dexterm-cli 0.1.4 → 0.1.6

package/dist/packages/data/src/larp/score.js

@@ -0,0 +1,220 @@
+// LARP score (task-1471): a 0-100 summary of the LARP check's flags. Pure, offline, deterministic.
+//
+// What it is: the transparent SUM of named flags, each with its points and the evidence that raised it. Higher
+// means more of the things that go with LARP coins showed up. It is evidence, not a verdict: every flag can be
+// innocent on its own, and the score never says a coin is fake, safe or worth anything.
+//
+// Missing data never lowers the score and is never scored as clean. A flag whose evidence could not be read (page
+// blocked, RDAP down, the X sources unavailable) goes to `missing` with the points it COULD have added, and the
+// range `[score, score + those points]` (and its band range) widens instead.
+//
+// Where the points come from (LARP_SCORE_WEIGHTS[*].source):
+//  - `calibrated`: the link-shape flags, fitted on the TRAIN split of the task-1401 eval set (1054 coins, 72 h
+//    outcome labels; packages/packs/src/larp-score-backtest.ts). points = clamp(round(8 × ln odds ratio of a bad
+//    outcome), 0, 12), using the flag only when ≥ 20 train coins carry it. The cap keeps link shape alone in the
+//    `medium` band at most: the larp-check skill never calls a coin LARP from links alone.
+//  - `prior`: page, domain, GitHub and X-account flags. The eval set does not hold that evidence point-in-time (the
+//    pages are gone or changed, and a deleted X account after a coin dies would leak the outcome), so these are
+//    pre-registered weights written from the skill text before any data, and are labelled as such everywhere.
+import { linkSignals } from "./link-baseline.js";
+export const LARP_SCORE_MODEL = 'larp-score-v1';
+/**
+ * The shipped weights. The `calibrated` rows are asserted equal to a fresh fit on the committed eval set
+ * (packages/packs/test/larp-score-1471.test.ts), so a re-tune cannot ship stale points.
+ */
+export const LARP_SCORE_WEIGHTS = {
+    // links (DexScreener / Jupiter advertised links): calibrated where the eval set had ≥ 20 train coins.
+    no_website: { group: 'links', label: 'no website advertised', points: 9, source: 'calibrated' },
+    no_x: { group: 'links', label: 'no X account advertised', points: 10, source: 'calibrated' },
+    x_not_account: { group: 'links', label: 'X link is a single post or a community, not an account', points: 5, source: 'calibrated' },
+    no_telegram: { group: 'links', label: 'no Telegram advertised', points: 12, source: 'calibrated' },
+    site_is_social: { group: 'links', label: 'the "website" is a social page', points: 1, source: 'calibrated' },
+    domain_no_name_match: { group: 'links', label: "the website's domain does not name the token", points: 0, source: 'calibrated' },
+    cheap_tld: { group: 'links', label: 'website on a throwaway-priced TLD', points: 0, source: 'calibrated' },
+    site_is_launchpad: { group: 'links', label: 'the "website" is a launchpad/explorer page', points: 4, source: 'prior' },
+    site_linktree: { group: 'links', label: 'the "website" is a link hub', points: 2, source: 'prior' },
+    site_free_host: { group: 'links', label: 'website on a free/site-builder host', points: 2, source: 'prior' },
+    links_mismatch: { group: 'links', label: 'sources advertise different sites or X accounts', points: 8, source: 'prior' },
+    // website (one SSRF-safe fetch, no JavaScript)
+    drainer_markers: { group: 'website', label: 'wallet-drainer markers on the page', points: 30, source: 'prior' },
+    default_page: { group: 'website', label: 'website is a default/placeholder page', points: 15, source: 'prior' },
+    wallet_connect: { group: 'website', label: 'website asks to connect a wallet', points: 8, source: 'prior' },
+    never_names_token: { group: 'website', label: 'website never names the token', points: 8, source: 'prior' },
+    // domain (RDAP)
+    domain_new: { group: 'domain', label: 'domain registered under 30 days ago', points: 8, source: 'prior' },
+    domain_privacy: { group: 'domain', label: 'domain behind registrant privacy', points: 2, source: 'prior' },
+    // GitHub (keyless API)
+    no_github: { group: 'github', label: 'no GitHub repo advertised', points: 2, source: 'prior' },
+    github_archived: { group: 'github', label: 'GitHub repo is archived', points: 4, source: 'prior' },
+    github_fork: { group: 'github', label: 'GitHub repo is a fork', points: 4, source: 'prior' },
+    github_stale: { group: 'github', label: 'GitHub repo not pushed in 180+ days', points: 4, source: 'prior' },
+    // X account (keyless lookup chain)
+    x_suspended: { group: 'x', label: 'X account is suspended', points: 20, source: 'prior' },
+    x_not_found: { group: 'x', label: 'X account does not exist', points: 15, source: 'prior' },
+    x_account_days_old: { group: 'x', label: 'X account under 7 days old', points: 12, source: 'prior' },
+    x_account_new: { group: 'x', label: 'X account under 30 days old', points: 6, source: 'prior' },
+    x_tiny_following: { group: 'x', label: 'X account has under 50 followers', points: 5, source: 'prior' },
+    x_no_posts: { group: 'x', label: 'X account has no posts in 30 days', points: 6, source: 'prior' },
+    x_handle_mismatch: { group: 'x', label: "the website's X link and the advertised X account differ", points: 10, source: 'prior' },
+    x_renamed: { group: 'x', label: 'the linked X post is now under another handle', points: 5, source: 'prior' },
+    x_no_site_link: { group: 'x', label: "the X account's bio/website does not link the coin's site", points: 3, source: 'prior' },
+};
+/** Band thresholds (pre-registered round numbers; their measured precision is in LARP_SCORE_MEASURED). */
+export const LARP_SCORE_BANDS = { medium: 25, high: 50 };
+export const bandOf = (score) => (score >= LARP_SCORE_BANDS.high ? 'high' : score >= LARP_SCORE_BANDS.medium ? 'medium' : 'low');
+/**
+ * Held-out TEST-split numbers for the link-shape part of the score (the only part the eval set can replay),
+ * from packages/packs/eval/larp-score-backtest.json (`dexterm backtest --subject larp-score`). A test asserts these match the committed report.
+ */
+export const LARP_SCORE_MEASURED = {
+    model: LARP_SCORE_MODEL,
+    eval: 'task-1401 eval set (built 2026-10-16), 72h outcome labels, bad = rug or dead',
+    part: 'link-shape flags only (page, domain, GitHub and X-account flags cannot be replayed on history)',
+    test: { n: 328, bad: 61, auroc: 0.691, by_band: { low: { n: 218, bad: 27 }, medium: { n: 110, bad: 34 }, high: { n: 0, bad: 0 } } },
+    train: { n: 726, bad: 294, auroc: 0.727 },
+};
+const W = LARP_SCORE_WEIGHTS;
+const LINK_FLAG = {
+    site_is_social: 'site_is_social', site_is_launchpad: 'site_is_launchpad', site_linktree: 'site_linktree', site_free_host: 'site_free_host',
+    site_no_name_match: 'domain_no_name_match', cheap_tld: 'cheap_tld', x_not_profile: 'x_not_account', no_x: 'no_x', no_tg: 'no_telegram',
+};
+/** The link-shape flags of a feature set (shared by the live score and the backtest, so both score the same thing). */
+export function linkFlagIds(f) {
+    const ids = linkSignals(f).map((s) => LINK_FLAG[s]);
+    if (f.web === 'none')
+        ids.unshift('no_website');
+    return ids;
+}
+/** Sum the link-shape points only (what the backtest scores). */
+export function linkScore(f, weights = {}) {
+    return Math.min(100, linkFlagIds(f).reduce((a, id) => a + (weights[id] ?? W[id].points), 0));
+}
+/** Compute the LARP score from the gathered evidence. Pure. */
+export function larpScore(ev) {
+    const flags = [];
+    const missing = [];
+    // A flag fitted to 0 points (it did not go with bad outcomes) is not listed: it would add nothing but noise.
+    const add = (id, evidence) => { const w = W[id]; if (w.points > 0)
+        flags.push({ id, group: w.group, label: w.label, points: w.points, weight: w.source, evidence }); };
+    const miss = (id, group, what, maxPoints) => { if (maxPoints > 0)
+        missing.push({ id, group, what, maxPoints }); };
+    const pts = (...ids) => ids.reduce((a, id) => a + W[id].points, 0);
+    if (ev.mode === 'token' && ev.link) {
+        const why = {
+            no_website: 'DexScreener/Jupiter list no website', no_x: 'DexScreener/Jupiter list no X link', no_telegram: 'DexScreener/Jupiter list no Telegram link',
+            x_not_account: `the advertised X link is a ${ev.link.x === 'status' ? 'single post' : ev.link.x === 'community' ? 'community' : 'non-account page'}`,
+            site_is_social: 'the advertised website is a social-network page', site_is_launchpad: 'the advertised website is a launchpad/explorer page',
+            site_linktree: 'the advertised website is a link hub', site_free_host: 'the advertised website is on a free/site-builder host',
+            domain_no_name_match: 'neither the symbol nor the name appears in the domain', cheap_tld: 'the domain is on a throwaway-priced TLD',
+        };
+        for (const id of linkFlagIds(ev.link))
+            add(id, why[id] ?? W[id].label);
+    }
+    if (ev.mismatch.length)
+        add('links_mismatch', ev.mismatch.join('; '));
+    // website page
+    if (ev.website) {
+        const p = ev.page;
+        if (!p || !p.ok)
+            miss('website:*', 'website', `website page not read${p && !p.ok ? ` (${p.reason})` : ''}`, pts('drainer_markers', 'default_page', 'wallet_connect', 'never_names_token'));
+        else {
+            if (p.drainerFlags.length)
+                add('drainer_markers', `markers: ${p.drainerFlags.slice(0, 3).join(', ')}`);
+            if (p.defaultPage)
+                add('default_page', 'the page matches a default/placeholder template');
+            if (p.walletConnect)
+                add('wallet_connect', 'the page carries a wallet-connect prompt');
+            if (p.mentionsSymbol === false && p.mentionsName === false)
+                add('never_names_token', 'neither the symbol nor the name appears in the page text');
+            else if (p.mentionsSymbol === null && p.mentionsName === null)
+                miss('never_names_token', 'website', 'whether the page names the token (no symbol/name to look for)', W.never_names_token.points);
+        }
+        const d = ev.domain;
+        if (!d || !d.ok)
+            miss('domain:*', 'domain', `domain registration not read${d && !d.ok ? ` (${d.reason})` : ''}`, pts('domain_new', 'domain_privacy'));
+        else {
+            if (typeof d.ageDays === 'number' && d.ageDays < 30)
+                add('domain_new', `registered ${d.ageDays} days ago (RDAP)`);
+            else if (d.ageDays === null)
+                miss('domain_new', 'domain', 'domain registration date', W.domain_new.points);
+            if (d.privacy === true)
+                add('domain_privacy', 'the RDAP registrant contact is redacted');
+            else if (d.privacy === null)
+                miss('domain_privacy', 'domain', 'registrant privacy', W.domain_privacy.points);
+        }
+    }
+    // GitHub
+    const g = ev.github;
+    if (g === 'none') {
+        if (ev.mode === 'token')
+            add('no_github', 'no github.com repo link among the advertised links or on the fetched page');
+    }
+    else if (g && !g.ok)
+        miss('github:*', 'github', `GitHub repo not read (${g.reason})`, pts('github_archived', 'github_fork', 'github_stale'));
+    else if (g) {
+        if (g.archived)
+            add('github_archived', 'the GitHub API marks the repo archived');
+        if (g.fork)
+            add('github_fork', 'the GitHub API marks the repo a fork');
+        if (typeof g.daysSincePush === 'number' && g.daysSincePush > 180)
+            add('github_stale', `last push ${g.daysSincePush} days ago`);
+    }
+    // X account
+    const x = ev.x;
+    if (x && x.handle) {
+        const at = `@${x.screenName ?? x.handle}`;
+        if (x.status === 'suspended')
+            add('x_suspended', `${at}: an X lookup source reports the account suspended`);
+        else if (x.status === 'not_found')
+            add('x_not_found', `@${x.handle}: two independent sources (vxtwitter, X oEmbed) found no such account`);
+        else if (x.status === 'unavailable')
+            miss('x:*', 'x', `X account not read (${x.unavailable[0] ?? 'every source failed'})`, Math.max(pts('x_suspended'), pts('x_account_days_old', 'x_tiny_following', 'x_no_posts', 'x_no_site_link')));
+        else {
+            if (typeof x.ageDays === 'number' && x.ageDays < 7)
+                add('x_account_days_old', `${at} created ${x.createdAt?.slice(0, 10)} (${x.ageDays} days ago)`);
+            else if (typeof x.ageDays === 'number' && x.ageDays < 30)
+                add('x_account_new', `${at} created ${x.createdAt?.slice(0, 10)} (${x.ageDays} days ago)`);
+            else if (x.ageDays === null)
+                miss('x_account_days_old', 'x', 'X account created date', W.x_account_days_old.points);
+            if (typeof x.followers === 'number' && x.followers < 50)
+                add('x_tiny_following', `${at} has ${x.followers} followers${x.countsSource === 'vxtwitter' && x.countsAsOf ? ` (cached copy from ${x.countsAsOf.slice(0, 16).replace('T', ' ')} UTC)` : ''}`);
+            else if (x.followers === null)
+                miss('x_tiny_following', 'x', 'X follower count', W.x_tiny_following.points);
+            if (x.tweets === 0)
+                add('x_no_posts', `${at} has never posted`);
+            else if (typeof x.daysSinceLastPost === 'number' && x.daysSinceLastPost > 30)
+                add('x_no_posts', `${at} last posted ${x.lastPostAt?.slice(0, 10)} (${x.daysSinceLastPost} days ago)`);
+            else if (x.lastPostAt === null && x.tweets !== 0)
+                miss('x_no_posts', 'x', 'X last post date', W.x_no_posts.points);
+            if (x.linksSite === false)
+                add('x_no_site_link', `${at}'s bio and website field do not mention ${ev.website ? new URL(ev.website).hostname.replace(/^www\./, '') : 'the site'}`);
+            else if (x.linksSite === null && ev.website)
+                miss('x_no_site_link', 'x', "whether the X account links the coin's site", W.x_no_site_link.points);
+        }
+        if (x.renamed)
+            add('x_renamed', x.renamed.evidence);
+    }
+    if (ev.xAgreement?.siteAgrees === false)
+        add('x_handle_mismatch', ev.xAgreement.note ?? "the website's X link and the advertised account differ");
+    const GROUP_MAX = {
+        website: pts('drainer_markers', 'default_page', 'wallet_connect', 'never_names_token'),
+        domain: pts('domain_new', 'domain_privacy'),
+        github: pts('github_archived', 'github_fork', 'github_stale'),
+        x: Math.max(pts('x_suspended'), pts('x_account_days_old', 'x_tiny_following', 'x_no_posts', 'x_no_site_link')),
+    };
+    for (const n of ev.notChecked ?? [])
+        if (!missing.some((m) => m.group === n.group))
+            miss(`${n.group}:*`, n.group, n.why, GROUP_MAX[n.group]);
+    flags.sort((a, b) => b.points - a.points);
+    const score = Math.min(100, flags.reduce((a, f) => a + f.points, 0));
+    const hi = Math.min(100, score + missing.reduce((a, m) => a + m.maxPoints, 0));
+    const m = LARP_SCORE_MEASURED.test;
+    return {
+        model: LARP_SCORE_MODEL, score, band: bandOf(score),
+        range: { lo: score, hi, bandLo: bandOf(score), bandHi: bandOf(hi) },
+        thresholds: { ...LARP_SCORE_BANDS },
+        flags, top: flags.filter((f) => f.points > 0).slice(0, 3), missing,
+        measured: `link-shape part only, held-out test split (${m.n} coins, ${m.bad} went bad within 72 h): AUROC ${m.auroc.toFixed(2)}; ${m.by_band.low.bad}/${m.by_band.low.n} low-band and ${m.by_band.medium.bad}/${m.by_band.medium.n} medium-band coins went bad. Page, domain, GitHub and X points are pre-registered priors, not fitted.`,
+        caveat: 'a sum of named flags, evidence not a verdict: any flag can be innocent, a low score is not a safety check, and missing data widens the range instead of lowering the score',
+    };
+}

package/dist/packages/data/src/larp/x-account.js

@@ -0,0 +1,316 @@
+// LARP detector — keyless X account lookup (task-1471). Read-only, no login, no cookies, no X API key.
+//
+// Why a fallback chain: measured 2026-10-19 (handoff evidence x-repro.md), FxTwitter answers `404 User not found`
+// for accounts that exist on roughly one call in six, a missing handle gets a 302 to the project's GitHub page on
+// some calls, and "suspended" is reported only some of the time. vxtwitter serves a cached copy (its own
+// `fetched_on`, up to about a day old). X's own oEmbed endpoint says exists / missing and the canonical handle, and
+// nothing else. The X syndication timeline (429 / empty) and the Nitter-class mirrors (offline, suspended, or a 200
+// "offline" page) gave nothing usable and are not in the chain.
+//
+// So no single answer is a verdict: `active` needs one source returning the profile; `suspended` needs a source
+// saying so; `not_found` needs TWO independent sources (vxtwitter AND oEmbed) saying missing; anything else is
+// `unavailable`. Every field that could not be read is listed in `unavailable` and is never guessed.
+//
+// Politeness: one handle per user action, at most five calls, a per-host spacing limiter, a TTL cache, and a
+// circuit breaker per source (the shared HealthRegistry: 3 failures or 2× 429 in a minute → degraded, 30 s..10 min
+// backoff). The bio is untrusted text: the caller firewalls it before it reaches a model.
+import { HealthRegistry } from "../health.js";
+import { systemClock } from "../clock.js";
+import { parseHttpUrl } from "./links.js";
+const RESERVED = new Set(['i', 'home', 'search', 'intent', 'hashtag', 'share', 'explore', 'settings', 'messages', 'notifications', 'login', 'signup', 'tos', 'privacy', 'compose']);
+const HANDLE = /^[A-Za-z0-9_]{1,15}$/;
+const X_HOSTS = new Set(['x.com', 'twitter.com', 'mobile.twitter.com', 'mobile.x.com', 'fxtwitter.com', 'vxtwitter.com', 'fixupx.com', 'nitter.net']);
+const SOURCE_ID = { fxtwitter: 'fxtwitter', vxtwitter: 'vxtwitter', 'x-oembed': 'x-oembed' };
+const HOST = { fxtwitter: 'api.fxtwitter.com', vxtwitter: 'api.vxtwitter.com', 'x-oembed': 'publish.x.com' };
+/** Parse an advertised X link into its kind, handle and status id. Pure. */
+export function parseXLink(raw) {
+    const u = parseHttpUrl(raw);
+    if (!u)
+        return { kind: 'other', handle: null, statusId: null };
+    const host = u.hostname.toLowerCase().replace(/^www\./, '');
+    if (!X_HOSTS.has(host))
+        return { kind: 'other', handle: null, statusId: null };
+    const parts = u.pathname.split('/').filter(Boolean);
+    if (parts[0]?.toLowerCase() === 'i' && parts[1]?.toLowerCase() === 'communities')
+        return { kind: 'community', handle: null, statusId: null };
+    const h = parts[0] ?? '';
+    if (!HANDLE.test(h) || RESERVED.has(h.toLowerCase()))
+        return { kind: 'other', handle: null, statusId: null };
+    if (parts[1]?.toLowerCase() === 'status' && /^\d{1,25}$/.test(parts[2] ?? ''))
+        return { kind: 'status', handle: h, statusId: parts[2] };
+    return { kind: parts.length === 1 ? 'profile' : 'other', handle: h, statusId: null };
+}
+const json = (body) => {
+    try {
+        const v = JSON.parse(body);
+        return v && typeof v === 'object' ? v : null;
+    }
+    catch {
+        return null;
+    }
+};
+const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null);
+const str = (v) => (typeof v === 'string' && v ? v : null);
+const iso = (v) => { const t = typeof v === 'string' ? Date.parse(v) : NaN; return Number.isFinite(t) ? new Date(t).toISOString() : null; };
+const days = (now, at) => (at ? Math.max(0, Math.floor((now - Date.parse(at)) / 86_400_000)) : null);
+const bareHost = (raw) => { const u = raw ? parseHttpUrl(raw) : null; return u ? u.hostname.toLowerCase().replace(/^www\./, '') : null; };
+function mentionsToken(bio, ctx) {
+    const sym = (ctx.symbol ?? '').trim();
+    const name = (ctx.name ?? '').trim();
+    if (!sym && !name && !ctx.mint)
+        return null;
+    const b = bio.toLowerCase();
+    if (ctx.mint && bio.includes(ctx.mint))
+        return true;
+    if (sym.length >= 2 && new RegExp(`(^|[^a-z0-9])\\$?${sym.toLowerCase().replace(/[^a-z0-9]/g, '')}([^a-z0-9]|$)`).test(b))
+        return true;
+    if (name.length >= 3 && b.includes(name.toLowerCase()))
+        return true;
+    return false;
+}
+/** The lookup service: chain + cache + spacing + circuit breakers. One instance per process. */
+export class XAccountLookup {
+    fetchImpl;
+    clock;
+    health;
+    minIntervalMs;
+    ttlMs;
+    ttlUnavailableMs;
+    maxEntries;
+    cache = new Map();
+    lastCall = new Map();
+    constructor(opts) {
+        this.fetchImpl = opts.fetch;
+        this.clock = opts.clock ?? systemClock;
+        this.health = opts.health ?? new HealthRegistry({ clock: this.clock });
+        this.minIntervalMs = opts.minIntervalMs ?? 1000;
+        this.ttlMs = opts.ttlMs ?? 30 * 60_000;
+        this.ttlUnavailableMs = opts.ttlUnavailableMs ?? 10 * 60_000;
+        this.maxEntries = opts.maxEntries ?? 500;
+    }
+    /** Per-host spacing: calls to one host are serialized at least minIntervalMs apart. */
+    async spaced(host, fn) {
+        const prev = this.lastCall.get(host) ?? Promise.resolve();
+        let release;
+        const mine = new Promise((r) => { release = r; });
+        this.lastCall.set(host, prev.then(() => mine));
+        await prev;
+        try {
+            return await fn();
+        }
+        finally {
+            if (this.minIntervalMs > 0)
+                void this.clock.sleep(this.minIntervalMs).then(release);
+            else
+                release();
+        }
+    }
+    async get(source, endpoint, url, trace) {
+        const sid = SOURCE_ID[source];
+        if (!this.health.isAvailable(sid)) {
+            trace.push({ source, endpoint, status: null, result: 'skipped: circuit open (source degraded)', ms: 0 });
+            return null;
+        }
+        const t0 = this.clock.now();
+        try {
+            const r = await this.spaced(HOST[source], () => this.fetchImpl(url));
+            const ms = this.clock.now() - t0;
+            // 404 / 3xx are answers (a vote), not source failures; 429 and 5xx other than vxtwitter's suspended body are.
+            const failed = r.status === 0 || r.status === 429 || (r.status >= 500 && !/suspended/i.test(r.body));
+            this.health.record(sid, failed ? { ok: false, status: r.status, latencyMs: ms, error: `http ${r.status}` } : { ok: true, status: r.status, latencyMs: ms });
+            return { status: r.status, body: r.body, ms };
+        }
+        catch (e) {
+            const ms = this.clock.now() - t0;
+            this.health.record(sid, { ok: false, latencyMs: ms, error: e.message });
+            trace.push({ source, endpoint, status: null, result: `error: ${e.message}`.slice(0, 120), ms });
+            return null;
+        }
+    }
+    /** Look up the account behind an advertised X link. Never throws. */
+    async lookup(xUrl, ctx = {}) {
+        const link = parseXLink(xUrl);
+        const now = this.clock.now();
+        const key = `${link.handle?.toLowerCase() ?? xUrl}|${link.statusId ?? ''}|${(ctx.symbol ?? '').toLowerCase()}|${(ctx.name ?? '').toLowerCase()}|${ctx.mint ?? ''}|${bareHost(ctx.website) ?? ''}`;
+        const hit = this.cache.get(key);
+        if (hit && now - hit.at < (hit.report.status === 'unavailable' ? this.ttlUnavailableMs : this.ttlMs))
+            return { ...hit.report, cached: true };
+        const report = await this.uncached(xUrl, link, ctx);
+        this.cache.delete(key);
+        this.cache.set(key, { at: now, report });
+        while (this.cache.size > this.maxEntries)
+            this.cache.delete(this.cache.keys().next().value);
+        return report;
+    }
+    async uncached(url, link, ctx) {
+        const now = this.clock.now();
+        const trace = [];
+        const base = {
+            url, kind: link.kind, handle: link.handle, status: 'unavailable', screenName: null, id: null, renamed: null,
+            createdAt: null, ageDays: null, followers: null, following: null, tweets: null, lastPostAt: null, daysSinceLastPost: null,
+            bio: null, website: null, bioMentionsToken: null, linksSite: null, countsAsOf: null, countsSource: null,
+            unavailable: [], sources: trace, cached: false, fetchedAt: new Date(now).toISOString(),
+        };
+        if (!link.handle) {
+            base.unavailable = ['account (the X link is not an account or a post)'];
+            return base;
+        }
+        let h = link.handle;
+        // A status link: who wrote the post now. A different author means a renamed account or a borrowed post.
+        if (link.statusId) {
+            const r = await this.get('fxtwitter', 'status', `https://api.fxtwitter.com/${h}/status/${link.statusId}`, trace);
+            const j = r ? json(r.body) : null;
+            const author = str(j?.tweet?.author?.screen_name);
+            if (r)
+                trace.push({ source: 'fxtwitter', endpoint: 'status', status: r.status, result: author ? `post by @${author}` : `no post (${str(j?.message) ?? r.status})`, ms: r.ms });
+            if (author && author.toLowerCase() !== h.toLowerCase()) {
+                base.renamed = { from: h, to: author, evidence: `the linked post ${link.statusId} is now shown under @${author}` };
+                h = author;
+            }
+        }
+        let profile = null;
+        let suspended = false;
+        let missingVotes = 0;
+        const missingBy = [];
+        // 1) FxTwitter profile: fresh counts. A 404 is one vote only (measured false 404s).
+        const fx = await this.get('fxtwitter', 'profile', `https://api.fxtwitter.com/${h}`, trace);
+        if (fx) {
+            const j = json(fx.body);
+            const u = j?.user;
+            if (fx.status === 200 && u) {
+                profile = { screenName: str(u.screen_name), id: str(u.id), createdAt: iso(u.joined), followers: num(u.followers), following: num(u.following), tweets: num(u.tweets), bio: typeof u.description === 'string' ? u.description : null, website: str(u.website?.url), asOf: new Date(now).toISOString() };
+                trace.push({ source: 'fxtwitter', endpoint: 'profile', status: 200, result: 'profile', ms: fx.ms });
+            }
+            else if (str(j?.reason) === 'suspended') {
+                suspended = true;
+                trace.push({ source: 'fxtwitter', endpoint: 'profile', status: fx.status, result: 'suspended', ms: fx.ms });
+            }
+            else {
+                trace.push({ source: 'fxtwitter', endpoint: 'profile', status: fx.status, result: fx.status >= 300 && fx.status < 400 ? 'redirect (missing handle or error page)' : `no profile (${str(j?.message) ?? fx.status})`, ms: fx.ms });
+            }
+        }
+        // 2) vxtwitter: cached copy; says suspended / missing reliably in the probe.
+        if (!profile) {
+            const vx = await this.get('vxtwitter', 'profile', `https://api.vxtwitter.com/${h}`, trace);
+            if (vx) {
+                const j = json(vx.body);
+                if (vx.status === 200 && j && str(j.screen_name)) {
+                    const fetchedOn = num(j.fetched_on);
+                    profile = { screenName: str(j.screen_name), id: j.id === undefined || j.id === null ? null : String(j.id), createdAt: iso(j.created_at), followers: num(j.followers_count), following: num(j.following_count), tweets: num(j.tweet_count), bio: typeof j.description === 'string' ? j.description : null, website: null, asOf: fetchedOn ? new Date(fetchedOn * 1000).toISOString() : null };
+                    trace.push({ source: 'vxtwitter', endpoint: 'profile', status: 200, result: 'profile (cached copy)', ms: vx.ms });
+                }
+                else if (/suspended/i.test(str(j?.error) ?? '')) {
+                    suspended = true;
+                    trace.push({ source: 'vxtwitter', endpoint: 'profile', status: vx.status, result: 'suspended', ms: vx.ms });
+                }
+                else if (vx.status === 404) {
+                    missingVotes++;
+                    missingBy.push('vxtwitter');
+                    trace.push({ source: 'vxtwitter', endpoint: 'profile', status: 404, result: 'not found', ms: vx.ms });
+                }
+                else
+                    trace.push({ source: 'vxtwitter', endpoint: 'profile', status: vx.status, result: 'no answer', ms: vx.ms });
+            }
+        }
+        // 3) X oEmbed: exists vs missing (200 for a suspended account too).
+        let oembedExists = null;
+        if (!profile && !suspended) {
+            const oe = await this.get('x-oembed', 'oembed', `https://publish.x.com/oembed?url=${encodeURIComponent(`https://x.com/${h}`)}`, trace);
+            if (oe) {
+                const j = json(oe.body);
+                if (oe.status === 200 && j) {
+                    oembedExists = true;
+                    trace.push({ source: 'x-oembed', endpoint: 'oembed', status: 200, result: 'exists', ms: oe.ms });
+                }
+                else if (oe.status === 404) {
+                    oembedExists = false;
+                    missingVotes++;
+                    missingBy.push('x-oembed');
+                    trace.push({ source: 'x-oembed', endpoint: 'oembed', status: 404, result: 'not found', ms: oe.ms });
+                }
+                else
+                    trace.push({ source: 'x-oembed', endpoint: 'oembed', status: oe.status, result: 'no answer', ms: oe.ms });
+            }
+        }
+        // 4) Last post date (FxTwitter statuses), only for an account that exists.
+        let lastPostAt = null;
+        let postsRead = false;
+        if (profile) {
+            const st = await this.get('fxtwitter', 'statuses', `https://api.fxtwitter.com/2/profile/${h}/statuses`, trace);
+            const j = st ? json(st.body) : null;
+            const results = Array.isArray(j?.results) ? j.results : null;
+            if (st?.status === 200 && results) {
+                postsRead = true;
+                const times = results.map((r) => iso(r.created_at)).filter((t) => !!t).sort();
+                lastPostAt = times.at(-1) ?? null;
+                trace.push({ source: 'fxtwitter', endpoint: 'statuses', status: 200, result: `${results.length} recent posts`, ms: st.ms });
+            }
+            else if (st)
+                trace.push({ source: 'fxtwitter', endpoint: 'statuses', status: st.status, result: 'posts unavailable', ms: st.ms });
+        }
+        const out = { ...base };
+        if (profile) {
+            out.status = 'active';
+            Object.assign(out, {
+                screenName: profile.screenName, id: profile.id, createdAt: profile.createdAt, ageDays: days(now, profile.createdAt),
+                followers: profile.followers, following: profile.following, tweets: profile.tweets,
+                bio: profile.bio !== null ? profile.bio.slice(0, 280) : null, website: profile.website,
+                countsAsOf: profile.asOf, countsSource: trace.find((t) => t.endpoint === 'profile' && t.status === 200)?.source ?? null,
+                lastPostAt, daysSinceLastPost: days(now, lastPostAt),
+            });
+            // A posts list that came back empty for an account with zero tweets is "no posts", not missing.
+            if (postsRead && !lastPostAt && profile.tweets === 0)
+                out.daysSinceLastPost = null;
+            out.bioMentionsToken = profile.bio !== null ? mentionsToken(profile.bio, ctx) : null;
+            const site = bareHost(ctx.website);
+            if (site) {
+                const bioHit = (profile.bio ?? '').toLowerCase().includes(site);
+                const webHit = bareHost(profile.website) === site;
+                out.linksSite = bioHit || webHit ? true : (profile.website !== null || profile.bio !== null) ? false : null;
+            }
+        }
+        else if (suspended)
+            out.status = 'suspended';
+        else if (missingVotes >= 2)
+            out.status = 'not_found';
+        else if (oembedExists)
+            out.status = 'unavailable'; // exists per X, but no source returned the profile
+        const miss = [];
+        if (out.status !== 'active') {
+            if (out.status === 'unavailable')
+                miss.push(`account status (${missingBy.length ? `only ${missingBy.join(' + ')} said missing; ` : ''}no source returned the profile)`);
+        }
+        else {
+            if (out.createdAt === null)
+                miss.push('account created date');
+            if (out.followers === null)
+                miss.push('follower count');
+            if (out.following === null)
+                miss.push('following count');
+            if (out.tweets === null)
+                miss.push('post count');
+            if (!postsRead)
+                miss.push('last post date');
+            if (out.bio === null)
+                miss.push('bio');
+            if (ctx.website && out.linksSite === null)
+                miss.push('site cross-link');
+            if (out.bioMentionsToken === null && (ctx.symbol || ctx.name))
+                miss.push('bio mentions the token');
+        }
+        out.unavailable = miss;
+        return out;
+    }
+}
+/** Advertised handles per source, and whether they and the site's own X links agree. Pure. */
+export function xHandleAgreement(advertised, siteLinks) {
+    const handles = advertised.map((l) => ({ h: parseXLink(l.url), source: l.source })).filter((x) => x.h.handle).map((x) => ({ handle: x.h.handle, source: x.source }));
+    const distinct = [...new Set(handles.map((x) => x.handle.toLowerCase()))];
+    const siteHandles = siteLinks === null ? null : [...new Set(siteLinks.map((u) => parseXLink(u)).filter((x) => x.kind === 'profile' && x.handle).map((x) => x.handle.toLowerCase()))];
+    const siteLinksAdvertised = siteHandles === null || !distinct.length ? null : siteHandles.length === 0 ? false : siteHandles.some((s) => distinct.includes(s));
+    const agree = distinct.length === 0 ? null : distinct.length === 1 && (siteHandles === null || siteHandles.length === 0 || siteHandles.includes(distinct[0]));
+    const siteAgrees = !distinct.length || !siteHandles?.length ? null : siteHandles.some((s) => distinct.includes(s));
+    const note = distinct.length > 1 ? `sources advertise different X accounts: ${distinct.map((d) => `@${d}`).join(', ')}`
+        : agree === false && siteHandles?.length ? `the website links @${siteHandles.join(', @')} but the token lists @${distinct[0]}` : null;
+    return { handles, agree, siteAgrees, siteHandles, siteLinksAdvertised, note };
+}

package/dist/packages/data/src/sources/jupiter.js

@@ -106,6 +106,7 @@ export function normalizeJupToken(raw, fetchedAt) {
         top10Pct: numOrNull(raw.audit?.topHoldersPercentage),
         devPct: numOrNull(raw.audit?.devBalancePercentage),
         devMints: numOrNull(raw.audit?.devMints),
+        devAddress: typeof raw.dev === 'string' && /^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(raw.dev) ? raw.dev : null,
         lpLockedPct: null,
         rugRisks: [],
         rugScore: null,