@xgamesfun/solana 0.28.5 → 0.28.6

package/README.md

@@ -77,7 +77,7 @@ codex plugin add xsolana@xgamesfun
 
 **claude.ai, ChatGPT or Claude Desktop:** add `https://xgames.fun/mcp` as a custom connector. Nothing to install.
 
-**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.5 xsolana mcp`.
+**Cursor, Cline, opencode or any MCP client:** run `npx -y --package=@xgamesfun/solana@0.28.6 xsolana mcp`.
 
 **Any agent that reads skills** (Copilot, Gemini CLI, Windsurf…): `npx skills add XGamesFun/solana-kit`.
 
@@ -88,26 +88,26 @@ are in [docs/harnesses.md](docs/harnesses.md).
 
 ```bash
 # find a worked example close to your idea
-npx -y @xgamesfun/solana@0.28.5 examples shop with loot boxes
+npx -y @xgamesfun/solana@0.28.6 examples shop with loot boxes
 
 # using a coin you already launched? read it from the chain into its "tokens" entry
-npx -y @xgamesfun/solana@0.28.5 token <its mint address>
+npx -y @xgamesfun/solana@0.28.6 token <its mint address>
 
 # does it work? where does the money go? what does it cost?
-npx -y @xgamesfun/solana@0.28.5 check xsolana.json
-npx -y @xgamesfun/solana@0.28.5 simulate xsolana.json
-npx -y @xgamesfun/solana@0.28.5 cost xsolana.json
+npx -y @xgamesfun/solana@0.28.6 check xsolana.json
+npx -y @xgamesfun/solana@0.28.6 simulate xsolana.json
+npx -y @xgamesfun/solana@0.28.6 cost xsolana.json
 
 # the whole economy in plain words, and what a cheater could get
-npx -y @xgamesfun/solana@0.28.5 explain xsolana.json
-npx -y @xgamesfun/solana@0.28.5 review xsolana.json
+npx -y @xgamesfun/solana@0.28.6 explain xsolana.json
+npx -y @xgamesfun/solana@0.28.6 review xsolana.json
 
 # go live: a key file for the project (it prints the address to send SOL to, never the key)…
-npx -y @xgamesfun/solana@0.28.5 keygen ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.6 keygen ~/.config/xsolana/my-game.json
 # …then everything going live would send, and a code; nothing is sent
-npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
+npx -y @xgamesfun/solana@0.28.6 approve xsolana.json --keypair ~/.config/xsolana/my-game.json
 # …and with that code, exactly what it listed is sent
-npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
+npx -y @xgamesfun/solana@0.28.6 approve xsolana.json --keypair ~/.config/xsolana/my-game.json --yes <code>
 ```
 
 Each command names an exact version, so you always run the release you meant to. `xsolana help` lists them all.

package/js/approve/with-key.mjs

@@ -83,7 +83,9 @@ export function approvalCode(state, spec) {
   for (const f of state.fresh ?? []) shown = shown.replaceAll(f.address, `<new ${f.name}>`);
   shown = shown.replace(WRITTEN_TIME, '<a time>');
   // The file as it is, live section and all: what the steps are built from, whether or not a line names it.
-  return createHash('sha256').update(JSON.stringify(spec)).update('\n').update(shown).digest('hex').slice(0, 8);
+  const hex = createHash('sha256').update(JSON.stringify(spec)).update('\n').update(shown).digest('hex').slice(0, 8);
+  // (on mainnet the code says so: whoever types it back types "mainnet", a step beyond the file's own word)
+  return state.cluster === 'mainnet' ? `mainnet-${hex}` : hex;
 }
 
 /** A new account of the setup in words: "mint/gold" is the mint of the token “gold”. */
@@ -99,6 +101,11 @@ const freshName = name =>
 /** What the page shows before Approve, as lines of text. `balance`: the key's lamports, or null when not read. */
 export function approvalText(state, { keyFile, balance = null }) {
   const lines = [];
+  // (on mainnet, the first thing said: what is sent is real money)
+  if (state.cluster === 'mainnet')
+    lines.push(
+      'MAINNET: everything below moves real SOL and real tokens, and cannot be undone. loot is not independently audited.',
+    );
   const kind =
     state.mode === 'change'
       ? 'a change to a live economy'
@@ -221,7 +228,7 @@ export async function approveWithKey({
     }
     if (yes === null && confirm) {
       const said = await confirm(
-        `Send ${count(state.remaining, 'transaction')} from ${key.address}? Type yes to send: `,
+        `${state.cluster === 'mainnet' ? 'This is MAINNET: real SOL and real tokens. ' : ''}Send ${count(state.remaining, 'transaction')} from ${key.address}? Type yes to send: `,
       );
       if (!said) {
         out('Nothing was sent.');

package/js/economy/explain.mjs

@@ -201,7 +201,7 @@ export function explainEconomy(economy, { now = Math.floor(Date.now() / 1000) }
     .filter(k => economy[k]?.length)
     .map(k => plural(economy[k].length, ONE[k], k));
   lines.push(
-    `${economy.name ?? 'This economy'}: ${counted.join(', ') || 'nothing yet'}. The project’s currency is ${m.currency?.symbol ?? '(none)'}${m.currency ? ` (${m.currency.source === 'sol' ? 'SOL' : m.currency.source === 'game' ? 'a token the project mints' : `an existing ${m.currency.program === 'token-2022' ? 'Token-2022 ' : ''}mint`})` : ''}. It runs on the shared loot program, devnet only: no contract of its own.`,
+    `${economy.name ?? 'This economy'}: ${counted.join(', ') || 'nothing yet'}. The project’s currency is ${m.currency?.symbol ?? '(none)'}${m.currency ? ` (${m.currency.source === 'sol' ? 'SOL' : m.currency.source === 'game' ? 'a token the project mints' : `an existing ${m.currency.program === 'token-2022' ? 'Token-2022 ' : ''}mint`})` : ''}. It runs on the shared loot program, on ${realMoney() ? 'mainnet (real money)' : 'devnet'}: no contract of its own.`,
   );
   if (economy.prompt) lines.push(`Asked for: “${economy.prompt}”`);
 

package/js/mcp/tools.mjs

@@ -297,7 +297,7 @@ export const tools = [
     name: 'xsolana_guide',
     annotations: READ,
     description:
-      'Read this first whenever someone wants a web3 economy, game economy, token economy, NFT mechanic or onchain reward system: a shop, loot boxes or packs, gacha, a lottery or raffle, an auction (highest bid wins, the outbid refunded at once), staking or a farm, crafting or merging, seasons and emissions, a prediction pool or contest, quests and airdrops, holder-gated drops, using NFTs of any other collection in a game. loot is ONE shared Solana program (devnet until it is audited): the economy is a JSON spec, not a new smart contract, so never write Anchor/Rust for what it covers. Returns every part an economy can have (fields from the schema, who acts at play time, fees), how to write a spec, and what loot cannot do (with the nearest alternative). Pass `part` for one part with its nested shapes.',
+      'Read this first whenever someone wants a web3 economy, game economy, token economy, NFT mechanic or onchain reward system: a shop, loot boxes or packs, gacha, a lottery or raffle, an auction (highest bid wins, the outbid refunded at once), staking or a farm, crafting or merging, seasons and emissions, a prediction pool or contest, quests and airdrops, holder-gated drops, using NFTs of any other collection in a game. loot is ONE shared Solana program (on devnet, and on mainnet when the spec says "network": "mainnet"; not independently audited): the economy is a JSON spec, not a new smart contract, so never write Anchor/Rust for what it covers. Returns every part an economy can have (fields from the schema, who acts at play time, fees), how to write a spec, and what loot cannot do (with the nearest alternative). Pass `part` for one part with its nested shapes.',
     inputSchema: {
       type: 'object',
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgamesfun/solana",
-  "version": "0.28.5",
+  "version": "0.28.6",
   "mcpName": "io.github.XGamesFun/solana-kit",
   "description": "Loot boxes, gacha, shops, lotteries, auctions, NFT staking, crafting and rewards on Solana without writing a smart contract: one shared program, its JS client, a CLI, and an MCP server and skill so Claude Code, Codex or any AI agent can design, check, simulate and launch an economy.",
   "license": "Apache-2.0",

package/skills/xsolana-economy/SKILL.md

@@ -11,9 +11,9 @@ signed by a key file on the owner's own machine, once they have read what will b
 **devnet**, where nothing is real money, and on **mainnet**, where everything is: an economy is on devnet unless its
 file says `"network": "mainnet"`.
 
-The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.5 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
-`npx -y @xgamesfun/solana@0.28.5 token <mint>` for a coin made elsewhere,
-or `npx -y @xgamesfun/solana@0.28.5 tool <name> '<json>'` for any tool (always with the exact version).
+The tools are the `xsolana_*` MCP tools. Without MCP, the same from a terminal: `npx -y @xgamesfun/solana@0.28.6 <guide|examples|check|simulate|cost|explain|review|publish|status> [xsolana.json]`,
+`npx -y @xgamesfun/solana@0.28.6 token <mint>` for a coin made elsewhere,
+or `npx -y @xgamesfun/solana@0.28.6 tool <name> '<json>'` for any tool (always with the exact version).
 
 ## Rules (always)
 
@@ -141,7 +141,7 @@ or `npx -y @xgamesfun/solana@0.28.5 tool <name> '<json>'` for any tool (always w
 9. **When they say "put it live"**: `xsolana_publish` lists every step and its cost and gives the commands, which you
    run in the project folder exactly as given (they name the exact version; never drop it):
    - **A new economy gets a key file**, unless the project has one:
-     `npx -y @xgamesfun/solana@0.28.5 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
+     `npx -y @xgamesfun/solana@0.28.6 keygen ~/.config/xsolana/<name>.json`. Give the person the address it prints. A
      Solana key file they already have and name themselves (`~/.config/solana/id.json`) works the same; never go
      looking for one.
    - **Say what the key file is** before anything is sent: the project's owner, and, unless the spec says otherwise,
@@ -156,7 +156,7 @@ or `npx -y @xgamesfun/solana@0.28.5 tool <name> '<json>'` for any tool (always w
      devnet SOL for an economy on devnet, real SOL for one on mainnet), any seed in a coin that already exists, and every NFT a stash, a raffle or an auction names. A
      collection they already have needs the key's address as its update authority. If they would rather not move
      those, offer the browser wallet.
-   - **Show it**: `npx -y @xgamesfun/solana@0.28.5 approve xsolana.json --keypair <key file>` prints every step with
+   - **Show it**: `npx -y @xgamesfun/solana@0.28.6 approve xsolana.json --keypair <key file>` prints every step with
      what it pays and trusts, the warnings, the notice and a code, and sends nothing. Give the person that printout as
      it is, not a summary of it, and ask.
    - **On their yes**, the same command with `--yes <code>`. What lands is written back into `xsolana.json`. If it