dexterm-cli 0.0.0-stage → 0.1.2

package/dist/packages/data/src/x/source.js

@@ -0,0 +1,285 @@
+// @dexterm/data — the X poller behind the social feed (task-1357). Attached to a SocialFeed; `tick(now)` is
+// called from the feed's own tick (the UI's 2 Hz data tick), creates no timers, awaits nothing the quit path
+// could wait on, and turns every failure into a VISIBLE state:
+//
+//   logged-out     no tokens (the header says `x ○ logged out · dexterm x login`)
+//   ok             reads flowing (`x ● @handle · 12/300 search · $0.12 today`)
+//   rate-limited   429 or an exhausted window; shows the reset time; reads resume after it
+//   no-credit      the daily spend budget is reached; resumes at the next UTC day
+//   not-enrolled   the user's X app tier cannot read search/list timelines (Free tier)
+//   error          transport / 5xx; retried on the next cycle with backoff
+//
+// What it polls (design §5.2 / §5.4): the OPEN token (search/recent every 60 s, cached 15 min per query,
+// since_id so a re-poll costs only new posts), the user's own X lists (list tweets, every 5 min per list) and
+// manual KOL lists (`from:` search in batches of 20, every 5 min). Never a cashtag stream, never scraping.
+// Posts land in SocialFeed.ingest(), which firewalls the text; cashtags on KOL posts resolve to board mints
+// only when the symbol is unique on the board (else the post stays unattributed).
+import { XApiError, handlesQuery, tokenQuery, tweetToRaw } from "./api.js";
+export class XSource {
+    api;
+    store;
+    kol;
+    now;
+    board;
+    tokenPollMs;
+    kolPollMs;
+    tokenMax;
+    onChange;
+    onLog;
+    focus = null;
+    sinceByMint = new Map();
+    lastTokenAt = 0;
+    lastKolAt = 0;
+    lastFocusMint = null;
+    busy = false;
+    closed = false;
+    state = 'logged-out';
+    user = null;
+    lastOkAt = null;
+    lastError = null;
+    resumesAt = null;
+    errorBackoffUntil = 0;
+    errorStrikes = 0;
+    posts = 0;
+    requests = 0;
+    /** Where posts go: set by SocialFeed.attachX(). */
+    sink = null;
+    metaAt = 0;
+    metaCache = { loggedIn: false, user: null, obtainedAt: null };
+    /** `obtained_at` of the record X answered 401 for: only a NEWER login (dexterm x login) re-arms the poller. */
+    deadObtainedAt = null;
+    constructor(opts) {
+        this.api = opts.api;
+        this.store = opts.store;
+        this.kol = opts.kol ?? null;
+        this.now = opts.now ?? (() => Date.now());
+        this.board = opts.board ?? (() => []);
+        this.tokenPollMs = opts.tokenPollMs ?? 60_000;
+        this.kolPollMs = opts.kolPollMs ?? 5 * 60_000;
+        this.tokenMax = opts.tokenMax ?? 50;
+        this.onChange = opts.onChange ?? (() => { });
+        this.onLog = opts.onLog ?? null;
+        this.user = this.store.meta().user;
+        this.state = this.store.meta().loggedIn ? 'ok' : 'logged-out';
+    }
+    /** The open token: polled every tokenPollMs while set (the first poll is immediate). */
+    setFocus(f) {
+        this.focus = f;
+        if (f && f.mint !== this.lastFocusMint) {
+            this.lastTokenAt = 0;
+            this.lastFocusMint = f.mint;
+        }
+    }
+    /** tokens.json is re-read at most every 5 s (status() runs on every tick and render). */
+    meta(now) {
+        if (now - this.metaAt >= 5_000 || this.metaAt === 0) {
+            const m = this.store.meta();
+            this.metaCache = { loggedIn: m.loggedIn, user: m.user, obtainedAt: m.obtainedAt };
+            this.metaAt = now;
+        }
+        return this.metaCache;
+    }
+    status() {
+        const now = this.now();
+        const meta = this.meta(now);
+        if (!meta.loggedIn && this.state !== 'off') {
+            this.state = 'logged-out';
+            this.user = null;
+            this.deadObtainedAt = null;
+        }
+        else if (meta.loggedIn && this.state === 'logged-out' && (this.deadObtainedAt === null || meta.obtainedAt !== this.deadObtainedAt)) {
+            this.state = 'ok';
+            this.user = meta.user;
+            this.deadObtainedAt = null;
+            this.lastError = null;
+        }
+        if ((this.state === 'rate-limited' || this.state === 'no-credit') && this.resumesAt !== null && now >= this.resumesAt) {
+            this.state = 'ok';
+            this.resumesAt = null;
+        }
+        const spend = this.api.spend?.status() ?? null;
+        const windows = {};
+        for (const k of ['search', 'list-tweets', 'me']) {
+            const w = this.api.window(k);
+            if (w)
+                windows[k] = w;
+        }
+        const w = windows.search;
+        const fmtIn = (t) => { const m = Math.max(0, Math.round((t - now) / 60_000)); return m < 1 ? '<1 min' : `${m} min`; };
+        const used = w && w.limit !== null && w.remaining !== null ? `${w.limit - w.remaining}/${w.limit} search` : null;
+        const money = spend ? `$${spend.usd.toFixed(2)} of $${spend.budgetUsd} today` : null;
+        const who = this.user ? `@${this.user.username}` : 'logged in';
+        const detail = this.state === 'logged-out' ? (this.deadObtainedAt !== null ? 'login revoked or expired at X · dexterm x login' : 'logged out · dexterm x login (your own X app, your limits)')
+            : this.state === 'off' ? 'off in this mode'
+                : this.state === 'rate-limited' ? `rate limited${this.resumesAt ? ` · resets in ${fmtIn(this.resumesAt)}` : ''} · keyless sources still live`
+                    : this.state === 'no-credit' ? `daily budget reached (${money ?? '?'})${this.resumesAt ? ` · resets in ${fmtIn(this.resumesAt)}` : ''}`
+                        : this.state === 'not-enrolled' ? `${who} · your X app tier cannot read search/list timelines (Free tier) · identity only`
+                            : this.state === 'error' ? `error · ${this.lastError ?? '?'} · retrying`
+                                : [who, used, money].filter(Boolean).join(' · ');
+        return { state: this.state, user: this.user, detail, lastOkAt: this.lastOkAt, lastError: this.lastError, resumesAt: this.resumesAt, spend, windows, posts: this.posts, requests: this.requests };
+    }
+    /** Called from SocialFeed.tick(). Never throws, never awaited by the caller. */
+    tick(now = this.now()) {
+        if (this.closed || this.busy)
+            return;
+        const st = this.status();
+        if (st.state !== 'ok' && st.state !== 'error')
+            return;
+        if (st.state === 'error' && now < this.errorBackoffUntil)
+            return;
+        const tokenDue = !!this.focus && now - this.lastTokenAt >= this.tokenPollMs;
+        const kolDue = !!this.kol && now - this.lastKolAt >= this.kolPollMs;
+        if (!tokenDue && !kolDue)
+            return;
+        this.busy = true;
+        void (async () => {
+            try {
+                if (tokenDue) {
+                    this.lastTokenAt = now;
+                    await this.pollToken();
+                }
+                if (kolDue && !this.closed) {
+                    this.lastKolAt = now;
+                    await this.pollKol();
+                }
+            }
+            finally {
+                this.busy = false;
+            }
+        })();
+    }
+    fail(e) {
+        const now = this.now();
+        if (e instanceof XApiError) {
+            this.lastError = e.message;
+            if (e.kind === 'unauthorized') {
+                this.state = 'logged-out';
+                this.user = null;
+                this.deadObtainedAt = this.store.meta().obtainedAt ?? -1;
+                this.metaAt = 0;
+            }
+            else if (e.kind === 'rate-limited') {
+                this.state = 'rate-limited';
+                this.resumesAt = e.resetAt ?? now + 15 * 60_000;
+            }
+            else if (e.kind === 'no-credit') {
+                this.state = 'no-credit';
+                this.resumesAt = this.api.spend?.status().resetsAt ?? now + 3_600_000;
+            }
+            else if (e.kind === 'not-enrolled') {
+                this.state = 'not-enrolled';
+            }
+            else {
+                this.state = 'error';
+                this.errorStrikes += 1;
+                this.errorBackoffUntil = now + Math.min(10 * 60_000, 30_000 * 2 ** (this.errorStrikes - 1));
+            }
+        }
+        else {
+            this.lastError = e instanceof Error ? e.message : String(e);
+            this.state = 'error';
+            this.errorStrikes += 1;
+            this.errorBackoffUntil = now + Math.min(10 * 60_000, 30_000 * 2 ** (this.errorStrikes - 1));
+        }
+        this.onLog?.(`x-api: ${this.state}: ${this.lastError}`);
+        this.onChange('social:x');
+    }
+    ok() {
+        this.state = 'ok';
+        this.lastError = null;
+        this.resumesAt = null;
+        this.errorStrikes = 0;
+        this.lastOkAt = this.now();
+    }
+    deliver(raws, reason) {
+        if (!raws.length || !this.sink)
+            return;
+        this.posts += raws.length;
+        this.sink(raws);
+        this.onChange(reason);
+    }
+    async pollToken() {
+        const f = this.focus;
+        if (!f || this.closed)
+            return;
+        try {
+            const page = await this.api.searchRecent(tokenQuery({ symbol: f.symbol, mint: f.mint, handle: f.handle }), { maxResults: this.tokenMax, sinceId: this.sinceByMint.get(f.mint) ?? null });
+            if (!page.cached)
+                this.requests += 1;
+            if (page.newestId)
+                this.sinceByMint.set(f.mint, page.newestId);
+            this.ok();
+            this.deliver(page.tweets.map((t) => tweetToRaw(t, page.users, { mints: [f.mint], fetchedAt: page.fetchedAt })), 'social:x:token');
+            if (page.cached)
+                this.onChange('social:x');
+        }
+        catch (e) {
+            this.fail(e);
+        }
+    }
+    /** Symbol → mint when unique on the board. */
+    resolveCashtags(cashtags) {
+        const board = this.board();
+        const out = [];
+        for (const c of cashtags) {
+            const hits = board.filter((b) => b.symbol.toUpperCase() === c.toUpperCase());
+            if (hits.length === 1)
+                out.push(hits[0].mint);
+        }
+        return [...new Set(out)];
+    }
+    async pollKol() {
+        if (!this.kol || this.closed)
+            return;
+        const lists = this.kol.all().filter((l) => l.enabled);
+        const ownLists = lists.filter((l) => l.source === 'own-x-list' && /^own-x-list:\d+$/.test(l.id));
+        const manualHandles = [...new Set(lists.filter((l) => l.source !== 'own-x-list').flatMap((l) => l.handles).filter((h) => !this.kol.isMuted(h)))];
+        try {
+            for (const l of ownLists) {
+                if (this.closed)
+                    return;
+                const page = await this.api.listTweets(l.id.slice('own-x-list:'.length), { maxResults: 50 });
+                if (!page.cached)
+                    this.requests += 1;
+                this.ok();
+                this.deliver(page.tweets.map((t) => tweetToRaw(t, page.users, { mints: this.resolveCashtags(cashtagsOf(t.text)), fetchedAt: page.fetchedAt })), 'social:x:kol');
+            }
+            for (let i = 0; i < manualHandles.length; i += 20) {
+                if (this.closed)
+                    return;
+                const page = await this.api.searchRecent(handlesQuery(manualHandles.slice(i, i + 20)), { maxResults: 50 });
+                if (!page.cached)
+                    this.requests += 1;
+                this.ok();
+                this.deliver(page.tweets.map((t) => tweetToRaw(t, page.users, { mints: this.resolveCashtags(cashtagsOf(t.text)), fetchedAt: page.fetchedAt })), 'social:x:kol');
+            }
+        }
+        catch (e) {
+            this.fail(e);
+        }
+    }
+    /** Import the user's own X lists as `own-x-list` KOL lists (handles only; posts are never stored by this). */
+    async importOwnLists() {
+        if (!this.kol)
+            throw new XApiError('http', 'no KOL store');
+        const me = this.user ?? (await this.api.me());
+        this.user = me;
+        const lists = await this.api.ownedLists(me.id);
+        const out = [];
+        for (const l of lists) {
+            const members = await this.api.listMembers(l.id);
+            const handles = members.map((m) => m.username.toLowerCase());
+            this.kol.seed({ id: `own-x-list:${l.id}`, name: l.name, source: 'own-x-list', handles, wallets: [], signed: null, since: this.now(), enabled: true, tier: 'kol-a' });
+            out.push({ id: `own-x-list:${l.id}`, name: l.name, handles: handles.length });
+        }
+        this.ok();
+        this.lastKolAt = 0; // poll the new lists on the next tick
+        this.onChange('social:x:lists');
+        return { lists: out };
+    }
+    close() { this.closed = true; }
+}
+const CASHTAG_RE = /\$([A-Za-z][A-Za-z0-9_]{0,15})\b/g;
+export function cashtagsOf(text) {
+    return [...new Set([...text.matchAll(CASHTAG_RE)].map((m) => m[1].toUpperCase()))];
+}

package/dist/packages/data/src/x/token-store.js

@@ -0,0 +1,134 @@
+// @dexterm/data — local storage for the X client id and the user's OAuth tokens (task-1357).
+//
+//   <xDir>/client-id    the user's OWN X app Client ID (public-ish, kept out of argv/repo anyway), mode 0600
+//   <xDir>/tokens.json  { v, access_token, refresh_token, token_type, scope, expires_at, obtained_at, user }, mode 0600
+//
+// The directory is created 0700. Nothing here prints a token: `meta()` is the only read meant for display and
+// it carries ages, scopes and the handle, never the secret. The store is the ONLY module that reads tokens.json;
+// the adapter asks it for a bearer and never keeps a copy longer than one request.
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isPlausibleClientId, xDir } from "./config.js";
+export class XTokenStore {
+    dir;
+    now;
+    constructor(opts = {}) {
+        this.dir = opts.dir ?? xDir(opts.env ?? process.env);
+        this.now = opts.now ?? (() => Date.now());
+    }
+    get tokensPath() { return join(this.dir, 'tokens.json'); }
+    get clientIdPath() { return join(this.dir, 'client-id'); }
+    ensureDir() {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        try {
+            chmodSync(this.dir, 0o700);
+        }
+        catch { /* best effort on platforms without chmod */ }
+    }
+    writePrivate(path, text) {
+        this.ensureDir();
+        writeFileSync(path, text, { mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch { /* best effort */ }
+    }
+    // ---------------------------------------------------------------- client id
+    /** `DEXTERM_X_CLIENT_ID` wins (CI / scripts), else the stored file; null when neither is usable. */
+    clientId(env = process.env) {
+        const fromEnv = env.DEXTERM_X_CLIENT_ID?.trim();
+        if (fromEnv && isPlausibleClientId(fromEnv))
+            return fromEnv;
+        try {
+            const v = readFileSync(this.clientIdPath, 'utf8').trim();
+            return isPlausibleClientId(v) ? v : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    setClientId(id) {
+        const v = id.trim();
+        if (!isPlausibleClientId(v))
+            throw new Error('that does not look like an X app Client ID (8-128 URL-safe characters)');
+        this.writePrivate(this.clientIdPath, v + '\n');
+    }
+    clearClientId() {
+        if (!existsSync(this.clientIdPath))
+            return false;
+        rmSync(this.clientIdPath, { force: true });
+        return true;
+    }
+    // ---------------------------------------------------------------- tokens
+    /** The full record (secret!). Only the OAuth client and the API adapter may call this. */
+    tokens() {
+        try {
+            if (!existsSync(this.tokensPath))
+                return null;
+            const raw = JSON.parse(readFileSync(this.tokensPath, 'utf8'));
+            if (raw.v !== 1 || typeof raw.access_token !== 'string' || !raw.access_token)
+                return null;
+            return {
+                v: 1,
+                access_token: raw.access_token,
+                refresh_token: typeof raw.refresh_token === 'string' && raw.refresh_token ? raw.refresh_token : null,
+                token_type: typeof raw.token_type === 'string' ? raw.token_type : 'bearer',
+                scope: typeof raw.scope === 'string' ? raw.scope : '',
+                expires_at: Number(raw.expires_at) || 0,
+                obtained_at: Number(raw.obtained_at) || 0,
+                user: raw.user && typeof raw.user === 'object' && typeof raw.user.id === 'string' && typeof raw.user.username === 'string' ? { id: raw.user.id, username: raw.user.username } : null,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Persist a token response. The whole record is rewritten (X may rotate the refresh token). */
+    setTokens(res, user = this.tokens()?.user ?? null) {
+        if (typeof res.access_token !== 'string' || !res.access_token)
+            throw new Error('token response carried no access_token');
+        const now = this.now();
+        const rec = {
+            v: 1,
+            access_token: res.access_token,
+            refresh_token: res.refresh_token ?? null,
+            token_type: res.token_type ?? 'bearer',
+            scope: res.scope ?? '',
+            expires_at: now + (Number(res.expires_in) > 0 ? Number(res.expires_in) : 7200) * 1000,
+            obtained_at: now,
+            user,
+        };
+        this.writePrivate(this.tokensPath, JSON.stringify(rec, null, 2) + '\n');
+        return rec;
+    }
+    setUser(user) {
+        const t = this.tokens();
+        if (!t)
+            return;
+        t.user = user;
+        this.writePrivate(this.tokensPath, JSON.stringify(t, null, 2) + '\n');
+    }
+    clearTokens() {
+        if (!existsSync(this.tokensPath))
+            return false;
+        rmSync(this.tokensPath, { force: true });
+        return true;
+    }
+    /** Display-safe status. */
+    meta() {
+        const t = this.tokens();
+        if (!t)
+            return { loggedIn: false, user: null, scopes: [], expiresAt: null, hasRefresh: false, obtainedAt: null };
+        return { loggedIn: true, user: t.user, scopes: t.scope.split(/\s+/).filter(Boolean), expiresAt: t.expires_at, hasRefresh: !!t.refresh_token, obtainedAt: t.obtained_at };
+    }
+    /** File modes as the OS reports them (tests + doctor): null when a file is missing. */
+    modes() {
+        const mode = (p) => { try {
+            return existsSync(p) ? (statSync(p).mode & 0o777) : null;
+        }
+        catch {
+            return null;
+        } };
+        return { dir: mode(this.dir), tokens: mode(this.tokensPath), clientId: mode(this.clientIdPath) };
+    }
+}

package/dist/packages/data/src/x/transport.js

@@ -0,0 +1,71 @@
+// @dexterm/data — the one HTTP transport for X (task-1357). Separate from http.ts's keyless client because
+// X needs an `Authorization: Bearer …` header (user-context reads) and form-encoded POSTs (token/revoke).
+// Built on node:http(s) directly so it works even where tests replace `globalThis.fetch` (helpers.ts blocks
+// the network for keyless code; the X tests talk to a loopback mock server through this transport).
+//
+// Rules: GET/POST only; the bearer is set per request and never stored here; every error message is passed
+// through redactXSecrets(); the URL is never logged with a query (search queries are the user's business).
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { redactXSecrets } from "./config.js";
+/** Headers worth keeping: content type, rate-limit windows (X uses `x-rate-limit-*`), retry-after. */
+const KEEP = ['content-type', 'retry-after', 'x-rate-limit-limit', 'x-rate-limit-remaining', 'x-rate-limit-reset', 'x-user-limit-24hour-limit', 'x-user-limit-24hour-remaining', 'x-user-limit-24hour-reset', 'x-app-limit-24hour-limit', 'x-app-limit-24hour-remaining', 'x-app-limit-24hour-reset'];
+export const X_USER_AGENT = 'dexterm/0.0.1 (+local terminal screener; user-authorized X reads only)';
+export function nodeXTransport(defaults = {}) {
+    const userAgent = defaults.userAgent ?? X_USER_AGENT;
+    return (req) => new Promise((resolve, reject) => {
+        const t0 = performance.now();
+        let url;
+        try {
+            url = new URL(req.url);
+        }
+        catch {
+            reject(new Error('x transport: bad URL'));
+            return;
+        }
+        if (url.protocol !== 'https:' && !(url.protocol === 'http:' && (url.hostname === '127.0.0.1' || url.hostname === 'localhost'))) {
+            reject(new Error(`x transport: refusing ${url.protocol}//${url.hostname} (https only, http on loopback only)`));
+            return;
+        }
+        const headers = { 'user-agent': userAgent, accept: 'application/json', ...(req.headers ?? {}) };
+        if (req.body !== undefined)
+            headers['content-length'] = String(Buffer.byteLength(req.body));
+        const fn = url.protocol === 'https:' ? httpsRequest : httpRequest;
+        const timeoutMs = req.timeoutMs ?? defaults.timeoutMs ?? 15_000;
+        const r = fn(url, { method: req.method, headers, timeout: timeoutMs }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                const kept = {};
+                for (const h of KEEP) {
+                    const v = res.headers[h];
+                    if (typeof v === 'string')
+                        kept[h] = v;
+                    else if (Array.isArray(v))
+                        kept[h] = v[0];
+                }
+                resolve({ status: res.statusCode ?? 0, headers: kept, body: Buffer.concat(chunks).toString('utf8'), latencyMs: Math.round(performance.now() - t0) });
+            });
+            res.on('error', (e) => reject(new Error(redactXSecrets(`x transport: ${e.message}`))));
+        });
+        const fail = (msg) => { try {
+            r.destroy();
+        }
+        catch { /* ignore */ } reject(new Error(redactXSecrets(msg))); };
+        r.on('timeout', () => fail(`x transport: timed out after ${timeoutMs} ms`));
+        r.on('error', (e) => fail(`x transport: ${e.message}`));
+        if (req.signal) {
+            if (req.signal.aborted) {
+                fail('x transport: aborted');
+                return;
+            }
+            req.signal.addEventListener('abort', () => fail('x transport: aborted'), { once: true });
+        }
+        if (req.body !== undefined)
+            r.write(req.body);
+        r.end();
+    });
+}
+export function formBody(fields) {
+    return new URLSearchParams(fields).toString();
+}

package/dist/packages/data/vendor/solana-web3/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2023 Solana Labs, Inc
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/packages/data/vendor/solana-web3/NOTICE.md

@@ -0,0 +1,13 @@
+# Vendored: @solana/web3.js 1.98.4 (browser IIFE bundle)
+
+- File: `index.iife.min.js` — `lib/index.iife.min.js` from the npm tarball `solana-web3.js-1.98.4.tgz`
+  (fetched 2026-10-09 with `npm pack @solana/web3.js@1.98.4`; nothing was installed into node_modules).
+- sha256: `09cdbea951b2ed0e11bcbe3aeb1ee9f035f9fb51ed212aca645475ae82688cc3` (pinned by
+  `packages/data/test/signer-1328.test.ts`; a changed file fails the test).
+- License: MIT (see `LICENSE`, copied verbatim from the package).
+- Why it is here (task-1328): Phantom's `signTransaction()` takes a `VersionedTransaction` OBJECT, not
+  bytes, so the wallet bridge's tx-sign page needs web3.js in the browser to rebuild the transaction
+  the signer built. The bundle is INLINED into the page under the CSP nonce (no remote script, no CDN,
+  no network fetch at sign time) and exposed as `window.dexSolana`. It runs only in the user's
+  browser on the loopback sign page; dexterm's Node processes never import it.
+- Upgrade: replace the file, update the sha256 in the test and here, re-run the bridge + signer tests.