dexterm-cli 0.0.0-stage → 0.1.2

package/dist/packages/data/src/social/kol.js

@@ -0,0 +1,269 @@
+// @dexterm/data — KOL lists (task-1330; design §5.4): the user's own lists (lane I-02 will fill
+// `own-x-list` from `list.read`), manual handles, and signed packs. A pack carries HANDLES (and optional
+// wallet addresses with evidence links), never posts; it grants membership, never credibility. Lists
+// persist in the shared SQLite cache (one --db controls everything) under the `social:kol` namespace.
+//
+// Pack format (task-1288 pack conventions, narrowed to one content kind):
+//   <dir>/pack.json      { name, version, publisher, kind: "kol-list", handles: [{ handle, wallet?, evidence? }] }
+//   <dir>/pack.lock      { files: { "pack.json": "<sha256 hex>" }, hash: "<sha256 hex of the files listing>" }
+//   <dir>/pack.lock.sig  optional `ssh-keygen -Y sign -n dexterm-pack` signature over pack.lock
+// Trust: `signed.verified` is true only when the signature verifies against the user's pinned
+// ~/.dexterm/allowed_signers; a tampered hash is refused outright (never imported as "unsigned").
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { systemClock } from "../clock.js";
+export const KOL_NS = 'social:kol';
+const FOREVER_MS = 10 * 365 * 86_400_000;
+export const PACK_MAX_HANDLES = 500;
+const HANDLE_RE = /^[A-Za-z0-9_]{1,15}$/;
+const BASE58_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const PROTO_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+export function normalizeHandle(h) {
+    return h.trim().replace(/^@/, '').toLowerCase();
+}
+export function isValidHandle(h) {
+    return HANDLE_RE.test(normalizeHandle(h));
+}
+export function sha256Hex(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/** The lock's `hash` is the sha256 of the sorted `name=sha\n` listing. */
+export function packHash(files) {
+    const listing = Object.keys(files).sort().map((k) => `${k}=${files[k]}\n`).join('');
+    return sha256Hex(listing);
+}
+/** `ssh-keygen -Y verify` against a pinned allowed_signers file. False on any failure, never throws. */
+export function sshKeygenVerifier(allowedSigners) {
+    return (lockBytes, signature, publisher) => {
+        try {
+            if (!existsSync(allowedSigners))
+                return false;
+            const sigPath = join(process.env.TMPDIR ?? '/tmp', `dexterm-pack-${process.pid}-${Date.now()}.sig`);
+            // ssh-keygen wants the signature in a file; the message goes on stdin.
+            writeFileSync(sigPath, signature);
+            try {
+                const r = spawnSync('ssh-keygen', ['-Y', 'verify', '-f', allowedSigners, '-I', publisher, '-n', 'dexterm-pack', '-s', sigPath], { input: lockBytes, timeout: 5000 });
+                return r.status === 0;
+            }
+            finally {
+                try {
+                    unlinkSync(sigPath);
+                }
+                catch { /* ignore */ }
+            }
+        }
+        catch {
+            return false;
+        }
+    };
+}
+export class PackError extends Error {
+    constructor(message) { super(message); this.name = 'PackError'; }
+}
+/** Parse + validate a pack directory. Throws PackError on any shape/hash problem; never imports a tampered pack. */
+export function readPack(dir, verify) {
+    const manifestPath = join(dir, 'pack.json');
+    const lockPath = join(dir, 'pack.lock');
+    if (!existsSync(manifestPath))
+        throw new PackError('pack.json missing');
+    if (!existsSync(lockPath))
+        throw new PackError('pack.lock missing (unlocked packs are refused)');
+    const manifestBytes = readFileSync(manifestPath);
+    const lockBytes = readFileSync(lockPath);
+    let lock;
+    try {
+        lock = JSON.parse(lockBytes.toString('utf8'));
+    }
+    catch {
+        throw new PackError('pack.lock is not JSON');
+    }
+    if (!lock || typeof lock !== 'object' || !lock.files || typeof lock.files !== 'object' || typeof lock.hash !== 'string')
+        throw new PackError('pack.lock shape');
+    for (const k of Object.keys(lock.files))
+        if (PROTO_KEYS.has(k) || k.includes('/') || k.includes('\\') || k.startsWith('.'))
+            throw new PackError(`pack.lock lists a forbidden path: ${k}`);
+    const want = lock.files['pack.json'];
+    if (!want || sha256Hex(manifestBytes) !== want.toLowerCase())
+        throw new PackError('pack.json does not match pack.lock (tampered or stale)');
+    if (packHash(lock.files) !== lock.hash.toLowerCase())
+        throw new PackError('pack.lock hash does not match its file listing');
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestBytes.toString('utf8'));
+    }
+    catch {
+        throw new PackError('pack.json is not JSON');
+    }
+    if (!manifest || typeof manifest !== 'object')
+        throw new PackError('pack.json shape');
+    if (manifest.kind !== 'kol-list')
+        throw new PackError(`pack kind ${JSON.stringify(manifest.kind)} is not kol-list`);
+    for (const k of ['name', 'version', 'publisher'])
+        if (typeof manifest[k] !== 'string' || !manifest[k].trim() || manifest[k].length > 80)
+            throw new PackError(`pack.json ${k}`);
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(manifest.name))
+        throw new PackError('pack name');
+    if (!Array.isArray(manifest.handles))
+        throw new PackError('pack.json handles must be an array');
+    if (manifest.handles.length === 0)
+        throw new PackError('pack has no handles');
+    if (manifest.handles.length > PACK_MAX_HANDLES)
+        throw new PackError(`pack has ${manifest.handles.length} handles (max ${PACK_MAX_HANDLES})`);
+    for (const h of manifest.handles) {
+        if (!h || typeof h !== 'object' || typeof h.handle !== 'string' || !isValidHandle(h.handle))
+            throw new PackError(`bad handle entry ${JSON.stringify(h?.handle ?? h).slice(0, 40)}`);
+        if (h.wallet !== undefined && (typeof h.wallet !== 'string' || !BASE58_RE.test(h.wallet)))
+            throw new PackError(`bad wallet for @${h.handle}`);
+        if (h.evidence !== undefined && (typeof h.evidence !== 'string' || !/^https?:\/\//.test(h.evidence) || h.evidence.length > 300))
+            throw new PackError(`bad evidence link for @${h.handle}`);
+    }
+    const sigPath = join(dir, 'pack.lock.sig');
+    const signed = existsSync(sigPath);
+    const verified = signed && !!verify && verify(lockBytes, readFileSync(sigPath, 'utf8'), manifest.publisher);
+    return { manifest, lock, signed, verified };
+}
+export class KolStore {
+    cache;
+    clock;
+    verify;
+    lists;
+    mutedSet;
+    constructor(opts) {
+        this.cache = opts.cache;
+        this.clock = opts.clock ?? systemClock;
+        this.verify = opts.verify ?? (opts.allowedSigners ? sshKeygenVerifier(opts.allowedSigners) : undefined);
+        this.lists = this.cache.get(KOL_NS, 'lists')?.value ?? [];
+        this.mutedSet = new Set(this.cache.get(KOL_NS, 'muted')?.value ?? []);
+    }
+    save() {
+        this.cache.set(KOL_NS, 'lists', this.lists, { ttlMs: FOREVER_MS });
+        this.cache.set(KOL_NS, 'muted', [...this.mutedSet], { ttlMs: FOREVER_MS });
+    }
+    all() { return this.lists.map((l) => ({ ...l, handles: [...l.handles], wallets: [...l.wallets] })); }
+    get(id) { return this.lists.find((l) => l.id === id); }
+    muted() { return [...this.mutedSet].sort(); }
+    isMuted(handle) { return this.mutedSet.has(normalizeHandle(handle)); }
+    /** Create a manual list (or return the existing one by name). */
+    create(name, source = 'manual') {
+        const id = `${source}:${name.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').slice(0, 64)}`;
+        const existing = this.lists.find((l) => l.id === id);
+        if (existing)
+            return existing;
+        const list = { id, name: name.trim().slice(0, 80), source, handles: [], wallets: [], signed: null, since: this.clock.now(), enabled: true, tier: source === 'pack' ? 'kol-b' : 'kol-a' };
+        this.lists.push(list);
+        this.save();
+        return list;
+    }
+    remove(id) {
+        const n = this.lists.length;
+        this.lists = this.lists.filter((l) => l.id !== id);
+        if (this.lists.length !== n)
+            this.save();
+        return this.lists.length !== n;
+    }
+    setEnabled(id, enabled) {
+        const l = this.get(id);
+        if (!l)
+            return false;
+        l.enabled = enabled;
+        this.save();
+        return true;
+    }
+    addHandle(id, handle) {
+        const l = this.get(id);
+        if (!l)
+            return { ok: false, reason: 'no such list' };
+        if (l.source === 'pack')
+            return { ok: false, reason: 'packs are read-only (edit the pack and re-import)' };
+        const h = normalizeHandle(handle);
+        if (!isValidHandle(h))
+            return { ok: false, reason: 'handle must be 1-15 letters, digits or _' };
+        if (l.handles.includes(h))
+            return { ok: false, reason: `@${h} already in ${l.name}` };
+        if (l.handles.length >= PACK_MAX_HANDLES)
+            return { ok: false, reason: `list is full (${PACK_MAX_HANDLES})` };
+        l.handles.push(h);
+        this.save();
+        return { ok: true };
+    }
+    removeHandle(id, handle) {
+        const l = this.get(id);
+        if (!l)
+            return false;
+        const h = normalizeHandle(handle);
+        const n = l.handles.length;
+        l.handles = l.handles.filter((x) => x !== h);
+        if (l.handles.length !== n)
+            this.save();
+        return l.handles.length !== n;
+    }
+    mute(handle) { const h = normalizeHandle(handle); if (isValidHandle(h)) {
+        this.mutedSet.add(h);
+        this.save();
+    } }
+    unmute(handle) { this.mutedSet.delete(normalizeHandle(handle)); this.save(); }
+    /** Seed a fully-formed list (fixtures/demos and tests only; the app path is create()/importPack()). */
+    seed(list) {
+        this.lists = this.lists.filter((l) => l.id !== list.id);
+        this.lists.push({ ...list, handles: list.handles.map(normalizeHandle), wallets: [...list.wallets] });
+        this.save();
+    }
+    /** Import a pack directory as a `pack` list (replacing a previous import of the same pack name). */
+    importPack(dir) {
+        const { manifest, lock, signed, verified } = readPack(dir, this.verify);
+        const id = `pack:${manifest.name.toLowerCase()}`;
+        const handles = [...new Set(manifest.handles.map((h) => normalizeHandle(h.handle)))];
+        const wallets = [...new Set(manifest.handles.map((h) => h.wallet).filter((w) => !!w))];
+        const list = {
+            id, name: `${manifest.name}@${manifest.version}`, source: 'pack', handles, wallets,
+            signed: { publisher: manifest.publisher, hash: lock.hash.toLowerCase(), verified },
+            since: this.clock.now(), enabled: true,
+            // A verified signature from a pinned publisher counts like the user's own list; unsigned packs stay kol-b.
+            tier: signed && verified ? 'kol-a' : 'kol-b',
+        };
+        this.lists = this.lists.filter((l) => l.id !== id);
+        this.lists.push(list);
+        this.save();
+        return list;
+    }
+    /** `kol-a` / `kol-b` for a handle on an enabled, unmuted list (own lists and verified packs win), else null. */
+    tierOf(handle) {
+        const h = normalizeHandle(handle);
+        if (this.mutedSet.has(h))
+            return null;
+        let best = null;
+        for (const l of this.lists) {
+            if (!l.enabled || !l.handles.includes(h))
+                continue;
+            if (l.tier === 'kol-a')
+                return 'kol-a';
+            best = 'kol-b';
+        }
+        return best;
+    }
+    /** Every handle that counts for the trending feed (enabled lists, muted removed), lower-cased. */
+    kolHandles() {
+        const out = new Set();
+        for (const l of this.lists)
+            if (l.enabled)
+                for (const h of l.handles)
+                    if (!this.mutedSet.has(h))
+                        out.add(h);
+        return out;
+    }
+    /** `own(3) · pack "sol-alpha" (41, signed)` style footer summary. */
+    summary() {
+        const own = this.lists.filter((l) => l.source !== 'pack');
+        const packs = this.lists.filter((l) => l.source === 'pack');
+        const parts = [];
+        if (own.length)
+            parts.push(`own(${own.reduce((s, l) => s + l.handles.length, 0)})`);
+        for (const p of packs)
+            parts.push(`pack "${p.name}" (${p.handles.length}, ${p.signed?.verified ? 'signed' : 'unsigned'}${p.enabled ? '' : ', off'})`);
+        if (this.mutedSet.size)
+            parts.push(`muted ${this.mutedSet.size}`);
+        return parts.length ? parts.join(' · ') : 'no KOL lists';
+    }
+}

package/dist/packages/data/src/social/model.js

@@ -0,0 +1,11 @@
+// @dexterm/data — social / news / trending model (task-1330, lane I-03; INTEGRATIONS-DESIGN §5.1).
+//
+// Conventions follow ../model.ts: epoch-ms timestamps, `null` = "source did not say", plain interfaces
+// only. Every post's `text` has ALREADY been through the ingest firewall (./firewall.ts) when it is a
+// SocialPost; the pre-firewall shape is `RawPost`. Nothing here is ever posted anywhere, and nothing is
+// fetched from X: posts arrive from keyless sources (news RSS, on-chain rules) today and from the user's
+// own X login (lane I-02) later — the model is the same.
+/** Display truncation (design §5.6): 280 shown, 512 stored, 160 for bios. */
+export const POST_DISPLAY_MAX = 280;
+export const POST_STORED_MAX = 512;
+export const BIO_MAX = 160;

package/dist/packages/data/src/social/rank.js

@@ -0,0 +1,184 @@
+// @dexterm/data — credibility, velocity, trend rows and narratives (task-1330; design §5.3 / §5.4).
+//
+// Rank = velocity × credibility, computed locally and deterministically:
+//   velocity    = spam-excluded listed posts in the last hour ÷ the mean of the previous 23 hourly
+//                 buckets (≥ 2 non-empty buckets required, else the venue's own volume velocity, else "new")
+//   credibility = mean author credibility over the window + KOL count + on-chain confirmation
+//                 − boost penalty − spam share; 0..100
+//   score       = velocity × credibility/100 + 0.1 per independent venue source that lists the mint
+// Author credibility comes only from the user's own observations (early entry, confirm rate, follower
+// quality when known) on top of a tier baseline; a KOL list grants membership, never credibility.
+import { countsForVelocity } from "./dedupe.js";
+export const HOUR_MS = 3_600_000;
+export const WINDOW_HOURS = 24;
+export const MIN_VELOCITY_SAMPLES = 2;
+export const BOOST_PENALTY = 20;
+export const CHAIN_CONFIRM_BONUS = 15;
+export const KOL_BONUS_PER = 2;
+export const KOL_BONUS_CAP = 10;
+export const SPAM_SHARE_PENALTY = 20;
+export const VENUE_CONFIRM_BONUS = 0.1;
+/** Baselines by tier (design §5.5 rule 6 + §5.4): news domains are official sources; spam is spam. */
+export const TIER_BASE = { src: 90, 'kol-a': 60, 'kol-b': 50, own: 55, none: 30, spam: 4 };
+const clamp01 = (n) => (typeof n === 'number' && Number.isFinite(n) ? Math.max(0, Math.min(1, n)) : null);
+export function credibilityOf(author, obs, now) {
+    const earlyEntry = clamp01(obs?.earlyEntry);
+    const followerQuality = clamp01(obs?.followerQuality);
+    const onChainConfirmRate = clamp01(obs?.onChainConfirmRate);
+    let score = TIER_BASE[author.tier];
+    if (earlyEntry !== null)
+        score += 25 * earlyEntry;
+    if (onChainConfirmRate !== null)
+        score += 15 * onChainConfirmRate;
+    if (followerQuality !== null)
+        score += 10 * followerQuality;
+    const spamPenalty = author.tier === 'spam' ? Math.max(0, score - TIER_BASE.spam) : 0;
+    score -= spamPenalty;
+    score = Math.max(0, Math.min(100, Math.round(score)));
+    return { handle: author.handle, score, inputs: { earlyEntry, followerQuality, onChainConfirmRate, spamPenalty, boostPenalty: 0 }, computedAt: now };
+}
+/** Posts per hourly bucket, index 0 = the current hour, 1 = the previous, … up to `hours`. */
+export function hourlyBuckets(posts, now, hours = WINDOW_HOURS) {
+    const out = new Array(hours).fill(0);
+    for (const p of posts) {
+        if (!countsForVelocity(p))
+            continue;
+        const age = now - p.t;
+        if (age < 0)
+            continue;
+        const i = Math.floor(age / HOUR_MS);
+        if (i < hours)
+            out[i] += 1;
+    }
+    return out;
+}
+export function socialVelocity(buckets) {
+    const postsPerHour = buckets[0] ?? 0;
+    const prior = buckets.slice(1);
+    const samples = prior.filter((n) => n > 0).length;
+    if (samples < MIN_VELOCITY_SAMPLES)
+        return { postsPerHour, velocity: null, samples };
+    const mean = prior.reduce((s, n) => s + n, 0) / prior.length;
+    return { postsPerHour, velocity: mean > 0 ? postsPerHour / mean : null, samples };
+}
+export function buildTrendRow(input) {
+    const { posts, venue, now } = input;
+    const listed = posts.filter((p) => !p.hidden);
+    const counted = posts.filter(countsForVelocity);
+    const lastHour = counted.filter((p) => now - p.t < HOUR_MS);
+    const buckets = hourlyBuckets(posts, now);
+    const sv = socialVelocity(buckets);
+    let velocity = sv.velocity;
+    let basis = 'social';
+    if (velocity === null) {
+        if (venue && venue.volumeVelocity !== null) {
+            velocity = venue.volumeVelocity;
+            basis = 'venue';
+        }
+        else
+            basis = 'new';
+    }
+    const windowPosts = lastHour.length ? lastHour : counted;
+    const kols = new Set();
+    let credSum = 0;
+    for (const p of windowPosts) {
+        credSum += input.credibility(p.author);
+        if (input.kolHandles.has(p.author.handle.replace(/^@/, '').toLowerCase()))
+            kols.add(p.author.handle.toLowerCase());
+    }
+    const spamCount = listed.filter((p) => p.flags.includes('spam')).reduce((s, p) => s + (p.collapsed?.posts ?? p.dupCount), 0);
+    const squatCount = listed.filter((p) => p.flags.includes('squat') || p.flags.includes('unverified-cashtag')).length;
+    const total = counted.length + spamCount;
+    const spamShare = total > 0 ? spamCount / total : 0;
+    let cred = windowPosts.length ? credSum / windowPosts.length : venue ? 20 + (venue.organicScore ?? 0) * 0.2 : 0;
+    cred += Math.min(kols.size, KOL_BONUS_CAP) * KOL_BONUS_PER;
+    if (input.chainConfirmed)
+        cred += CHAIN_CONFIRM_BONUS;
+    if (venue?.boosted)
+        cred -= BOOST_PENALTY;
+    cred -= spamShare * SPAM_SHARE_PENALTY;
+    cred = Math.max(0, Math.min(100, Math.round(cred)));
+    const venueSources = venue ? venue.sources.filter((s) => s !== 'boost').length : 0;
+    const vel = velocity ?? (sv.postsPerHour > 0 ? 1 : 0.5);
+    const score = vel * (cred / 100) + venueSources * VENUE_CONFIRM_BONUS;
+    const latest = [...counted].sort((a, b) => b.t - a.t).find((p) => input.credibility(p.author) >= 40) ?? null;
+    const sources = new Set();
+    for (const p of listed)
+        sources.add(p.platform === 'x' ? 'X' : p.platform === 'telegram' ? 'TG' : p.platform === 'discord' ? 'DC' : p.platform === 'news' ? 'news' : 'chain');
+    for (const s of venue?.sources ?? [])
+        sources.add(s);
+    const updatedAt = Math.max(venue?.fetchedAt ?? 0, ...listed.map((p) => p.provenance.fetchedAt));
+    return {
+        mint: input.mint, symbol: input.symbol, narrative: input.narrative ?? null,
+        velocity, velocityBasis: basis, postsPerHour: sv.postsPerHour, kolCount: kols.size, credibility: cred, score: Math.round(score * 1000) / 1000,
+        sources: [...sources], priceChange1h: venue?.priceChange1h ?? null, liq: venue?.liquidityUsd ?? null,
+        latestCrediblePostId: latest?.id ?? null, latestCrediblePost: latest,
+        hiddenSpam: spamCount, hiddenSquats: squatCount, updatedAt: updatedAt || now, venue,
+    };
+}
+/** Highest score first; ties by posts/h then symbol so the order is total. */
+export function rankRows(rows) {
+    return [...rows].sort((a, b) => b.score - a.score || b.postsPerHour - a.postsPerHour || a.symbol.localeCompare(b.symbol));
+}
+/**
+ * Narratives = clusters of tokens linked by shared KOL threads (one KOL handle posting about both inside
+ * the window) or co-mention (one post naming both mints). Union-find over the rows' mints. Labels come
+ * from `labels` (the analyst summary or the user), never from a single post; unlabelled clusters keep
+ * `label: null` and the UI lists the symbols.
+ */
+export function buildNarratives(rows, posts, kolHandles, labels = new Map(), newsCountFor = () => 0) {
+    const mints = rows.map((r) => r.mint);
+    const idx = new Map(mints.map((m, i) => [m, i]));
+    const parent = mints.map((_, i) => i);
+    const find = (i) => (parent[i] === i ? i : (parent[i] = find(parent[i])));
+    const union = (a, b) => { const ra = find(a), rb = find(b); if (ra !== rb)
+        parent[rb] = ra; };
+    const byKol = new Map();
+    const threads = new Map();
+    for (const p of posts) {
+        if (!countsForVelocity(p))
+            continue;
+        const ids = p.mints.map((m) => idx.get(m)).filter((i) => i !== undefined);
+        for (let i = 1; i < ids.length; i++)
+            union(ids[0], ids[i]); // co-mention
+        const h = p.author.handle.replace(/^@/, '').toLowerCase();
+        if (kolHandles.has(h)) {
+            const s = byKol.get(h) ?? new Set();
+            for (const i of ids)
+                s.add(i);
+            byKol.set(h, s);
+        }
+    }
+    for (const [h, set] of byKol) {
+        const arr = [...set];
+        for (let i = 1; i < arr.length; i++)
+            union(arr[0], arr[i]);
+        for (const i of arr) {
+            const t = threads.get(i) ?? new Set();
+            t.add(h);
+            threads.set(i, t);
+        }
+    }
+    const groups = new Map();
+    mints.forEach((_, i) => { const r = find(i); const g = groups.get(r) ?? []; g.push(i); groups.set(r, g); });
+    const out = [];
+    for (const members of groups.values()) {
+        if (members.length < 2)
+            continue; // a narrative needs at least two tokens
+        const rs = members.map((i) => rows[i]).sort((a, b) => b.score - a.score);
+        const id = rs.map((r) => r.mint.slice(0, 6)).sort().join('+');
+        const kolSet = new Set();
+        for (const i of members)
+            for (const h of threads.get(i) ?? [])
+                kolSet.add(h);
+        const vels = rs.map((r) => r.velocity).filter((v) => v !== null);
+        const d24 = rs.map((r) => r.venue?.priceChange1h).filter((v) => typeof v === 'number');
+        out.push({
+            id, label: labels.get(id) ?? null, tokens: rs.map((r) => r.mint), symbols: rs.map((r) => r.symbol),
+            velocity: vels.length ? vels.reduce((s, v) => s + v, 0) / vels.length : null,
+            delta24h: d24.length ? d24.reduce((s, v) => s + v, 0) / d24.length : null,
+            kolThreads: kolSet.size, newsCount: members.reduce((s, i) => s + newsCountFor(rows[i].mint), 0),
+        });
+    }
+    return out.sort((a, b) => (b.velocity ?? 0) - (a.velocity ?? 0) || b.tokens.length - a.tokens.length);
+}

package/dist/packages/data/src/social/rss.js

@@ -0,0 +1,113 @@
+// @dexterm/data — publishers' RSS as the NEWS column (task-1330; design §4 "context, not signal").
+// Four official feeds, polled every 10 minutes through the shared HttpClient (`news-rss` source,
+// polite bucket), parsed with a small dependency-free RSS 2.0 / Atom reader. Headlines are untrusted
+// text and go through the ingest firewall like any post; links are kept as `url` (opened by the OS
+// browser on ⏎, never fetched by dexterm).
+export const RSS_FEEDS = [
+    { id: 'coindesk', url: 'https://www.coindesk.com/arc/outboundfeeds/rss/', domain: 'coindesk.com', label: 'coindesk' },
+    { id: 'cointelegraph', url: 'https://cointelegraph.com/rss', domain: 'cointelegraph.com', label: 'cointelegr' },
+    { id: 'theblock', url: 'https://www.theblock.co/rss.xml', domain: 'theblock.co', label: 'theblock' },
+    { id: 'decrypt', url: 'https://decrypt.co/feed', domain: 'decrypt.co', label: 'decrypt' },
+];
+export const NEWS_REFRESH_MS = 10 * 60_000;
+const META = { source: 'news-rss', bucket: 'news-rss' };
+const ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' };
+export function decodeEntities(s) {
+    return s.replace(/&(#x[0-9a-f]+|#\d+|[a-z]+);/gi, (m, e) => {
+        if (e[0] === '#') {
+            const cp = e[1] === 'x' || e[1] === 'X' ? parseInt(e.slice(2), 16) : parseInt(e.slice(1), 10);
+            return Number.isFinite(cp) && cp > 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+        }
+        return ENTITIES[e.toLowerCase()] ?? m;
+    });
+}
+function tag(block, name) {
+    const m = new RegExp(`<${name}(?:\\s[^>]*)?>([\\s\\S]*?)<\\/${name}>`, 'i').exec(block);
+    if (!m)
+        return null;
+    let v = m[1].trim();
+    const cd = /^<!\[CDATA\[([\s\S]*?)\]\]>$/.exec(v);
+    if (cd)
+        v = cd[1];
+    return decodeEntities(v.replace(/<[^>]+>/g, '')).trim();
+}
+/** RSS 2.0 `<item>` and Atom `<entry>` → RssItem[], newest first; items without a title are dropped. */
+export function parseRss(xml) {
+    const out = [];
+    const blocks = [...xml.matchAll(/<(item|entry)(?:\s[^>]*)?>([\s\S]*?)<\/\1>/gi)].map((m) => m[2]);
+    for (const b of blocks) {
+        const title = tag(b, 'title');
+        if (!title)
+            continue;
+        let link = tag(b, 'link');
+        if (!link) {
+            const atom = /<link[^>]*href="([^"]+)"/i.exec(b);
+            link = atom ? decodeEntities(atom[1]) : null;
+        }
+        if (link && !/^https?:\/\//i.test(link))
+            link = null;
+        const dateText = tag(b, 'pubDate') ?? tag(b, 'dc:date') ?? tag(b, 'updated') ?? tag(b, 'published');
+        const t = dateText ? Date.parse(dateText) : NaN;
+        const guid = tag(b, 'guid') ?? tag(b, 'id') ?? link ?? title;
+        out.push({ title, link, publishedAt: Number.isFinite(t) ? t : null, guid });
+    }
+    return out.sort((a, b) => (b.publishedAt ?? 0) - (a.publishedAt ?? 0));
+}
+const TAG_RULES = [
+    ['security', /\b(hack|hacked|exploit|drain|drains|drained|breach|phishing|stolen|theft|scam|rug|malware|vulnerab)/i],
+    ['regulation', /\b(sec\b|cftc|regulat|lawsuit|court|judge|congress|senate|bill\b|ban\b|bans\b|barred|fine\b|fines\b|seize|settlement|attorney general|treasury)/i],
+    ['solana', /\b(solana|sol\b|pump\.?fun|jupiter|raydium|meteora|memecoin|meme coin|phantom)/i],
+    ['macro', /\b(fed\b|rates?\b|inflation|cpi|etf|bitcoin|btc|ethereum|eth\b|market|stocks?|treasur|dollar|tariff)/i],
+];
+/** Keyword bracket for the NEWS panel (`[macro]`, `[security]`, …): rules, not a judgement. */
+export function newsTag(title) {
+    for (const [t, re] of TAG_RULES)
+        if (re.test(title))
+            return t;
+    return 'other';
+}
+export function rssItemToRaw(item, feed, fetchedAt) {
+    return {
+        id: `news:${feed.id}:${item.guid}`.slice(0, 200),
+        t: item.publishedAt ?? fetchedAt,
+        platform: 'news',
+        author: { id: feed.domain, handle: feed.domain, tier: 'src', createdAt: null },
+        text: item.title,
+        url: item.link,
+        lang: null,
+        metrics: {},
+        mints: [],
+        source: 'news-rss',
+        fetchedAt,
+    };
+}
+export class NewsRss {
+    http;
+    feeds;
+    constructor(http, feeds = RSS_FEEDS) {
+        this.http = http;
+        this.feeds = feeds;
+    }
+    async fetch(feed) {
+        const r = await this.http.getText(feed.url, META);
+        return { items: parseRss(r.data), fetchedAt: r.fetchedAt };
+    }
+    /** All feeds, sequential (the bucket paces); each failure is a caption, never a throw. */
+    async fetchAll() {
+        const posts = [];
+        const errors = {};
+        let fetchedAt = null;
+        for (const f of this.feeds) {
+            try {
+                const r = await this.fetch(f);
+                fetchedAt = Math.max(fetchedAt ?? 0, r.fetchedAt);
+                for (const it of r.items)
+                    posts.push(rssItemToRaw(it, f, r.fetchedAt));
+            }
+            catch (e) {
+                errors[f.id] = (e instanceof Error ? e.message : String(e)).slice(0, 80);
+            }
+        }
+        return { posts, errors, fetchedAt };
+    }
+}