@xgamesfun/solana 0.28.3 → 0.28.5

package/README.md

@@ -77,7 +77,7 @@ codex plugin add xsolana@xgamesfun
 
 **claude.ai, ChatGPT or Claude Desktop:** add `https://xgames.fun/mcp` as a custom connector. Nothing to install.
 
-**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.3 xsolana mcp`.
+**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.5 xsolana mcp`.
 
 **Any agent that reads skills** (Copilot, Gemini CLI, Windsurf…): `npx skills add XGamesFun/solana-kit`.
 
@@ -88,26 +88,26 @@ are in [docs/harnesses.md](docs/harnesses.md).
 
 ```bash
 # find a worked example close to your idea
-npx -y @xgamesfun/solana@0.28.3 examples shop with loot boxes
+npx -y @xgamesfun/solana@0.28.5 examples shop with loot boxes
 
 # using a coin you already launched? read it from the chain into its "tokens" entry
-npx -y @xgamesfun/solana@0.28.3 token <its mint address>
+npx -y @xgamesfun/solana@0.28.5 token <its mint address>
 
 # does it work? where does the money go? what does it cost?
-npx -y @xgamesfun/solana@0.28.3 check xsolana.json
-npx -y @xgamesfun/solana@0.28.3 simulate xsolana.json
-npx -y @xgamesfun/solana@0.28.3 cost xsolana.json
+npx -y @xgamesfun/solana@0.28.5 check xsolana.json
+npx -y @xgamesfun/solana@0.28.5 simulate xsolana.json
+npx -y @xgamesfun/solana@0.28.5 cost xsolana.json
 
 # the whole economy in plain words, and what a cheater could get
-npx -y @xgamesfun/solana@0.28.3 explain xsolana.json
-npx -y @xgamesfun/solana@0.28.3 review xsolana.json
+npx -y @xgamesfun/solana@0.28.5 explain xsolana.json
+npx -y @xgamesfun/solana@0.28.5 review xsolana.json
 
 # go live: a key file for the project (it prints the address to send SOL to, never the key)…
-npx -y @xgamesfun/solana@0.28.3 keygen ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.5 keygen ~/.config/xsolana/my-game.json
 # …then everything going live would send, and a code; nothing is sent
-npx -y @xgamesfun/solana@0.28.3 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
 # …and with that code, exactly what it listed is sent
-npx -y @xgamesfun/solana@0.28.3 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
+npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
 ```
 
 Each command names an exact version, so you always run the release you meant to. `xsolana help` lists them all.

package/js/client/accounts.js

@@ -406,6 +406,12 @@ export function decodeStash(data) {
  * collection (or null), flags, nonce, root (hex: the tree's root it holds for), payer }. Routes read it only while the
  * tree's root is still `root`; after that anyone may close it (`closeLeafIx`).
  */
+/**
+ * Where a Proven record's payer is: after the tag, eight 32-byte fields, the asset data hash's flag (and its 32 bytes
+ * when it has one), the flags and the nonce. Without an asset data hash, then with one.
+ */
+export const PROVEN_PAYER_AT = Object.freeze([1 + 32 * 8 + 1 + 1 + 8, 1 + 32 * 8 + 33 + 1 + 8]);
+
 export function decodeProven(data) {
   // Its shortest: the tag, five addresses, the root, data hash and creator hash, no asset data hash, the flags and
   // nonce, and its payer.

package/js/play/index.js

@@ -5166,8 +5166,16 @@ export function solanaApp({
         else if (hold.debt?.lender === me && time >= BigInt(hold.free_at))
           out.push({ ...claim, says: 'A loan you made is overdue and unpaid: take its NFT.' });
       }
-      // A compressed NFT's proof record this wallet paid for and left open: closing it brings its rent back.
-      for (const { account } of await client.programAccounts(loot.lootProgram(), [tag('Proven')])) {
+      // A compressed NFT's proof record this wallet paid for and left open: closing it brings its rent back. Found by its
+      // payer, which sits at one of two places (without an asset data hash, and with one: `loot.PROVEN_PAYER_AT`): a
+      // scan of every proof record of the program is refused by the play host's relay, and by any RPC that bounds what
+      // a scan may ask. These records only give rent back, so a scan that is refused leaves them out and lists the rest.
+      const proven = new Map();
+      for (const offset of loot.PROVEN_PAYER_AT) {
+        const found = await client.programAccounts(loot.lootProgram(), [tag('Proven'), at(offset, me)]).catch(() => []);
+        for (const x of found) proven.set(x.pubkey, x);
+      }
+      for (const { account } of proven.values()) {
         const leaf = (() => {
           try {
             return loot.decodeProven(account.data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/solana",
-  "version": "0.28.3",
+  "version": "0.28.5",
   "mcpName": "io.github.XGamesFun/solana-kit",
   "description": "Loot boxes, gacha, shops, lotteries, auctions, NFT staking, crafting and rewards on Solana without writing a smart contract: one shared program, its JS client, a CLI, and an MCP server and skill so Claude Code, Codex or any AI agent can design, check, simulate and launch an economy.",
   "license": "Apache-2.0",
@@ -74,6 +74,10 @@
       "types": "./types/approve/keyfile.d.mts",
       "default": "./js/approve/keyfile.mjs"
     },
+    "./wallet-adds": {
+      "types": "./types/approve/wallet-adds.d.mts",
+      "default": "./js/approve/wallet-adds.mjs"
+    },
     "./idl.json": "./js/client/idl/loot.json",
     "./package.json": "./package.json",
     "./release.json": "./release.json",

package/release.json

@@ -4,7 +4,7 @@
   "sbfBytes": 1794616,
   "sbfSha256": "ac8b09ed2c3a3f7daa2dfab55d2f6dea19fa43e4c98b44a82da2a68a7bc8ebbe",
   "idlSha256": "ef3b8043d62c606e850df75773b4535cdb08206216e17aca653111a77403abd7",
-  "clientSha256": "164ed8ee25b5a2714f6c8f5de243d6b650ba0741637ee3dd4c2886f15af3a6c5",
+  "clientSha256": "c8068236d278f2d164a95ad1d70a44d5763e08e77355c4fa3fbda0d336b5947e",
   "mainnet": {
     "programId": "xgames8C758PyweWB9sDw8evvwsTVwyA2fGRUeAXVPy",
     "sbfBytes": 1794616,

package/skills/xsolana-economy/SKILL.md

@@ -11,9 +11,9 @@ signed by a key file on the owner's own machine, once they have read what will b
 **devnet**, where nothing is real money, and on **mainnet**, where everything is: an economy is on devnet unless its
 file says `"network": "mainnet"`.
 
-The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.3 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
-`npx -y @xgamesfun/solana@0.28.3 token <mint>` for a coin made elsewhere,
-or `npx -y @xgamesfun/solana@0.28.3 tool <name> '<json>'` for any tool (always with the exact version).
+The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.5 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
+`npx -y @xgamesfun/solana@0.28.5 token <mint>` for a coin made elsewhere,
+or `npx -y @xgamesfun/solana@0.28.5 tool <name> '<json>'` for any tool (always with the exact version).
 
 ## Rules (always)
 
@@ -141,7 +141,7 @@ or `npx -y @xgamesfun/solana@0.28.3 tool <name> '<json>'` for any tool (always w
 9. **When they say "put it live"**: `xsolana_publish` lists every step and its cost and gives the commands, which you
    run in the project folder exactly as given (they name the exact version; never drop it):
    - **A new economy gets a key file**, unless the project has one:
-     `npx -y @xgamesfun/solana@0.28.3 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
+     `npx -y @xgamesfun/solana@0.28.5 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
      Solana key file they already have and name themselves (`~/.config/solana/id.json`) works the same; never go
      looking for one.
    - **Say what the key file is** before anything is sent: the project's owner, and, unless the spec says otherwise,
@@ -156,7 +156,7 @@ or `npx -y @xgamesfun/solana@0.28.3 tool <name> '<json>'` for any tool (always w
      devnet SOL for an economy on devnet, real SOL for one on mainnet), any seed in a coin that already exists, and every NFT a stash, a raffle or an auction names. A
      collection they already have needs the key's address as its update authority. If they would rather not move
      those, offer the browser wallet.
-   - **Show it**: `npx -y @xgamesfun/solana@0.28.3 approve xsolana.json --keypair <key file>` prints every step with
+   - **Show it**: `npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair <key file>` prints every step with
      what it pays and trusts, the warnings, the notice and a code, and sends nothing. Give the person that printout as
      it is, not a summary of it, and ask.
    - **On their yes**, the same command with `--yes <code>`. What lands is written back into `xsolana.json`. If it

package/types/approve/wallet-adds.d.mts

@@ -0,0 +1,15 @@
+/**
+ * Whether `theirs`, the message a wallet signed, is `ours`, the message prepared for it, with nothing but a wallet's
+ * own additions. `wallet`: the address the transaction was prepared for.
+ * → { ok: true, added: [what it added, in words] } or { ok: false, why: what it did, in words after "it …" }.
+ * Two messages that are the same bytes are not this function's to judge (nothing was added).
+ */
+export declare function walletAdded(ours: any, theirs: any, wallet: any): {
+    ok: boolean;
+    added: any[];
+    why?: undefined;
+} | {
+    added?: undefined;
+    ok: boolean;
+    why: string;
+};

package/types/client/accounts.d.ts

@@ -161,6 +161,11 @@ export declare function decodeStash(data: any): {
  * collection (or null), flags, nonce, root (hex: the tree's root it holds for), payer }. Routes read it only while the
  * tree's root is still `root`; after that anyone may close it (`closeLeafIx`).
  */
+/**
+ * Where a Proven record's payer is: after the tag, eight 32-byte fields, the asset data hash's flag (and its 32 bytes
+ * when it has one), the flags and the nonce. Without an asset data hash, then with one.
+ */
+export declare const PROVEN_PAYER_AT: readonly number[];
 export declare function decodeProven(data: any): {
     asset: string;
     tree: string;