dexterm-cli 0.1.6 → 0.2.0

package/dist/packages/tui/src/widgets.js

@@ -7,6 +7,7 @@ import { Canvas } from "./canvas.js";
 import { mix, luminance } from "./color.js";
 import { fmtUsd, fmtPct, fmtNum, fmtPrice, fmtPriceBare, fmtCompactUsd, compactDecimalsFor, fmtAgeSec, shortAddr, clamp } from "./fmt.js";
 import { launchpadColor } from "./theme.js";
+import { chartMarkers, markerGlyph, markerLetter, markerLabel, markerLegend, markerRow, omittedNote, MARKER_PERIOD_MS } from "./markers.js";
 export const BLOCKS = '▁▂▃▄▅▆▇█';
 // braille dot bits: column 0 rows 0..3, column 1 rows 0..3 (row 0 = top)
 const BR_L = [0x01, 0x02, 0x04, 0x40];
@@ -131,7 +132,7 @@ export function candleChart(c, x, y, w, h, candles, opts = {}) {
     const plotW = w - axisW;
     const plotH = h - volH - timeH;
     if (plotW < 10 || plotH < 4 || candles.length === 0)
-        return;
+        return null;
     const CW = 4; // 3-col body with centered wick + 1-col gap
     const n = Math.min(candles.length, Math.floor(plotW / CW));
     const data = candles.slice(-n);
@@ -144,6 +145,24 @@ export function candleChart(c, x, y, w, h, candles, opts = {}) {
         hi = Math.max(hi, k.h);
         vmax = Math.max(vmax, k.v);
     }
+    // task-1483: the trade marks for the bars on screen. Their prices (and the avg entry) widen the range when they sit
+    // within 3× of the last close, like the popup's levels; a farther price is left off the plot rather than squashing it.
+    const tm = opts.trades && (opts.trades.fills.length || opts.trades.avgEntry) ? opts.trades : null;
+    const period = MARKER_PERIOD_MS[String(opts.interval || '1h')] ?? 3600e3;
+    const set = tm ? chartMarkers(tm.fills, { periodMs: period, barTimes: data.map((k) => k.t) }) : null;
+    const lastC = data[data.length - 1].c;
+    const near = (p) => typeof p === 'number' && Number.isFinite(p) && p > 0 && lastC > 0 && p / lastC < 3 && lastC / p < 3;
+    if (set)
+        for (const m of set.markers)
+            if (near(m.priceUsd)) {
+                lo = Math.min(lo, m.priceUsd);
+                hi = Math.max(hi, m.priceUsd);
+            }
+    const avgUsd = tm?.avgEntry && near(tm.avgEntry.usd) ? tm.avgEntry.usd : null;
+    if (avgUsd !== null) {
+        lo = Math.min(lo, avgUsd);
+        hi = Math.max(hi, avgUsd);
+    }
     const pad = (hi - lo) * 0.06 || hi * 0.01;
     lo -= pad;
     hi += pad;
@@ -162,6 +181,30 @@ export function candleChart(c, x, y, w, h, candles, opts = {}) {
             c.put(x + k, y + row, '·', gridStyle);
         c.textR(x + plotW, y + row, axisW, ' ' + fmtAxis(price), labelStyle);
     }
+    // task-1483: closed round trips, entry bar → exit bar, as a faint wash behind the candles (green = sold above the entry)
+    if (set && tm?.band !== false) {
+        for (const r of set.trips) {
+            const a = Math.max(0, data.findIndex((k) => k.t + period > r.openT));
+            let b = n - 1;
+            for (let i = n - 1; i >= 0; i--)
+                if (data[i].t <= r.closeT) {
+                    b = i;
+                    break;
+                }
+            const win = r.entryUsd !== null && r.exitUsd !== null ? r.exitUsd >= r.entryUsd : null;
+            const tint = mix(bg, win === null ? t.muted : win ? t.up : t.down, 0.07);
+            for (let i = a; i <= b; i++)
+                for (let q = 0; q < CW; q++)
+                    for (let row = 0; row < plotH; row++) {
+                        const cx = x + i * CW + q;
+                        if (cx >= x + plotW)
+                            continue;
+                        const gi = c.idx(cx, y + row);
+                        if (!c.hard[gi])
+                            c.bg[gi] = tint;
+                    }
+        }
+    }
     // last price line + tag
     const last = data[data.length - 1];
     const lastRow = Math.round(rowsOf(last.c));
@@ -229,6 +272,7 @@ export function candleChart(c, x, y, w, h, candles, opts = {}) {
             }
         }
     }
+    const info = set ? drawTradeMarks(c, { x, y, plotW, plotH, n, CW, bg, lo, hi, axisW, fmtAxis, lastRow: lastRow >= 0 && lastRow < plotH ? lastRow : null, data, set, avgUsd, avgSource: tm?.avgEntry?.source ?? 'paper', scale: s }) : null;
     if (volH) {
         const vy = y + plotH;
         for (let i = 0; i < n; i++) {
@@ -260,6 +304,108 @@ export function candleChart(c, x, y, w, h, candles, opts = {}) {
         c.text(cx, ty, lab, labelStyle);
     }
     c.textR(x + plotW, ty, axisW, (opts.interval || '1h') + ' UTC', { fg: t.dim, bg });
+    return info;
+}
+const freeCell = (c, cx, cy) => { const ch = c.ch[c.idx(cx, cy)]; return ch === ' ' || ch === '·' || ch === '┄'; };
+/**
+ * task-1483: the avg-entry line, the B / S markers and their legend, on top of the drawn candles. Glyph + letter on
+ * every marker (△B ▽S paper, ▲B ▼S live), so NO_COLOR and calm read the same; colour only adds to it.
+ */
+function drawTradeMarks(c, g) {
+    const t = c.theme;
+    const { x, y, plotW, plotH, CW, bg } = g;
+    const rowsOf = (p) => ((g.hi - p) / (g.hi - g.lo)) * plotH;
+    // the open position's average entry: a dashed line through the empty cells (candles stay on top) + an axis tag
+    let avgRow = null;
+    let avgShown = false;
+    if (g.avgUsd !== null) {
+        avgRow = markerRow(g.avgUsd, g.lo, g.hi, plotH);
+        if (avgRow !== null) {
+            const col = g.avgSource === 'paper' ? t.warn : t.text;
+            for (let k = 0; k < plotW; k++)
+                if (freeCell(c, x + k, y + avgRow)) {
+                    c.put(x + k, y + avgRow, '┄', { fg: mix(bg, col, 0.8), bg, soft: true });
+                    avgShown = true;
+                }
+            // `avg` at the line's left end so it reads without colour (also over the last-price dashes when both share a row),
+            // and the value as an axis tag
+            const labelOk = (cx) => freeCell(c, cx, y + avgRow) || c.ch[c.idx(cx, y + avgRow)] === '╌';
+            if (labelOk(x) && labelOk(x + 1) && labelOk(x + 2)) {
+                c.text(x, y + avgRow, 'avg', { fg: col, bg, b: true, hard: true });
+                avgShown = true;
+            }
+            if (avgRow !== g.lastRow) {
+                c.fill(x + plotW, y + avgRow, g.axisW, 1, ' ', { bg }); // the grid label under it goes, not half of it
+                c.textR(x + plotW, y + avgRow, g.axisW, ' ' + g.fmtAxis(g.avgUsd), { fg: '#000000', bg: col, b: true });
+                avgShown = true;
+            }
+        }
+    }
+    const used = new Set();
+    const drawn = [];
+    let offPlot = 0;
+    for (const m of g.set.markers) {
+        const k = g.data[m.index];
+        const col0 = x + m.index * CW;
+        const buy = m.side === 'buy';
+        // the fill's own price; no price → against the bar (below the low for a buy, above the high for a sell)
+        let row = m.priceUsd !== null ? markerRow(m.priceUsd, g.lo, g.hi, plotH) : Math.floor(rowsOf(buy ? k.l : k.h)) + (buy ? 1 : -1);
+        if (row === null || row < 0 || row >= plotH) {
+            offPlot++;
+            continue;
+        }
+        // two marks in one bar on the same row (buy + sell, or paper + live): step away from the bar, never across it
+        while (row >= 0 && row < plotH && (used.has((row << 12) | m.index)))
+            row += buy ? 1 : -1;
+        if (row < 0 || row >= plotH) {
+            offPlot++;
+            continue;
+        }
+        used.add((row << 12) | m.index);
+        const sideCol = buy ? t.up : t.down;
+        const st = m.source === 'live' ? { fg: '#000000', bg: sideCol, b: true, hard: true } : { fg: sideCol, bg: mix(bg, sideCol, 0.2), b: true, hard: true };
+        c.put(col0 + 1, y + row, markerGlyph(m.side, m.source), st);
+        c.put(col0 + 2, y + row, markerLetter(m.side), st);
+        if (m.count > 1 && col0 + 3 < x + plotW)
+            c.put(col0 + 3, y + row, m.count > 9 ? '+' : String(m.count), st);
+        drawn.push({ marker: m, col: col0 + 1, row });
+    }
+    // the newest marker gets a compact label (B 41k) where the row has room, right of it first, else left
+    const newest = drawn[drawn.length - 1];
+    if (newest) {
+        const label = markerLabel(newest.marker, g.fmtAxis, 1);
+        const fits = (sx) => sx >= x && sx + label.length <= x + plotW && [...label].every((_, i) => freeCell(c, sx + i, y + newest.row));
+        const right = newest.col + 3 + (newest.marker.count > 1 ? 1 : 0);
+        const sx = fits(right) ? right : fits(newest.col - 2 - label.length) ? newest.col - 2 - label.length : null;
+        if (sx !== null)
+            c.text(sx, y + newest.row, label, { fg: newest.marker.side === 'buy' ? t.up : t.down, bg, hard: true });
+    }
+    // legend + what was left off, on the top plot row where it is empty (else the bottom row), never over a candle
+    const note = [markerLegend(drawn.map((d) => d.marker), avgShown), omittedNote(g.set)].filter(Boolean).join(' · ');
+    if (note) {
+        const text = note.length > plotW - 2 ? note.slice(0, Math.max(0, plotW - 3)) + '…' : note;
+        // the outermost rows first (top, bottom, then inwards); in a row, the leftmost run of empty cells long enough
+        const rows = [];
+        for (let i = 0; i < Math.ceil(plotH / 2); i++) {
+            rows.push(i);
+            if (plotH - 1 - i !== i)
+                rows.push(plotH - 1 - i);
+        }
+        const len = [...text].length;
+        place: for (const row of rows) {
+            if (row === avgRow || row === g.lastRow || drawn.some((d) => d.row === row))
+                continue;
+            let run = 0;
+            for (let cx = x + 1; cx < x + plotW; cx++) {
+                run = freeCell(c, cx, y + row) ? run + 1 : 0;
+                if (run === len) {
+                    c.text(cx - len + 1, y + row, text, { fg: t.dim, bg, i: true });
+                    break place;
+                }
+            }
+        }
+    }
+    return { set: g.set, drawn, offPlot, avgRow };
 }
 /** Horizontal progress bar: gradient fill, hot head cell, one-cell ▓ glow past the head, ░ empty. pct 0..100 */
 export function bar(c, x, y, w, pct, opts = {}) {
@@ -483,7 +629,8 @@ export function tradeTape(c, x, y, w, h, trades, now, opts = {}) {
             continue;
         }
         cx = c.textR(cx + 1, yy, 8, fmtUsd(tr.usd), { fg: t.text, bg });
-        cx = c.text(cx + 2, yy, tr.price > 0 ? fmtPrice(tr.price) : '—', { fg: t.muted, bg }, Math.max(0, x + w - cx - 2));
+        // task-1537: the caller's price basis (a market cap at the coin's supply by default); plain price without one
+        cx = c.text(cx + 2, yy, tr.price > 0 ? (opts.priceFmt ?? fmtPrice)(tr.price) : '—', { fg: t.muted, bg }, Math.max(0, x + w - cx - 2));
         c.text(cx + 2, yy, shortAddr(tr.wallet, 3), { fg: t.dim, bg }, Math.max(0, x + w - cx - 2));
         n += 1;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dexterm-cli",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "mcpName": "io.github.dexterm-xyz/dexterm",
   "description": "dexterm: terminal DEX screener with a local Claude CLI analyst",
   "author": "The dexterm authors",
@@ -25,6 +25,7 @@
   },
   "devDependencies": {
     "@dexterm/agents": "0.0.1",
+    "@dexterm/autotrade": "0.0.1",
     "@dexterm/custom": "0.0.1",
     "@dexterm/data": "0.0.1",
     "@dexterm/mcp": "0.0.1",

package/dist/packages/data/src/trade/caps.js

@@ -1,323 +0,0 @@
-// dexterm T1 — signer-side trade caps (SPEC §6.0 invariant 3, §6.2 CL-04). The policy the UI, the
-// model, the voice router and a compromised popup CANNOT bypass: every real trade is re-checked here
-// against hard limits before anything is signed or submitted, and refused out of policy.
-//
-// Hard rules (task-1310 scope §3):
-//   * DEVNET is the default. MAINNET requires `mainnetEnabled` (the `--mainnet` flag) AND a known USD
-//     notional AND it must pass a per-trade USD cap (default $5) and a daily USD cap (default $20).
-//   * A plan whose simulation failed, whose price impact exceeds 3%, or whose signed/submitted intent
-//     differs from the shown plan (plan-hash mismatch) is refused.
-//   * Round 2 (SPEC §6.2): the decoded transaction must pass the program allow-list / forbidden-
-//     instruction scan, the simulated SOL OUT of the wallet must not exceed the plan (+ a fee
-//     allowance) nor the absolute SOL-out cap, slippage has a ceiling, and a mainnet notional must be
-//     strictly positive and known.
-//   * Caps live here, not in the UI. This module holds no keys and performs no I/O beyond the daily
-//     ledger; it only decides ALLOW / REFUSE.
-//
-// This file imports no wallet, signing or crypto-key library. `node:crypto` is used only for a SHA-256
-// plan hash (binding), never for key material.
-import { createHash } from 'node:crypto';
-import { DatabaseSync } from 'node:sqlite';
-import { mkdirSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { homedir } from 'node:os';
-import { systemClock } from "../clock.js";
-export const DEFAULT_PER_TRADE_USD = 5;
-export const DEFAULT_DAILY_USD = 20;
-export const MAX_PRICE_IMPACT_PCT = 3;
-/** Absolute SOL that may leave the wallet in one transaction (any network). */
-export const DEFAULT_MAX_SOL_OUT = 1;
-export const HARD_MAX_SOL_OUT = 5;
-/** Slippage ceiling (SPEC §6.2 "slippage exceeds the configured maximum"). */
-export const DEFAULT_MAX_SLIPPAGE_BPS = 500;
-export const HARD_MAX_SLIPPAGE_BPS = 1000;
-/**
- * How much MORE SOL than the planned SOL leg a transaction may consume: network fee + priority fee +
- * up to two ATA rents (2 × 0.00203928 SOL). A buy of 0.5 SOL may simulate as 0.5 + fees; 0.51 may not.
- */
-export const SOL_OVERHEAD_ALLOWANCE_LAMPORTS = 10000000n; // 0.01 SOL
-// DEFECT 6: hard ceilings the caps can NEVER exceed, however they are configured. `--max-usd 1000000`
-// or `--daily-usd 1e12` must not be accepted as-is. defaultCaps() clamps any override down to these,
-// the CLI flag parser rejects an over-ceiling value outright, and (round 2) checkCaps clamps AGAIN at
-// the decision point so a caps object literal or a mutated object cannot raise them either.
-export const HARD_MAX_PER_TRADE_USD = 500;
-export const HARD_MAX_DAILY_USD = 2000;
-function clampCap(v, dflt, hardMax) {
-    const n = typeof v === 'number' ? v : Number(v);
-    if (!(n > 0) || !Number.isFinite(n))
-        return dflt;
-    return Math.min(n, hardMax);
-}
-/**
- * Safe defaults: devnet, mainnet disabled, tiny caps. Override only from explicit flags. The result is
- * FROZEN (round 2): mutating a caps object after construction throws instead of raising a cap.
- */
-export function defaultCaps(over = {}) {
-    const caps = {
-        network: over.network === 'mainnet' ? 'mainnet' : 'devnet',
-        mainnetEnabled: over.mainnetEnabled === true,
-        // Defensive clamps: a caller can only make caps SMALLER than the defaults by override, never silently
-        // larger through a bad value. Non-finite / negative values fall back to the safe default; an
-        // over-ceiling value is clamped DOWN to the hard ceiling (DEFECT 6).
-        perTradeUsd: clampCap(over.perTradeUsd, DEFAULT_PER_TRADE_USD, HARD_MAX_PER_TRADE_USD),
-        dailyUsd: clampCap(over.dailyUsd, DEFAULT_DAILY_USD, HARD_MAX_DAILY_USD),
-        maxPriceImpactPct: clampCap(over.maxPriceImpactPct, MAX_PRICE_IMPACT_PCT, MAX_PRICE_IMPACT_PCT),
-        maxSolOut: clampCap(over.maxSolOut, DEFAULT_MAX_SOL_OUT, HARD_MAX_SOL_OUT),
-        maxSlippageBps: clampCap(over.maxSlippageBps, DEFAULT_MAX_SLIPPAGE_BPS, HARD_MAX_SLIPPAGE_BPS),
-    };
-    // mainnet is only ever on when explicitly enabled AND the network is mainnet.
-    if (caps.network === 'mainnet' && !caps.mainnetEnabled)
-        caps.network = 'devnet';
-    return Object.freeze(caps);
-}
-/**
- * task-1328: without `--mainnet` the USD caps are configurable only DOWNWARD — a value above the
- * defaults ($5 / $20) is clamped back to the default. Raising them needs the explicit mainnet flag
- * (and the hard ceilings still apply). The signer applies this to the caps it was started with.
- */
-export function capsOnlyDownward(caps) {
-    if (caps.mainnetEnabled)
-        return caps;
-    return defaultCaps({
-        ...caps,
-        perTradeUsd: Math.min(caps.perTradeUsd, DEFAULT_PER_TRADE_USD),
-        dailyUsd: Math.min(caps.dailyUsd, DEFAULT_DAILY_USD),
-        // task-1337 (verify-1328 minor): the SOL-out and slippage ceilings are downward-only too without
-        // --mainnet; `--max-slippage-bps 900` used to be honoured on a devnet-labelled signer.
-        maxSolOut: Math.min(caps.maxSolOut, DEFAULT_MAX_SOL_OUT),
-        maxSlippageBps: Math.min(caps.maxSlippageBps, DEFAULT_MAX_SLIPPAGE_BPS),
-    });
-}
-/**
- * The caps as the decision point actually applies them: every numeric cap clamped to its hard ceiling
- * (or its default when missing/invalid), whatever object the caller handed in. A `TradeCaps` literal
- * `{perTradeUsd: 1e9}` is therefore worth exactly HARD_MAX_PER_TRADE_USD here (re-verify MEDIUM #6).
- */
-export function effectiveCaps(caps) {
-    const c = caps ?? {};
-    return defaultCaps({
-        network: c.network, mainnetEnabled: c.mainnetEnabled,
-        perTradeUsd: c.perTradeUsd, dailyUsd: c.dailyUsd, maxPriceImpactPct: c.maxPriceImpactPct,
-        maxSolOut: c.maxSolOut, maxSlippageBps: c.maxSlippageBps,
-    });
-}
-const ok = { ok: true };
-function refuse(reason, message) {
-    return { ok: false, reason, message };
-}
-function lamportsToSolText(l) { return (Number(l) / 1e9).toFixed(4); }
-export function checkCaps(plan, rawCaps, spentTodayUsd, opts = {}) {
-    const caps = effectiveCaps(rawCaps);
-    // 1. Network gate — mainnet is the dangerous one.
-    if (plan.network === 'mainnet') {
-        if (!caps.mainnetEnabled || caps.network !== 'mainnet') {
-            return refuse('mainnet-not-enabled', 'mainnet trading requires the --mainnet flag (and an explicit opt-in)');
-        }
-    }
-    else if (plan.network !== caps.network) {
-        return refuse('network-mismatch', `plan network ${plan.network} does not match configured ${caps.network}`);
-    }
-    // 2. Static transaction policy (SPEC §6.2): quote binding, program allow-list, forbidden
-    //    instructions, signer. Checked BEFORE the simulation gate because a plan that failed policy was
-    //    (deliberately) never simulated. A plan with no verdict at all is refused: only the executor's
-    //    decoder produces one, so its absence means the bytes were never inspected.
-    const pol = plan.txPolicy;
-    if (!pol || typeof pol !== 'object' || pol.ok !== true) {
-        if (pol && pol.ok === false)
-            return refuse(pol.reason, pol.message);
-        return refuse('program-not-allowed', 'the transaction was not inspected');
-    }
-    // 3. Simulation must have run and passed (no confirm on a red sim).
-    if (!plan.simulated)
-        return refuse('not-simulated', 'the transaction was not simulated');
-    if (!plan.simOk)
-        return refuse('simulation-failed', `simulation failed: ${plan.simError ?? 'unknown error'}`);
-    // 4. Price impact ceiling (any network). Unknown impact is refused on mainnet (re-verify LOW #10).
-    if (plan.priceImpactPct === null || !Number.isFinite(plan.priceImpactPct)) {
-        if (plan.network === 'mainnet')
-            return refuse('price-impact', 'the quote carried no price impact; refusing on mainnet');
-    }
-    else if (plan.priceImpactPct > caps.maxPriceImpactPct) {
-        return refuse('price-impact', `price impact ${plan.priceImpactPct.toFixed(2)}% exceeds the ${caps.maxPriceImpactPct}% ceiling`);
-    }
-    // 5. Slippage ceiling (any network).
-    if (!Number.isFinite(plan.slippageBps) || plan.slippageBps < 0 || plan.slippageBps > caps.maxSlippageBps) {
-        return refuse('slippage', `slippage ${plan.slippageBps} bps exceeds the ${caps.maxSlippageBps} bps ceiling`);
-    }
-    // 6. SOL out of the wallet, from the SIMULATED balance delta (any network): must be known, must not
-    //    exceed the planned SOL leg plus the fee allowance, and must not exceed the absolute cap.
-    if (typeof plan.solOutLamports !== 'bigint') {
-        return refuse('sol-delta-unknown', 'the simulation did not report the wallet balance change');
-    }
-    if (typeof plan.solLegLamports !== 'bigint' || plan.solLegLamports < 0n) {
-        return refuse('sol-out-cap', 'the plan carries no SOL leg');
-    }
-    if (plan.solOutLamports > plan.solLegLamports + SOL_OVERHEAD_ALLOWANCE_LAMPORTS) {
-        return refuse('sol-out-cap', `the transaction moves ${lamportsToSolText(plan.solOutLamports)} SOL out but the plan is ${lamportsToSolText(plan.solLegLamports)} SOL`);
-    }
-    const maxOutLamports = BigInt(Math.round(caps.maxSolOut * 1e9));
-    if (plan.solOutLamports > maxOutLamports) {
-        return refuse('sol-out-cap', `${lamportsToSolText(plan.solOutLamports)} SOL out exceeds the ${caps.maxSolOut} SOL per-transaction cap`);
-    }
-    // 7. USD caps — enforced on mainnet (devnet funds have no value), and on devnet when the caller asks
-    //    (task-1363 fast-wallet lane). Mainnet with no known USD value, or a zero/negative one, is refused
-    //    rather than waved through (round 2: `<= 0`, was `< 0`).
-    if (plan.network === 'mainnet' || opts.enforceUsd === true) {
-        if (plan.notionalUsd === null || !Number.isFinite(plan.notionalUsd) || plan.notionalUsd <= 0) {
-            return refuse('no-usd-value', `cannot price this trade in USD (or it prices at $0); refusing${plan.network === 'mainnet' ? ' on mainnet' : ' (USD caps are enforced on this lane)'}`);
-        }
-        if (plan.notionalUsd > caps.perTradeUsd) {
-            return refuse('per-trade-cap', `trade $${plan.notionalUsd.toFixed(2)} exceeds the per-trade cap $${caps.perTradeUsd.toFixed(2)}`);
-        }
-        const spent = Number.isFinite(spentTodayUsd) && spentTodayUsd > 0 ? spentTodayUsd : 0;
-        if (spent + plan.notionalUsd > caps.dailyUsd) {
-            return refuse('daily-cap', `trade $${plan.notionalUsd.toFixed(2)} would exceed today's remaining budget ($${Math.max(0, caps.dailyUsd - spent).toFixed(2)} of $${caps.dailyUsd.toFixed(2)})`);
-        }
-    }
-    return ok;
-}
-/**
- * A plan hash binds a confirm/signature to the exact plan the user saw (SPEC §6.5 plan-hash binding).
- * If any material field changes between display and submit, the hash changes and the confirm is void.
- * Amounts are included so an inflated size or a swapped mint invalidates the confirm.
- */
-export function planHash(plan) {
-    const canonical = [
-        plan.network, plan.mint, plan.side,
-        plan.amountInRaw.toString(), plan.amountOutRaw.toString(),
-        String(plan.slippageBps), plan.route.join('>'),
-        typeof plan.solLegLamports === 'bigint' ? plan.solLegLamports.toString() : 'none',
-        typeof plan.solOutLamports === 'bigint' ? plan.solOutLamports.toString() : 'none',
-    ].join('|');
-    return createHash('sha256').update(canonical).digest('hex');
-}
-/** True when two plans are the same trade (same hash). Used to refuse a mutated plan at submit time. */
-export function samePlan(a, b) {
-    return planHash(a) === planHash(b);
-}
-function utcDay(now) {
-    return new Date(now).toISOString().slice(0, 10); // YYYY-MM-DD (UTC)
-}
-/** Where the CLI keeps the daily-cap ledger (shared by every dexterm process on this machine). */
-export function defaultCapLedgerPath() {
-    return join(homedir(), '.dexterm', 'trade-caps.sqlite');
-}
-/**
- * Persistent daily-spend ledger for the USD daily cap. Backed by node:sqlite so the cap survives a
- * restart (a compromised UI cannot "forget" today's spend by relaunching). An in-memory DB is used
- * when no path is given (tests). Only realized mainnet USD is recorded.
- *
- * Round 2: `tryReserve` checks AND charges inside one `BEGIN IMMEDIATE` transaction, so two dexterm
- * PROCESSES sharing the file cannot both pass the daily check (re-verify MEDIUM #7); a `busy_timeout`
- * makes a concurrent open wait instead of throwing SQLITE_BUSY. `lock()` is the panic path: a locked
- * ledger reserves nothing until `unlock()`.
- */
-export class CapLedger {
-    db;
-    clock;
-    constructor(opts = {}) {
-        const path = opts.path ?? ':memory:';
-        if (path !== ':memory:')
-            mkdirSync(dirname(path), { recursive: true });
-        this.db = new DatabaseSync(path);
-        this.clock = opts.clock ?? systemClock;
-        this.db.exec(`
-      PRAGMA busy_timeout = 5000;
-      PRAGMA journal_mode = WAL;
-      CREATE TABLE IF NOT EXISTS trade_day_spend (
-        day TEXT PRIMARY KEY,
-        usd REAL NOT NULL DEFAULT 0,
-        trades INTEGER NOT NULL DEFAULT 0
-      ) WITHOUT ROWID;
-      CREATE TABLE IF NOT EXISTS trade_lock (
-        id INTEGER PRIMARY KEY CHECK (id = 1),
-        locked_at INTEGER NOT NULL,
-        reason TEXT NOT NULL
-      );
-    `);
-    }
-    /** USD already spent on mainnet today (UTC). */
-    spentToday(now = this.clock.now()) {
-        const row = this.db.prepare('SELECT usd FROM trade_day_spend WHERE day = ?').get(utcDay(now));
-        return row && Number.isFinite(row.usd) ? Number(row.usd) : 0;
-    }
-    /** Record a realized mainnet trade's USD against today's budget. Devnet trades record nothing. */
-    record(usd, now = this.clock.now()) {
-        if (!(usd > 0))
-            return;
-        const day = utcDay(now);
-        this.db.prepare(`INSERT INTO trade_day_spend (day, usd, trades) VALUES (?, ?, 1)
-                     ON CONFLICT(day) DO UPDATE SET usd = usd + excluded.usd, trades = trades + 1`).run(day, usd);
-    }
-    /**
-     * Atomically check `spent + usd <= dailyCap` and reserve `usd` for today. The SELECT and the INSERT
-     * run inside BEGIN IMMEDIATE, which takes the write lock first, so concurrent processes serialize
-     * here. Returns the reservation's DAY so a refund credits the same day even across midnight.
-     */
-    tryReserve(usd, dailyCap, now = this.clock.now()) {
-        const day = utcDay(now);
-        if (!(usd > 0))
-            return { ok: true, day, usd: 0 };
-        this.db.exec('BEGIN IMMEDIATE');
-        try {
-            if (this.lockedRow()) {
-                this.db.exec('ROLLBACK');
-                return { ok: false, reason: 'panicked', spent: this.spentToday(now) };
-            }
-            const row = this.db.prepare('SELECT usd FROM trade_day_spend WHERE day = ?').get(day);
-            const spent = row && Number.isFinite(row.usd) && Number(row.usd) > 0 ? Number(row.usd) : 0;
-            if (spent + usd > dailyCap) {
-                this.db.exec('ROLLBACK');
-                return { ok: false, reason: 'daily-cap', spent };
-            }
-            this.db.prepare(`INSERT INTO trade_day_spend (day, usd, trades) VALUES (?, ?, 1)
-                       ON CONFLICT(day) DO UPDATE SET usd = usd + excluded.usd, trades = trades + 1`).run(day, usd);
-            this.db.exec('COMMIT');
-            return { ok: true, day, usd };
-        }
-        catch (e) {
-            try {
-                this.db.exec('ROLLBACK');
-            }
-            catch { /* not in a transaction */ }
-            throw e;
-        }
-    }
-    /**
-     * Undo a reservation (DEFECT 5): the executor charges a trade's USD BEFORE it signs/submits so a
-     * burst of concurrent trades cannot each pass the daily check and collectively blow the cap. If the
-     * send definitely never left (sign failed, tx-byte mismatch, a pre-broadcast JSON-RPC rejection) the
-     * reservation is refunded here, to the DAY it was reserved on (re-verify LOW #9). A send that was
-     * broadcast, or MAY have been (transport error), is NOT refunded — the funds may have moved.
-     */
-    refund(usd, dayOrNow = this.clock.now()) {
-        if (!(usd > 0))
-            return;
-        const day = typeof dayOrNow === 'string' ? dayOrNow : utcDay(dayOrNow);
-        // Floor at 0; one trade's refund can never drive the day negative.
-        this.db.prepare(`UPDATE trade_day_spend SET usd = MAX(0, usd - ?), trades = MAX(0, trades - 1) WHERE day = ?`).run(usd, day);
-    }
-    lockedRow() {
-        const row = this.db.prepare('SELECT locked_at, reason FROM trade_lock WHERE id = 1').get();
-        return row ?? null;
-    }
-    /** The panic lock, if engaged. Re-read every call so a lock from another process is seen at once. */
-    locked() {
-        const row = this.lockedRow();
-        return row ? { lockedAt: Number(row.locked_at), reason: String(row.reason) } : null;
-    }
-    /** PANIC: refuse every reservation until unlock(). Idempotent. */
-    lock(reason = 'panic', now = this.clock.now()) {
-        this.db.prepare('INSERT OR IGNORE INTO trade_lock (id, locked_at, reason) VALUES (1, ?, ?)').run(now, reason.slice(0, 200));
-    }
-    unlock() {
-        const r = this.db.prepare('DELETE FROM trade_lock WHERE id = 1').run();
-        return Number(r.changes) > 0;
-    }
-    close() {
-        try {
-            this.db.close();
-        }
-        catch { /* already closed */ }
-    }
-}