class ApiError extends PafiSDKError {
     status?: number | undefined;
     constructor(message: string, status?: number | undefined);
 }
+/**
+ * Thrown by `quoteOperatorFee*` when an upstream price source
+ * (Chainlink ETH/USD, PAFI subgraph) is unavailable or stale and the
+ * caller did not opt in to the hardcoded fallback prices.
+ *
+ * v0.7.1 — previously `quoteOperatorFeePt` silently fell back to
+ * ETH=$3000 / PT=$0.10 with `console.warn`. That caused mass
+ * `INSUFFICIENT_FEE` rejects during Chainlink incidents, or worse,
+ * accepted under-priced fees. Now opt-in via
+ * `allowStaleFallback: true`. See SDK_CORE_TRADING_AUDIT.md C2.
+ */
+declare class OracleStaleError extends PafiSDKError {
+    readonly source: "chainlink" | "subgraph";
+    readonly reason: string;
+    constructor(source: "chainlink" | "subgraph", reason: string);
+}
 
 /**
  * Orderly Network Vault — entrypoint for **perp deposit** flow on
@@ -1169,13 +1185,18 @@ interface SmartAccountSender {
  * Returns true when `err` originates from the **paymaster layer** rather
  * than the contract or bundler layer. Covers:
  *
- * - ERC-4337 AA3x validation errors (AA31–AA34)
- * - Pimlico sponsorship rejections (`pm_*` methods, "sponsorship" messages)
- * - PAFI proxy HTTP errors (401, 403, 429, 503)
+ * - ERC-4337 AA3x validation errors (AA31–AA34, word-boundary match)
+ * - Pimlico sponsorship rejections (`pm_*` methods, "sponsorship" / "paymaster")
+ * - PAFI proxy HTTP errors — checked via typed `status` / `statusCode`
+ *   field when present, NOT substring match
  * - Generic "rate limit" / "unauthorized" strings
  *
  * Use this to decide whether retrying without a paymaster makes sense.
  * Contract reverts (AA23, AA24, AA25) and bundler errors are NOT matched.
+ *
+ * v0.7.1 — replaced naive substring matching that false-positived on
+ * arbitrary text containing "503"/"403"/"429" (e.g. address/transit ID).
+ * See SDK_CORE_TRADING_AUDIT.md C3.
  */
 declare function isPaymasterError(err: unknown): boolean;
 interface SendWithPaymasterFallbackParams {
@@ -1251,9 +1272,20 @@ interface QuoteOperatorFeePtConfig {
     subgraphUrl?: string;
     /** USDT token decimals. Default 6 (USDC/USDT on Base/Ethereum). */
     usdtDecimals?: number;
-    /** Fallback ETH price (USD) when Chainlink is unreachable. Default 3000. */
+    /**
+     * Opt-in fallback prices used when Chainlink / subgraph is
+     * unavailable. Default `false` — throw `OracleStaleError`. Set
+     * `true` AND configure `fallbackEthPriceUsd` / `fallbackPtPriceUsdt`
+     * to absorb oracle outages instead of surfacing them.
+     *
+     * v0.7.1 — previously fallback was always-on with hardcoded
+     * defaults (ETH=$3000, PT=$0.10), causing under-priced fees during
+     * incidents. See SDK_CORE_TRADING_AUDIT.md C2.
+     */
+    allowStaleFallback?: boolean;
+    /** Fallback ETH price (USD) when Chainlink is unreachable. Only used when `allowStaleFallback: true`. Default 3000. */
     fallbackEthPriceUsd?: number;
-    /** Fallback PT price (USDT per 1 PT) when subgraph is unreachable. Default 0.1. */
+    /** Fallback PT price (USDT per 1 PT) when subgraph is unreachable. Only used when `allowStaleFallback: true`. Default 0.1. */
     fallbackPtPriceUsdt?: number;
     fetchImpl?: typeof fetch;
 }
@@ -1270,6 +1302,11 @@ interface QuoteOperatorFeeUsdtConfig {
     premiumBps?: number;
     chainlinkFeedAddress?: Address;
     usdtDecimals?: number;
+    /**
+     * Opt-in fallback price when Chainlink is unavailable. Default
+     * `false` — throw `OracleStaleError`. v0.7.1 — see C2.
+     */
+    allowStaleFallback?: boolean;
     fallbackEthPriceUsd?: number;
 }
 /**
@@ -1713,4 +1750,4 @@ declare class PafiSDK {
     signLoginMessage(message: string): Promise<Hex>;
 }
 
-export { ApiError, BATCH_EXECUTOR_7702_IMPL, BATCH_EXECUTOR_ABI, BATCH_EXECUTOR_ADDRESS_BASE_MAINNET, BATCH_EXECUTOR_ADDRESS_BASE_SEPOLIA, BROKER_HASHES, type BuildDelegationUserOpParams, type BuildPartialUserOpParams, type BuildPerpDepositViaRelayParams, type BuildPerpDepositWithGasDeductionParams, COMMON_POOLS, COMMON_TOKENS, CONTRACT_ADDRESSES, ChainConfig, type CheckEthAndBranchParams, ConfigurationError, type ContractAddresses, DUMMY_SIGNATURE_V07, type DelegateImpl, EIP712Signature, ENTRY_POINT_V07, ENTRY_POINT_V08, type Eip7702AuthorizationJsonRpc, LoginMessageParams, MintRequest, type ModalOpenOptions, ORDERLY_RELAY_ABI, ORDERLY_VAULT_ABI, ORDERLY_VAULT_ADDRESSES, ORDERLY_VAULT_BASE_MAINNET, type Operation, type OrderlyRelayDepositRequest, PAFI_SUBGRAPH_URL, PERMIT2_ADDRESS, POINT_TOKEN_FACTORY_ADDRESSES, POINT_TOKEN_IMPL_ADDRESSES, POINT_TOKEN_POOLS, type PackedUserOperationMessage, type PafiProxyTransportParams, PafiSDK, PafiSDKConfig, PafiSDKError, type PafiWebModalAdapter, type PafiWebModalHandle, type PartialUserOperation, type PaymasterConfig, type PaymasterFields, PointTokenDomainConfig, PoolKey, type QuoteOperatorFeePtConfig, type QuoteOperatorFeeUsdtConfig, ReceiverConsent, SIMPLE_7702_IMPL_BASE_MAINNET, SUPPORTED_CHAINS, type SendWithPaymasterFallbackParams, type SignatureStruct, SignatureVerification, SigningError, SimulationError, type SmartAccountSender, type SponsorshipScenario, type SubmissionPath, TOKEN_HASHES, UNIVERSAL_ROUTER_ADDRESSES, type UserOpReceipt, type UserOpTypedData, type UserOperation, V4_QUOTER_ADDRESSES, type VaultDepositFE, ZERO_VALUE, _resetPaymasterConfigForTests, assembleUserOperation, buildDelegationUserOp, buildEip7702Authorization, buildPartialUserOperation, buildPerpDepositViaRelay, buildPerpDepositWithGasDeduction, buildUserOpTypedData, burnRequestTypes, checkDelegation, checkEthAndBranch, computeAccountId, computeAuthorizationHash, computeUserOpHash, createPafiProxyTransport, decodeBatchExecuteCalls, detectDelegateImpl, encodeBatchExecute, erc20ApproveOp, erc20BurnOp, erc20TransferOp, fetchPafiPools, getAaNonce, getContractAddresses, getDummySignatureFor7702, getPafiWebModalAdapter, getPaymasterConfig, isDelegatedTo, isDelegatedToTarget, isPaymasterConfigured, isPaymasterError, mintRequestTypes, openPafiWebModal, openWebPopup, parseEip7702DelegatedAddress, quoteOperatorFeePt, quoteOperatorFeeUsdt, rawCallOp, receiverConsentTypes, sendWithPaymasterFallback, serializeUserOpToJsonRpc, setPafiWebModalAdapter, setPaymasterConfig, splitAuthorizationSig, webPopupAdapter };
+export { ApiError, BATCH_EXECUTOR_7702_IMPL, BATCH_EXECUTOR_ABI, BATCH_EXECUTOR_ADDRESS_BASE_MAINNET, BATCH_EXECUTOR_ADDRESS_BASE_SEPOLIA, BROKER_HASHES, type BuildDelegationUserOpParams, type BuildPartialUserOpParams, type BuildPerpDepositViaRelayParams, type BuildPerpDepositWithGasDeductionParams, COMMON_POOLS, COMMON_TOKENS, CONTRACT_ADDRESSES, ChainConfig, type CheckEthAndBranchParams, ConfigurationError, type ContractAddresses, DUMMY_SIGNATURE_V07, type DelegateImpl, EIP712Signature, ENTRY_POINT_V07, ENTRY_POINT_V08, type Eip7702AuthorizationJsonRpc, LoginMessageParams, MintRequest, type ModalOpenOptions, ORDERLY_RELAY_ABI, ORDERLY_VAULT_ABI, ORDERLY_VAULT_ADDRESSES, ORDERLY_VAULT_BASE_MAINNET, type Operation, OracleStaleError, type OrderlyRelayDepositRequest, PAFI_SUBGRAPH_URL, PERMIT2_ADDRESS, POINT_TOKEN_FACTORY_ADDRESSES, POINT_TOKEN_IMPL_ADDRESSES, POINT_TOKEN_POOLS, type PackedUserOperationMessage, type PafiProxyTransportParams, PafiSDK, PafiSDKConfig, PafiSDKError, type PafiWebModalAdapter, type PafiWebModalHandle, type PartialUserOperation, type PaymasterConfig, type PaymasterFields, PointTokenDomainConfig, PoolKey, type QuoteOperatorFeePtConfig, type QuoteOperatorFeeUsdtConfig, ReceiverConsent, SIMPLE_7702_IMPL_BASE_MAINNET, SUPPORTED_CHAINS, type SendWithPaymasterFallbackParams, type SignatureStruct, SignatureVerification, SigningError, SimulationError, type SmartAccountSender, type SponsorshipScenario, type SubmissionPath, TOKEN_HASHES, UNIVERSAL_ROUTER_ADDRESSES, type UserOpReceipt, type UserOpTypedData, type UserOperation, V4_QUOTER_ADDRESSES, type VaultDepositFE, ZERO_VALUE, _resetPaymasterConfigForTests, assembleUserOperation, buildDelegationUserOp, buildEip7702Authorization, buildPartialUserOperation, buildPerpDepositViaRelay, buildPerpDepositWithGasDeduction, buildUserOpTypedData, burnRequestTypes, checkDelegation, checkEthAndBranch, computeAccountId, computeAuthorizationHash, computeUserOpHash, createPafiProxyTransport, decodeBatchExecuteCalls, detectDelegateImpl, encodeBatchExecute, erc20ApproveOp, erc20BurnOp, erc20TransferOp, fetchPafiPools, getAaNonce, getContractAddresses, getDummySignatureFor7702, getPafiWebModalAdapter, getPaymasterConfig, isDelegatedTo, isDelegatedToTarget, isPaymasterConfigured, isPaymasterError, mintRequestTypes, openPafiWebModal, openWebPopup, parseEip7702DelegatedAddress, quoteOperatorFeePt, quoteOperatorFeeUsdt, rawCallOp, receiverConsentTypes, sendWithPaymasterFallback, serializeUserOpToJsonRpc, setPafiWebModalAdapter, setPaymasterConfig, splitAuthorizationSig, webPopupAdapter };

package/dist/index.d.ts

@@ -100,6 +100,22 @@ declare class ApiError extends PafiSDKError {
     status?: number | undefined;
     constructor(message: string, status?: number | undefined);
 }
+/**
+ * Thrown by `quoteOperatorFee*` when an upstream price source
+ * (Chainlink ETH/USD, PAFI subgraph) is unavailable or stale and the
+ * caller did not opt in to the hardcoded fallback prices.
+ *
+ * v0.7.1 — previously `quoteOperatorFeePt` silently fell back to
+ * ETH=$3000 / PT=$0.10 with `console.warn`. That caused mass
+ * `INSUFFICIENT_FEE` rejects during Chainlink incidents, or worse,
+ * accepted under-priced fees. Now opt-in via
+ * `allowStaleFallback: true`. See SDK_CORE_TRADING_AUDIT.md C2.
+ */
+declare class OracleStaleError extends PafiSDKError {
+    readonly source: "chainlink" | "subgraph";
+    readonly reason: string;
+    constructor(source: "chainlink" | "subgraph", reason: string);
+}
 
 /**
  * Orderly Network Vault — entrypoint for **perp deposit** flow on
@@ -1169,13 +1185,18 @@ interface SmartAccountSender {
  * Returns true when `err` originates from the **paymaster layer** rather
  * than the contract or bundler layer. Covers:
  *
- * - ERC-4337 AA3x validation errors (AA31–AA34)
- * - Pimlico sponsorship rejections (`pm_*` methods, "sponsorship" messages)
- * - PAFI proxy HTTP errors (401, 403, 429, 503)
+ * - ERC-4337 AA3x validation errors (AA31–AA34, word-boundary match)
+ * - Pimlico sponsorship rejections (`pm_*` methods, "sponsorship" / "paymaster")
+ * - PAFI proxy HTTP errors — checked via typed `status` / `statusCode`
+ *   field when present, NOT substring match
  * - Generic "rate limit" / "unauthorized" strings
  *
  * Use this to decide whether retrying without a paymaster makes sense.
  * Contract reverts (AA23, AA24, AA25) and bundler errors are NOT matched.
+ *
+ * v0.7.1 — replaced naive substring matching that false-positived on
+ * arbitrary text containing "503"/"403"/"429" (e.g. address/transit ID).
+ * See SDK_CORE_TRADING_AUDIT.md C3.
  */
 declare function isPaymasterError(err: unknown): boolean;
 interface SendWithPaymasterFallbackParams {
@@ -1251,9 +1272,20 @@ interface QuoteOperatorFeePtConfig {
     subgraphUrl?: string;
     /** USDT token decimals. Default 6 (USDC/USDT on Base/Ethereum). */
     usdtDecimals?: number;
-    /** Fallback ETH price (USD) when Chainlink is unreachable. Default 3000. */
+    /**
+     * Opt-in fallback prices used when Chainlink / subgraph is
+     * unavailable. Default `false` — throw `OracleStaleError`. Set
+     * `true` AND configure `fallbackEthPriceUsd` / `fallbackPtPriceUsdt`
+     * to absorb oracle outages instead of surfacing them.
+     *
+     * v0.7.1 — previously fallback was always-on with hardcoded
+     * defaults (ETH=$3000, PT=$0.10), causing under-priced fees during
+     * incidents. See SDK_CORE_TRADING_AUDIT.md C2.
+     */
+    allowStaleFallback?: boolean;
+    /** Fallback ETH price (USD) when Chainlink is unreachable. Only used when `allowStaleFallback: true`. Default 3000. */
     fallbackEthPriceUsd?: number;
-    /** Fallback PT price (USDT per 1 PT) when subgraph is unreachable. Default 0.1. */
+    /** Fallback PT price (USDT per 1 PT) when subgraph is unreachable. Only used when `allowStaleFallback: true`. Default 0.1. */
     fallbackPtPriceUsdt?: number;
     fetchImpl?: typeof fetch;
 }
@@ -1270,6 +1302,11 @@ interface QuoteOperatorFeeUsdtConfig {
     premiumBps?: number;
     chainlinkFeedAddress?: Address;
     usdtDecimals?: number;
+    /**
+     * Opt-in fallback price when Chainlink is unavailable. Default
+     * `false` — throw `OracleStaleError`. v0.7.1 — see C2.
+     */
+    allowStaleFallback?: boolean;
     fallbackEthPriceUsd?: number;
 }
 /**
@@ -1713,4 +1750,4 @@ declare class PafiSDK {
     signLoginMessage(message: string): Promise<Hex>;
 }
 
-export { ApiError, BATCH_EXECUTOR_7702_IMPL, BATCH_EXECUTOR_ABI, BATCH_EXECUTOR_ADDRESS_BASE_MAINNET, BATCH_EXECUTOR_ADDRESS_BASE_SEPOLIA, BROKER_HASHES, type BuildDelegationUserOpParams, type BuildPartialUserOpParams, type BuildPerpDepositViaRelayParams, type BuildPerpDepositWithGasDeductionParams, COMMON_POOLS, COMMON_TOKENS, CONTRACT_ADDRESSES, ChainConfig, type CheckEthAndBranchParams, ConfigurationError, type ContractAddresses, DUMMY_SIGNATURE_V07, type DelegateImpl, EIP712Signature, ENTRY_POINT_V07, ENTRY_POINT_V08, type Eip7702AuthorizationJsonRpc, LoginMessageParams, MintRequest, type ModalOpenOptions, ORDERLY_RELAY_ABI, ORDERLY_VAULT_ABI, ORDERLY_VAULT_ADDRESSES, ORDERLY_VAULT_BASE_MAINNET, type Operation, type OrderlyRelayDepositRequest, PAFI_SUBGRAPH_URL, PERMIT2_ADDRESS, POINT_TOKEN_FACTORY_ADDRESSES, POINT_TOKEN_IMPL_ADDRESSES, POINT_TOKEN_POOLS, type PackedUserOperationMessage, type PafiProxyTransportParams, PafiSDK, PafiSDKConfig, PafiSDKError, type PafiWebModalAdapter, type PafiWebModalHandle, type PartialUserOperation, type PaymasterConfig, type PaymasterFields, PointTokenDomainConfig, PoolKey, type QuoteOperatorFeePtConfig, type QuoteOperatorFeeUsdtConfig, ReceiverConsent, SIMPLE_7702_IMPL_BASE_MAINNET, SUPPORTED_CHAINS, type SendWithPaymasterFallbackParams, type SignatureStruct, SignatureVerification, SigningError, SimulationError, type SmartAccountSender, type SponsorshipScenario, type SubmissionPath, TOKEN_HASHES, UNIVERSAL_ROUTER_ADDRESSES, type UserOpReceipt, type UserOpTypedData, type UserOperation, V4_QUOTER_ADDRESSES, type VaultDepositFE, ZERO_VALUE, _resetPaymasterConfigForTests, assembleUserOperation, buildDelegationUserOp, buildEip7702Authorization, buildPartialUserOperation, buildPerpDepositViaRelay, buildPerpDepositWithGasDeduction, buildUserOpTypedData, burnRequestTypes, checkDelegation, checkEthAndBranch, computeAccountId, computeAuthorizationHash, computeUserOpHash, createPafiProxyTransport, decodeBatchExecuteCalls, detectDelegateImpl, encodeBatchExecute, erc20ApproveOp, erc20BurnOp, erc20TransferOp, fetchPafiPools, getAaNonce, getContractAddresses, getDummySignatureFor7702, getPafiWebModalAdapter, getPaymasterConfig, isDelegatedTo, isDelegatedToTarget, isPaymasterConfigured, isPaymasterError, mintRequestTypes, openPafiWebModal, openWebPopup, parseEip7702DelegatedAddress, quoteOperatorFeePt, quoteOperatorFeeUsdt, rawCallOp, receiverConsentTypes, sendWithPaymasterFallback, serializeUserOpToJsonRpc, setPafiWebModalAdapter, setPaymasterConfig, splitAuthorizationSig, webPopupAdapter };
+export { ApiError, BATCH_EXECUTOR_7702_IMPL, BATCH_EXECUTOR_ABI, BATCH_EXECUTOR_ADDRESS_BASE_MAINNET, BATCH_EXECUTOR_ADDRESS_BASE_SEPOLIA, BROKER_HASHES, type BuildDelegationUserOpParams, type BuildPartialUserOpParams, type BuildPerpDepositViaRelayParams, type BuildPerpDepositWithGasDeductionParams, COMMON_POOLS, COMMON_TOKENS, CONTRACT_ADDRESSES, ChainConfig, type CheckEthAndBranchParams, ConfigurationError, type ContractAddresses, DUMMY_SIGNATURE_V07, type DelegateImpl, EIP712Signature, ENTRY_POINT_V07, ENTRY_POINT_V08, type Eip7702AuthorizationJsonRpc, LoginMessageParams, MintRequest, type ModalOpenOptions, ORDERLY_RELAY_ABI, ORDERLY_VAULT_ABI, ORDERLY_VAULT_ADDRESSES, ORDERLY_VAULT_BASE_MAINNET, type Operation, OracleStaleError, type OrderlyRelayDepositRequest, PAFI_SUBGRAPH_URL, PERMIT2_ADDRESS, POINT_TOKEN_FACTORY_ADDRESSES, POINT_TOKEN_IMPL_ADDRESSES, POINT_TOKEN_POOLS, type PackedUserOperationMessage, type PafiProxyTransportParams, PafiSDK, PafiSDKConfig, PafiSDKError, type PafiWebModalAdapter, type PafiWebModalHandle, type PartialUserOperation, type PaymasterConfig, type PaymasterFields, PointTokenDomainConfig, PoolKey, type QuoteOperatorFeePtConfig, type QuoteOperatorFeeUsdtConfig, ReceiverConsent, SIMPLE_7702_IMPL_BASE_MAINNET, SUPPORTED_CHAINS, type SendWithPaymasterFallbackParams, type SignatureStruct, SignatureVerification, SigningError, SimulationError, type SmartAccountSender, type SponsorshipScenario, type SubmissionPath, TOKEN_HASHES, UNIVERSAL_ROUTER_ADDRESSES, type UserOpReceipt, type UserOpTypedData, type UserOperation, V4_QUOTER_ADDRESSES, type VaultDepositFE, ZERO_VALUE, _resetPaymasterConfigForTests, assembleUserOperation, buildDelegationUserOp, buildEip7702Authorization, buildPartialUserOperation, buildPerpDepositViaRelay, buildPerpDepositWithGasDeduction, buildUserOpTypedData, burnRequestTypes, checkDelegation, checkEthAndBranch, computeAccountId, computeAuthorizationHash, computeUserOpHash, createPafiProxyTransport, decodeBatchExecuteCalls, detectDelegateImpl, encodeBatchExecute, erc20ApproveOp, erc20BurnOp, erc20TransferOp, fetchPafiPools, getAaNonce, getContractAddresses, getDummySignatureFor7702, getPafiWebModalAdapter, getPaymasterConfig, isDelegatedTo, isDelegatedToTarget, isPaymasterConfigured, isPaymasterError, mintRequestTypes, openPafiWebModal, openWebPopup, parseEip7702DelegatedAddress, quoteOperatorFeePt, quoteOperatorFeeUsdt, rawCallOp, receiverConsentTypes, sendWithPaymasterFallback, serializeUserOpToJsonRpc, setPafiWebModalAdapter, setPaymasterConfig, splitAuthorizationSig, webPopupAdapter };

package/dist/index.js

@@ -102,6 +102,16 @@ var ApiError = class extends PafiSDKError {
   }
   status;
 };
+var OracleStaleError = class extends PafiSDKError {
+  source;
+  reason;
+  constructor(source, reason) {
+    super(`Oracle ${source} unavailable: ${reason}`);
+    this.name = "OracleStaleError";
+    this.source = source;
+    this.reason = reason;
+  }
+};
 
 // src/perp/buildPerpDepositWithGasDeduction.ts
 import { encodeFunctionData as encodeFunctionData3 } from "viem";
@@ -594,11 +604,9 @@ function parseEip7702DelegatedAddress(code) {
   if (!code || code === "0x" || code === "0x0") return null;
   const normalized = code.toLowerCase();
   const magic = EIP7702_MAGIC.toLowerCase();
-  const idx = normalized.indexOf(magic);
-  if (idx === -1) return null;
-  const raw = normalized.slice(idx + magic.length, idx + magic.length + 40);
-  if (raw.length !== 40) return null;
-  return `0x${raw}`;
+  if (!normalized.startsWith(magic)) return null;
+  if (normalized.length !== magic.length + 40) return null;
+  return `0x${normalized.slice(magic.length)}`;
 }
 async function checkDelegation(client, address) {
   const code = await client.getCode({ address });
@@ -727,9 +735,24 @@ function createPafiProxyTransport(params) {
 }
 
 // src/transport/paymasterFallback.ts
+var PAYMASTER_HTTP_STATUSES = /* @__PURE__ */ new Set([401, 403, 429, 503]);
+var PAYMASTER_PATTERNS = [
+  /\bAA3[1-4]\b/i,
+  /\bpaymaster\b/i,
+  /\bsponsorship\b/i,
+  /\bpm_\w+/i,
+  /\brate ?limit\b/i,
+  /\bunauthorized\b/i
+];
 function isPaymasterError(err) {
-  const msg = (err?.message ?? String(err)).toLowerCase();
-  return msg.includes("paymaster") || msg.includes("sponsorship") || msg.includes("aa31") || msg.includes("aa32") || msg.includes("aa33") || msg.includes("aa34") || msg.includes("pm_") || msg.includes("rate limit") || msg.includes("unauthorized") || msg.includes("403") || msg.includes("429") || msg.includes("503");
+  if (err == null || typeof err !== "object") return false;
+  const e = err;
+  const status = e.status ?? e.statusCode ?? e.response?.status ?? e.cause?.status;
+  if (typeof status === "number" && PAYMASTER_HTTP_STATUSES.has(status)) {
+    return true;
+  }
+  const msg = e.message ?? String(err);
+  return PAYMASTER_PATTERNS.some((re) => re.test(msg));
 }
 async function sendWithPaymasterFallback(params) {
   const { primaryClient, fallbackClient, txParams, txParamsFallback, onFallback } = params;
@@ -899,6 +922,7 @@ async function quoteOperatorFeeUsdt(config) {
     gasUnits = DEFAULT_GAS_UNITS,
     premiumBps = DEFAULT_PREMIUM_BPS,
     usdtDecimals = DEFAULT_USDT_DECIMALS,
+    allowStaleFallback = false,
     fallbackEthPriceUsd = 3e3
   } = config;
   const chainlinkFeedAddress = config.chainlinkFeedAddress ?? getContractAddresses(chainId).chainlinkEthUsd;
@@ -908,7 +932,7 @@ async function quoteOperatorFeeUsdt(config) {
   const ethPrice8dec = await getEthPrice8dec(
     provider,
     chainlinkFeedAddress,
-    fallbackEthPriceUsd
+    allowStaleFallback ? fallbackEthPriceUsd : null
   );
   const denomExp = 18 + 8 - usdtDecimals;
   return withPremium * ethPrice8dec / 10n ** BigInt(denomExp);
@@ -922,6 +946,7 @@ async function quoteOperatorFeePt(config) {
     premiumBps = DEFAULT_PREMIUM_BPS,
     subgraphUrl = PAFI_SUBGRAPH_URL,
     usdtDecimals = DEFAULT_USDT_DECIMALS,
+    allowStaleFallback = false,
     fallbackEthPriceUsd = 3e3,
     fallbackPtPriceUsdt = 0.1,
     fetchImpl = globalThis.fetch
@@ -931,12 +956,16 @@ async function quoteOperatorFeePt(config) {
   const nativeCost = gasPrice * gasUnits;
   const withPremium = nativeCost * BigInt(premiumBps) / 10000n;
   const [ethPrice8dec, ptPerUsdt18dec] = await Promise.all([
-    getEthPrice8dec(provider, chainlinkFeedAddress, fallbackEthPriceUsd),
+    getEthPrice8dec(
+      provider,
+      chainlinkFeedAddress,
+      allowStaleFallback ? fallbackEthPriceUsd : null
+    ),
     getPtPerUsdt18dec(
       fetchImpl,
       subgraphUrl,
       pointTokenAddress,
-      fallbackPtPriceUsdt
+      allowStaleFallback ? fallbackPtPriceUsdt : null
     )
   ]);
   return withPremium * ethPrice8dec * ptPerUsdt18dec / 10n ** 26n;
@@ -957,9 +986,13 @@ async function getEthPrice8dec(provider, feed, fallback) {
     }
     return answer;
   } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    if (fallback === null) {
+      throw new OracleStaleError("chainlink", reason);
+    }
     console.warn(
-      "[quoteOperatorFeePt] Chainlink unavailable, using fallback:",
-      err.message
+      "[quoteOperatorFee] Chainlink unavailable, using opt-in fallback:",
+      reason
     );
     return BigInt(Math.round(fallback * 1e8));
   }
@@ -992,9 +1025,13 @@ async function getPtPerUsdt18dec(fetchImpl, subgraphUrl, pointTokenAddress, fall
     }
     return 10n ** 24n / raw;
   } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    if (fallbackPtPriceUsdt === null) {
+      throw new OracleStaleError("subgraph", reason);
+    }
     console.warn(
-      "[quoteOperatorFeePt] subgraph unavailable, using fallback:",
-      err.message
+      "[quoteOperatorFeePt] subgraph unavailable, using opt-in fallback:",
+      reason
     );
     const ptPerUsdtHuman = 1 / fallbackPtPriceUsdt;
     return parseBigDecimalTo18(ptPerUsdtHuman.toFixed(18));
@@ -1307,6 +1344,7 @@ export {
   ORDERLY_VAULT_ABI,
   ORDERLY_VAULT_ADDRESSES,
   ORDERLY_VAULT_BASE_MAINNET,
+  OracleStaleError,
   PAFI_SUBGRAPH_URL,
   PERMIT2_ADDRESS,
   POINT_TOKEN_FACTORY_ADDRESSES,