@xgamesfun/solana 0.28.0 → 0.28.1

package/README.md

@@ -76,7 +76,7 @@ codex plugin add xsolana@xgamesfun
 
 **claude.ai, ChatGPT or Claude Desktop:** add `https://xgames.fun/mcp` as a custom connector. Nothing to install.
 
-**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.0 xsolana mcp`.
+**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.1 xsolana mcp`.
 
 **Any agent that reads skills** (Copilot, Gemini CLI, Windsurf…): `npx skills add XGamesFun/solana-kit`.
 
@@ -87,26 +87,26 @@ are in [docs/harnesses.md](docs/harnesses.md).
 
 ```bash
 # find a worked example close to your idea
-npx -y @xgamesfun/solana@0.28.0 examples shop with loot boxes
+npx -y @xgamesfun/solana@0.28.1 examples shop with loot boxes
 
 # using a coin you already launched? read it from the chain into its "tokens" entry
-npx -y @xgamesfun/solana@0.28.0 token <its mint address>
+npx -y @xgamesfun/solana@0.28.1 token <its mint address>
 
 # does it work? where does the money go? what does it cost?
-npx -y @xgamesfun/solana@0.28.0 check xsolana.json
-npx -y @xgamesfun/solana@0.28.0 simulate xsolana.json
-npx -y @xgamesfun/solana@0.28.0 cost xsolana.json
+npx -y @xgamesfun/solana@0.28.1 check xsolana.json
+npx -y @xgamesfun/solana@0.28.1 simulate xsolana.json
+npx -y @xgamesfun/solana@0.28.1 cost xsolana.json
 
 # the whole economy in plain words, and what a cheater could get
-npx -y @xgamesfun/solana@0.28.0 explain xsolana.json
-npx -y @xgamesfun/solana@0.28.0 review xsolana.json
+npx -y @xgamesfun/solana@0.28.1 explain xsolana.json
+npx -y @xgamesfun/solana@0.28.1 review xsolana.json
 
 # go live: a key file for the project (it prints the address to send devnet SOL to, never the key)…
-npx -y @xgamesfun/solana@0.28.0 keygen ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.1 keygen ~/.config/xsolana/my-game.json
 # …then everything going live would send, and a code; nothing is sent
-npx -y @xgamesfun/solana@0.28.0 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.1 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
 # …and with that code, exactly what it listed is sent
-npx -y @xgamesfun/solana@0.28.0 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
+npx -y @xgamesfun/solana@0.28.1 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
 ```
 
 Each command names an exact version, so you always run the release you meant to. `xsolana help` lists them all.

package/js/approve/page.js

@@ -62,8 +62,16 @@ export function approvalPage(token) {
   let last = null;
   // The legal lines the box was last shown with.
   let legalShown = new Set();
+  // How many of the lines about what the wallet added have been said on this page.
+  let addedSaid = 0;
   function render(state) {
     last = state;
+    // What the wallet added to transactions that landed (its own checks): they were sent as it signed them. Said
+    // whenever a state arrives, so one that landed in a batch that then stopped is said too.
+    const addedLines = state.walletAdded ?? [];
+    for (const line of addedLines.slice(addedSaid))
+      log(`${line} It was sent as your wallet signed it: everything listed here is in it, untouched.`);
+    addedSaid = Math.max(addedSaid, addedLines.length);
     // A token's name the spec changes and the chain can't take (`unwritten`): said whether or not anything else was
     // sent. With nothing else to send, the page never calls that a landing.
     const unwritten = state.unwritten ?? [];

package/js/approve/server.mjs

@@ -2,8 +2,9 @@
 // wallet, served only when asked for (`xsolana approve --keypair`, js/approve/with-key.mjs, drives this same approval
 // with a key file and no page). The
 // server builds each transaction (js/economy/plan.mjs), has the fresh keys a setup makes sign their part, and sends
-// only what it prepared: a wallet's answer must carry the exact message prepared for it and that wallet's valid
-// signature. Each prepared batch answers once and expires after 90 seconds. What lands is written back into the spec
+// only what it prepared and showed: a wallet's answer must carry that wallet's valid signature of the exact message
+// prepared for it, or of that message with nothing but a wallet's own additions (js/approve/wallet-adds.mjs: its
+// Lighthouse checks, a compute budget). Each prepared batch answers once and expires after 90 seconds. What lands is written back into the spec
 // file as it lands, so a setup cut short goes on from where it stopped. The server never sees the owner's key.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { chmod, mkdtemp, open as openFile, readFile, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
@@ -16,9 +17,9 @@ import { equalBytes, fromBase64, toBase64 } from '../chain/bytes.js';
 import { alreadyProcessed, checkCluster, notMainnet, rpcClient } from '../chain/rpc.js';
 import { addressBytes, encodeBase58 } from '../chain/base58.js';
 import { slotHashes, tableAddress } from '../chain/lookup.js';
-import { COMPUTE_BUDGET_PROGRAM, SYSVAR_SLOT_HASHES } from '../chain/pda.js';
+import { SYSVAR_SLOT_HASHES } from '../chain/pda.js';
 import { MINT_BYTES } from '../chain/token.js';
-import { compileMessage, readMessage, readTransaction, wireTransaction } from '../chain/tx.js';
+import { compileMessage, readTransaction, wireTransaction } from '../chain/tx.js';
 import { accountKind, decode } from '../client/accounts.js';
 import { LOOT_PROGRAM, pda } from '../client/pda.js';
 import { check, describe } from '../economy/check.mjs';
@@ -30,6 +31,7 @@ import { madeSoFar, plan, PER_APPROVAL } from '../economy/plan.mjs';
 import { compareDetails, liveStepDetails, namesOf, outsideAddresses, stepDetails } from './details.mjs';
 import { freshKeypair, verifySignature } from './ed25519.mjs';
 import { checkLive, checkMints, LiveMismatch, MintMismatch, readRenames } from './live-check.mjs';
+import { walletAdded } from './wallet-adds.mjs';
 
 const PREPARE_TTL_MS = 90_000;
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -150,6 +152,8 @@ export async function createApproval({
   // Goes up each time the live section changes: a batch prepared before a change is never sent.
   let generation = 0;
   const signatures = [];
+  // What a wallet added to transactions this session sent (its own checks, a compute budget): said on the page.
+  const walletAdds = [];
   const at = now();
   const mode = !spec.live ? 'new' : spec.live.partial ? 'resume' : 'change';
   /**
@@ -413,6 +417,8 @@ export async function createApproval({
       steps,
       landed: [...done].map(id => ({ id, says: said.get(id)?.says ?? id, details: said.get(id)?.details ?? [] })),
       signatures: [...signatures],
+      // (what a wallet added to transactions it signed, in words: they were sent as it signed them)
+      walletAdded: [...walletAdds],
       // The project the setup sends to, once a wallet is connected: always that wallet's own (or the one it is the
       // authority of).
       project: extra.project ?? null,
@@ -597,7 +603,7 @@ export async function createApproval({
     prepared = null;
     if (batch.generation !== generation)
       throw new ApproveError(409, 'Something landed after that batch was built: ask for the next one.');
-    const wires = checkSigned(batch.wires, signed, wallet);
+    const { wires, added } = checkSigned(batch.wires, signed, wallet);
     busy = true;
     try {
       for (const [i, wire] of wires.entries()) {
@@ -654,6 +660,8 @@ export async function createApproval({
           }
         }
         signatures.push(signature);
+        // (what the wallet added to it is said once it has landed, never of one that did not)
+        if (added[i]) walletAdds.push(added[i]);
         await landed(sent, batch.ctx, signature, { more: i < wires.length - 1 });
       }
     } finally {
@@ -928,53 +936,18 @@ const sameText = (a, b) => {
   return x.length === y.length && timingSafeEqual(x, y);
 };
 
-/** What a Compute Budget instruction asks for, by its first byte. */
-const BUDGET_ASKS = {
-  1: 'a heap size',
-  2: 'a compute unit limit',
-  3: 'a compute unit price (a priority fee of its own)',
-  4: 'a limit on the account data loaded',
-};
-
 /**
- * What a wallet did to a message it was to sign as it stood, in words for the refusal: " (it added …)" when the
- * message it signed is the prepared one with instructions added (a wallet that adds its own priority fee, or checks
- * of its own), " (it put another blockhash on it)", or '' when the change is anything else or can't be read.
+ * The wallet's signed copies, as they are sent: { wires, added }. Each is the exact prepared message with the wallet's
+ * valid signature, or, from a wallet that adds to what it signs, the wallet's own message with its signature, taken
+ * only when everything prepared is in it untouched and what it added is a wallet's own (`walletAdded`,
+ * js/approve/wallet-adds.mjs: instructions of the Lighthouse program, a heap size). `added`: for each transaction, what
+ * was added to it in words, or null. Anything else is refused, and nothing is sent.
  */
-export function walletChange(ours, theirs) {
-  try {
-    const [a, b] = [readMessage(ours), readMessage(theirs)];
-    const told = m =>
-      m.instructions.map(ix => ({
-        program: m.keys[ix.programIndex],
-        kind: ix.data[0],
-        text: `${m.keys[ix.programIndex]} ${ix.accountIndexes.map(i => m.keys[i] ?? `#${i}`).join(',')} ${toBase64(ix.data)}`,
-      }));
-    const mine = told(a);
-    const added = [];
-    let at = 0;
-    for (const ix of told(b)) {
-      if (at < mine.length && ix.text === mine[at].text) at++;
-      else added.push(ix);
-    }
-    if (at !== mine.length || !added.length)
-      return a.blockhash !== b.blockhash ? ' (it put another blockhash on it)' : '';
-    const what = added.map(ix =>
-      ix.program === COMPUTE_BUDGET_PROGRAM
-        ? (BUDGET_ASKS[ix.kind] ?? 'a compute budget instruction')
-        : `an instruction of the program ${ix.program}`,
-    );
-    return ` (it added ${[...new Set(what)].join(', ')})`;
-  } catch {
-    return '';
-  }
-}
-
-/** The wallet's signed copies: each the exact prepared message, each with the wallet's valid signature. */
 function checkSigned(prepared, signed, wallet) {
   if (!Array.isArray(signed) || signed.length !== prepared.length)
     throw new ApproveError(400, 'The wallet’s answer does not match the request.');
-  return prepared.map((wire, i) => {
+  const added = prepared.map(() => null);
+  const wires = prepared.map((wire, i) => {
     let mine;
     let theirs;
     try {
@@ -983,11 +956,20 @@ function checkSigned(prepared, signed, wallet) {
     } catch {
       throw new ApproveError(400, 'The wallet returned something that is not a transaction.');
     }
-    if (!equalBytes(mine.message, theirs.message))
-      throw new ApproveError(
-        400,
-        `The wallet changed the transaction before signing it${walletChange(mine.message, theirs.message)}, so nothing was sent: only what was prepared and shown here is ever sent. A wallet that adds to what it signs can’t approve this way: use one that signs a transaction as it stands. (A setup that has not started can be signed by a key file instead: xsolana approve --keypair. One that has started is finished by the key that started it.)`,
-      );
+    if (!equalBytes(mine.message, theirs.message)) {
+      const taken = walletAdded(mine.message, theirs.message, wallet);
+      if (!taken.ok)
+        throw new ApproveError(
+          400,
+          `The wallet changed the transaction before signing it (it ${taken.why}), so nothing was sent. A wallet may add its own checks (instructions of the Lighthouse program) to a transaction it alone signs; everything that was prepared and shown here must be in it untouched, and nothing else may be. (A setup that has not started can be signed by a key file instead: xsolana approve --keypair. One that has started is finished by the key that started it.)`,
+        );
+      // The wallet's own message, with the wallet's own signature: it is the transaction's one signer.
+      const signature = theirs.signatures[0];
+      if (theirs.signers[0] !== wallet || !verifySignature(wallet, theirs.message, signature))
+        throw new ApproveError(400, 'The wallet’s signature is missing or does not match your wallet.');
+      added[i] = `Transaction ${i + 1} of its batch: your wallet added ${taken.added.join(', ')}.`;
+      return wireTransaction(theirs.message, [signature]);
+    }
     const slot = mine.signers.indexOf(wallet);
     if (slot < 0) throw new ApproveError(400, 'This transaction was not prepared for that wallet.');
     const signature = theirs.signatures[slot];
@@ -997,6 +979,7 @@ function checkSigned(prepared, signed, wallet) {
     signatures[slot] = signature;
     return wireTransaction(mine.message, signatures);
   });
+  return { wires, added };
 }
 
 // ---------------------------------------------------------------- the page

package/js/approve/wallet-adds.mjs

@@ -0,0 +1,180 @@
+// What a wallet may add to a transaction it was asked to sign as it stood, and nothing else.
+//
+// The approval page prepares each transaction, shows what it does, and sends what the wallet signed. Some wallets add
+// to a transaction before they sign it: Phantom adds its own checks (instructions of the Lighthouse program, which
+// read accounts and fail the transaction when something is not as the wallet expected). The page takes such a
+// transaction only when everything that was prepared and shown is still in it, untouched, and everything else is of
+// the two programs a wallet adds for its own sake: Compute Budget and Lighthouse. Then what is sent is the wallet's
+// own message with the wallet's own signature. Anything else is refused, as any change was before.
+//
+// The rule, each part of which is needed:
+// - Both messages are legacy, with no lookup table: every account is in the message itself, so every account is
+//   compared by its address.
+// - The wallet is the message's one signer and its fee payer, in both. A transaction a fresh key signs too (a new
+//   mint, a new collection) can't be changed: that key signed the prepared message.
+// - The same blockhash.
+// - Every prepared instruction is there, in the prepared order, with the same program, the same accounts and the
+//   same data.
+// - Every account a prepared instruction names (its program too) is a signer or writable in the wallet's message
+//   exactly as it was in the prepared one. Whether an account can be written is the message's word, not one
+//   instruction's: an added instruction that asks to write an account of ours would make it writable for ours too.
+// - Every other instruction is the Lighthouse program's, or a Compute Budget instruction that asks for a heap size
+//   or a limit on loaded data the prepared transaction does not set. Never a unit limit or a unit price: the fee of a
+//   prepared transaction is the one it was shown with.
+// - Nothing added names the loader of upgradeable programs, which would let a program's own account be written.
+import { equalBytes } from '../chain/bytes.js';
+import { COMPUTE_BUDGET_PROGRAM, LIGHTHOUSE_PROGRAM } from '../chain/pda.js';
+import { readMessage } from '../chain/tx.js';
+
+/** What a Compute Budget instruction asks for, by its first byte. */
+const BUDGET_ASKS = {
+  1: 'a heap size',
+  2: 'a compute unit limit',
+  3: 'a compute unit price (a priority fee of its own)',
+  4: 'a limit on the account data loaded',
+};
+
+/** The kinds that set a transaction's fee: its unit limit and its unit price. */
+const FEE_KINDS = new Set([2, 3]);
+/** The loader of upgradeable programs: named anywhere in a transaction, it lets a program's own account be written. */
+const UPGRADEABLE_LOADER = 'BPFLoaderUpgradeab1e11111111111111111111111';
+
+/** A refusal of a wallet's message: `why`, in words that go after "it …". */
+class Refused extends Error {}
+
+/**
+ * A legacy message's accounts and instructions with nothing left as a number:
+ * { blockhash, signers, flags (address → { signer, writable }), instructions: [{ program, accounts: [address], data }] }.
+ * Throws `Refused` for a message that is not legacy, that names an account twice, or whose own numbers do not add up.
+ */
+function laidOut(message) {
+  let m;
+  try {
+    m = readMessage(message);
+  } catch {
+    throw new Refused('returned something that is not a transaction');
+  }
+  if (m.version !== 'legacy' || m.lookups.length)
+    throw new Refused('returned a transaction that loads accounts from a lookup table, which can’t be compared');
+  const { numRequiredSignatures: signed, numReadonlySigned, numReadonlyUnsigned } = m.header;
+  const count = m.keys.length;
+  if (signed < 1 || signed > count || numReadonlySigned >= signed || numReadonlyUnsigned > count - signed)
+    throw new Refused('returned a transaction whose header does not add up');
+  if (new Set(m.keys).size !== count) throw new Refused('returned a transaction that names an account twice');
+  const flags = new Map(
+    m.keys.map((address, i) => [
+      address,
+      {
+        signer: i < signed,
+        writable: i < signed - numReadonlySigned || (i >= signed && i < count - numReadonlyUnsigned),
+      },
+    ]),
+  );
+  const at = i => {
+    if (i >= count) throw new Refused('returned a transaction that names an account it does not list');
+    return m.keys[i];
+  };
+  return {
+    blockhash: m.blockhash,
+    signers: m.keys.slice(0, signed),
+    flags,
+    instructions: m.instructions.map(ix => ({
+      program: at(ix.programIndex),
+      accounts: ix.accountIndexes.map(at),
+      data: ix.data,
+    })),
+  };
+}
+
+const sameInstruction = (a, b) =>
+  a.program === b.program &&
+  a.accounts.length === b.accounts.length &&
+  a.accounts.every((address, i) => address === b.accounts[i]) &&
+  equalBytes(a.data, b.data);
+
+/**
+ * Whether `theirs`, the message a wallet signed, is `ours`, the message prepared for it, with nothing but a wallet's
+ * own additions. `wallet`: the address the transaction was prepared for.
+ * → { ok: true, added: [what it added, in words] } or { ok: false, why: what it did, in words after "it …" }.
+ * Two messages that are the same bytes are not this function's to judge (nothing was added).
+ */
+export function walletAdded(ours, theirs, wallet) {
+  try {
+    // (the prepared message is this package's own: one this can't lay out is one a wallet may not change)
+    let a;
+    try {
+      a = laidOut(ours);
+    } catch {
+      throw new Refused('changed a transaction that can only be sent as it was prepared');
+    }
+    const b = laidOut(theirs);
+    if (a.signers.length !== 1 || a.signers[0] !== wallet)
+      throw new Refused(
+        'changed a transaction that another key signs too (a new account’s own key signed it as it was prepared)',
+      );
+    if (b.signers.length !== 1) throw new Refused('added a signer');
+    if (b.signers[0] !== wallet) throw new Refused('put another fee payer on it');
+    if (a.blockhash !== b.blockhash) throw new Refused('put another blockhash on it');
+
+    // Every prepared instruction, in its order; whatever stands between them is what the wallet added.
+    const added = [];
+    let next = 0;
+    for (const ix of b.instructions) {
+      if (next < a.instructions.length && sameInstruction(ix, a.instructions[next])) next++;
+      else added.push(ix);
+    }
+    if (next !== a.instructions.length) throw new Refused('changed, dropped or moved one of the prepared instructions');
+    if (!added.length) throw new Refused('changed the transaction’s accounts');
+
+    // No account of ours is more, or less, than it was: a signer, or writable.
+    const mine = new Set(a.instructions.flatMap(ix => [ix.program, ...ix.accounts]));
+    for (const address of mine) {
+      const was = a.flags.get(address);
+      const is = b.flags.get(address);
+      if (!is || was.signer !== is.signer || was.writable !== is.writable)
+        throw new Refused(
+          `changed what the account ${address} is in the transaction (${was.writable ? 'it could be written, and no longer can' : 'it could only be read, and can now be written'})`,
+        );
+    }
+
+    // The network lets a program's own account be written only in a transaction that names the upgradeable loader:
+    // without it, an account that is called as a program is read-only whatever the message says. So the loader, named
+    // by anything added, would change what a prepared instruction can write. It is never the wallet's to add.
+    if (b.flags.has(UPGRADEABLE_LOADER) && !a.flags.has(UPGRADEABLE_LOADER))
+      throw new Refused('named the upgradeable loader, which the prepared transaction does not');
+
+    // What it added is a wallet's own: instructions of the Lighthouse program, or a heap size or a limit on loaded
+    // data the transaction did not set. Never a unit limit or a unit price: a prepared transaction's fee is its own
+    // (this package's setups set both), and a wallet's price on top of it is not taken.
+    const set = new Set(
+      a.instructions.filter(ix => ix.program === COMPUTE_BUDGET_PROGRAM).map(ix => (ix.data.length ? ix.data[0] : -1)),
+    );
+    const words = [];
+    let own = 0;
+    for (const ix of added) {
+      if (ix.program === LIGHTHOUSE_PROGRAM) {
+        own++;
+        continue;
+      }
+      if (ix.program !== COMPUTE_BUDGET_PROGRAM) throw new Refused(`added an instruction of the program ${ix.program}`);
+      const kind = ix.data.length ? ix.data[0] : -1;
+      const what = BUDGET_ASKS[kind];
+      if (!what) throw new Refused('added a compute budget instruction of a kind not known here');
+      if (ix.accounts.length)
+        throw new Refused('added a compute budget instruction that names accounts, which none does');
+      if (set.has(kind))
+        throw new Refused(
+          `added ${what.replace(/^a /, 'a second ')}: the transaction sets its own, and the network refuses one that sets it twice`,
+        );
+      if (FEE_KINDS.has(kind))
+        throw new Refused(`added ${what}: the fee of a transaction prepared here is the one it was shown with`);
+      set.add(kind);
+      words.push(what);
+    }
+    if (own) words.push(`${own} instruction${own === 1 ? '' : 's'} of the Lighthouse program (a wallet’s own checks)`);
+    return { ok: true, added: words };
+  } catch (e) {
+    if (!(e instanceof Refused)) throw e;
+    return { ok: false, why: e.message };
+  }
+}

package/js/chain/pda.js

@@ -10,6 +10,12 @@ export const TOKEN_PROGRAM = 'TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA';
 export const TOKEN_2022_PROGRAM = 'TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb';
 export const ASSOCIATED_TOKEN_PROGRAM = 'ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL';
 export const COMPUTE_BUDGET_PROGRAM = 'ComputeBudget111111111111111111111111111111';
+/**
+ * Lighthouse: a program of assertions (it reads accounts and fails the transaction when one is not as expected),
+ * which a wallet may add to a transaction before signing it (Phantom does). The same address on mainnet and devnet:
+ * its source's `declare_id!` and its README, github.com/Jac0xb/lighthouse.
+ */
+export const LIGHTHOUSE_PROGRAM = 'L2TExMFKdjpN9kozasaurPirfHy9P8sbXoAN1qA3S95';
 export const METAPLEX_METADATA_PROGRAM = 'metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s';
 /** Metaplex Core: the program of Core assets and collections. */
 export const MPL_CORE_PROGRAM = 'CoREENxT6tW1HoK8ypY1SxRMZTcVPm7R94rH4PZNhX7d';

package/js/economy/plan.mjs

@@ -1892,8 +1892,8 @@ export const SETUP_UNIT_PRICE = 1n;
 /**
  * A setup transaction's instructions as the owner's wallet is handed them: led by a compute unit limit and a compute
  * unit price, each once. A wallet that adds its own priority fee (Phantom does) adds it only to a transaction that
- * sets neither, and the approval page sends a transaction only as it prepared it, so every setup transaction sets both
- * itself. The limit is all a transaction can have (1,400,000 units): nothing here measures what a step takes, a box's
+ * sets neither, and the approval page takes no price a wallet puts on a transaction that has one, so every setup
+ * transaction sets both itself: its fee is the plan's own, whatever the wallet. The limit is all a transaction can have (1,400,000 units): nothing here measures what a step takes, a box's
  * write needs it, and no step may fail for want of compute. A limit or a price the instructions already carry is
  * kept.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/solana",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "mcpName": "io.github.XGamesFun/solana-kit",
   "description": "Loot boxes, gacha, shops, lotteries, auctions, NFT staking, crafting and rewards on Solana without writing a smart contract: one shared program, its JS client, a CLI, and an MCP server and skill so Claude Code, Codex or any AI agent can design, check, simulate and launch an economy.",
   "license": "Apache-2.0",

package/release.json

@@ -4,5 +4,5 @@
   "sbfBytes": 1794616,
   "sbfSha256": "ac8b09ed2c3a3f7daa2dfab55d2f6dea19fa43e4c98b44a82da2a68a7bc8ebbe",
   "idlSha256": "ef3b8043d62c606e850df75773b4535cdb08206216e17aca653111a77403abd7",
-  "clientSha256": "166349fb1609e0a5e051eba44691783ea1ffaf6f307983a7c24c4c3f0a44f60e"
+  "clientSha256": "3ef11453089e952e50d9d5a7199d9629b3417a091a071ea6dfd90f42746a2421"
 }

package/skills/xsolana-economy/SKILL.md

@@ -10,9 +10,9 @@ writes or deploys a contract: the spec is checked, simulated and priced by the `
 signed by a key file on the owner's own machine, once they have read what will be sent and said yes. It runs on
 **devnet** until the program is audited.
 
-The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.0 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
-`npx -y @xgamesfun/solana@0.28.0 token <mint>` for a coin made elsewhere,
-or `npx -y @xgamesfun/solana@0.28.0 tool <name> '<json>'` for any tool (always with the exact version).
+The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.1 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
+`npx -y @xgamesfun/solana@0.28.1 token <mint>` for a coin made elsewhere,
+or `npx -y @xgamesfun/solana@0.28.1 tool <name> '<json>'` for any tool (always with the exact version).
 
 ## Rules (always)
 
@@ -137,7 +137,7 @@ or `npx -y @xgamesfun/solana@0.28.0 tool <name> '<json>'` for any tool (always w
 9. **When they say "put it live"**: `xsolana_publish` lists every step and its cost and gives the commands, which you
    run in the project folder exactly as given (they name the exact version; never drop it):
    - **A new economy gets a key file**, unless the project has one:
-     `npx -y @xgamesfun/solana@0.28.0 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
+     `npx -y @xgamesfun/solana@0.28.1 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
      Solana key file they already have and name themselves (`~/.config/solana/id.json`) works the same; never go
      looking for one.
    - **Say what the key file is** before anything is sent: the project's owner, and, unless the spec says otherwise,
@@ -152,7 +152,7 @@ or `npx -y @xgamesfun/solana@0.28.0 tool <name> '<json>'` for any tool (always w
      (`xsolana_cost`), any seed in a coin that already exists, and every NFT a stash, a raffle or an auction names. A
      collection they already have needs the key's address as its update authority. If they would rather not move
      those, offer the browser wallet.
-   - **Show it**: `npx -y @xgamesfun/solana@0.28.0 approve xsolana.json --keypair <key file>` prints every step with
+   - **Show it**: `npx -y @xgamesfun/solana@0.28.1 approve xsolana.json --keypair <key file>` prints every step with
      what it pays and trusts, the warnings, the notice and a code, and sends nothing. Give the person that printout as
      it is, not a summary of it, and ask.
    - **On their yes**, the same command with `--yes <code>`. What lands is written back into `xsolana.json`. If it

package/types/chain/pda.d.ts

@@ -3,6 +3,12 @@ export declare const TOKEN_PROGRAM = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5D
 export declare const TOKEN_2022_PROGRAM = "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb";
 export declare const ASSOCIATED_TOKEN_PROGRAM = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
 export declare const COMPUTE_BUDGET_PROGRAM = "ComputeBudget111111111111111111111111111111";
+/**
+ * Lighthouse: a program of assertions (it reads accounts and fails the transaction when one is not as expected),
+ * which a wallet may add to a transaction before signing it (Phantom does). The same address on mainnet and devnet:
+ * its source's `declare_id!` and its README, github.com/Jac0xb/lighthouse.
+ */
+export declare const LIGHTHOUSE_PROGRAM = "L2TExMFKdjpN9kozasaurPirfHy9P8sbXoAN1qA3S95";
 export declare const METAPLEX_METADATA_PROGRAM = "metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s";
 /** Metaplex Core: the program of Core assets and collections. */
 export declare const MPL_CORE_PROGRAM = "CoREENxT6tW1HoK8ypY1SxRMZTcVPm7R94rH4PZNhX7d";

package/types/economy/plan.d.mts

@@ -1051,8 +1051,8 @@ export declare const SETUP_UNIT_PRICE = 1n;
 /**
  * A setup transaction's instructions as the owner's wallet is handed them: led by a compute unit limit and a compute
  * unit price, each once. A wallet that adds its own priority fee (Phantom does) adds it only to a transaction that
- * sets neither, and the approval page sends a transaction only as it prepared it, so every setup transaction sets both
- * itself. The limit is all a transaction can have (1,400,000 units): nothing here measures what a step takes, a box's
+ * sets neither, and the approval page takes no price a wallet puts on a transaction that has one, so every setup
+ * transaction sets both itself: its fee is the plan's own, whatever the wallet. The limit is all a transaction can have (1,400,000 units): nothing here measures what a step takes, a box's
  * write needs it, and no step may fail for want of compute. A limit or a price the instructions already carry is
  * kept.
  */