perp-cli 0.12.17 → 0.14.1

package/dist/agent-wallet/store.d.ts

@@ -1,4 +1,5 @@
-import type { AgentMeta } from "../settings.js";
+import type { AgentMeta, AgentSource, AnyAgentMeta, ArcusAgentMeta, OndoAgentMeta, QfexAgentMeta } from "../settings.js";
+import type { Network } from "../exchanges/venue-types.js";
 /**
  * Attempt to acquire the lockfile for an exchange's agent-approve operation.
  * Returns void on success. Throws LOCK_HELD if another live process holds it.
@@ -9,11 +10,27 @@ import type { AgentMeta } from "../settings.js";
  */
 export declare function acquireLock(exchange: string): void;
 export declare function releaseLock(exchange: string): void;
+export declare function getAgent(exchange: string, agentName?: string): AgentMeta | null;
 /**
- * Returns the specific named agent, or the first non-partial agent when
- * agentName is omitted.
+ * Network a legacy-shaped agent is registered on, or null when it cannot be
+ * classified (an untagged Lighter-family record, whose approve always honored -n).
  */
-export declare function getAgent(exchange: string, agentName?: string): AgentMeta | null;
+export declare function recordedAgentNetworkOf(exchange: string, meta: AgentMeta): Network | null;
+/**
+ * How an agent record got here (AgentMeta.source). Records written before the field existed were
+ * all created by `wallet agent approve` (master-signed on this machine), except Ondo keys, which
+ * are always created in the Ondo Perps web app.
+ */
+export declare function agentSourceOf(exchange: string, meta: AnyAgentMeta): AgentSource;
+/**
+ * Network a legacy-shaped agent is registered on. Untagged Lighter-family
+ * records (whose approve always honored -n) cannot be classified and throw.
+ */
+export declare function agentNetworkOf(exchange: string, meta: AgentMeta): Network;
+/** Throws AGENT_NOT_REGISTERED when `meta` was registered on a different network than `network`. */
+export declare function assertAgentNetwork(exchange: string, meta: AgentMeta, network: Network): void;
+/** First non-partial agent of `exchange` registered on `network`, or null. */
+export declare function getAgentForNetwork(exchange: string, network: Network): AgentMeta | null;
 /**
  * Persist an agent meta entry for the given exchange.
  * Acquires a lockfile before writing to prevent concurrent races (AC-14).
@@ -35,3 +52,19 @@ export declare function listAgents(exchange?: string): Array<{
     exchange: string;
     meta: AgentMeta;
 }>;
+type VenueAgentMap = {
+    ondo: OndoAgentMeta;
+    arcus: ArcusAgentMeta;
+    qfex: QfexAgentMeta;
+};
+/** Named agent, or the only/first registered one when agentName is omitted. */
+export declare function getVenueAgent<V extends keyof VenueAgentMap>(venue: V, agentName?: string): VenueAgentMap[V] | null;
+/** First Ondo/Arcus agent registered on `network` (meta.network), or null — never another network's key. */
+export declare function getVenueAgentForNetwork<V extends keyof VenueAgentMap>(venue: V, network: Network): VenueAgentMap[V] | null;
+export declare function setVenueAgent<V extends keyof VenueAgentMap>(venue: V, meta: VenueAgentMap[V]): void;
+export declare function deleteVenueAgent(venue: keyof VenueAgentMap, agentName: string): boolean;
+export declare function listVenueAgents(): Array<{
+    exchange: keyof VenueAgentMap;
+    meta: OndoAgentMeta | ArcusAgentMeta | QfexAgentMeta;
+}>;
+export {};

package/dist/agent-wallet/store.js

@@ -90,7 +90,15 @@ function isPidAlive(pid) {
  * Returns the specific named agent, or the first non-partial agent when
  * agentName is omitted.
  */
+/** Venues whose agents use a non-legacy meta shape (see getVenueAgent). */
+const NON_LEGACY_AGENT_VENUES = new Set(["ondo", "arcus", "qfex"]);
+function assertLegacyAgentVenue(exchange) {
+    if (NON_LEGACY_AGENT_VENUES.has(exchange)) {
+        throw new PerpError("INVALID_PARAMS", `${exchange} agents use a venue-specific meta; call getVenueAgent("${exchange}")`);
+    }
+}
 export function getAgent(exchange, agentName) {
+    assertLegacyAgentVenue(exchange);
     const settings = loadSettings();
     const byExchange = settings.agents?.[exchange];
     if (!byExchange)
@@ -106,6 +114,69 @@ export function getAgent(exchange, agentName) {
     }
     return null;
 }
+/**
+ * Venues whose agent approve/rotate was hardwired to mainnet endpoints before
+ * agent records carried `network` — an untagged record of these venues was
+ * provably registered on mainnet.
+ */
+const PRE_TAG_MAINNET_ONLY_VENUES = new Set(["aster", "hyperliquid", "pacifica"]);
+/**
+ * Network a legacy-shaped agent is registered on, or null when it cannot be
+ * classified (an untagged Lighter-family record, whose approve always honored -n).
+ */
+export function recordedAgentNetworkOf(exchange, meta) {
+    if (meta.network !== undefined)
+        return meta.network;
+    if (PRE_TAG_MAINNET_ONLY_VENUES.has(exchange))
+        return "mainnet";
+    return null;
+}
+/**
+ * How an agent record got here (AgentMeta.source). Records written before the field existed were
+ * all created by `wallet agent approve` (master-signed on this machine), except Ondo keys, which
+ * are always created in the Ondo Perps web app.
+ */
+export function agentSourceOf(exchange, meta) {
+    if (meta.source !== undefined)
+        return meta.source;
+    return exchange === "ondo" || exchange === "qfex" ? "imported" : "approved";
+}
+/**
+ * Network a legacy-shaped agent is registered on. Untagged Lighter-family
+ * records (whose approve always honored -n) cannot be classified and throw.
+ */
+export function agentNetworkOf(exchange, meta) {
+    const recorded = recordedAgentNetworkOf(exchange, meta);
+    if (recorded !== null)
+        return recorded;
+    throw new PerpError("AGENT_NOT_REGISTERED", `${exchange} agent "${meta.agentName}" has no recorded network (registered before network tagging)`, {
+        remediation: `Set "network": "mainnet" or "testnet" on settings.agents["${exchange}"]["${meta.agentName}"] in ~/.perp/settings.json, or re-register it: perp [-n testnet] wallet agent rotate ${exchange} ${meta.agentName}`,
+    });
+}
+/** Throws AGENT_NOT_REGISTERED when `meta` was registered on a different network than `network`. */
+export function assertAgentNetwork(exchange, meta, network) {
+    const registered = agentNetworkOf(exchange, meta);
+    if (registered !== network) {
+        throw new PerpError("AGENT_NOT_REGISTERED", `${exchange} agent "${meta.agentName}" is registered on ${registered}, not ${network}`, {
+            remediation: registered === "mainnet"
+                ? `Run without -n testnet to use or manage it, or register a testnet agent: perp -n testnet wallet agent approve ${exchange}`
+                : `Run with -n testnet to use or manage it, or register a mainnet agent: perp wallet agent approve ${exchange}`,
+        });
+    }
+}
+/** First non-partial agent of `exchange` registered on `network`, or null. */
+export function getAgentForNetwork(exchange, network) {
+    assertLegacyAgentVenue(exchange);
+    const settings = loadSettings();
+    const byExchange = settings.agents?.[exchange];
+    if (!byExchange)
+        return null;
+    for (const meta of Object.values(byExchange)) {
+        if (meta.status !== "partial" && agentNetworkOf(exchange, meta) === network)
+            return meta;
+    }
+    return null;
+}
 /**
  * Persist an agent meta entry for the given exchange.
  * Acquires a lockfile before writing to prevent concurrent races (AC-14).
@@ -115,6 +186,7 @@ export function getAgent(exchange, agentName) {
  * double-acquire or release.
  */
 export function setAgent(exchange, meta) {
+    assertLegacyAgentVenue(exchange);
     const alreadyLocked = callerHoldsLock(exchange);
     if (!alreadyLocked) {
         acquireLock(exchange);
@@ -162,6 +234,8 @@ export function listAgents(exchange) {
     for (const [ex, agents] of Object.entries(settings.agents)) {
         if (exchange !== undefined && ex !== exchange)
             continue;
+        if (NON_LEGACY_AGENT_VENUES.has(ex))
+            continue; // listed by listVenueAgents()
         if (agents && typeof agents === "object") {
             for (const meta of Object.values(agents)) {
                 result.push({ exchange: ex, meta });
@@ -170,3 +244,61 @@ export function listAgents(exchange) {
     }
     return result;
 }
+/** Named agent, or the only/first registered one when agentName is omitted. */
+export function getVenueAgent(venue, agentName) {
+    const settings = loadSettings();
+    const byVenue = settings.agents?.[venue];
+    if (!byVenue)
+        return null;
+    if (agentName !== undefined)
+        return byVenue[agentName] ?? null;
+    const first = Object.values(byVenue)[0];
+    return first === undefined ? null : first;
+}
+/** First Ondo/Arcus agent registered on `network` (meta.network), or null — never another network's key. */
+export function getVenueAgentForNetwork(venue, network) {
+    const settings = loadSettings();
+    const byVenue = settings.agents?.[venue];
+    if (!byVenue)
+        return null;
+    const match = Object.values(byVenue).find(m => m.network === network);
+    return match === undefined ? null : match;
+}
+export function setVenueAgent(venue, meta) {
+    const alreadyLocked = callerHoldsLock(venue);
+    if (!alreadyLocked)
+        acquireLock(venue);
+    try {
+        const settings = loadSettings();
+        if (!settings.agents)
+            settings.agents = {};
+        const map = (settings.agents[venue] ?? {});
+        map[meta.agentName] = meta;
+        settings.agents[venue] = map;
+        saveSettings(settings);
+    }
+    finally {
+        if (!alreadyLocked)
+            releaseLock(venue);
+    }
+}
+export function deleteVenueAgent(venue, agentName) {
+    const settings = loadSettings();
+    const byVenue = settings.agents?.[venue];
+    if (!byVenue || !(agentName in byVenue))
+        return false;
+    delete byVenue[agentName];
+    saveSettings(settings);
+    return true;
+}
+export function listVenueAgents() {
+    const settings = loadSettings();
+    const out = [];
+    for (const v of ["ondo", "arcus", "qfex"]) {
+        const m = settings.agents?.[v];
+        if (m)
+            for (const meta of Object.values(m))
+                out.push({ exchange: v, meta });
+    }
+    return out;
+}

package/dist/agent-wallet/venue-keystore.d.ts

@@ -0,0 +1,14 @@
+export declare function venueKeystoreDir(dir: string): string;
+export declare function venueKeystorePath(dir: string, name: string): string;
+/** Encrypt `plaintext` and write it with mode 0600. Returns the absolute path. */
+export declare function saveVenueSecret(dir: string, name: string, plaintext: string, passphrase: string): string;
+/**
+ * Atomic keystore write: tmp file (0600, exclusive create) in the same directory, fsync,
+ * then rename over the target. A crash or full disk never leaves a truncated keystore
+ * where a valid one (or none) was. Throws on any failure after removing the tmp file.
+ */
+export declare function writeKeystoreAtomic(path: string, contents: string): void;
+/** Read + decrypt a stored secret. `remediation` is surfaced on every failure. */
+export declare function loadVenueSecret(dir: string, name: string, passphrase: string, remediation: string): string;
+/** Idempotent delete. Returns true if a file was removed. */
+export declare function deleteVenueSecret(dir: string, name: string): boolean;

package/dist/agent-wallet/venue-keystore.js

@@ -0,0 +1,121 @@
+/**
+ * Generic per-venue encrypted secret store (SSOT Rule #3).
+ *
+ * `~/.perp/<dir>/<name>.json`, AES-256-GCM with a scrypt-derived key — the same
+ * scheme as lighter-keystore.ts / OWS. Used for secrets that are not an
+ * OWS-native curve key: Lighter-family L2 slot keys (`lighter-rh-agents`) and
+ * Ondo HMAC API secrets (`ondo-agents`).
+ *
+ * No fallbacks (Rule #2): missing file / wrong passphrase / corrupt file throw.
+ */
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync } from "fs";
+import { resolve } from "path";
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { PerpError } from "../errors.js";
+const KDF = { dklen: 32, n: 65536, p: 1, r: 8 };
+function assertSafeSegment(s, what) {
+    if (!/^[A-Za-z0-9._-]+$/.test(s) || s === "." || s === "..") {
+        throw new PerpError("INVALID_PARAMS", `invalid keystore ${what}: "${s}"`);
+    }
+}
+export function venueKeystoreDir(dir) {
+    assertSafeSegment(dir, "directory");
+    const home = process.env["HOME"];
+    if (!home)
+        throw new PerpError("INVALID_PARAMS", "HOME is not set; cannot locate ~/.perp keystore");
+    return resolve(home, ".perp", dir);
+}
+export function venueKeystorePath(dir, name) {
+    assertSafeSegment(name, "name");
+    return resolve(venueKeystoreDir(dir), `${name}.json`);
+}
+/** Encrypt `plaintext` and write it with mode 0600. Returns the absolute path. */
+export function saveVenueSecret(dir, name, plaintext, passphrase) {
+    const d = venueKeystoreDir(dir);
+    if (!existsSync(d))
+        mkdirSync(d, { recursive: true, mode: 0o700 });
+    chmodSync(d, 0o700);
+    const path = venueKeystorePath(dir, name);
+    const salt = randomBytes(32);
+    const iv = randomBytes(12);
+    const dk = scryptSync(Buffer.from(passphrase, "utf-8"), salt, KDF.dklen, { N: KDF.n, r: KDF.r, p: KDF.p, maxmem: 128 * 1024 * 1024 });
+    const cipher = createCipheriv("aes-256-gcm", dk, iv);
+    const ciphertext = Buffer.concat([cipher.update(Buffer.from(plaintext, "utf-8")), cipher.final()]);
+    const file = {
+        version: 1,
+        kind: "venue-secret",
+        dir,
+        name,
+        crypto: {
+            cipher: "aes-256-gcm",
+            cipherparams: { iv: iv.toString("hex") },
+            ciphertext: ciphertext.toString("hex"),
+            auth_tag: cipher.getAuthTag().toString("hex"),
+            kdf: "scrypt",
+            kdfparams: { dklen: KDF.dklen, n: KDF.n, p: KDF.p, r: KDF.r, salt: salt.toString("hex") },
+        },
+        createdAt: new Date().toISOString(),
+    };
+    writeKeystoreAtomic(path, JSON.stringify(file, null, 2));
+    return path;
+}
+/**
+ * Atomic keystore write: tmp file (0600, exclusive create) in the same directory, fsync,
+ * then rename over the target. A crash or full disk never leaves a truncated keystore
+ * where a valid one (or none) was. Throws on any failure after removing the tmp file.
+ */
+export function writeKeystoreAtomic(path, contents) {
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        const fd = openSync(tmp, "wx", 0o600);
+        try {
+            writeSync(fd, contents);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        if (existsSync(tmp))
+            unlinkSync(tmp);
+        throw e;
+    }
+}
+/** Read + decrypt a stored secret. `remediation` is surfaced on every failure. */
+export function loadVenueSecret(dir, name, passphrase, remediation) {
+    const path = venueKeystorePath(dir, name);
+    if (!existsSync(path)) {
+        throw new PerpError("KEY_NOT_FOUND", `Keystore not found: ${path}`, { remediation });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf-8"));
+    }
+    catch (e) {
+        throw new PerpError("SIGNATURE_FAILED", `Keystore corrupt (${path}): ${e instanceof Error ? e.message : String(e)}`, { remediation });
+    }
+    if (parsed.version !== 1 || parsed.crypto?.cipher !== "aes-256-gcm" || parsed.crypto?.kdf !== "scrypt") {
+        throw new PerpError("SIGNATURE_FAILED", `Keystore has unsupported version/cipher: ${path}`, { remediation });
+    }
+    const kp = parsed.crypto.kdfparams;
+    const dk = scryptSync(Buffer.from(passphrase, "utf-8"), Buffer.from(kp.salt, "hex"), kp.dklen, { N: kp.n, r: kp.r, p: kp.p, maxmem: 128 * 1024 * 1024 });
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", dk, Buffer.from(parsed.crypto.cipherparams.iv, "hex"));
+        decipher.setAuthTag(Buffer.from(parsed.crypto.auth_tag, "hex"));
+        return Buffer.concat([decipher.update(Buffer.from(parsed.crypto.ciphertext, "hex")), decipher.final()]).toString("utf-8");
+    }
+    catch (e) {
+        throw new PerpError("SIGNATURE_FAILED", `Keystore decrypt failed (${path}): ${e instanceof Error ? e.message : String(e)}`, { remediation });
+    }
+}
+/** Idempotent delete. Returns true if a file was removed. */
+export function deleteVenueSecret(dir, name) {
+    const path = venueKeystorePath(dir, name);
+    if (!existsSync(path))
+        return false;
+    unlinkSync(path);
+    return true;
+}

package/dist/api/public/hyperliquid.js

@@ -1,4 +1,4 @@
-import { HYPERLIQUID_API_URL } from "./urls.js";
+import { HYPERLIQUID_API_URL, sharedApiNetwork } from "./urls.js";
 import { assertOk } from "./_http.js";
 import { withCache, TTL_MARKET } from "../../cache.js";
 // ── Internal ──
@@ -16,7 +16,7 @@ async function hlPost(type) {
 export function fetchHyperliquidMeta() {
     // SSOT rule #2: error must propagate. Row-level skipping handles missing
     // markPx / funding so a 0 doesn't reach downstream comparisons.
-    return withCache("pub:hl:metaAndAssetCtxs", TTL_MARKET, async () => {
+    return withCache(`pub:hl:${sharedApiNetwork()}:metaAndAssetCtxs`, TTL_MARKET, async () => {
         const json = await hlPost("metaAndAssetCtxs");
         const universe = (json[0] ?? {}).universe ?? [];
         const ctxs = (json[1] ?? []);
@@ -38,7 +38,7 @@ export function fetchHyperliquidMetaRaw() {
     // `.catch(() => null)` so a network failure surfaces as a rejected Promise.
     // Callers should wrap with Promise.allSettled to keep multi-DEX comparisons
     // running when one DEX is down.
-    return withCache("pub:hl:metaAndAssetCtxs:raw", TTL_MARKET, () => hlPost("metaAndAssetCtxs"));
+    return withCache(`pub:hl:${sharedApiNetwork()}:metaAndAssetCtxs:raw`, TTL_MARKET, () => hlPost("metaAndAssetCtxs"));
 }
 export function parseHyperliquidMetaRaw(raw) {
     const rates = new Map();
@@ -65,7 +65,7 @@ export function parseHyperliquidMetaRaw(raw) {
 }
 export function fetchHyperliquidAllMidsRaw() {
     // SSOT rule #2: error must propagate; see fetchHyperliquidMetaRaw.
-    return withCache("pub:hl:allMids:raw", TTL_MARKET, () => hlPost("allMids"));
+    return withCache(`pub:hl:${sharedApiNetwork()}:allMids:raw`, TTL_MARKET, () => hlPost("allMids"));
 }
 // ── Health check ──
 export async function pingHyperliquid() {

package/dist/api/public/lighter.js

@@ -1,4 +1,4 @@
-import { LIGHTER_API_URL } from "./urls.js";
+import { LIGHTER_API_URL, sharedApiNetwork } from "./urls.js";
 import { assertOk } from "./_http.js";
 import { withCache, TTL_MARKET } from "../../cache.js";
 // ── Fetchers ──
@@ -7,7 +7,7 @@ export function fetchLighterOrderBookDetails() {
     // returned no markets" from "API down" otherwise. Row-level skipping is
     // applied for missing/invalid last_trade_price so we never publish a
     // 0 price downstream.
-    return withCache("pub:lt:orderBookDetails", TTL_MARKET, async () => {
+    return withCache(`pub:lt:${sharedApiNetwork()}:orderBookDetails`, TTL_MARKET, async () => {
         const res = await fetch(`${LIGHTER_API_URL}/api/v1/orderBookDetails`);
         await assertOk(res, "Lighter orderBookDetails");
         const json = await res.json();
@@ -31,7 +31,7 @@ export function fetchLighterOrderBookDetailsRaw() {
     // rejected Promise instead of being indistinguishable from "API returned no
     // markets". Non-2xx responses are also rejected so a 5xx JSON body cannot
     // fulfill as if it were valid data.
-    return withCache("pub:lt:orderBookDetails:raw", TTL_MARKET, async () => {
+    return withCache(`pub:lt:${sharedApiNetwork()}:orderBookDetails:raw`, TTL_MARKET, async () => {
         const res = await fetch(`${LIGHTER_API_URL}/api/v1/orderBookDetails`);
         await assertOk(res, "Lighter orderBookDetails");
         return res.json();
@@ -44,7 +44,7 @@ export function fetchLighterFundingRates() {
     // documented as intermittent on Lighter's side — when missing, surface as
     // null so the consumer can apply the orderBookDetails fallback (a
     // documented price-source preference, NOT an error fallback).
-    return withCache("pub:lt:fundingRates", TTL_MARKET, async () => {
+    return withCache(`pub:lt:${sharedApiNetwork()}:fundingRates`, TTL_MARKET, async () => {
         const res = await fetch(`${LIGHTER_API_URL}/api/v1/funding-rates`);
         await assertOk(res, "Lighter funding-rates");
         const json = await res.json();
@@ -75,7 +75,7 @@ export function fetchLighterFundingRates() {
 }
 export function fetchLighterFundingRatesRaw() {
     // SSOT rule #2: error must propagate; see fetchLighterOrderBookDetailsRaw.
-    return withCache("pub:lt:fundingRates:raw", TTL_MARKET, async () => {
+    return withCache(`pub:lt:${sharedApiNetwork()}:fundingRates:raw`, TTL_MARKET, async () => {
         const res = await fetch(`${LIGHTER_API_URL}/api/v1/funding-rates`);
         await assertOk(res, "Lighter funding-rates");
         return res.json();

package/dist/api/public/pacifica.d.ts

@@ -2,7 +2,6 @@ interface PacificaAsset {
     symbol: string;
     funding: number;
     mark: number;
-    nextFunding?: number;
 }
 export declare function fetchPacificaPrices(): Promise<PacificaAsset[]>;
 export declare function fetchPacificaPricesRaw(): Promise<unknown>;

package/dist/api/public/pacifica.js

@@ -1,11 +1,11 @@
-import { PACIFICA_API_URL } from "./urls.js";
+import { PACIFICA_API_URL, sharedApiNetwork } from "./urls.js";
 import { assertOk } from "./_http.js";
 import { withCache, TTL_MARKET } from "../../cache.js";
 // ── Fetchers ──
 export function fetchPacificaPrices() {
     // SSOT rule #2: error must propagate. Row-level skipping is applied for
     // missing/invalid mark or funding so a 0 doesn't reach downstream paths.
-    return withCache("pub:pac:prices", TTL_MARKET, async () => {
+    return withCache(`pub:pac:${sharedApiNetwork()}:prices`, TTL_MARKET, async () => {
         const res = await fetch(PACIFICA_API_URL);
         await assertOk(res, "Pacifica prices");
         const json = await res.json();
@@ -21,16 +21,7 @@ export function fetchPacificaPrices() {
             if (!symbol || fundingRaw === undefined || !Number.isFinite(funding) || !Number.isFinite(mark) || mark <= 0) {
                 continue;
             }
-            const nextFundingRaw = p.next_funding;
-            const nextFundingNumber = Number(nextFundingRaw);
-            out.push({
-                symbol,
-                funding,
-                mark,
-                nextFunding: nextFundingRaw !== undefined && Number.isFinite(nextFundingNumber)
-                    ? nextFundingNumber
-                    : undefined,
-            });
+            out.push({ symbol, funding, mark });
         }
         return out;
     });
@@ -41,7 +32,7 @@ export function fetchPacificaPricesRaw() {
     // Callers should wrap with Promise.allSettled to keep multi-DEX comparisons
     // running when one DEX is down. Non-2xx responses are also rejected so a
     // 5xx JSON body cannot fulfill as if it were valid data.
-    return withCache("pub:pac:prices:raw", TTL_MARKET, async () => {
+    return withCache(`pub:pac:${sharedApiNetwork()}:prices:raw`, TTL_MARKET, async () => {
         const res = await fetch(PACIFICA_API_URL);
         await assertOk(res, "Pacifica prices");
         return res.json();

package/dist/api/public/urls.d.ts

@@ -1,12 +1,20 @@
 /**
  * Shared API URL management for all exchanges.
- * URLs are mutable to support --network testnet switching.
+ *
+ * `legacyPublicBaseUrl(venue, net)` is the network-aware source for the public
+ * data path (funding/legacy-public.ts). The mutable `*_API_URL` globals remain
+ * for the older fetchers below and are switched by setSharedApiNetwork().
  */
+type LegacyPublicVenue = "pacifica" | "hyperliquid" | "aster";
+export declare function legacyPublicBaseUrl(venue: LegacyPublicVenue, net: "mainnet" | "testnet"): string;
 export declare let PACIFICA_API_URL: string;
 export declare let HYPERLIQUID_API_URL: string;
 export declare let LIGHTER_API_URL: string;
+/** Network selected by the CLI entry point (setSharedApiNetwork). */
+export declare function sharedApiNetwork(): "mainnet" | "testnet";
 /**
  * Switch shared API URLs between mainnet and testnet.
  * Call from CLI entry point after parsing --network flag.
  */
 export declare function setSharedApiNetwork(network: "mainnet" | "testnet"): void;
+export {};

package/dist/api/public/urls.js

@@ -1,33 +1,55 @@
 /**
  * Shared API URL management for all exchanges.
- * URLs are mutable to support --network testnet switching.
+ *
+ * `legacyPublicBaseUrl(venue, net)` is the network-aware source for the public
+ * data path (funding/legacy-public.ts). The mutable `*_API_URL` globals remain
+ * for the older fetchers below and are switched by setSharedApiNetwork().
  */
+import { PerpError } from "../../errors.js";
+import { asterVenue } from "../../exchanges/venues/aster.js";
+import { MAINNET_REST as PAC_MAINNET_REST, TESTNET_REST as PAC_TESTNET_REST } from "../../pacifica/constants.js";
+/** REST base per legacy venue and network. null = no public testnet API known. */
+const LEGACY_PUBLIC_BASES = {
+    pacifica: { mainnet: PAC_MAINNET_REST, testnet: PAC_TESTNET_REST },
+    hyperliquid: { mainnet: "https://api.hyperliquid.xyz", testnet: "https://api.hyperliquid-testnet.xyz" },
+    // SSOT: the Aster venue definition (venues/aster.ts) — same hosts AsterAdapter uses.
+    aster: { mainnet: asterVenue.networks.mainnet.restUrl, testnet: asterVenue.networks.testnet === null ? null : asterVenue.networks.testnet.restUrl },
+};
+export function legacyPublicBaseUrl(venue, net) {
+    const url = LEGACY_PUBLIC_BASES[venue][net];
+    if (url === null) {
+        throw new PerpError("NOT_IMPLEMENTED", `${venue} has no public ${net} market-data API`, {
+            remediation: `Run without --testnet for ${venue} market data`,
+        });
+    }
+    return url;
+}
 const MAINNET_URLS = {
-    pacifica: "https://api.pacifica.fi/api/v1/info/prices",
+    pacifica: `${PAC_MAINNET_REST}/info/prices`,
     hyperliquid: "https://api.hyperliquid.xyz/info",
     lighter: "https://mainnet.zklighter.elliot.ai",
 };
 const TESTNET_URLS = {
-    pacifica: null, // no public testnet API
+    pacifica: `${PAC_TESTNET_REST}/info/prices`,
     hyperliquid: "https://api.hyperliquid-testnet.xyz/info",
     lighter: "https://testnet.zklighter.elliot.ai",
 };
 export let PACIFICA_API_URL = MAINNET_URLS.pacifica;
 export let HYPERLIQUID_API_URL = MAINNET_URLS.hyperliquid;
 export let LIGHTER_API_URL = MAINNET_URLS.lighter;
+let _sharedNetwork = "mainnet";
+/** Network selected by the CLI entry point (setSharedApiNetwork). */
+export function sharedApiNetwork() {
+    return _sharedNetwork;
+}
 /**
  * Switch shared API URLs between mainnet and testnet.
  * Call from CLI entry point after parsing --network flag.
  */
 export function setSharedApiNetwork(network) {
-    if (network === "testnet") {
-        PACIFICA_API_URL = TESTNET_URLS.pacifica ?? MAINNET_URLS.pacifica;
-        HYPERLIQUID_API_URL = TESTNET_URLS.hyperliquid ?? MAINNET_URLS.hyperliquid;
-        LIGHTER_API_URL = TESTNET_URLS.lighter ?? MAINNET_URLS.lighter;
-    }
-    else {
-        PACIFICA_API_URL = MAINNET_URLS.pacifica;
-        HYPERLIQUID_API_URL = MAINNET_URLS.hyperliquid;
-        LIGHTER_API_URL = MAINNET_URLS.lighter;
-    }
+    _sharedNetwork = network;
+    const urls = network === "testnet" ? TESTNET_URLS : MAINNET_URLS;
+    PACIFICA_API_URL = urls.pacifica;
+    HYPERLIQUID_API_URL = urls.hyperliquid;
+    LIGHTER_API_URL = urls.lighter;
 }

package/dist/arb/file-lock.d.ts

@@ -0,0 +1,11 @@
+/** How long to wait for another process's lock, and when a lock left by a dead process is stale. */
+export declare const FILE_LOCK_WAIT_MS = 5000;
+export declare const FILE_LOCK_STALE_MS = 30000;
+/**
+ * Run `fn` holding the advisory lock file `<path>.lock` (O_EXCL create) — for a load → modify →
+ * save of a state file shared by several perp processes (bots, daemons, CLI), so one process
+ * never overwrites another's concurrent write. A lock older than FILE_LOCK_STALE_MS (its holder
+ * died) is removed; a live one not released within FILE_LOCK_WAIT_MS → LOCK_HELD (nothing is
+ * written on top of an unknown concurrent write).
+ */
+export declare function withFileLock<T>(path: string, what: string, fn: () => T): T;

package/dist/arb/file-lock.js

@@ -0,0 +1,74 @@
+import { closeSync, existsSync, mkdirSync, openSync, statSync, unlinkSync } from "fs";
+import { resolve } from "path";
+import { PerpError } from "../errors.js";
+/** How long to wait for another process's lock, and when a lock left by a dead process is stale. */
+export const FILE_LOCK_WAIT_MS = 5_000;
+export const FILE_LOCK_STALE_MS = 30_000;
+/** Locks this process holds (path → depth): a nested load-modify-save in the same process never self-deadlocks. */
+const held = new Map();
+/**
+ * Run `fn` holding the advisory lock file `<path>.lock` (O_EXCL create) — for a load → modify →
+ * save of a state file shared by several perp processes (bots, daemons, CLI), so one process
+ * never overwrites another's concurrent write. A lock older than FILE_LOCK_STALE_MS (its holder
+ * died) is removed; a live one not released within FILE_LOCK_WAIT_MS → LOCK_HELD (nothing is
+ * written on top of an unknown concurrent write).
+ */
+export function withFileLock(path, what, fn) {
+    const lock = `${path}.lock`;
+    const depth = held.get(lock) ?? 0;
+    if (depth > 0) {
+        held.set(lock, depth + 1);
+        try {
+            return fn();
+        }
+        finally {
+            held.set(lock, depth);
+        }
+    }
+    const dir = resolve(path, "..");
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + FILE_LOCK_WAIT_MS;
+    const sleeper = new Int32Array(new SharedArrayBuffer(4));
+    for (;;) {
+        try {
+            closeSync(openSync(lock, "wx", 0o600));
+            break;
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+            let stale = false;
+            try {
+                stale = Date.now() - statSync(lock).mtimeMs > FILE_LOCK_STALE_MS;
+            }
+            catch {
+                continue; // released between the open and the stat: try again
+            }
+            if (stale) {
+                try {
+                    unlinkSync(lock);
+                }
+                catch { /* another process removed it */ }
+                continue;
+            }
+            if (Date.now() > deadline) {
+                throw new PerpError("LOCK_HELD", `${what} is locked by another perp process (${lock})`, {
+                    remediation: `Retry shortly; if no other perp process is running, delete ${lock}`,
+                });
+            }
+            Atomics.wait(sleeper, 0, 0, 10);
+        }
+    }
+    held.set(lock, 1);
+    try {
+        return fn();
+    }
+    finally {
+        held.delete(lock);
+        try {
+            unlinkSync(lock);
+        }
+        catch { /* already gone */ }
+    }
+}