Vest platform: a client for Vest Markets, traded on a session the extension relays

Vest (next.vestmarkets.com) is a perps prop firm: index, metal and energy
perps on CME hours, plus stocks, FX and crypto. It joins as a fourth
platform, 'vest', on the DXtrade engine paths. Those are now keyed by
isNotionalPlatform() instead of === 'dxtrade': the firm's own symbols,
percent fees, notional sizing from volatility, and a scheduler lane of its
own.

- Login is relayed, not stored. Vest signs people in with Google through
  Privy and renews the session with a device key the browser won't export.
  Extension 0.17.0's vest-relay.js reads the token the Vest app renews for
  itself (~15 min). It renews nothing, so the tab is never logged out. The
  background script posts that token to POST /api/vest/session, which holds
  it in memory only. With no Vest tab open on a machine that trades Vest,
  the extension opens one.
- The firm's credential is the Vest login's wallet address. The dashboard's
  form offers the relayed wallet with one click.
- VestClient (lib/vest-class.ts), mapped from the web app's traffic and code
  since Vest publishes no API:
  - Reads the capital accounts, balances (free amount plus position
    collateral), positions and open orders with the user token.
  - Mints per-account tokens for orders and transactions.
  - Names accounts for their rules (V50K-E-D3-T10-34, V50K-F-D3-34,
    V25K-I-7) so account-type prefixes can match.
  - Takes Vest's own max-drawdown and daily-loss floors. dayStartBalance =
    floor + the type's limit, so the engine's room is never more than
    Vest's.
  - Uses each symbol's taker fee and margin rate from exchangeInfo, and
    hourly volatility over in-session hours only.
  - Places take-profit and stop as position legs, which Vest cancels as an
    OCO pair.
- Daily P&L and fund rows come from /v3/transactions by Vest's 20:00 ET
  day. A books check holds an account, naming the transaction types, when
  the balance and the transactions disagree.
- scripts/check-vest.mjs (in npm run check): Vest's day across DST, account
  names, parsing, volatility gaps, market hours, the session store.

Not yet run against Vest with a live session: the order and exit bodies
come from the app's code, and the transaction classification from its enum.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -203,6 +203,50 @@ Use `brokerWebSocket` or `signalrWebSocket` from `lib/outbound-proxy.ts` for bro
 sockets, and `directWebSocket` for control sockets. All share the same user agent;
 the broker proxy still applies only to broker traffic.
 
+## Vest firms (Vest Markets)
+
+Vest (next.vestmarkets.com) is a perps prop firm: index, metal and energy perps
+on CME hours, plus stocks, FX and crypto. Set it up on the master's **Firms**
+page with platform **Vest**. It shares the DXtrade engine: its own symbols
+(new firms start on `NDX-USD-PERP`, `SPX-USD-PERP`, `GC-PERP`, standing in for
+NQ, ES and GC), notional sizing from volatility, percent fees, hard daily-loss
+stops, and a scheduler lane of its own. Leave **Trades every day** off for the
+index and metal perps: they close for weekends and 5–6 PM ET.
+
+**Login is relayed, not stored.** Vest signs people in with Google (through
+Privy) and renews the session with a device key the browser keeps, so this
+instance cannot log in by itself. Instead:
+
+1. In Chrome on this machine (with the AutoFirmer extension, 0.17.0+), open
+   next.vestmarkets.com and sign in. The person signs in once; Vest keeps the
+   session for 30 days.
+2. The extension relays the tab's short-lived access token to this dashboard
+   (`POST /api/vest/session`, held in memory only) every time the Vest app
+   renews it. If no Vest tab is open, the extension opens one in the background.
+3. On the dashboard, the Vest firm's credential is the **wallet address** of
+   that login. The credential form offers the relayed wallet with one click.
+
+With no live session for the wallet, the client sits unauthenticated and says
+so; it never tries to log in.
+
+What the client reads from Vest (lib/vest-class.ts, mapped from the web app's
+own traffic since Vest publishes no API):
+
+- Accounts: every eval and funded account on the login, named for their rules,
+  e.g. `V50K-E-D3-T10-34` (50K eval, 3% daily loss, 10% target, attempt 34),
+  `V50K-F-D3-34` (funded) and `V25K-I-7` (instant). Account-type prefixes on the
+  master match those names.
+- Floors: Vest states each account's max-drawdown floor (the auto-liq threshold
+  here) and daily-loss floor. The engine's daily room is never more than Vest
+  leaves.
+- Fees and leverage: each symbol's taker fee (0.25 bp on the index and metal
+  perps) and margin rate, from Vest's exchange info. Set the firm's
+  **Commission %** to the same (`0.0025`) for the pre-trade checks.
+- Exits: the take-profit and stop are legs of the position on Vest's side,
+  and Vest cancels the other when one triggers.
+
+`npm run check` includes the Vest helpers (scripts/check-vest.mjs).
+
 ---
 
 ## The master dashboard