shinjuku-shield 0.3.84 → 0.3.85

package/README.md

@@ -6,13 +6,13 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.84. The npm packages `shinjuku-shield` and
+This is version 0.3.85. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files; `shinjuku` is the short command.
 
 ## Set up
 
 ```sh
-npx -y --no-audit --no-fund shinjuku-shield@0.3.84 setup
+npx -y --no-audit --no-fund shinjuku-shield@0.3.85 setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -24,7 +24,7 @@ server to that host's config.
 ## The `shinjuku` command
 
 ```sh
-npm install -g shinjuku@0.3.84
+npm install -g shinjuku@0.3.85
 shinjuku help
 ```
 
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.84 mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.85 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.84", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.85", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "b73f57e58ae0466a090f5b1728e7852bab48e7d28ad6bb0f0ba9657b6cc681b1",
-  "bytes": 12505075,
-  "sourceCommit": "52a8e17d03018f2cc026f9f9d306a785ef4da9f5",
+  "sha256": "654041bce4139bfb928180cc1a3c1ff05e570d9fc51ddfa718e9d0ef7fbf9095",
+  "bytes": 12513236,
+  "sourceCommit": "1e2a8c09784450c8bc0a5d391c428d08f699c44a",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1282,5 +1282,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-23T19:32:52.495Z"
+  "publishedAt": "2026-10-23T20:33:40.235Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shield",
-  "version": "0.3.84",
+  "version": "0.3.85",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "b73f57e5",
-  "shinjukuSha256": "b73f57e58ae0466a090f5b1728e7852bab48e7d28ad6bb0f0ba9657b6cc681b1",
+  "shinjukuRelease": "654041bc",
+  "shinjukuSha256": "654041bce4139bfb928180cc1a3c1ff05e570d9fc51ddfa718e9d0ef7fbf9095",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -62798,7 +62798,7 @@ async function readRelayConfig({ serviceUrl: serviceUrl2, fetchImpl, id }) {
 async function submitRelayedDeposit(input) {
   return withWalletLease(input.store, input.deps ?? {}, () => submitRelayedDepositLeased(input));
 }
-async function submitRelayedDepositLeased({ store, connection, programId, proofTools, depositId, serviceUrl: serviceUrl2, deps = {} }) {
+async function submitRelayedDepositLeased({ store, connection, programId, proofTools, depositId, serviceUrl: serviceUrl2, historyUrl, deps = {} }) {
   assertDepositId(depositId);
   const name = walName(depositId);
   const record = store.readWal(name);
@@ -62812,7 +62812,8 @@ async function submitRelayedDepositLeased({ store, connection, programId, proofT
   const source = new import_web3101.PublicKey(record.relay.tokenAccount);
   const pause3 = deps.pause ?? delay;
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const loadHistory = () => finalizedHistory({ store, connection, id, proofTools, deps });
+  const historyConnection = connection.historyRpcChoice !== void 0 || connection.historyRpc ? connection : connectSplit(connection, historyUrl);
+  const loadHistory = () => finalizedHistory({ store, connection: historyConnection, id, proofTools, deps });
   const refuse19 = async (reason) => {
     record.relay.approvedOnChain = (await relaySource(connection, id, record)).approved;
     record.relay.lastRefusal = { reason, at: (/* @__PURE__ */ new Date()).toISOString() };
@@ -62981,8 +62982,42 @@ function settleTransaction(connection, signature2) {
     maxSupportedTransactionVersion: 1
   }));
 }
+async function foundSettle(connection, id, record, intent) {
+  let entries;
+  try {
+    if (typeof connection.getSignaturesForAddress !== "function") return void 0;
+    entries = await retryRpc2(() => connection.getSignaturesForAddress(intent.address, { limit: SETTLE_SEARCH_LIMIT }, "finalized"));
+  } catch {
+    return void 0;
+  }
+  if (!Array.isArray(entries)) return void 0;
+  for (const entry of [...entries].reverse()) {
+    if (entry?.err !== null || typeof entry.signature !== "string") continue;
+    const transaction = await settleTransaction(connection, entry.signature).catch(() => void 0);
+    if (!transaction?.meta || transaction.meta.err) continue;
+    const landing = returnedIntent(transaction, id, record);
+    if (landing) return { signature: entry.signature, transaction, landing };
+  }
+  return void 0;
+}
 async function relayReceipt({ connection, id, record, intent, loadHistory, transaction: read, walkMs }) {
   const signature2 = record.relay.result?.signature;
+  if (!signature2) {
+    const found = await foundSettle(connection, id, record, intent);
+    if (found) {
+      const { transaction, landing } = found;
+      record.relay.result = { signature: found.signature, slot: transaction.slot };
+      return {
+        intent: intent.address.toBase58(),
+        indexAfter: landing.indexAfter,
+        signature: found.signature,
+        slot: transaction.slot,
+        feeLamports: transaction.meta.fee,
+        broadcaster: landing.broadcaster.toBase58(),
+        source: landing.source.toBase58()
+      };
+    }
+  }
   if (signature2) {
     const transaction = (read ? await read : void 0) ?? await settleTransaction(connection, signature2);
     const landing = transaction?.meta && !transaction.meta.err ? returnedIntent(transaction, id, record) ?? settleFunder(transaction, id, intent.address) : void 0;
@@ -63378,7 +63413,7 @@ async function publishDepositMemo({ serviceUrl: serviceUrl2, record, fetchImpl =
   const stored = await fetchMemoFromService(serviceUrl2, record.memoDigest, { fetchImpl });
   if (!stored || !Buffer.from(stored).equals(bytes2)) fail11("memo_publish_readback_mismatch");
 }
-var import_web3101, DEPOSIT_WAL_SCHEMA, P03_BINDING, BUFFER_SIZE, DEPOSIT_INTENT_LEN, DEPOSIT_RECORD_LEN, CLOSE_BUFFER, COMPACT_DEPOSIT_INTENT, BUFFER_LIFETIME_SLOTS, BUFFER_MIN_REMAINING_SLOTS, FEE_MARGIN_LAMPORTS, RESOLVED_STATES, LANDED_STATES, hex, field32, walName, LANDED_WALK_MS, SLOW_WALK, delay, DEPOSIT_RELAY_SCHEMA, DEPOSIT_RECLAIM_SCHEMA, DEPOSIT_RELAY_CONFIG_SCHEMA, APPROVE_COMPUTE_UNITS, RECLAIM_COMPUTE_UNITS, RELAY_ROUNDS, RELAY_KEY_PROBES, MAX_SCAN_COUNT, RELAY_REQUEST_TIMEOUT_MS, RELAY_MAX_WAIT_SECONDS, RELAY_REFUSALS, RECLAIM_REFUSALS, relayHex, SPLIT_MAX, DEFAULT_SPLIT_PARTS, SPLIT_UNIT_ATOMIC, FUNDS_PLAN_SCHEMA, FUNDS_PLAN_PREFIX, relayKeyPool, __test;
+var import_web3101, DEPOSIT_WAL_SCHEMA, P03_BINDING, BUFFER_SIZE, DEPOSIT_INTENT_LEN, DEPOSIT_RECORD_LEN, CLOSE_BUFFER, COMPACT_DEPOSIT_INTENT, BUFFER_LIFETIME_SLOTS, BUFFER_MIN_REMAINING_SLOTS, FEE_MARGIN_LAMPORTS, RESOLVED_STATES, LANDED_STATES, hex, field32, walName, LANDED_WALK_MS, SLOW_WALK, delay, DEPOSIT_RELAY_SCHEMA, DEPOSIT_RECLAIM_SCHEMA, DEPOSIT_RELAY_CONFIG_SCHEMA, APPROVE_COMPUTE_UNITS, RECLAIM_COMPUTE_UNITS, RELAY_ROUNDS, RELAY_KEY_PROBES, MAX_SCAN_COUNT, RELAY_REQUEST_TIMEOUT_MS, RELAY_MAX_WAIT_SECONDS, RELAY_REFUSALS, RECLAIM_REFUSALS, relayHex, SPLIT_MAX, DEFAULT_SPLIT_PARTS, SPLIT_UNIT_ATOMIC, FUNDS_PLAN_SCHEMA, FUNDS_PLAN_PREFIX, relayKeyPool, SETTLE_SEARCH_LIMIT, __test;
 var init_deposit = __esm({
   "wallet/src/deposit/deposit.mjs"() {
     "use strict";
@@ -63486,6 +63521,7 @@ var init_deposit = __esm({
     FUNDS_PLAN_SCHEMA = "carbon-shielded-wallet/add-funds/v1";
     FUNDS_PLAN_PREFIX = "add-funds-";
     relayKeyPool = (store, record) => record.relay.keyPool ?? record.pool ?? store.state.pool;
+    SETTLE_SEARCH_LIMIT = 10;
     __test = Object.freeze({ parseBuffer });
   }
 });
@@ -75305,6 +75341,7 @@ async function runSelfCustodyDeposit(args) {
     throw new Error("deposit requires --program, --deposit-id, --amount <atomic>, --proof-tools, and --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
   }
   const proofTools = loadP03PublicPaymentProofTools(flag(args, "--proof-tools"));
+  const historyUrl = historyRpcUrl(flag(args, "--history-rpc"));
   const path = walletPath(pool2);
   const relay = args.includes("--relay");
   const indexFlag = flag(args, "--one-time-index");
@@ -75361,7 +75398,7 @@ async function runSelfCustodyDeposit(args) {
       }, null, 2));
       return;
     }
-    const result = await (relay ? submitRelayedDeposit : submitDeposit)({ ...common, serviceUrl: flag(args, "--service") });
+    const result = await (relay ? submitRelayedDeposit : submitDeposit)({ ...common, serviceUrl: flag(args, "--service"), ...relay ? { historyUrl } : {} });
     console.log(JSON.stringify({
       ...result,
       next: result.state === "published" ? "run recover; export and verify two fresh backups" : "rerun with --submit --service <facilitator URL> to publish the memo"
@@ -151811,7 +151848,7 @@ function parseArgs2(args) {
   if (!options["dry-run"] && FOR_RUN.some((key) => !options[key])) fail41("arguments_missing");
   return options;
 }
-async function main5(args = process.argv.slice(2)) {
+async function main5(args = process.argv.slice(2), { output: output2 = (result) => console.log(JSON.stringify(result)) } = {}) {
   if (args.length === 1 && args[0] === "--help") {
     console.log(USAGE3);
     return;
@@ -151894,20 +151931,20 @@ async function main5(args = process.argv.slice(2)) {
         return { id, amountAtomic: record.amountAtomic, accountCommitment: record.mergeAccountCommitment, noteCommitments: record.mergeNoteCommitments ?? [] };
       });
       if (dryRun) {
-        console.log(JSON.stringify({
+        output2({
           dryRun: true,
           resume: resume.map((entry) => ({ amountAtomic: entry.amountAtomic, amount: usdc9(entry.amountAtomic) })),
           next: "run the same command without --dry-run: it finishes these merges first (never pays twice)"
-        }));
+        });
         return;
       }
       const results2 = [];
       for (const entry of resume) results2.push(await runOne(entry));
-      console.log(JSON.stringify({
+      output2({
         success: true,
         resumed: results2,
         next: "after the next pool anchor (up to 5 minutes; about 30 s on a pool with sub-anchors): balance --refresh, then rerun merge (it plans the next round, or says nothing is left) or your payment"
-      }));
+      });
       return;
     }
     const snapshotRead = readBalanceSnapshot(store);
@@ -151915,8 +151952,8 @@ async function main5(args = process.argv.slice(2)) {
     if (balance.status !== "current" || snapshotRead.snapshot?.programId !== String(options.program)) fail41("balance_walk_not_current_run_balance_refresh");
     if (balance.detail.inFlight.some((item) => item.kind !== "merge")) fail41("in_flight_work_finish_first");
     const plan = planMerge({ snapshot: snapshotRead.snapshot, exitReserved: exitReservedNoteCommitments(store) });
-    const shown = (output2) => ({ amountAtomic: output2.valueAtomic, amount: usdc9(output2.valueAtomic) });
-    const merges = plan.merge.map((output2) => ({ id: nextMergeId(store, output2.commitment), amountAtomic: output2.valueAtomic, accountCommitment: output2.commitment })).filter((entry) => entry.id !== void 0);
+    const shown = (output3) => ({ amountAtomic: output3.valueAtomic, amount: usdc9(output3.valueAtomic) });
+    const merges = plan.merge.map((output3) => ({ id: nextMergeId(store, output3.commitment), amountAtomic: output3.valueAtomic, accountCommitment: output3.commitment })).filter((entry) => entry.id !== void 0);
     const summary = {
       totalAtomic: plan.totalAtomic,
       total: usdc9(plan.totalAtomic),
@@ -151928,19 +151965,19 @@ async function main5(args = process.argv.slice(2)) {
     const nothing = merges.length === 0;
     const why = !plan.keep || plan.merge.length + plan.later.length === 0 ? "nothing to merge: one funded account (or none) holds the shielded balance, so one payment already draws it all (with up to 3 notes)" : plan.merge.length === 0 ? `nothing to merge this round: a payment already draws ${plan.notes.length} notes, the most one spend takes is ${MAX_RESPEND_NOTES}. Make one payment first (its change joins those notes into one account), then rerun merge` : void 0;
     if (dryRun || nothing) {
-      console.log(JSON.stringify({ dryRun, ...summary, ...why ? { next: why } : nothing ? { next: "nothing left to merge" } : {
+      output2({ dryRun, ...summary, ...why ? { next: why } : nothing ? { next: "nothing left to merge" } : {
         next: "run the same command without --dry-run (with --proof-tools, --profile, --facilitator); nothing was signed or sent"
-      } }));
+      } });
       return;
     }
     const results = [];
     for (const entry of merges) results.push(await runOne(entry));
-    console.log(JSON.stringify({
+    output2({
       success: true,
       ...summary,
       merged: results,
       next: plan.later.length ? "after the next pool anchor (up to 5 minutes; about 30 s on a pool with sub-anchors): make your payment (it draws the kept account and the new notes), then balance --refresh and rerun merge for the accounts in later" : "after the next pool anchor (up to 5 minutes; about 30 s on a pool with sub-anchors), rerun your payment: it draws the kept account plus the new notes. balance --refresh shows the new state"
-    }));
+    });
   } finally {
     await release();
   }
@@ -154914,7 +154951,8 @@ function fundsView(store, plan, { now = Date.now(), running } = {}) {
       state: last?.stopped ? "stopped" : idle ? "not running" : last?.until ? "waiting" : "next",
       ...last?.waitsFor ? { waitsFor: last.waitsFor } : {},
       ...last?.until && !idle ? { until: last.until } : {},
-      ...last?.stopped ? { code: last.stopped } : {},
+      // A wait's code (K29 T13): the terminal says the wait in words only.
+      ...last?.stopped ? { code: last.stopped } : last?.code ? { code: last.code } : {},
       ...last?.said?.length ? { said: last.said } : {}
     };
   });
@@ -155087,20 +155125,44 @@ var TRANSIENT = [
   /^E[A-Z0-9_]{1,40}$/
 ];
 var SOON_CODES = /(_retry_same_|_rerun$|wallet_process_locked|wallet_locked|_wait_next_epoch|_anchor_not_finalized)/;
-function transient(ctx, run5, waitsFor) {
+var RETRY_WORDS = [
+  [/^p03_deposit_landed_history_walk_slow_retry_later$/, {
+    now: "the deposit is in the pool; the wallet could not read the pool history in time to confirm it, so it reads again",
+    waitsFor: "a new read of the pool history to confirm the deposit (the deposit is in the pool)"
+  }],
+  [/^p03_deposit_(landed_history_pending|receipt_transaction_unavailable|receipt_evidence_missing)_retry_later$/, {
+    now: "the deposit is in the pool; the chain does not show the wallet its receipt yet, so it reads again",
+    waitsFor: "the chain to show the deposit's receipt (the deposit is in the pool)"
+  }],
+  [/^p03_deposit_relay_not_settled_rerun_same_id$/, {
+    now: "the facilitator has not moved the deposit into the pool yet, so the wallet asks again",
+    waitsFor: "the facilitator to move the deposit into the pool"
+  }],
+  [/^rpc_unreachable$/, { now: "the RPC did not answer, so the wallet asks again", waitsFor: "an answer from the RPC (it did not answer)" }],
+  [/^rpc_rate_limited$/, { now: "the RPC asked the wallet to slow down, so it asks again", waitsFor: "the RPC to take requests again (it asked the wallet to slow down)" }],
+  [/^(wallet_process_locked|p03_pocket_cli_wallet_locked)$/, {
+    now: "another wallet command uses this wallet right now, so add-funds tries again",
+    waitsFor: "the other wallet command to finish with this wallet"
+  }]
+];
+var RETRY_ANY = { now: "the step did not finish this time and nothing was lost, so it runs again", waitsFor: "a new try of the step (nothing was lost)" };
+var NO_CODE = { now: "the step ended without an error code (it was stopped, or a connection was refused), so it runs again", waitsFor: "a new try of the step (it ended without an error code)" };
+function transient(ctx, run5, words2) {
   ctx.transient += 1;
-  if (ctx.transient > MAX_TRANSIENT) return stop2(run5, `the step failed ${MAX_TRANSIENT} times in a row (${run5.code ?? "no error code"})`);
-  return wait(has(run5, SOON_CODES) ? SOON_MS : LATER_MS, waitsFor, { transient: true });
+  if (ctx.transient > MAX_TRANSIENT) return { ...stop2(run5, words2.waitsFor), tries: true };
+  const code2 = run5.code ?? run5.codes[0];
+  return wait(has(run5, SOON_CODES) ? SOON_MS : LATER_MS, words2.waitsFor, { transient: true, said: words2.now, ...code2 ? { code: code2 } : {} });
 }
 function otherwise(ctx, run5) {
   if (run5.aborted) return stop2(run5, "stopped");
   if (run5.exit === 2) return stop2(run5, "the step's command line was refused");
-  if (!run5.code && !run5.codes.length) return transient(ctx, run5, "a new try of the step (it ended without an error code)");
+  if (!run5.code && !run5.codes.length) return transient(ctx, run5, NO_CODE);
   if (has(run5, FACILITATOR_LATER)) {
     return wait(LATER_MS, has(run5, /_paused_retry_later$/) ? "the facilitator to take this step again (it is paused right now)" : "the facilitator's relayer to have its fee money again");
   }
   if (run5.codes.some((code2) => TRANSIENT.some((pattern) => pattern.test(code2)))) {
-    return transient(ctx, run5, `a new try (${run5.code ?? run5.codes[0]}: a later run clears it)`);
+    const codes = [run5.code, ...run5.codes].filter(Boolean);
+    return transient(ctx, run5, RETRY_WORDS.find(([pattern]) => codes.some((code2) => pattern.test(code2)))?.[1] ?? RETRY_ANY);
   }
   return stop2(run5, `the step refused (${run5.code ?? run5.codes[0]})`);
 }
@@ -155121,7 +155183,7 @@ function depositArgs(ctx, submit, part) {
     usdcFlag(part.amountAtomic),
     "--service",
     values.service,
-    ...submit ? ["--submit"] : []
+    ...submit ? ["--submit", ...historyRpcArgs(ctx)] : []
   ];
 }
 function crowdFlags(ctx) {
@@ -155687,20 +155749,26 @@ async function addFunds(values, deps) {
       }
       const label = outcome.label ?? next ?? stage;
       if (outcome.kind === "stop") {
-        const said = (outcome.run?.held ?? []).filter((text3) => !/^(Help|next): /.test(text3));
-        if (!said.length && outcome.run?.last) said.push(outcome.run.last);
+        const said = outcome.tries ? [] : (outcome.run?.held ?? []).filter((text3) => !/^(Help|next): /.test(text3));
+        if (!said.length && outcome.run?.last && !outcome.tries) said.push(outcome.run.last);
         for (const text3 of said) io.err(`  ${text3}
 `);
         plan.status = { stage: label, at: iso2(deps.now()), stopped: outcome.run?.code ?? outcome.run?.codes?.[0] ?? "refused", waitsFor: outcome.waitsFor, ...said.length ? { said } : {} };
         save2();
-        throw failure("stopped", `the ${label} step needs you: ${outcome.waitsFor}${said.length ? " (its own line and hint are above)" : ""}. Fix that, then rerun this same add-funds command: it continues at ${label}`);
+        throw failure("stopped", outcome.tries ? `add-funds stopped after ${MAX_TRANSIENT} tries of the ${label} step: it still waits for ${outcome.waitsFor}. Nothing was lost. Run this same add-funds command again later: it continues at ${label}` : `the ${label} step needs you: ${outcome.waitsFor}${said.length ? " (its own line and hint are above)" : ""}. Fix that, then rerun this same add-funds command: it continues at ${label}`);
       }
       const until = iso2(deps.now() + outcome.ms);
-      plan.status = { stage: label, at: iso2(deps.now()), waitsFor: outcome.waitsFor, until };
+      plan.status = { stage: label, at: iso2(deps.now()), waitsFor: outcome.waitsFor, until, ...outcome.code ? { code: outcome.code } : {} };
       save2();
-      if (outcome.waitsFor !== lastWait) {
+      if (outcome.transient) {
+        const at = `${until.slice(11, 19)} UTC`;
+        ctx.say(label, values.has("--once") ? `${outcome.said} on the next add-funds run (--once ends this one here; the next try can start at ${at})` : ctx.transient === 1 ? `${outcome.said} at ${at} by itself (nothing to do)` : `try ${ctx.transient} of ${MAX_TRANSIENT}: still waits for ${outcome.waitsFor}; next try at ${at}`);
+        lastWait = outcome.waitsFor;
+      } else if (outcome.waitsFor !== lastWait) {
         ctx.say(label, `waits for ${outcome.waitsFor}; next try at ${until}${outcome.every ? ` (${outcome.every})` : ""}`);
         lastWait = outcome.waitsFor;
+      } else if (!outcome.every) {
+        ctx.say(label, `still waits for ${outcome.waitsFor}; next try at ${until}`);
       }
       if (values.has("--once")) {
         plan.status = { ...plan.status, ended: iso2(deps.now()) };
@@ -155708,7 +155776,7 @@ async function addFunds(values, deps) {
         printEnd(deps, fundsView(store, plan, { now: deps.now(), running: false }), ctx.terminal);
         return;
       }
-      await sleep3(outcome.ms, abort.signal);
+      await (deps.sleep ?? sleep3)(outcome.ms, abort.signal);
     }
     plan.status = { ...plan.status ?? { stage: currentStage(store, plan) }, ended: iso2(deps.now()) };
     save2();
@@ -158018,7 +158086,7 @@ var COMMANDS = [
       flag2("--profile", "<file>", "the facilitator's public seller profile, public-profile.json (pocket fill; needed only with --pockets 1 or more)"),
       flag2("--pockets", "<n>", "0 to 20; default 0 (no pocket and no dwell). 1 or more fills that many pockets after the deposit (pocket fill). A new payment never pays from a pocket: it pays through Shinjuku from the shielded balance, so most wallets leave this out", { check: "count" }),
       flag2("--pocket-size", "<usdc>", "the size of each pocket, in USDC; default 1 (1 USDC), the size our facilitator uses", { check: "atomic", usdc: true }),
-      { ...HISTORY_RPC_FLAG, about: `add-funds passes it only to the steps that read the pool's history (balance --refresh, pocket fill, and its dwell check; never to a deposit or Privacy Cash step): ${HISTORY_RPC_FLAG.about}` },
+      { ...HISTORY_RPC_FLAG, about: `add-funds passes it only to the steps that read the pool's history (balance --refresh, pocket fill, its dwell check, and the deposit's walk that confirms a deposit that landed without the facilitator's answer; never to a Privacy Cash step): ${HISTORY_RPC_FLAG.about}` },
       flag2("--from-key-file", "<file>", "--route privacy-cash: a solana-keygen JSON key of your own wallet that pays into Privacy Cash and owns its notes"),
       flag2("--crowd-amount", "<usdc>", "--route privacy-cash: whole USDC to put into Privacy Cash first (13 = 13 USDC); leave it out to spend notes that key already holds there", { check: "atomic", usdc: true }),
       { ...PRIVACY_CASH_VIA_FLAG, about: `--route privacy-cash: ${PRIVACY_CASH_VIA_FLAG.about}` },
@@ -158103,6 +158171,7 @@ var COMMANDS = [
       flag2("--deposit-id", "<id>", "your name for this deposit; reuse it for every retry", { required: true }),
       flag2("--amount", "<usdc>", "USDC to deposit (0.03 = 3 cents)", { required: true, check: "atomic", usdc: true }),
       ...rpcFlags,
+      { ...HISTORY_RPC_FLAG, about: `with --relay --submit, only for the pool-history walk that confirms a deposit that landed without the facilitator's answer: ${HISTORY_RPC_FLAG.about}` },
       bool2("--submit", "send the recorded deposit (second run)"),
       flag2("--service", "<url>", "facilitator that stores the deposit memo (use with --submit; with --relay, on both runs)"),
       bool2("--relay", "deposit from a one-time address of this wallet that holds only USDC; the facilitator pays every fee and rent, so it needs no SOL"),
@@ -158805,7 +158874,7 @@ var COMMANDS = [
       "After setup it needs only --amount and --to: config.json gives the wallet, the passphrase file, the proof tools, the profile, the program, and the facilitator. Without setup, give every flag marked required (the old form also takes --to <USDC token account> --recipient-owner <owner>).",
       "The wallet pays exactly --amount to a note it owns and keeps the rest private. The facilitator relays the note's exit to the recipient and pays every fee. No wallet key signs.",
       "The recipient must already hold USDC (a Solana address with a USDC account, for example a Phantom address that received USDC); the command checks it first and sends nothing to an address without one. It refuses this wallet's own address: an exit there would show on chain that the money is yours. Best: an address that never sent USDC into this wallet.",
-      `--amount all sends the whole private balance. When the balance is in more than one part, it says so and sends nothing: join the parts first with ${CLI2} merge (a private move inside this wallet; about 2 minutes per extra part), then run it again.`,
+      "--amount all sends the whole private balance. When the balance is in more than one part, the same command joins the parts first (a private move inside this wallet, no fee; nothing leaves it; about 2 minutes per extra part, after a random wait of up to 60 s), then sends all of it. Ctrl+C stops it; the same command again goes on and never sends twice.",
       "The command prints the unshield id first. If it stops, run the same command with --unshield-id <that id> added: it finishes that unshield and never sends twice.",
       "In a terminal it ends with one plain line (what was sent, to whom, the exit transaction) and the new private balance: after an exit the wallet reads the balance again itself (the same walk as balance --refresh, over the same connection; Tor when setup recorded it). A program, or --json, gets the result as JSON.",
       `--parts and --max-delay-minutes make a private send (${CLI2} unshield --amount 3 --parts 3 --max-delay-minutes 20 --to <your wallet address>): the plan (part sizes, part ids <unshield-id>-p1.., earliest times) is saved in the wallet before part 1, each part is one unshield, and a stopped run continues at the first part not yet exited when the same command with its --unshield-id runs again. The wallet is free for other commands while a part waits. Keep the command running until it prints its result.`,
@@ -159631,15 +159700,17 @@ async function runUnshieldCommand(args, values, deps, io) {
     setArg("--to", getAssociatedTokenAddressSync(mint, owner, true, TOKEN_PROGRAM_ID).toBase58());
     setArg("--recipient-owner", owner.toBase58());
   }
-  if (values.get("--amount") === "all") setArg("--amount", await sendAllAtomic(values, deps, io, openStore));
   let id = values.get("--unshield-id");
-  if (id === void 0) {
+  const ensureId = () => {
+    if (id !== void 0) return;
     id = `unshield-${randomBytes35(6).toString("hex")}`;
     setArg("--unshield-id", id);
     values.set(UNSHIELD_MADE_ID, id);
     io.err(`unshield id: ${id} (if this command stops, run it again with --unshield-id ${id} added: it finishes this unshield and never sends twice)
 `);
-  }
+  };
+  if (values.get("--amount") === "all") setArg("--amount", await sendAllAtomic(values, deps, io, openStore, ensureId));
+  ensureId();
   const gated = await spendGate(callArgs, values, deps, io, { amountAtomic: values.get("--amount"), again: ` with --unshield-id ${id}` });
   let answer;
   const returned = await deps.unshieldMain(gated, { output: (result) => {
@@ -159743,25 +159814,86 @@ async function refreshAfterUnshield(walletFile, values, deps, io) {
     restore();
   }
 }
-async function sendAllAtomic(values, deps, io, openStore) {
+async function sendAllAtomic(values, deps, io, openStore, ensureId) {
   const store = openStore();
   let report = computeBalance({ store, snapshotRead: readBalanceSnapshot(store), source: "local", now: deps.now() });
   if (report.status !== "current") report = await refreshAfterUnshield(values.get("--wallet"), values, deps, io) ?? report;
+  const notCurrent = (read) => new PublicFailure(`balance_not_current: --amount all needs the current private balance, and it is not current (${balanceNotCurrentWhy(read)}); nothing was sent. Run ${CLI2} balance --refresh in a minute, then this command again, or give the amount, like ${UNSHIELD_EXAMPLE}`);
   const empty = report.status === "empty" || report.status === "current" && report.atomic === "0";
-  if (!empty && (report.status !== "current" || !/^[1-9][0-9]*$/.test(String(report.atomic ?? "")))) {
-    throw new PublicFailure(`balance_not_current: --amount all needs the current private balance, and it is not current (${balanceNotCurrentWhy(report)}); nothing was sent. Run ${CLI2} balance --refresh in a minute, then this command again, or give the amount, like ${UNSHIELD_EXAMPLE}`);
-  }
   if (empty) {
     throw new PublicFailure(`no_spendable_account: the private balance is 0 USDC, so --amount all has nothing to send; nothing was sent. Add funds first (${CLI2} help add-funds)`);
   }
   const parts = joinParts(store);
-  if (parts?.parts > 1) {
-    throw new PublicFailure(`unshield_joining_accounts: the private balance (${usdcOr(report.atomic)}) is in ${parts.parts} parts, and one unshield sends from one part; nothing was sent. Join the parts first with ${CLI2} merge (a private move inside this wallet, no fee; about ${parts.minutes} minutes), then run ${CLI2} unshield --amount all --to <your wallet address> again`);
-  }
-  io.err(`--amount all: the whole private balance, ${usdcOr(report.atomic)}
+  const join40 = parts?.joining > 0 || parts?.parts > 1 && report.status === "current";
+  if (join40) report = await joinForSendAll(report, parts, store, values, deps, io, ensureId);
+  if (report.status !== "current" || !/^[1-9][0-9]*$/.test(String(report.atomic ?? ""))) throw notCurrent(report);
+  if (!join40) io.err(`--amount all: the whole private balance, ${usdcOr(report.atomic)}
 `);
   return report.atomic;
 }
+var SEND_ALL_JOIN_ROUNDS = 3;
+async function joinForSendAll(report, parts, store, values, deps, io, ensureId) {
+  const count2 = parts.parts + parts.joining;
+  const known = /^[0-9]+$/.test(String(report.atomic ?? ""));
+  io.err(`--amount all: the private balance${known ? `, ${usdcOr(report.atomic)},` : ""} is in ${count2} parts, and one unshield sends from one part. The wallet joins the parts first (a private move inside this wallet, no fee; nothing leaves it), then sends all of it: about ${joinMinutes(count2)} min. Ctrl+C stops it; the same command again goes on and never sends twice
+`);
+  ensureId();
+  if (parts.joining === 0) {
+    const waitMs = Math.floor((deps.random ?? Math.random)() * (JOIN_SOON_MAX_MS + 1));
+    io.err(`the join starts in ${Math.round(waitMs / 1e3)} s: a random wait, so the chain does not show the join right after your request
+`);
+    await (deps.sleep ?? ((ms) => new Promise((done) => {
+      setTimeout(done, ms);
+    })))(waitMs);
+  }
+  const history = values.get("--history-rpc");
+  const mergeArgs = [
+    "--wallet",
+    values.get("--wallet"),
+    "--passphrase-file",
+    values.get("--passphrase-file"),
+    "--program",
+    values.get("--program"),
+    "--proof-tools",
+    values.get("--payer-proof-tools"),
+    "--profile",
+    values.get("--profile"),
+    "--facilitator",
+    new URL(values.get("--facilitator")).origin,
+    ...values.has("--rpc-file") ? ["--rpc-file", values.get("--rpc-file")] : [],
+    ...history ? ["--history-rpc", history] : []
+  ];
+  const startedAt = deps.now();
+  let joined = 0;
+  let left = parts;
+  let keep;
+  let read;
+  for (let round = 1; round <= SEND_ALL_JOIN_ROUNDS; round += 1) {
+    let answer;
+    try {
+      await deps.mergeMain(mergeArgs, { output: (result) => {
+        answer = result;
+      } });
+    } catch (error) {
+      io.err("note: the join stopped, so the unshield did not start; nothing was sent\n");
+      throw error;
+    }
+    const merged = (answer?.merged ?? answer?.resumed ?? []).filter((entry) => entry?.state === "merged").length;
+    joined += merged;
+    keep = answer?.keep?.amountAtomic ?? keep;
+    read = await refreshAfterUnshield(values.get("--wallet"), values, deps, io);
+    left = joinParts(store);
+    if (read?.status === "current" && left?.parts <= 1 && left.joining === 0) {
+      const seconds2 = Math.max(0, Math.round((deps.now() - startedAt) / 1e3));
+      io.err(`joined the ${count2} parts in ${Math.floor(seconds2 / 60)} min ${seconds2 % 60} s; sending all ${usdcOr(read.atomic)} now
+`);
+      return read;
+    }
+    if (!read || read.status !== "current" || merged === 0) break;
+  }
+  const remaining = left ? left.parts + left.joining : void 0;
+  throw new PublicFailure(`unshield_joining_accounts: the wallet joined ${joined} part${joined === 1 ? "" : "s"} of your private balance into the largest one` + (remaining > 1 ? `, and it is still in ${remaining} parts` : read ? ", but the balance walk after the join is not current yet" : ", but the balance could not be read again after the join") + `; nothing was sent. Send a fixed amount up to the largest part${keep ? ` (${usdcOr(keep)})` : ""} now, like ${UNSHIELD_EXAMPLE} (that send also joins the parts it draws), or run ${CLI2} unshield --amount all --to <your wallet address> again in a few minutes: it goes on with the next join`);
+}
 async function runUnshieldCancel(values, deps, io) {
   const walletFile = resolve38(values.get("--wallet"));
   const passphrase2 = payerPassphrase(values, deps);