feat(perps-controller): make package safe for extension consumers (re-do of #8374)

[abretonc7s]

Explanation

@metamask/perps-controller currently cannot be consumed from the MetaMask extension because:

1. LavaMoat policy violation — the public barrel re-exports 8 MYX adapter functions, which pulls @myx-trade/sdk into the static import graph even though MYXProvider is loaded via dynamic import().
2. Webpack static analysis — webpack eagerly resolves the argument of import('./providers/MYXProvider') at build time, which breaks because MYXProvider is intentionally not published (files: [..., "!dist/providers/MYXProvider*"]).
3. Eager install — @myx-trade/sdk is in dependencies, so extension yarn install still pulls it even though it is unused outside the dynamic path.

Solution

This PR is the functional equivalent of #8374, re-created on top of the latest mobile→core sync. The mobile repo owns the source-of-truth for packages/perps-controller/src/**/*.ts via scripts/perps/validate-core-sync.sh, so the src/ changes arrive here via the sync script run from mobile branch feat/tat-2863-sync-controller-code-extension. The package metadata (package.json, CHANGELOG.md, yarn.lock) has to be maintained manually on the core side because it lives outside the rsync path.

Commit layout

Commit 1 (feat(perps): sync controller code from mobile) — initial sync output. The three core fixes (webpackIgnore magic comment, MYX barrel removal, perpsConnectionAttemptContext relocation) plus accumulated mobile drift from the previous sync baseline (withdrawal-timestamp state fields, HyperLiquid service improvements, etc.).

Commit 2 (feat(perps): move @myx-trade/sdk to optionalDependencies) — package metadata only:

• Move @myx-trade/sdk from dependencies to optionalDependencies so extension/mobile consumers don't install it automatically.
• Regenerate yarn.lock with dependenciesMeta["@myx-trade/sdk"].optional = true on the workspace entry.
• Document the Unreleased changes in CHANGELOG.md (Changed + BREAKING Removed sections).

Commit 3 (Merge origin/main into feat/perps/another-sync) — merge commit that:

• Pulls in feat(perps): latest controller sync #8333 (competing perps sync) and the 5 releases that landed on main while this PR was in review. Conflict resolution: take mobile as source of truth on src/ (re-ran the sync script after merge to guarantee packages/perps-controller/src/ matches mobile HEAD exactly), merged CHANGELOG entries, kept optionalDependencies block.
• Reverts a draft addition of MetaMetricsController:trackEvent to PerpsControllerAllowedActions. An earlier draft added this to let the extension drop a type cast, but mobile has no MetaMetricsController (uses a MetaMetrics singleton), so @metamask/messenger's parent type narrowed to never and broke mobile's perps-controller-messenger setup. Extension keeps its existing cast workaround until both host apps share a real MetaMetricsController.

Commit 4 (chore(perps-controller): fix CI — changelog order + prettier) — small CI follow-up.

Commit 5 (chore(perps-controller): sync lint cleanup from mobile) — output of running the hardened mobile sync script after a corresponding mobile fix to align mobile's .eslintrc.js perps-controller override with core's @metamask/eslint-config base rules. Mobile changes that produced this commit:

1. Added BinaryExpression[operator='in'] (+ WithStatement and SequenceExpression) to the mobile .eslintrc.js perps-controller override so mobile lint mirrors what core enforces. This closes the gap where 'x' in y violations passed mobile lint silently and then landed in core as new no-restricted-syntax suppressions at sync time.
2. Replaced 24 'x' in y uses with hasProperty(y, 'x') from @metamask/utils across 8 source files. Four cases were kept as 'in' behind /* eslint-disable no-restricted-syntax */ because hasProperty narrows the KEY but not the discriminated-union branch — losing access to .filled, .resting, .oid, .totalSz on the HyperLiquid SDK types and losing keyof typeof HYPERLIQUID_ASSET_CONFIGS narrowing.
3. Hardened scripts/perps/validate-core-sync.sh step 6 with a per-file/per-rule suppression delta check that hard-fails the sync if any (file, rule) pair's suppression count INCREASED compared to the baseline. This is the canonical local detection point for "a new lint violation is about to land in core."

Net effect on this PR: perps-controller suppression count drops from 30 → 6. eslint-suppressions.json loses 45 entries. No runtime change.

Splitting the commits this way makes it easy for a reviewer to see the "PR 8374 intent" (commits 1–2) isolated from the merge (commit 3), CI fix (commit 4), and the lint cleanup (commit 5).

Verification

• yarn install — clean (only the expected optional-dep warning for @myx-trade/sdk).
• yarn workspace @metamask/perps-controller build — PASS.
• yarn workspace @metamask/perps-controller changelog:validate — PASS.
• Full mobile→core sync pipeline (preflight → conflict check → rsync → yarn install → verify fixes → eslint auto-fix + suppressions → build → lint → sync state): 9/9 PASS after the merge + lint cleanup. Suppression count: 6 (down from 30 before commit 5).
• Mobile-side typecheck (tsc --noEmit with no incremental cache): PASS — validates that the package type changes round-trip cleanly into mobile's RootExtendedMessenger.
• Mobile jest (PerpsController.test.ts, HyperLiquidSubscriptionService.test.ts, TradingService.test.ts): 412 passing, 4 skipped.

References

• Supersedes fix: Remove dynamic imports, move myx to optional dependencies #8374
• Depends on feat(perps): sync controller code with extension metamask-mobile#28509 (source-of-truth mobile changes — includes the lint alignment + hasProperty migration that produced commit 5)
• Extension consumer: feat: add metrics to perps metamask-extension#41337 (this PR unblocks the LavaMoat/webpack concerns; the controllerMessenger as PackagePerpsControllerMessenger cast remains until MetaMetricsController becomes a shared concept)

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Medium risk because it introduces a breaking change to public exports and adjusts dynamic import/bundling behavior, plus modifies WebSocket/REST candle subscription lifecycles which could affect chart/market data reliability under rapid navigation.

Overview
Makes @metamask/perps-controller safer for extension consumers by moving @myx-trade/sdk to optionalDependencies, removing MYX adapter utilities from the public barrel (breaking), and adding /* webpackIgnore: true */ to the dynamic MYXProvider import to avoid webpack static resolution.

Hardens HyperLiquid connectivity and live-data flows: adds perpsConnectionAttemptContext to optionally suppress noisy startup errors, adds candle subscription debounce and AbortController cancellation for in-flight REST candle fetches, and prevents WS subscription leaks/races by tracking pending subscription promises.

Includes a broad lint cleanup replacing many 'x' in y checks with hasProperty (keeping a few in checks with explicit eslint disables for type narrowing), and updates the changelog, lockfile, and sync-state metadata accordingly.

^{Reviewed by Cursor Bugbot for commit 5ec006a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 37fe686. Configure here.}