dexterm-cli 0.1.5 → 0.1.7

package/dist/packages/data/src/trade/signer/service.js

@@ -1,400 +0,0 @@
-// dexterm T2 — the SIGNER SERVICE (task-1328, SPEC §6.5). The policy-owning side of the trade: it holds
-// the caps, the daily-cap ledger, the kill switch, the plan registry, the wallet bridge and the live
-// fill ledger, and exposes exactly the small API the protocol names. It is transport-agnostic (the host
-// serves it over the authenticated stdio channel; tests call it directly).
-//
-// What the UI can and cannot do through this surface:
-//   * plan(order)   → the signer quotes, builds, decodes, policy-checks, BINDS and simulates ITS OWN
-//                     transaction for the linked wallet it reads from ITS OWN link store; the UI gets a
-//                     JSON view (no bytes) and a hash.
-//   * confirm(hash) → the signer re-checks caps, reserves USD, opens the wallet page (the physical
-//                     approval), verifies and re-simulates the signed bytes, submits, confirms, books.
-//   * probe()       → the devnet plumbing transaction (never on mainnet).
-//   * status / precheck / drop / panic.
-//   There is no sign(bytes), no submit(bytes), no setCaps(), no way to name a different wallet.
-import { systemClock } from "../../clock.js";
-import { LiveExecutor, PLAN_TTL_MS, LiveLedger } from "../executor.js";
-import { effectiveCaps, HARD_MAX_SLIPPAGE_BPS } from "../caps.js";
-import { WalletLinkStore } from "../link-store.js";
-import { rpcNetwork } from "../rpc-exec.js";
-import { resolveSolUsd } from "../sol-usd.js";
-import { FAST_MAX_SOL_PER_FILL } from "./fast-wallet.js";
-import { SOL_MINT } from "../../paper.js";
-import { JupiterRateLimitedError, normalizeSwapQuote } from "../../sources/jupiter-swap.js";
-import { SIGNER_PROTOCOL_VERSION } from "./protocol.js";
-const B58 = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
-const HASH = /^[0-9a-f]{64}$/;
-export class SignerError extends Error {
-    reason;
-    /** task-1368: for `rate-limited`, how long the caller should wait before asking again (ms). */
-    retryAfterMs;
-    constructor(reason, message, retryAfterMs) {
-        super(message);
-        this.name = 'SignerError';
-        this.reason = reason;
-        if (retryAfterMs !== undefined)
-            this.retryAfterMs = retryAfterMs;
-    }
-}
-/**
- * task-1368: a build error that is really Jupiter rate limiting (the data layer's typed error after its bounded
- * retry) becomes `rate-limited` with the honest wait, so the ticket keeps the plan and retries; anything else is
- * `build-failed` as before. Never swallows: the message is the data layer's own.
- */
-function buildError(e) {
-    if (e instanceof JupiterRateLimitedError)
-        return new SignerError('rate-limited', e.message, e.retryAfterMs);
-    return new SignerError('build-failed', e instanceof Error ? e.message : String(e));
-}
-/** task-1363: validate an untrusted fill request. Anything off-shape is a bad request (never coerced). */
-export function parseFillParams(p) {
-    if (p === null || typeof p !== 'object')
-        throw new SignerError('bad-request', 'fill params must be an object');
-    const x = p;
-    if (typeof x.ref !== 'string' || !/^[\x21-\x7e]{1,64}$/.test(x.ref))
-        throw new SignerError('bad-request', 'ref must be 1..64 printable characters (planId:legKey)');
-    if (typeof x.mint !== 'string' || !B58.test(x.mint))
-        throw new SignerError('bad-request', 'mint must be a base58 address');
-    if (x.side !== 'buy' && x.side !== 'sell')
-        throw new SignerError('bad-request', 'side must be buy or sell');
-    if (typeof x.decimals !== 'number' || !Number.isInteger(x.decimals) || x.decimals < 0 || x.decimals > 18)
-        throw new SignerError('bad-request', 'decimals must be an integer 0..18');
-    if (typeof x.lamports !== 'string' || !/^[0-9]{1,19}$/.test(x.lamports) || BigInt(x.lamports) <= 0n)
-        throw new SignerError('bad-request', 'lamports must be a positive integer string');
-    const symbol = typeof x.symbol === 'string' ? x.symbol.replace(/[^\x20-\x7e]/g, '?').slice(0, 16) : '';
-    return { ref: x.ref, mint: x.mint, symbol: symbol || x.mint.slice(0, 4), side: x.side, decimals: x.decimals, lamports: x.lamports };
-}
-/** Validate an untrusted plan request. Anything off-shape is a bad request (never coerced). */
-export function parsePlanParams(p) {
-    if (p === null || typeof p !== 'object')
-        throw new SignerError('bad-request', 'plan params must be an object');
-    const x = p;
-    if (typeof x.mint !== 'string' || !B58.test(x.mint))
-        throw new SignerError('bad-request', 'mint must be a base58 address');
-    if (x.side !== 'buy' && x.side !== 'sell')
-        throw new SignerError('bad-request', 'side must be buy or sell');
-    if (typeof x.decimals !== 'number' || !Number.isInteger(x.decimals) || x.decimals < 0 || x.decimals > 18)
-        throw new SignerError('bad-request', 'decimals must be an integer 0..18');
-    if (typeof x.amountRaw !== 'string' || !/^[0-9]{1,30}$/.test(x.amountRaw) || BigInt(x.amountRaw) <= 0n)
-        throw new SignerError('bad-request', 'amountRaw must be a positive integer string');
-    if (typeof x.slippageBps !== 'number' || !Number.isInteger(x.slippageBps) || x.slippageBps < 0 || x.slippageBps > HARD_MAX_SLIPPAGE_BPS)
-        throw new SignerError('bad-request', `slippageBps must be an integer 0..${HARD_MAX_SLIPPAGE_BPS}`);
-    const symbol = typeof x.symbol === 'string' ? x.symbol.replace(/[^\x20-\x7e]/g, '?').slice(0, 16) : '';
-    return { mint: x.mint, symbol: symbol || x.mint.slice(0, 4), side: x.side, decimals: x.decimals, amountRaw: x.amountRaw, slippageBps: x.slippageBps };
-}
-export function parseHashParam(p) {
-    const h = p !== null && typeof p === 'object' ? p.hash : undefined;
-    if (typeof h !== 'string' || !HASH.test(h))
-        throw new SignerError('bad-request', 'hash must be a 64-hex plan hash');
-    return h;
-}
-export class SignerService {
-    ex;
-    d;
-    links;
-    live;
-    feed;
-    clock;
-    fastStore;
-    log;
-    /** Plans this service built, by hash (the executor keeps its own frozen registry too). */
-    plans = new Map();
-    /** task-1368: per plan hash, whether the order's mint exists on this signer's network (swap plans). */
-    mintOnNet = new Map();
-    /** One confirm at a time: a second keypress while the wallet page is open is refused, not queued. */
-    confirming = null;
-    constructor(s) {
-        this.ex = s.executor;
-        this.d = s.deps;
-        this.links = s.linkStore;
-        this.live = s.liveLedger;
-        this.feed = s.solUsdFeed ?? null;
-        this.clock = s.clock ?? systemClock;
-        this.fastStore = s.fastStore ?? null;
-        this.log = s.log ?? (() => { });
-    }
-    /** The network of the RPC endpoint the signer actually talks to. Classified, never a label. */
-    network() {
-        const rpc = this.d.rpc;
-        return rpcNetwork(rpc.url, rpc.network ?? null);
-    }
-    rpcHost() {
-        try {
-            return new URL(this.d.rpc.url).hostname;
-        }
-        catch {
-            return '?';
-        }
-    }
-    linked() {
-        const w = this.links.get();
-        if (!w)
-            throw new SignerError('no-wallet', 'no wallet is linked; run `dexterm wallet link` (or /wallet link)');
-        return { publicKey: w.publicKey, linkedAt: w.linkedAt };
-    }
-    solUsdView() {
-        const r = resolveSolUsd(this.d.solUsd?.(), this.clock.now(), this.network());
-        return r.price === null ? { price: null, reason: r.reason } : { price: r.price, sources: r.sources };
-    }
-    status() {
-        const caps = effectiveCaps(this.d.caps);
-        const ks = this.ex.killSwitch;
-        const panic = ks.engaged();
-        const lock = this.d.ledger.locked();
-        this.sweep();
-        return {
-            version: SIGNER_PROTOCOL_VERSION,
-            pid: process.pid,
-            linked: this.links.get() ? this.linked() : null,
-            fastWallet: this.d.fastSigner ? { publicKey: this.d.fastSigner.publicKey } : null,
-            network: this.network(),
-            rpcHost: this.rpcHost(),
-            caps: { network: caps.network, mainnetEnabled: caps.mainnetEnabled, perTradeUsd: caps.perTradeUsd, dailyUsd: caps.dailyUsd, maxPriceImpactPct: caps.maxPriceImpactPct, maxSolOut: caps.maxSolOut, maxSlippageBps: caps.maxSlippageBps },
-            panic,
-            ledgerLocked: lock,
-            spentTodayUsd: this.d.ledger.spentToday(),
-            plans: this.plans.size,
-            solUsd: this.solUsdView(),
-            probeAvailable: !!this.d.probe && this.network() === 'devnet',
-        };
-    }
-    sweep() {
-        const now = this.clock.now();
-        for (const [h, b] of this.plans)
-            if (now - b.builtAt > PLAN_TTL_MS) {
-                this.plans.delete(h);
-                this.mintOnNet.delete(h);
-            }
-    }
-    /**
-     * task-1368: does the mint account exist on the network the signer talks to? Read-only `getMultipleAccounts`;
-     * null when the RPC cannot answer. On a devnet signer a mainnet-only token answers false — the reason the swap's
-     * simulation fails there, shown in plain English on the ticket instead of a truncated RPC error.
-     */
-    async mintExists(mint) {
-        const rpc = this.d.rpc;
-        if (typeof rpc.accountsInfo !== 'function')
-            return null;
-        try {
-            const infos = await rpc.accountsInfo.call(this.d.rpc, [mint]);
-            return infos[0] !== null && infos[0] !== undefined;
-        }
-        catch {
-            return null;
-        }
-    }
-    quoteRequest(p) {
-        return {
-            inputMint: p.side === 'buy' ? SOL_MINT : p.mint,
-            outputMint: p.side === 'buy' ? p.mint : SOL_MINT,
-            amount: BigInt(p.amountRaw),
-            slippageBps: p.slippageBps,
-            mode: 'ExactIn',
-        };
-    }
-    /**
-     * task-1368: the keyless Jupiter quote for an order, fetched by the signer's own HTTP client (ONE limiter for
-     * preview, re-quote and build) and reusable by `plan` for QUOTE_REUSE_MS. Read-only: numbers and strings go
-     * back, never a transaction, and nothing is registered. Rate limiting past the retry budget is `rate-limited`.
-     */
-    async quote(params) {
-        const p = parsePlanParams(params);
-        const req = this.quoteRequest(p);
-        const build = this.d.build;
-        try {
-            const raw = await build.quoteRaw(req);
-            const q = normalizeSwapQuote(raw, this.clock.now());
-            const age = typeof build.quoteAge === 'function' ? build.quoteAge(req) : null;
-            return {
-                inputMint: q.inputMint, outputMint: q.outputMint, inAmountRaw: q.inAmount.toString(), outAmountRaw: q.outAmount.toString(),
-                minOutRaw: q.otherAmountThreshold.toString(), slippageBps: q.slippageBps, priceImpactPct: q.priceImpactPct, route: [...q.route],
-                usdValue: q.usdValue, solUsd: this.solUsdView(), host: typeof build.host === 'string' ? build.host : '?', ageMs: Math.max(0, age ?? 0), fetchedAt: this.clock.now(),
-            };
-        }
-        catch (e) {
-            throw buildError(e);
-        }
-    }
-    view(b) {
-        const p = b.plan;
-        const pre = this.ex.precheck(b);
-        const policy = p.txPolicy.ok ? { ok: true } : { ok: false, reason: p.txPolicy.reason, message: p.txPolicy.message };
-        return {
-            hash: b.hash, kind: b.kind, lane: b.lane, ref: b.ref, network: this.network(), mint: p.mint, symbol: p.symbol, side: p.side, decimals: b.order.decimals,
-            amountInRaw: p.amountInRaw.toString(), amountOutRaw: p.amountOutRaw.toString(), minOutRaw: b.quote.otherAmountThreshold.toString(),
-            slippageBps: p.slippageBps, route: [...p.route], priceImpactPct: p.priceImpactPct, notionalUsd: p.notionalUsd,
-            solUsd: b.solUsd.price === null ? { price: null, reason: b.solUsd.reason } : { price: b.solUsd.price, sources: b.solUsd.sources },
-            sim: { ran: p.simulated, ok: p.simOk, error: p.simError, unitsConsumed: null, solOutLamports: p.solOutLamports === null ? null : p.solOutLamports.toString() },
-            mintOnNetwork: this.mintOnNet.get(b.hash) ?? null,
-            feeLamports: b.feeLamports.toString(), prioritizationFeeLamports: b.prioritizationFeeLamports, instructions: [...b.instructions],
-            policy, precheck: pre.ok ? { ok: true } : { ok: false, reason: pre.reason, message: pre.message },
-            userPublicKey: b.userPublicKey, builtAt: b.builtAt, expiresAt: b.builtAt + PLAN_TTL_MS,
-        };
-    }
-    /** Build a SWAP plan for the LINKED wallet. The order comes from the UI; the wallet, caps, tx do not. */
-    async plan(params) {
-        const p = parsePlanParams(params);
-        const linked = this.linked();
-        await this.feed?.ensureFresh();
-        const order = { mint: p.mint, symbol: p.symbol, side: p.side, decimals: p.decimals, amountRaw: BigInt(p.amountRaw), slippageBps: p.slippageBps };
-        let built;
-        try {
-            built = await this.ex.buildPlan({ order, userPublicKey: linked.publicKey, network: this.network() });
-        }
-        catch (e) {
-            throw buildError(e);
-        }
-        this.plans.set(built.hash, built);
-        // task-1368: the mint's existence on THIS network (devnet signer + mainnet token = the sim-failure reason), and
-        // the FULL simulation error in the log (the ticket row truncates; `invalid transaction: Tr…` told the user nothing).
-        this.mintOnNet.set(built.hash, await this.mintExists(p.mint));
-        if (built.plan.simulated && !built.plan.simOk)
-            this.log(`signer: plan ${built.hash.slice(0, 8)} ${p.side} ${p.symbol} simulation failed on ${this.network()} (${this.rpcHost()}): ${built.plan.simError ?? 'unknown error'}`);
-        this.sweep();
-        return this.view(built);
-    }
-    /** Build the devnet PROBE plan. Refused unless the RPC is devnet by classification. */
-    async probe() {
-        const linked = this.linked();
-        if (this.network() !== 'devnet')
-            throw new SignerError('network-mismatch', 'the probe runs only on devnet');
-        let built;
-        try {
-            built = await this.ex.buildProbe({ userPublicKey: linked.publicKey });
-        }
-        catch (e) {
-            throw new SignerError('build-failed', e instanceof Error ? e.message : String(e));
-        }
-        this.plans.set(built.hash, built);
-        return this.view(built);
-    }
-    /**
-     * task-1363: the fast wallet's public status. Loaded only when the signer runs against devnet AND a record
-     * exists; the balance is read from the devnet RPC (null when unreadable). Never carries the seed.
-     */
-    async fast() {
-        const signer = this.d.fastSigner ?? null;
-        const rec = this.fastStore?.get() ?? null;
-        const base = { network: 'devnet', maxSolPerFill: FAST_MAX_SOL_PER_FILL, createdAt: rec?.createdAt ?? null };
-        if (!signer) {
-            const reason = this.network() !== 'devnet' ? 'the fast wallet exists only on devnet; this signer is not on a devnet RPC'
-                : rec ? 'the fast wallet record could not be loaded' : 'no fast wallet: `dexterm wallet fast create`';
-            return { ...base, loaded: false, publicKey: rec?.publicKey ?? null, balanceLamports: null, reason };
-        }
-        let balance = null;
-        try {
-            balance = (await this.d.rpc.balance(signer.publicKey)).toString();
-        }
-        catch {
-            balance = null;
-        }
-        return { ...base, loaded: true, publicKey: signer.publicKey, balanceLamports: balance, reason: null };
-    }
-    /**
-     * task-1363: build a DEVNET FILL for the fast wallet from an order-plan leg. The engine (in the terminal
-     * process) asks; the signer builds its own transaction for ITS fast wallet, applies the probe-shape policy,
-     * simulates, prices the SOL leg in USD from its own feed and registers the plan under a hash the engine then
-     * confirms. Refused off devnet or without a loaded fast wallet. Caps are decided at precheck/confirm.
-     */
-    async fill(params) {
-        const p = parseFillParams(params);
-        if (this.network() !== 'devnet')
-            throw new SignerError('network-mismatch', 'devnet fills run only on devnet');
-        if (!this.d.fastSigner)
-            throw new SignerError('no-fast-wallet', 'no fast wallet is loaded; create one with `dexterm wallet fast create` (devnet) and restart dexterm');
-        await this.feed?.ensureFresh();
-        let built;
-        try {
-            built = await this.ex.buildFill({ lamports: BigInt(p.lamports), mint: p.mint, symbol: p.symbol, decimals: p.decimals, side: p.side, ref: p.ref });
-        }
-        catch (e) {
-            throw new SignerError('build-failed', e instanceof Error ? e.message : String(e));
-        }
-        this.plans.set(built.hash, built);
-        this.sweep();
-        return this.view(built);
-    }
-    precheck(params) {
-        const hash = parseHashParam(params);
-        const b = this.plans.get(hash);
-        if (!b)
-            return { ok: false, reason: 'plan-mismatch', message: 'unknown plan' };
-        const r = this.ex.precheck(b);
-        return r.ok ? { ok: true } : { ok: false, reason: r.reason, message: r.message };
-    }
-    drop(params) {
-        const hash = parseHashParam(params);
-        return { dropped: this.plans.delete(hash) };
-    }
-    /**
-     * The keypress arrived: confirm the plan named by hash. The wallet is re-read from the link store (a
-     * link changed since the plan → signer-mismatch). Single-flight: a second confirm while one is in
-     * progress is refused rather than queued (the wallet page is already open).
-     */
-    async confirm(params) {
-        const hash = parseHashParam(params);
-        const b = this.plans.get(hash);
-        if (!b)
-            return { kind: 'refused', reason: 'plan-mismatch', message: 'unknown or expired plan; build it again' };
-        if (this.confirming)
-            return { kind: 'refused', reason: 'plan-mismatch', message: 'another confirm is in progress' };
-        // task-1363: a fast-lane plan is confirmed for the FAST wallet (no Phantom link needed); a main-lane plan for
-        // the linked wallet as before. The executor re-checks the lane against the plan's own public key.
-        const signerKey = b.lane === 'fast' ? (this.d.fastSigner?.publicKey ?? null) : this.linked().publicKey;
-        if (!signerKey)
-            return { kind: 'refused', reason: 'signer-mismatch', message: 'no fast wallet is loaded for this fill' };
-        this.confirming = hash;
-        try {
-            await this.feed?.ensureFresh();
-            const out = await this.ex.confirmAndSubmit(b, hash, signerKey);
-            this.plans.delete(hash);
-            return toConfirmView(out, this.network());
-        }
-        finally {
-            this.confirming = null;
-        }
-    }
-    /** PANIC: engage the kill switch, lock the ledger, forget every plan. One-way; resume needs the TTY path. */
-    panic(params) {
-        const reason = (params !== null && typeof params === 'object' && typeof params.reason === 'string')
-            ? String(params.reason).replace(/[^\x20-\x7e]/g, '?').slice(0, 120) : 'panic';
-        const ks = this.ex.killSwitch;
-        const rec = ks.engage(reason, this.clock.now());
-        try {
-            this.d.ledger.lock(reason, this.clock.now());
-        }
-        catch { /* the kill-switch file alone disables trading */ }
-        this.plans.clear();
-        return { engaged: true, reason: rec.reason };
-    }
-    /** Dispatch one protocol method. Unknown methods are refused; errors become `ok:false`. */
-    async call(method, params) {
-        switch (method) {
-            case 'status': return this.status();
-            case 'plan': return this.plan(params);
-            case 'probe': return this.probe();
-            case 'precheck': return this.precheck(params);
-            case 'confirm': return this.confirm(params);
-            case 'drop': return this.drop(params);
-            case 'panic': return this.panic(params);
-            case 'fast': return this.fast();
-            case 'fill': return this.fill(params);
-            case 'quote': return this.quote(params);
-            default: throw new SignerError('bad-request', `unknown method ${JSON.stringify(String(method).slice(0, 32))}`);
-        }
-    }
-    /** The live fill ledger (for tests / the CLI probe). */
-    get liveLedger() { return this.live; }
-    get caps() { return effectiveCaps(this.d.caps); }
-}
-function fillView(f) {
-    return { t: f.t, mint: f.mint, symbol: f.symbol, side: f.side, decimals: f.decimals, solDelta: f.solDelta.toString(), tokenDelta: f.tokenDelta.toString(), feeLamports: f.feeLamports.toString(), priceSol: f.priceSol, realizedLamports: f.realizedLamports.toString() };
-}
-export function toConfirmView(out, network) {
-    switch (out.kind) {
-        case 'filled': return { kind: 'filled', signature: out.signature, fill: fillView(out.fill), roundTripMs: out.roundTripMs, lighthouseTail: out.lighthouseTail, network };
-        case 'refused': return { kind: 'refused', reason: out.reason, message: out.message };
-        case 'send-failed': return { kind: 'send-failed', signature: out.signature, error: out.error };
-        case 'send-unknown': return { kind: 'send-unknown', signature: out.signature, error: out.error };
-    }
-}

package/dist/packages/data/src/trade/signer/sol-usd-feed.js

@@ -1,98 +0,0 @@
-// dexterm T2 — the signer's OWN SOL/USD feed (task-1328, closes "SOL/USD freshness check"). The UI's
-// number is never trusted: the signer fetches its own timestamped samples from two INDEPENDENT keyless
-// sources — DexScreener (DEX-derived) and CoinGecko (exchange-derived) — and `resolveSolUsd` applies the
-// freshness (60 s), plausibility and two-source-agreement rules at every plan and confirm. A sample is
-// stamped with the clock at fetch; a fetch that fails leaves the old sample to AGE OUT rather than being
-// refreshed, so a dead feed turns into a refusal on mainnet, never into a stale price.
-//
-// Plain fetch with an unref'd timeout (no AbortSignal.timeout — its ref'd timer kept processes alive,
-// task-1319). No key, no cookies, GET only.
-import { systemClock } from "../../clock.js";
-import { WSOL_MINT } from "../tx-decode.js";
-export const DEXSCREENER_SOL_URL = `https://api.dexscreener.com/tokens/v1/solana/${WSOL_MINT}`;
-export const COINGECKO_SOL_URL = 'https://api.coingecko.com/api/v3/simple/price?ids=solana&vs_currencies=usd';
-async function fetchJson(url, signal) {
-    const res = await globalThis.fetch(url, { signal, headers: { accept: 'application/json', 'user-agent': 'dexterm/0.0.1 (+signer; keyless read-only)' } });
-    if (!res.ok)
-        throw new Error(`HTTP ${res.status}`);
-    return res.json();
-}
-const num = (v) => { const n = typeof v === 'number' ? v : typeof v === 'string' ? Number(v) : NaN; return Number.isFinite(n) ? n : null; };
-/** DexScreener: pick the most liquid SOL pair's priceUsd. */
-export function parseDexScreenerSol(body) {
-    if (!Array.isArray(body))
-        return null;
-    let best = null;
-    for (const p of body) {
-        const price = num(p.priceUsd);
-        const liq = num(p.liquidity?.usd) ?? 0;
-        if (price === null)
-            continue;
-        if (!best || liq > best.liq)
-            best = { liq, price };
-    }
-    return best?.price ?? null;
-}
-export function parseCoinGeckoSol(body) {
-    if (body === null || typeof body !== 'object')
-        return null;
-    return num((body.solana)?.usd);
-}
-export class SolUsdFeed {
-    clock;
-    fetcher;
-    timeoutMs;
-    bySource = new Map();
-    inflight = null;
-    lastError = null;
-    constructor(opts = {}) {
-        this.clock = opts.clock ?? systemClock;
-        this.fetcher = opts.fetcher ?? fetchJson;
-        this.timeoutMs = opts.timeoutMs ?? 5_000;
-    }
-    /** Current samples (possibly stale — the resolver decides). */
-    samples() { return [...this.bySource.values()]; }
-    /** Age of the freshest sample in ms, or Infinity. */
-    age(now = this.clock.now()) {
-        let best = Infinity;
-        for (const s of this.bySource.values())
-            best = Math.min(best, now - s.fetchedAt);
-        return best;
-    }
-    /** Refresh both sources (coalesced). Never throws; failures leave old samples to age out. */
-    refresh() {
-        if (this.inflight)
-            return this.inflight;
-        this.inflight = this.doRefresh().finally(() => { this.inflight = null; });
-        return this.inflight;
-    }
-    /** Refresh only when the freshest sample is older than `maxAgeMs`. */
-    async ensureFresh(maxAgeMs = 20_000) {
-        if (this.age() > maxAgeMs)
-            await this.refresh();
-    }
-    async one(source, url, parse) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(new Error('timeout')), this.timeoutMs);
-        timer.unref?.();
-        try {
-            const body = await this.fetcher(url, controller.signal);
-            const price = parse(body);
-            if (price === null)
-                throw new Error('no price in response');
-            this.bySource.set(source, { price, fetchedAt: this.clock.now(), source });
-        }
-        catch (e) {
-            this.lastError = `${source}: ${e instanceof Error ? e.message : String(e)}`;
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    async doRefresh() {
-        await Promise.all([
-            this.one('dexscreener', DEXSCREENER_SOL_URL, parseDexScreenerSol),
-            this.one('coingecko', COINGECKO_SOL_URL, parseCoinGeckoSol),
-        ]);
-    }
-}

package/dist/packages/data/src/trade/sol-usd.js

@@ -1,86 +0,0 @@
-// dexterm T1 — the SOL/USD price the signer prices a trade with (task-1310 round 2, HIGH #2).
-//
-// The USD caps are only as good as the SOL/USD number behind them: a stale or absurd price (say
-// $0.0001) makes a 100 SOL trade look like a cent. The executor therefore never takes a bare number.
-// It takes timestamped SAMPLES from named sources and resolves them here, refusing when:
-//   * a sample is older than MAX_AGE_MS (60 s) or dated in the future;
-//   * a price is outside the plausibility band [MIN_PLAUSIBLE_USD, MAX_PLAUSIBLE_USD] ($1–$10,000);
-//   * on MAINNET, fewer than two INDEPENDENT non-Jupiter sources agree within AGREE_PCT (3%). Jupiter
-//     is the swap vendor, so its price API is not an independent check of a Jupiter route and can
-//     never be the only source.
-// The resolved price is the HIGHEST of the agreeing sources: that over-states the notional slightly,
-// which is the conservative direction for a cap. Pure; no I/O.
-export const SOL_USD_MAX_AGE_MS = 60_000;
-export const SOL_USD_MIN_PLAUSIBLE = 1;
-export const SOL_USD_MAX_PLAUSIBLE = 10_000;
-export const SOL_USD_AGREE_PCT = 3;
-/** Sources that are the swap vendor itself (or a re-export of it) and so count as dependent. */
-export const SOL_USD_DEPENDENT_SOURCES = new Set(['jupiter', 'jupiter-swap', 'jupiter-price', 'jup']);
-function isSample(x) {
-    if (x === null || typeof x !== 'object')
-        return false;
-    const s = x;
-    return typeof s.price === 'number' && typeof s.fetchedAt === 'number' && typeof s.source === 'string';
-}
-function dependent(source) {
-    const s = source.toLowerCase();
-    return SOL_USD_DEPENDENT_SOURCES.has(s) || s.startsWith('jupiter') || s.startsWith('jup-');
-}
-/**
- * Resolve a SOL/USD price from samples. `input` may be a single sample, an array, or anything else
- * (a bare number, null, undefined) — anything that is not a well-formed sample is ignored, so a legacy
- * `() => 150` feed yields NO price and a mainnet trade is refused ('no-usd-value').
- */
-export function resolveSolUsd(input, now, network) {
-    const raw = Array.isArray(input) ? input : input === null || input === undefined ? [] : [input];
-    const rejected = [];
-    const fresh = new Map(); // one sample per source (the freshest)
-    for (const x of raw) {
-        if (!isSample(x)) {
-            rejected.push('malformed sample');
-            continue;
-        }
-        const src = x.source.trim().toLowerCase();
-        if (src.length === 0) {
-            rejected.push('unnamed source');
-            continue;
-        }
-        if (!Number.isFinite(x.price) || x.price < SOL_USD_MIN_PLAUSIBLE || x.price > SOL_USD_MAX_PLAUSIBLE) {
-            rejected.push(`${src}: implausible $${x.price}`);
-            continue;
-        }
-        if (!Number.isFinite(x.fetchedAt) || x.fetchedAt > now + 5_000) {
-            rejected.push(`${src}: bad timestamp`);
-            continue;
-        }
-        const age = now - x.fetchedAt;
-        if (age > SOL_USD_MAX_AGE_MS) {
-            rejected.push(`${src}: stale (${Math.round(age / 1000)} s)`);
-            continue;
-        }
-        const prev = fresh.get(src);
-        if (!prev || x.fetchedAt > prev.fetchedAt)
-            fresh.set(src, { price: x.price, fetchedAt: x.fetchedAt, source: src });
-    }
-    const valid = [...fresh.values()];
-    const why = rejected.length > 0 ? ` (${rejected.join('; ')})` : '';
-    if (network !== 'mainnet') {
-        // Devnet funds have no USD value; one fresh plausible sample from anyone is enough for display.
-        if (valid.length === 0)
-            return { price: null, reason: `no fresh SOL/USD sample${why}` };
-        const best = valid.reduce((a, b) => (b.price > a.price ? b : a));
-        return { price: best.price, sources: [best.source] };
-    }
-    const independent = valid.filter((s) => !dependent(s.source));
-    if (independent.length < 2) {
-        const have = independent.length === 1 ? `only ${independent[0].source}` : valid.length > 0 ? 'only the swap vendor' : 'none';
-        return { price: null, reason: `mainnet needs two independent non-Jupiter SOL/USD sources; have ${have}${why}` };
-    }
-    const lo = Math.min(...independent.map((s) => s.price));
-    const hi = Math.max(...independent.map((s) => s.price));
-    const spreadPct = ((hi - lo) / lo) * 100;
-    if (spreadPct > SOL_USD_AGREE_PCT) {
-        return { price: null, reason: `SOL/USD sources disagree by ${spreadPct.toFixed(1)}% (${independent.map((s) => `${s.source} $${s.price}`).join(', ')})` };
-    }
-    return { price: hi, sources: independent.map((s) => s.source) };
-}