dexterm-cli 0.1.6 → 0.1.7

package/dist/packages/data/src/trade/plans/executor-live.js

@@ -1,220 +0,0 @@
-// task-1363 — the LIVE fire path for the plan engine: an Executor that fills through the REAL signer process
-// (devnet only, from the capped FAST WALLET). The engine is synchronous and tick-driven; the signer is a child
-// process answered asynchronously. This adapter bridges the two WITHOUT the engine ever waiting:
-//
-//   quote(leg)      first call starts `signer.fill(...)` (build + policy + simulate + USD pricing in the SIGNER)
-//                   and throws RpcOutage (the engine logs price.unusable/rpc-outage and retries on the next
-//                   fresh tick, no attempt consumed). Once the signer has answered, the next quote() returns a
-//                   Quote carrying the signer's verdict: policy/sim/caps refusals arrive as `simOk:false` with
-//                   the signer's own reason, so the engine journals `policy.refused` with that reason.
-//   nextSignature() an INTENT id (`live_N`) the engine journals BEFORE anything is sent (CL-03).
-//   submit(leg)     starts `signer.confirm(hash)` — the signer re-checks caps, reserves USD, has the fast
-//                   wallet sign, verifies + re-simulates the bytes, submits and confirms — and returns
-//                   `send-unknown` at once: the engine marks the leg in flight and settles it by `lookup`.
-//   lookup(intent)  'not-found' while the confirm runs; {confirmed, fill} / 'failed' once the signer answered;
-//                   a transport error at confirm stays 'not-found' (the engine expires it after 90 s, never
-//                   resends — the chain may still have it; the fast wallet is capped so exposure is bounded).
-//
-// What is real on devnet: the lamports the fill moves out of the fast wallet (fees of the wrap-and-unwrap
-// sized to the plan's SOL leg), the signature, the on-chain memo naming the plan leg, the signer's USD
-// per-trade/daily ledger. What is MODELLED: the token leg (Jupiter has no devnet, so no token changes hands);
-// the fill is booked from the planned USD at the fire-time price and labelled `kind:'devnet-fill'` +
-// `modelledTokens:true` in the journal. Nothing in this file signs, holds a key, or reaches mainnet: the signer
-// refuses `fill` off devnet and never loads a fast wallet there.
-import { RpcOutage } from "./executor.js";
-/** How long a signer build is reused before it is rebuilt (the signer's own plan TTL is 90 s). */
-export const LIVE_BUILD_TTL_MS = 60_000;
-/** Remote refusals the signer formats as `reason: message`; anything else from the client is a transport problem. */
-const REMOTE_REFUSAL = /^(network-mismatch|no-fast-wallet|build-failed|bad-request|panicked|no-wallet|signer-mismatch|plan-mismatch):\s*/;
-export class LivePlanExecutor {
-    kind = 'live';
-    signer;
-    clock;
-    solUsd;
-    ttl;
-    onChange;
-    log;
-    builds = new Map();
-    pending = new Map();
-    intents = 0;
-    constructor(o) {
-        this.signer = o.signer;
-        this.clock = o.clock;
-        this.solUsd = o.solUsd;
-        this.ttl = o.buildTtlMs ?? LIVE_BUILD_TTL_MS;
-        this.onChange = o.onChange ?? (() => { });
-        this.log = o.log ?? (() => { });
-    }
-    /** The signer must be alive, on DEVNET, with a fast wallet loaded. Checked by the host before switching to live. */
-    async ready() {
-        if (!this.signer.alive)
-            return { ok: false, why: 'the signer process is not available' };
-        let status;
-        try {
-            status = await this.signer.status();
-        }
-        catch (e) {
-            return { ok: false, why: `signer status: ${msg(e)}` };
-        }
-        if (status.network !== 'devnet')
-            return { ok: false, why: `the signer is on ${status.network}; live plan fills run on devnet only` };
-        if (status.panic || status.ledgerLocked)
-            return { ok: false, why: 'live trading is panicked (dexterm wallet resume)' };
-        let fast;
-        try {
-            fast = await this.signer.fast();
-        }
-        catch (e) {
-            return { ok: false, why: `signer fast: ${msg(e)}` };
-        }
-        if (!fast.loaded || !fast.publicKey)
-            return { ok: false, why: fast.reason ?? 'no fast wallet is loaded in the signer' };
-        return { ok: true, network: 'devnet', fastWallet: fast.publicKey, balanceLamports: fast.balanceLamports };
-    }
-    /** One-line label for banners. */
-    describe(fastWallet) { return `LIVE · DEVNET · fast wallet${fastWallet ? ` ${fastWallet.slice(0, 4)}…${fastWallet.slice(-4)}` : ''}`; }
-    legId(req) { return `${req.plan.id}:${req.legKey}`; }
-    /** The SOL leg in lamports for this leg (buy: USD / SOL-USD; sell: tokens × price / SOL-USD). Null without a SOL price. */
-    lamportsFor(req) {
-        const sol = this.solUsd();
-        if (sol === null || !(sol > 0))
-            return null;
-        const usd = req.side === 'buy' ? (req.usd ?? 0) : req.tokenRaw !== null ? Number(req.tokenRaw) / 10 ** req.plan.decimals * req.priceUsd : 0;
-        if (!(usd > 0))
-            return null;
-        return BigInt(Math.round(usd / sol * 1e9));
-    }
-    quote(req) {
-        const id = this.legId(req);
-        const now = this.clock.now();
-        const b = this.builds.get(id);
-        if (b && b.state === 'building')
-            throw new RpcOutage();
-        if (b && b.state === 'outage') {
-            this.builds.delete(id);
-            throw new RpcOutage();
-        } // retried: a new build starts on the next quote
-        if (b && b.state === 'refused') {
-            this.builds.delete(id);
-            return this.refusedQuote(req, b.error ?? 'build refused', b.at);
-        }
-        if (b && b.state === 'built' && b.view && now - b.at < this.ttl && b.view.expiresAt > now)
-            return this.quoteFromView(req, b.view, b.at);
-        if (b)
-            this.builds.delete(id);
-        // start a build
-        const lamports = this.lamportsFor(req);
-        if (lamports === null) {
-            this.log(`live plans: no SOL/USD price yet to size ${id}; retrying`);
-            throw new RpcOutage();
-        }
-        const build = { state: 'building', view: null, error: null, at: now, usd: req.usd, tokenRaw: req.tokenRaw, priceUsd: req.priceUsd };
-        this.builds.set(id, build);
-        void this.signer.fill({ ref: id, mint: req.plan.mint, symbol: req.plan.symbol, decimals: req.plan.decimals, side: req.side, lamports: lamports.toString() })
-            .then((view) => { build.state = 'built'; build.view = view; build.at = this.clock.now(); this.onChange(); })
-            .catch((e) => {
-            const m = msg(e);
-            if (REMOTE_REFUSAL.test(m)) {
-                build.state = 'refused';
-                build.error = m;
-            }
-            else {
-                build.state = 'outage';
-                build.error = m;
-                this.log(`live plans: signer fill failed (${m}); retrying`);
-            }
-            this.onChange();
-        });
-        throw new RpcOutage();
-    }
-    refusedQuote(req, error, at) {
-        const m = REMOTE_REFUSAL.exec(error);
-        const reason = m ? m[1] : 'signer-refused';
-        return {
-            side: req.side, priceUsd: req.priceUsd, impactPct: 0, route: ['devnet-fill'], feeLamports: 0, tipLamports: 0,
-            simOk: false, simError: error, refusal: { reason, message: error.replace(REMOTE_REFUSAL, '') }, usd: req.usd, tokenRaw: req.tokenRaw, at,
-        };
-    }
-    /** The signer's verdict as a Quote: its policy / simulation / caps refusal (if any) travels with its own reason. */
-    quoteFromView(req, v, at) {
-        const bad = !v.policy.ok ? v.policy : !v.sim.ok ? { ok: false, reason: 'simulation-failed', message: v.sim.error ?? 'simulation failed' } : !v.precheck.ok ? v.precheck : null;
-        return {
-            side: req.side,
-            // a devnet fill has no route, so the signer cannot imply a price; the tick's price stands (on a Jupiter
-            // route the quote-implied price would come from the signer's view instead)
-            priceUsd: req.priceUsd,
-            impactPct: v.priceImpactPct ?? 0, route: [...v.route],
-            feeLamports: Number(v.feeLamports), tipLamports: 0,
-            simOk: bad === null, simError: bad ? `${bad.reason ?? 'refused'}: ${bad.message ?? ''}` : null,
-            refusal: bad ? { reason: bad.reason ?? 'signer-refused', message: bad.message ?? 'refused by the signer' } : null,
-            usd: req.usd, tokenRaw: req.tokenRaw, at,
-        };
-    }
-    nextSignature() { return `live_${++this.intents}`; }
-    submit(req) {
-        const id = this.legId(req);
-        const b = this.builds.get(id);
-        this.builds.delete(id);
-        if (!b || b.state !== 'built' || !b.view)
-            return { kind: 'send-failed', signature: req.signature, error: 'no fresh signer plan for this leg (rebuilt on the next tick)', feeLamports: 0 };
-        const view = b.view;
-        const p = { legId: id, hash: view.hash, state: 'confirming', outcome: null, error: null, fill: null, signature: null };
-        this.pending.set(req.signature, p);
-        void this.signer.confirm(view.hash)
-            .then((out) => {
-            p.outcome = out;
-            if (out.kind === 'filled') {
-                p.state = 'filled';
-                p.signature = out.signature;
-                p.fill = this.modelFill(req, out);
-            }
-            else if (out.kind === 'refused' || out.kind === 'send-failed') {
-                p.state = 'failed';
-                p.error = out.kind === 'refused' ? `${out.reason}: ${out.message}` : out.error;
-                p.signature = out.kind === 'send-failed' ? out.signature : null;
-            }
-            else {
-                p.state = 'unknown';
-                p.error = out.error;
-                p.signature = out.signature;
-            }
-            this.onChange();
-        })
-            .catch((e) => { p.state = 'unknown'; p.error = msg(e); this.log(`live plans: confirm transport error (${p.error}); outcome unknown, never resent`); this.onChange(); });
-        return { kind: 'send-unknown', signature: req.signature, error: 'live confirm in flight (fast wallet, devnet)', feeLamports: req.quote.feeLamports + req.quote.tipLamports };
-    }
-    /**
-     * The fill the engine books. SOL: the real on-chain delta the signer reported (fees of the wrap-and-unwrap).
-     * Tokens: MODELLED from the planned USD at the fire-time price (no token moves on devnet) and labelled so.
-     */
-    modelFill(req, out) {
-        const dec = req.plan.decimals;
-        const usd = req.usd ?? (req.tokenRaw !== null ? Number(req.tokenRaw) / 10 ** dec * req.quote.priceUsd : 0);
-        const tokens = req.tokenRaw ?? BigInt(Math.round(usd / req.quote.priceUsd * 10 ** dec));
-        return {
-            tokenDelta: req.quote.side === 'buy' ? tokens : -tokens,
-            solDelta: BigInt(out.fill.solDelta),
-            usd, priceUsd: req.quote.priceUsd,
-            kind: 'devnet-fill', signature: out.signature, modelledTokens: true, network: out.network,
-        };
-    }
-    lookup(signature) {
-        const p = this.pending.get(signature);
-        if (!p)
-            return 'not-found';
-        if (p.state === 'filled' && p.fill)
-            return { status: 'confirmed', fill: p.fill };
-        if (p.state === 'failed')
-            return { status: 'failed' };
-        return 'not-found'; // confirming, or an unknown outcome: never resent, expires in the engine
-    }
-    chainFill(signature) { return this.pending.get(signature)?.fill ?? null; }
-    /** Diagnostics for the TUI (what is building / in flight / settled). */
-    snapshot() {
-        return {
-            builds: [...this.builds.entries()].map(([leg, b]) => ({ leg, state: b.state, error: b.error })),
-            pending: [...this.pending.entries()].map(([intent, p]) => ({ leg: p.legId, intent, state: p.state, signature: p.signature, error: p.error })),
-        };
-    }
-}
-function msg(e) { return e instanceof Error ? e.message : String(e); }

package/dist/packages/data/src/trade/rpc-exec.js

@@ -1,229 +0,0 @@
-// dexterm T1 — the ONLY place that can submit a transaction (SPEC §6.1 steps 2/5). Kept out of the
-// read-only `sources/solana-rpc.ts` (which refuses non-read methods) so the broadcast path is small,
-// explicit and auditable. It simulates against the user's RPC, submits an already-signed transaction
-// (dexterm never signs), and confirms it. It holds no keys.
-//
-// DEVNET is the default RPC. Mainnet is only used when the caps allow it (--mainnet).
-import { systemClock } from "../clock.js";
-export const DEVNET_RPC = 'https://api.devnet.solana.com';
-export const MAINNET_RPC = 'https://api.mainnet-beta.solana.com';
-/**
- * Hostnames that are devnet/testnet by construction. EXACT matches only (round 2, re-verify MEDIUM #5):
- * the old substring test took `https://mainnet.helius-rpc.com/?api-key=devnet-team-key` for devnet and
- * dropped every USD cap. Any other host — mainnet, a vendor URL, localhost, an unparseable string — is
- * classified MAINNET so the caps apply by default. A deployment that really runs a private devnet can
- * say so explicitly via `TradeRpc({ network: 'devnet' })`.
- */
-export const DEVNET_HOSTS = new Set([
-    'api.devnet.solana.com',
-    'api.testnet.solana.com',
-    'devnet.helius-rpc.com',
-]);
-/**
- * DEFECT 4 / round 2: classify a trade from the RPC endpoint it will actually talk to, NOT from a
- * free-text "network" label and NOT from a substring. The URL is PARSED and only an exact known
- * devnet/testnet hostname is devnet. Everything else (including an empty or malformed URL) is mainnet.
- */
-export function rpcNetwork(url, explicit) {
-    if (explicit === 'devnet' || explicit === 'mainnet')
-        return explicit;
-    if (typeof url !== 'string' || url.length === 0)
-        return 'mainnet';
-    let host;
-    try {
-        const u = new URL(url);
-        if (u.protocol !== 'https:' && u.protocol !== 'http:' && u.protocol !== 'wss:' && u.protocol !== 'ws:')
-            return 'mainnet';
-        host = u.hostname.toLowerCase();
-    }
-    catch {
-        return 'mainnet';
-    }
-    return DEVNET_HOSTS.has(host) ? 'devnet' : 'mainnet';
-}
-/**
- * Only these JSON-RPC methods are reachable; `simulateTransaction` is the gate before any submit.
- * task-1337 adds the two READ methods the token-balance diff needs (the wallet's token accounts before
- * the trade, and address-lookup-table contents); still nothing that moves funds besides `sendTransaction`.
- */
-const ALLOWED = new Set(['simulateTransaction', 'sendTransaction', 'getLatestBlockhash', 'getSignatureStatuses', 'getBalance', 'getMultipleAccounts', 'getTokenAccountsByOwner', 'requestAirdrop']);
-/** The node's `[base64, 'base64']` (or a bare base64 string) account data → bytes; null when absent/odd. */
-export function decodeAccountData(data) {
-    const s = Array.isArray(data) ? data[0] : data;
-    if (typeof s !== 'string')
-        return null;
-    if (Array.isArray(data) && data[1] !== undefined && data[1] !== 'base64')
-        return null;
-    return Buffer.from(s, 'base64');
-}
-/**
- * The node ANSWERED with a JSON-RPC error. For `sendTransaction` this is a DEFINITE pre-broadcast
- * rejection (preflight failure, bad blockhash, malformed tx): nothing reached the network, so the
- * executor may refund the daily reservation. Any other failure (timeout, reset, 5xx) is a transport
- * error whose outcome is UNKNOWN and must not be refunded (round 2, re-verify MEDIUM #4).
- */
-export class RpcRejectedError extends Error {
-    method;
-    code;
-    data;
-    constructor(method, message, code, data) {
-        super(`rpc ${method}: ${message}`);
-        this.name = 'RpcRejectedError';
-        this.method = method;
-        this.code = code;
-        this.data = data;
-    }
-}
-export class TradeRpc {
-    http;
-    url;
-    /** The classified network of `url` (or the explicit config). The executor caps by THIS. */
-    network;
-    meta = { source: 'solana-rpc', bucket: 'solana-rpc' };
-    clock;
-    constructor(http, opts = {}) {
-        this.http = http;
-        this.url = opts.url ?? DEVNET_RPC;
-        this.network = rpcNetwork(this.url, opts.network ?? null);
-        this.clock = opts.clock ?? systemClock;
-    }
-    async call(method, params) {
-        if (!ALLOWED.has(method))
-            throw new Error(`refusing RPC method ${method}`);
-        const r = await this.http.postJson(this.url, { jsonrpc: '2.0', id: 1, method, params }, this.meta);
-        if (r.data.error)
-            throw new RpcRejectedError(method, r.data.error.message ?? 'error', typeof r.data.error.code === 'number' ? r.data.error.code : null, r.data.error.data);
-        if (r.data.result === undefined)
-            throw new Error(`rpc ${method}: no result`);
-        return r.data.result;
-    }
-    /**
-     * Simulate a (possibly unsigned) base64 transaction with `replaceRecentBlockhash` + `sigVerify:false`
-     * so the plan can be checked before the user signs. A non-null `err` means the trade must be refused.
-     * `opts.accounts` asks the node for the POST-simulation state of those addresses (their lamports are
-     * what the executor compares against the pre-balance to learn how much SOL the tx really moves).
-     */
-    async simulate(txBase64, opts = {}) {
-        const cfg = { encoding: 'base64', replaceRecentBlockhash: true, sigVerify: false, commitment: 'confirmed' };
-        const want = opts.accounts ?? [];
-        if (want.length > 0)
-            cfg.accounts = { encoding: 'base64', addresses: want };
-        const res = await this.call('simulateTransaction', [txBase64, cfg]);
-        const v = res.value;
-        let accounts = null;
-        let accountsData = null;
-        if (want.length > 0) {
-            accounts = want.map((_, i) => {
-                const a = v.accounts?.[i];
-                return a && typeof a.lamports === 'number' && Number.isFinite(a.lamports) ? BigInt(Math.trunc(a.lamports)) : null;
-            });
-            if (Array.isArray(v.accounts))
-                accountsData = want.map((_, i) => decodeAccountData(v.accounts?.[i]?.data));
-        }
-        return { ok: v.err === null || v.err === undefined, err: v.err ?? null, logs: v.logs ?? null, unitsConsumed: typeof v.unitsConsumed === 'number' ? v.unitsConsumed : null, accounts, accountsData };
-    }
-    /**
-     * task-1363: devnet faucet (`requestAirdrop`) for the capped fast wallet — refused by classification on any
-     * non-devnet endpoint (mainnet nodes reject it anyway). Returns the airdrop signature.
-     */
-    async airdrop(pubkey, lamports) {
-        if (this.network !== 'devnet')
-            throw new Error('requestAirdrop runs only against a devnet RPC endpoint');
-        if (!(lamports > 0n))
-            throw new Error('airdrop needs a positive lamport amount');
-        return this.call('requestAirdrop', [pubkey, Number(lamports)]);
-    }
-    /** Lamport balance of an account (read-only `getBalance`). Used for the pre-simulation balance. */
-    async balance(pubkey) {
-        const res = await this.call('getBalance', [pubkey, { commitment: 'confirmed' }]);
-        if (typeof res.value !== 'number' || !Number.isFinite(res.value))
-            throw new Error('rpc getBalance: bad value');
-        return BigInt(Math.trunc(res.value));
-    }
-    /**
-     * task-1337: read-only snapshots of several accounts (`getMultipleAccounts`, base64). null per entry
-     * when the account does not exist. Used for the token-account PRE-balances the simulation diff
-     * compares against, and to read address-lookup tables so every account a v0 transaction can touch is
-     * known. Throws on a malformed answer (the executor fails closed).
-     */
-    async accountsInfo(pubkeys) {
-        if (pubkeys.length === 0)
-            return [];
-        const out = [];
-        for (let i = 0; i < pubkeys.length; i += 100) { // the node caps one call at 100 accounts
-            const chunk = pubkeys.slice(i, i + 100);
-            const res = await this.call('getMultipleAccounts', [chunk, { encoding: 'base64', commitment: 'confirmed' }]);
-            if (!Array.isArray(res.value) || res.value.length !== chunk.length)
-                throw new Error('rpc getMultipleAccounts: bad value');
-            for (const a of res.value) {
-                if (a === null) {
-                    out.push(null);
-                    continue;
-                }
-                const data = decodeAccountData(a.data);
-                if (typeof a.lamports !== 'number' || typeof a.owner !== 'string' || data === null)
-                    throw new Error('rpc getMultipleAccounts: malformed account');
-                out.push({ lamports: BigInt(Math.trunc(a.lamports)), owner: a.owner, data });
-            }
-        }
-        return out;
-    }
-    /**
-     * task-1337: every token account `owner` holds under `programId` (`getTokenAccountsByOwner`, base64).
-     * These are the accounts a hostile route could drain; the executor watches their balances through the
-     * simulation. Throws on a malformed answer (fail closed).
-     */
-    async tokenAccountsByOwner(owner, programId) {
-        const res = await this.call('getTokenAccountsByOwner', [owner, { programId }, { encoding: 'base64', commitment: 'confirmed' }]);
-        if (!Array.isArray(res.value))
-            throw new Error('rpc getTokenAccountsByOwner: bad value');
-        return res.value.map((e) => {
-            const data = decodeAccountData(e.account?.data);
-            if (typeof e.pubkey !== 'string' || data === null)
-                throw new Error('rpc getTokenAccountsByOwner: malformed entry');
-            return { pubkey: e.pubkey, data };
-        });
-    }
-    /** A recent blockhash for a transaction dexterm builds itself (the devnet probe). Read-only. */
-    async latestBlockhash() {
-        const res = await this.call('getLatestBlockhash', [{ commitment: 'confirmed' }]);
-        const v = res.value;
-        if (!v || typeof v.blockhash !== 'string' || !/^[1-9A-HJ-NP-Za-km-z]{32,44}$/.test(v.blockhash))
-            throw new Error('rpc getLatestBlockhash: bad value');
-        return { blockhash: v.blockhash, lastValidBlockHeight: typeof v.lastValidBlockHeight === 'number' ? v.lastValidBlockHeight : 0 };
-    }
-    /** Broadcast an already-signed base64 transaction. Returns the signature. */
-    async submit(signedTxBase64) {
-        return this.call('sendTransaction', [signedTxBase64, { encoding: 'base64', skipPreflight: false, maxRetries: 3, preflightCommitment: 'confirmed' }]);
-    }
-    /**
-     * One status lookup for a signature we already know (from the signed bytes). Returns null when the
-     * node has not seen it. Used after a transport error on submit to learn whether the send landed.
-     */
-    async signatureStatus(signature) {
-        const res = await this.call('getSignatureStatuses', [[signature], { searchTransactionHistory: true }]);
-        const st = res.value?.[0];
-        if (!st)
-            return null;
-        return { confirmationStatus: st.confirmationStatus ?? null, err: st.err ?? null, slot: st.slot ?? null };
-    }
-    /** Poll signature status until confirmed/finalized, a chain error, or the bound elapses. */
-    async confirm(signature, opts = {}) {
-        const deadline = this.clock.now() + (opts.timeoutMs ?? 60_000);
-        const interval = opts.intervalMs ?? 2_000;
-        for (;;) {
-            const res = await this.call('getSignatureStatuses', [[signature], { searchTransactionHistory: false }]);
-            const st = res.value[0];
-            if (st) {
-                if (st.err)
-                    return { signature, confirmed: false, err: st.err, slot: st.slot ?? null };
-                if (st.confirmationStatus === 'confirmed' || st.confirmationStatus === 'finalized') {
-                    return { signature, confirmed: true, err: null, slot: st.slot ?? null };
-                }
-            }
-            if (this.clock.now() >= deadline)
-                return { signature, confirmed: false, err: 'confirmation timed out', slot: null };
-            await this.clock.sleep(interval);
-        }
-    }
-}

package/dist/packages/data/src/trade/signer/client.js

@@ -1,197 +0,0 @@
-// dexterm T2 — the signer CLIENT (task-1328): the UI's only handle on the signer process. It spawns the
-// signer as a child with piped stdio, hands it the session secret as the first stdin line, and sends
-// authenticated requests with per-call timeouts. Every failure is a REFUSAL (fail closed): a dead or
-// silent signer never becomes a "maybe it signed". The client never respawns a signer that died — LIVE
-// trading stays off for the rest of the run, and the user restarts dexterm.
-//
-// The client forwards exactly the argv the user started dexterm with (caps flags, --mainnet, --rpc).
-// It cannot change caps afterwards: there is no such message.
-import { spawn } from 'node:child_process';
-import { createInterface } from 'node:readline';
-import { fileURLToPath } from 'node:url';
-import { decodeFrame, encodeFrame, encodeHello, isEvent, isResponse, newSecret } from "./protocol.js";
-export class SignerUnavailableError extends Error {
-    /** The signer's refusal/error reason when it sent one (`rate-limited`, `build-failed`, a CapRefusal, …). */
-    reason;
-    /** task-1368: for `rate-limited`, how long to wait before asking the signer again. */
-    retryAfterMs;
-    constructor(message, detail = {}) {
-        super(message);
-        this.name = 'SignerUnavailableError';
-        this.reason = detail.reason ?? null;
-        this.retryAfterMs = typeof detail.retryAfterMs === 'number' && Number.isFinite(detail.retryAfterMs) ? detail.retryAfterMs : null;
-    }
-}
-export const DEFAULT_TIMEOUTS = { status: 8_000, plan: 60_000, probe: 30_000, precheck: 8_000, confirm: 240_000, drop: 8_000, panic: 8_000, fast: 12_000, fill: 30_000, quote: 20_000 };
-export function defaultSignerEntry() {
-    return fileURLToPath(new URL('./main.js', import.meta.url));
-}
-export class SignerClient {
-    child = null;
-    secret = newSecret();
-    outSeq = 0;
-    inSeq = 0;
-    nextId = 1;
-    pending = new Map();
-    ready = null;
-    dead = null;
-    opts;
-    argv;
-    pid = null;
-    constructor(opts = {}) {
-        this.opts = opts;
-        this.argv = [...(opts.argv ?? [])];
-    }
-    /**
-     * Available for LIVE work: not dead. A client that has not started yet IS alive — the signer is
-     * spawned lazily on the first request. task-1337: the old `child !== null && …` made every real run
-     * refuse `L` with "the signer process died" before the signer had ever been started (the ticket
-     * checks `alive` before its first call); only the fake signer in the tests, alive from construction,
-     * ever reached LIVE. `dead` is the fail-closed marker: set once on exit/error/timeout/close, never reset.
-     */
-    get alive() { return this.dead === null; }
-    /** Spawn + handshake (idempotent). Rejects when the signer cannot start; never retries. */
-    start() {
-        if (this.dead)
-            return Promise.reject(new SignerUnavailableError(this.dead));
-        if (this.ready)
-            return this.ready;
-        this.ready = new Promise((resolve, reject) => {
-            const entry = this.opts.entry ?? defaultSignerEntry();
-            let child;
-            try {
-                child = spawn(process.execPath, [entry, ...this.argv], { stdio: ['pipe', 'pipe', 'pipe'], env: this.opts.env ?? process.env });
-            }
-            catch (e) {
-                this.dead = `spawn failed: ${e instanceof Error ? e.message : String(e)}`;
-                reject(new SignerUnavailableError(this.dead));
-                return;
-            }
-            this.child = child;
-            this.pid = child.pid ?? null;
-            let settled = false;
-            const readyTimer = setTimeout(() => { if (!settled) {
-                settled = true;
-                this.kill('signer did not become ready');
-                reject(new SignerUnavailableError('signer did not become ready'));
-            } }, this.opts.readyTimeoutMs ?? 15_000);
-            readyTimer.unref?.();
-            child.on('error', (e) => { this.markDead(`signer error: ${e.message}`); if (!settled) {
-                settled = true;
-                clearTimeout(readyTimer);
-                reject(new SignerUnavailableError(this.dead ?? 'signer error'));
-            } });
-            child.on('exit', (code, signal) => { this.markDead(`signer exited (${code ?? signal ?? '?'})`); if (!settled) {
-                settled = true;
-                clearTimeout(readyTimer);
-                reject(new SignerUnavailableError(this.dead ?? 'signer exited'));
-            } });
-            if (child.stderr)
-                createInterface({ input: child.stderr }).on('line', (l) => this.opts.log?.(l));
-            if (child.stdout) {
-                createInterface({ input: child.stdout, crlfDelay: Infinity }).on('line', (line) => {
-                    const d = decodeFrame(this.secret, line, this.inSeq);
-                    if (!d.ok) {
-                        this.opts.log?.(`signer client: dropped frame (${d.why})`);
-                        return;
-                    }
-                    this.inSeq = d.seq + 1;
-                    this.onMessage(d.message, () => { if (!settled) {
-                        settled = true;
-                        clearTimeout(readyTimer);
-                        resolve();
-                    } });
-                });
-            }
-            child.stdin?.on('error', () => { });
-            child.stdin?.write(encodeHello(this.secret));
-        });
-        return this.ready;
-    }
-    onMessage(m, onReady) {
-        if (isEvent(m)) {
-            if (m.event === 'ready')
-                onReady();
-            return;
-        }
-        if (!isResponse(m))
-            return;
-        const p = this.pending.get(m.id);
-        if (!p)
-            return;
-        this.pending.delete(m.id);
-        clearTimeout(p.timer);
-        if (m.ok)
-            p.resolve(m.result);
-        else
-            p.reject(new SignerUnavailableError(m.error, { reason: m.reason, retryAfterMs: m.retryAfterMs }));
-    }
-    markDead(why) {
-        if (this.dead)
-            return;
-        this.dead = why;
-        for (const [id, p] of this.pending) {
-            clearTimeout(p.timer);
-            this.pending.delete(id);
-            p.reject(new SignerUnavailableError(why));
-        }
-    }
-    kill(why) {
-        this.markDead(why);
-        try {
-            this.child?.kill('SIGTERM');
-        }
-        catch { /* ignore */ }
-    }
-    async request(method, params, timeoutMs = DEFAULT_TIMEOUTS[method] ?? 8_000) {
-        if (this.dead)
-            throw new SignerUnavailableError(this.dead);
-        await this.start();
-        if (this.dead || !this.child?.stdin)
-            throw new SignerUnavailableError(this.dead ?? 'signer has no stdin');
-        const id = this.nextId++;
-        return new Promise((resolve, reject) => {
-            const timer = setTimeout(() => { this.pending.delete(id); reject(new SignerUnavailableError(`signer ${method} timed out after ${Math.round(timeoutMs / 1000)} s`)); }, timeoutMs);
-            timer.unref?.();
-            this.pending.set(id, { resolve: resolve, reject, timer });
-            try {
-                this.child.stdin.write(encodeFrame(this.secret, this.outSeq++, { id, method, params }));
-            }
-            catch (e) {
-                this.pending.delete(id);
-                clearTimeout(timer);
-                reject(new SignerUnavailableError(`write failed: ${e instanceof Error ? e.message : String(e)}`));
-            }
-        });
-    }
-    status() { return this.request('status', {}); }
-    plan(params) { return this.request('plan', { ...params }); }
-    probe() { return this.request('probe', {}); }
-    precheck(hash) { return this.request('precheck', { hash }); }
-    confirm(hash) { return this.request('confirm', { hash }); }
-    async drop(hash) { await this.request('drop', { hash }); }
-    async panic(reason) { await this.request('panic', { reason }); }
-    fast() { return this.request('fast', {}); }
-    fill(params) { return this.request('fill', { ...params }); }
-    quote(params) { return this.request('quote', { ...params }); }
-    close() {
-        this.markDead('closed');
-        try {
-            this.child?.stdin?.end();
-        }
-        catch { /* ignore */ }
-        const c = this.child;
-        if (c) {
-            const t = setTimeout(() => { try {
-                c.kill('SIGKILL');
-            }
-            catch { /* ignore */ } }, 2_000);
-            t.unref?.();
-            c.on('exit', () => clearTimeout(t));
-            try {
-                c.kill('SIGTERM');
-            }
-            catch { /* ignore */ }
-        }
-    }
-}