perp-cli 0.11.0 → 0.12.0

package/dist/exchanges/pacifica.js

@@ -1,13 +1,27 @@
 import { PacificaClient } from "../pacifica/index.js";
 import { LocalSolanaSigner } from "../signer/index.js";
+import { isExpired } from "../agent-wallet/expiry.js";
+import { PerpError } from "../errors.js";
 export class PacificaAdapter {
     name = "pacifica";
     chain = "solana";
     aliases = ["pac"];
     client;
+    /** Tier 3: PK direct (constructor-supplied keypair). */
     _solanaSigner;
+    /** Tier 2: OWS master signer (set via setSigner). */
+    _masterSigner;
+    /** Tier 1: agent OWS signer (Phase 2c). */
+    _agentSigner;
+    /** Tier 1 metadata. */
+    _agentMeta;
+    /** --no-agent bypass flag. */
+    _useNoAgent = false;
+    /** True when adapter was constructed without a real PK (read-only). */
     _hasRealKey;
+    /** Public Solana base58 of the active signer (`_resolveSigner().address`). */
     account;
+    /** Bound `signMessage` for the active signer (Phase 2c routes through `_resolveSigner`). */
     signMessage;
     _marketsCache = null;
     _marketsCacheTime = 0;
@@ -17,18 +31,92 @@ export class PacificaAdapter {
         this._hasRealKey = hasRealKey;
         this.account = this._solanaSigner.getPublicKeyBase58();
         this.client = new PacificaClient({ network, builderCode });
-        this.signMessage = (msg) => this._solanaSigner.signMessage(msg);
+        // Hot-path methods always go through `_resolveSigner()` so the bound
+        // `signMessage` reflects the highest-priority active tier.
+        this.signMessage = (msg) => this._resolveSigner().signer.signMessage(msg);
     }
     ensureSigner() {
-        if (!this._hasRealKey) {
-            throw new Error("No private key configured. Run: perp setup");
-        }
+        // Resolves across all tiers; throws PerpError if none available.
+        this._resolveSigner();
     }
-    /** Inject an external Solana signer. */
+    /**
+     * Inject an external Solana signer (Tier 2 — OWS master).
+     * Backward-compatible: existing callers (e.g. `perp -e pacifica --ows ...`
+     * in `_initWithOws`) continue to work; the master signer is what
+     * `_resolveSigner()` falls back to when no agent is registered.
+     */
     setSigner(signer) {
+        this._masterSigner = signer;
         this._solanaSigner = signer;
         this.account = signer.getPublicKeyBase58();
-        this.signMessage = (msg) => this._solanaSigner.signMessage(msg);
+        this._hasRealKey = true;
+        this.signMessage = (msg) => this._resolveSigner().signer.signMessage(msg);
+    }
+    /** Tier 1: inject agent OWS Solana signer (Phase 2c). */
+    setAgentSigner(meta, signer) {
+        this._agentMeta = meta;
+        this._agentSigner = signer;
+        // The `account` field is the master Solana address (used in REST envelopes
+        // as the `account` key) — agent path puts the master in `account` and the
+        // agent in `agent_wallet`. Capture the master Solana address from the
+        // AgentMeta so REST flows can reference it.
+        if (meta.userSolanaAddress) {
+            this.account = meta.userSolanaAddress;
+        }
+    }
+    /** Bypass Tier 1 (agent) — used for `--no-agent` flag. */
+    setNoAgent(noAgent) {
+        this._useNoAgent = noAgent;
+    }
+    /** True only when ALL THREE tiers are unconfigured. */
+    get isReadOnly() {
+        return !this._agentSigner && !this._masterSigner && !this._hasRealKey;
+    }
+    /** Which signer tier is currently active (for debug/diagnostics). */
+    get activeSignerTier() {
+        try {
+            return this._resolveSigner().tier;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Resolve the active signer across three tiers. Mirrors AsterAdapter._resolveSigner. */
+    _resolveSigner() {
+        // Tier 1: agent (when registered, not expired, --no-agent NOT set)
+        if (!this._useNoAgent && this._agentSigner && this._agentMeta) {
+            if (isExpired(this._agentMeta)) {
+                // Skip Tier 1 only if Tier 2/3 available; otherwise throw AGENT_EXPIRED
+                if (!this._masterSigner && !this._hasRealKey) {
+                    throw new PerpError("AGENT_EXPIRED", "Agent wallet has expired", {
+                        remediation: "perp wallet agent approve pacifica --rotate",
+                    });
+                }
+                // fall through to Tier 2/3
+            }
+            else {
+                return { tier: "agent", signer: this._agentSigner, address: this._agentSigner.getPublicKeyBase58() };
+            }
+        }
+        // Tier 2: OWS master
+        if (this._masterSigner) {
+            return { tier: "master", signer: this._masterSigner, address: this._masterSigner.getPublicKeyBase58() };
+        }
+        // Tier 3: PK direct
+        if (this._hasRealKey) {
+            // Guard: legacy test fixtures (e.g. bugfix-v042.test.ts) construct adapters
+            // via `Object.create(PacificaAdapter.prototype)` and only set `_hasRealKey = true`
+            // — `_solanaSigner` is undefined in that case. Fall back to the cached
+            // `account` field when available.
+            const address = this._solanaSigner
+                ? this._solanaSigner.getPublicKeyBase58()
+                : this.account;
+            return { tier: "pk", signer: this._solanaSigner, address };
+        }
+        // No signer at any tier
+        throw new PerpError("NO_SIGNER_AVAILABLE", "No signing path configured for Pacifica", {
+            remediation: "Run one of: (a) perp wallet agent approve pacifica --master <wallet>; (b) perp wallet generate && perp -e pacifica --ows <wallet>; (c) export PACIFICA_PRIVATE_KEY=...",
+        });
     }
     /** Access the underlying Keypair (only available with LocalSolanaSigner). */
     get keypair() {

package/dist/funding/rates.js

@@ -56,6 +56,9 @@ async function fetchHyperliquidRates() {
     }
 }
 async function fetchLighterRates() {
+    // Outer try/catch returning [] is intentional graceful degradation; see
+    // fetchAsterRates for the same pattern. Inside, SSOT rule #2 applies —
+    // skip rows whose mark price cannot be resolved instead of 0-coercing.
     try {
         const [details, funding] = await Promise.all([
             fetchLighterOrderBookDetails(),
@@ -63,25 +66,47 @@ async function fetchLighterRates() {
         ]);
         const priceMap = new Map(details.map(d => [d.marketId, d.lastTradePrice]));
         const symMap = new Map(details.map(d => [d.marketId, d.symbol]));
-        return funding.map(fr => {
+        const out = [];
+        for (const fr of funding) {
             const symbol = fr.symbol || symMap.get(fr.marketId) || "";
+            if (!symbol)
+                continue;
             const rate = fr.rate;
-            const hourly = toHourlyRate(rate, "lighter");
-            return {
+            // Prefer fr.markPrice; fall back to orderBook last-trade as a documented
+            // price-source preference (NOT an error fallback).
+            const directMark = fr.markPrice;
+            const fallbackMark = priceMap.get(fr.marketId);
+            let markPrice;
+            if (directMark !== null && Number.isFinite(directMark) && directMark > 0) {
+                markPrice = directMark;
+            }
+            else if (fallbackMark !== undefined && Number.isFinite(fallbackMark) && fallbackMark > 0) {
+                markPrice = fallbackMark;
+            }
+            if (!Number.isFinite(rate) || markPrice === undefined)
+                continue;
+            out.push({
                 exchange: "lighter",
                 symbol,
                 fundingRate: rate,
-                hourlyRate: hourly,
+                hourlyRate: toHourlyRate(rate, "lighter"),
                 annualizedPct: annualizeRate(rate, "lighter"),
-                markPrice: fr.markPrice || priceMap.get(fr.marketId) || 0,
-            };
-        });
+                markPrice,
+            });
+        }
+        return out;
     }
     catch {
         return [];
     }
 }
 async function fetchAsterRates() {
+    // Outer try/catch returning [] is intentional graceful degradation: when
+    // the entire endpoint is unreachable, the cross-DEX comparison should
+    // continue with the remaining venues.
+    // Inside the try block, SSOT rule #2 applies — refuse to silently 0-coerce
+    // missing markPrice / lastFundingRate, since those values feed downstream
+    // sizing and any 0 corrupts the comparison.
     try {
         const [premiums, tickers] = await Promise.all([
             fetch("https://fapi.asterdex.com/fapi/v1/premiumIndex").then(r => r.json()),
@@ -89,25 +114,38 @@ async function fetchAsterRates() {
         ]);
         const priceMap = new Map();
         for (const t of tickers ?? []) {
-            priceMap.set(String(t.symbol), Number(t.lastPrice ?? 0));
+            const last = Number(t.lastPrice);
+            if (Number.isFinite(last) && last > 0)
+                priceMap.set(String(t.symbol), last);
         }
-        return (premiums ?? [])
-            .filter(p => String(p.symbol ?? "").endsWith("USDT"))
-            .map(p => {
+        const out = [];
+        for (const p of premiums ?? []) {
             const rawSymbol = String(p.symbol ?? "");
+            if (!rawSymbol.endsWith("USDT"))
+                continue;
+            const fundingRate = Number(p.lastFundingRate);
+            // Prefer premiumIndex.markPrice; fall back to ticker.lastPrice as a
+            // documented price-source preference (NOT an error fallback).
+            const markFromPremium = Number(p.markPrice);
+            const markPrice = Number.isFinite(markFromPremium) && markFromPremium > 0
+                ? markFromPremium
+                : priceMap.get(rawSymbol);
+            if (!Number.isFinite(fundingRate) || markPrice === undefined || !Number.isFinite(markPrice) || markPrice <= 0) {
+                continue;
+            }
             const symbol = rawSymbol.replace(/USDT$/, "");
-            const rate = Number(p.lastFundingRate ?? 0);
-            const hourly = toHourlyRate(rate, "aster");
-            return {
+            const nextFundingTimeRaw = Number(p.nextFundingTime);
+            out.push({
                 exchange: "aster",
                 symbol,
-                fundingRate: rate,
-                hourlyRate: hourly,
-                annualizedPct: annualizeRate(rate, "aster"),
-                markPrice: Number(p.markPrice ?? priceMap.get(rawSymbol) ?? 0),
-                nextFundingTime: Number(p.nextFundingTime ?? 0),
-            };
-        });
+                fundingRate,
+                hourlyRate: toHourlyRate(fundingRate, "aster"),
+                annualizedPct: annualizeRate(fundingRate, "aster"),
+                markPrice,
+                nextFundingTime: Number.isFinite(nextFundingTimeRaw) ? nextFundingTimeRaw : 0,
+            });
+        }
+        return out;
     }
     catch {
         return [];

package/dist/guardrail/perp-guardrail.js

@@ -46,7 +46,15 @@ function isWithdrawTx(data) {
     return selector === "0x3ccfd60b" || selector === "0x2e1a7d4d";
 }
 function evaluate(ctx) {
-    const config = ctx.policy_config ?? {};
+    // SSOT rule #2: policy_config must be explicitly supplied. A missing
+    // policy_config previously fell through to silent defaults — that is a
+    // safety-critical fallback (the user might assume their custom limits are
+    // active when in fact only baked-in defaults are). Fail closed instead.
+    if (!ctx.policy_config) {
+        return deny("policy_config missing from PolicyContext; refusing to fall through to baked-in defaults. " +
+            "Caller must supply policy_config explicitly (max_tx_usd, max_daily_usd, etc.).");
+    }
+    const config = ctx.policy_config;
     const maxTxUsd = config.max_tx_usd ?? DEFAULT_LIMITS.max_tx_usd;
     const maxDailyUsd = config.max_daily_usd ?? DEFAULT_LIMITS.max_daily_usd;
     const maxWithdrawUsd = config.max_withdraw_usd ?? maxTxUsd;

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export {};
+import "./_stderr-filter.js";