shinjuku-shielded 0.3.12 → 0.3.13

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "d769dad321e1a1f88e0557c65b56336b2d6356fbd0167bc0f4acbed55793b27a",
-  "bytes": 11120051,
-  "sourceCommit": "864030c87ae9e0010ece0881f2e4c22fd5fac0bd",
+  "sha256": "d2ba7e62eff143df57466d5f0ba534856e29c88007eafc22c3dfaeb89535eadb",
+  "bytes": 11120794,
+  "sourceCommit": "21b7da9a5ca048b184cfec73d82ab94dfe9dff14",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "d769dad3",
-  "shinjukuSha256": "d769dad321e1a1f88e0557c65b56336b2d6356fbd0167bc0f4acbed55793b27a",
+  "shinjukuRelease": "d2ba7e62",
+  "shinjukuSha256": "d2ba7e62eff143df57466d5f0ba534856e29c88007eafc22c3dfaeb89535eadb",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -91035,7 +91035,7 @@ async function payViaFloat({
   if (response.ok && response.status !== 202) {
     let settled;
     try {
-      const encoded = response.headers.get("PAYMENT-RESPONSE");
+      const encoded = response.headers.get("PAYMENT-RESPONSE") ?? response.headers.get("X-PAYMENT-RESPONSE");
       settled = encoded && encoded.length <= 128 * 1024 ? decodePaymentResponseHeader(encoded) : void 0;
     } catch {
       settled = void 0;
@@ -119055,13 +119055,13 @@ init_http();
 import { createHash as createHash26 } from "node:crypto";
 
 // wallet/src/pocket/auto.mjs
-var import_web3124 = __toESM(require_index_cjs(), 1);
+var import_web3125 = __toESM(require_index_cjs(), 1);
 init_book();
 init_fill();
 
 // wallet/src/pocket/cli.mjs
 init_fs();
-var import_web3123 = __toESM(require_index_cjs(), 1);
+var import_web3124 = __toESM(require_index_cjs(), 1);
 init_store();
 init_processLease();
 init_chain2();
@@ -119197,7 +119197,259 @@ async function scanPockets({ store, connection, gap = 5, legacyPools = [] }) {
 init_proxy();
 init_rpcDefault();
 init_secretFile();
-var fail31 = (reason) => {
+
+// wallet/src/move/migration.mjs
+init_fs();
+var import_web3123 = __toESM(require_index_cjs(), 1);
+init_shielded_wallet();
+init_store();
+import { join as join21 } from "node:path";
+init_proxy();
+var DECIMAL4 = /^(0|[1-9][0-9]{0,90})$/;
+var HEX644 = /^[0-9a-f]{64}$/;
+var PRIVATE_HOST2 = /^(localhost|127\.0\.0\.1|\[::1\]|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+)$/;
+var fail31 = (code, detail) => new Error(`${code}: ${detail}`);
+var releaseInvalid = (why) => fail31(
+  "wallet_move_release_invalid",
+  `the facilitator's release document names its pools in a shape this wallet does not accept (${why}); nothing was moved. Update the wallet (npx -y shinjuku-shielded@latest), then run shinjuku-wallet move again`
+);
+var isPubkey2 = (value) => {
+  try {
+    return typeof value === "string" && new import_web3123.PublicKey(value).toBase58() === value;
+  } catch {
+    return false;
+  }
+};
+function poolOrigin(value, pool, facilitator) {
+  let url;
+  try {
+    url = new URL(String(value));
+  } catch {
+    url = void 0;
+  }
+  if (!url || url.username || url.password || url.search || url.hash) throw releaseInvalid("a facilitatorOrigin is not a plain URL");
+  if (!(url.protocol === "https:" || isOnionOrigin(url) || url.protocol === "http:" && PRIVATE_HOST2.test(url.hostname))) {
+    throw releaseInvalid("a facilitatorOrigin is not https");
+  }
+  if (url.origin !== new URL(facilitator).origin) throw releaseInvalid("a facilitatorOrigin is on another host than the facilitator");
+  const path = url.pathname.replace(/\/+$/, "");
+  if (path !== "" && path !== `/pool/${pool.slice(0, 8)}`) throw releaseInvalid("a facilitatorOrigin path is not /pool/<first 8 characters of its pool>");
+  return `${url.origin}${path}`;
+}
+function parseReleasePools(release, facilitator) {
+  const raw = release?.pools;
+  if (raw === void 0 || raw === null) {
+    if (release?.migration) throw releaseInvalid("it announces a migration but names no pools");
+    return Object.freeze({ pools: Object.freeze([]), migration: null });
+  }
+  if (!Array.isArray(raw) || raw.length > 16) throw releaseInvalid("pools is not a short list");
+  const pools = raw.map((entry) => {
+    if (!entry || typeof entry !== "object") throw releaseInvalid("a pool entry is not an object");
+    if (!isPubkey2(entry.pool) || !isPubkey2(entry.programId)) throw releaseInvalid("a pool or programId is not a base58 address");
+    if (!DECIMAL4.test(String(entry.poolDomain ?? ""))) throw releaseInvalid("a poolDomain is not a decimal number");
+    if (entry.role !== "active" && entry.role !== "draining") throw releaseInvalid("a pool role is not active or draining");
+    const tools = entry.proofTools;
+    const proofTools = tools && HEX644.test(String(tools.sumsSha256)) && tools.dir === String(tools.sumsSha256).slice(0, 8) ? Object.freeze({ dir: tools.dir, sumsSha256: tools.sumsSha256 }) : void 0;
+    return Object.freeze({
+      pool: entry.pool,
+      programId: entry.programId,
+      poolDomain: String(entry.poolDomain),
+      role: entry.role,
+      facilitatorOrigin: poolOrigin(entry.facilitatorOrigin, entry.pool, facilitator),
+      ...proofTools ? { proofTools } : {}
+    });
+  });
+  if (new Set(pools.map((entry) => entry.pool)).size !== pools.length) throw releaseInvalid("a pool is listed twice");
+  const byPool = new Map(pools.map((entry) => [entry.pool, entry]));
+  const announced = release.migration;
+  if (announced === void 0 || announced === null) return Object.freeze({ pools: Object.freeze(pools), migration: null });
+  if (typeof announced !== "object" || !Array.isArray(announced.from) || announced.from.length === 0) throw releaseInvalid("migration.from is not a list");
+  const to = byPool.get(announced.to);
+  if (!to || to.role !== "active") throw releaseInvalid("migration.to is not the active pool of the list");
+  const from = announced.from.map((pool) => {
+    const entry = byPool.get(pool);
+    if (!entry || entry.role !== "draining") throw releaseInvalid("a migration.from pool is not a draining pool of the list");
+    return entry;
+  });
+  return Object.freeze({ pools: Object.freeze(pools), migration: Object.freeze({ from: Object.freeze(from), to }) });
+}
+async function readReleasePools({ facilitator, fetchImpl = fetch }) {
+  const release = await fetchRelease(facilitator, { fetchImpl });
+  return Object.freeze({ release, ...parseReleasePools(release, facilitator) });
+}
+var knownPools = (config) => [config.pool, ...(config.previousPools ?? []).map((entry) => entry.pool)];
+function pendingMoves({ home, migration }) {
+  if (!migration) return [];
+  return migration.from.filter((entry) => existsSync(homeWalletPath(home, entry.pool))).map((from) => Object.freeze({ from, to: migration.to }));
+}
+function poolToolPaths(config, pool) {
+  const entry = config.pool === pool ? config : (config.previousPools ?? []).find((item) => item.pool === pool);
+  return entry ? {
+    proofTools: entry.proofTools,
+    exitProofTools: entry.exitProofTools,
+    profile: entry.profile,
+    program: entry.program,
+    ...entry.proofToolsRelease ? { proofToolsRelease: entry.proofToolsRelease } : {}
+  } : void 0;
+}
+function parseMoveTrust(values) {
+  return (values ?? []).map((value) => {
+    const sums = String(value).trim().toLowerCase();
+    if (!HEX644.test(sums)) {
+      throw fail31("wallet_move_proof_tools_trust_invalid", "--trust-proof-tools must be the 64-hex SHA-256 of a proof-tool set's SHA256SUMS; nothing was moved");
+    }
+    return sums;
+  });
+}
+var UNTRUSTED = /^(setup_proof_tools_pin_mismatch|setup_proof_tools_unpinned|wallet_channel_key_unset):/;
+async function poolProofTools({ home, config, entry, release, facilitator, trust = [], fetchImpl = fetch, publicKeyHex, deps = {} }) {
+  const set = entry.proofTools;
+  if (!set) return void 0;
+  const recorded = poolToolPaths(config, entry.pool);
+  if (recorded?.proofToolsRelease?.sumsSha256 === set.sumsSha256 && recorded.proofTools) return void 0;
+  let trusted;
+  if (trust.includes(set.sumsSha256)) {
+    trusted = Object.freeze({ dir: set.dir, sumsSha256: set.sumsSha256, trusted: true });
+  } else {
+    let pin;
+    try {
+      pin = expectedProofTools(facilitator);
+    } catch {
+      pin = void 0;
+    }
+    const keyOption = publicKeyHex === void 0 ? {} : { publicKeyHex };
+    try {
+      trusted = await (deps.trustServedSet ?? trustServedSet)({
+        home,
+        facilitator,
+        release: { ...release, pool: entry.pool, proofTools: set },
+        expected: pin,
+        fetchImpl,
+        ...keyOption
+      });
+    } catch (error) {
+      if (!UNTRUSTED.test(String(error?.message))) throw error;
+      throw fail31("wallet_move_proof_tools_untrusted", `the facilitator names proof-tool set ${set.dir} (SHA256SUMS ${set.sumsSha256}) for pool ${entry.pool}, and neither this wallet build's pin nor the signed release channel vouches for it; nothing was downloaded or moved. Update the wallet (npx -y shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools ${set.sumsSha256} (repeat the flag once per set)`);
+    }
+  }
+  const tools = await (deps.installProofTools ?? installProofTools)({ facilitator, toolsRoot: join21(home, "proof-tools"), expected: trusted, fetchImpl });
+  return Object.freeze({
+    dir: tools.dir,
+    sumsSha256: tools.sumsSha256,
+    proofTools: tools.proofTools,
+    exitProofTools: tools.exitProofTools,
+    profile: tools.profile,
+    installed: tools.downloaded > 0
+  });
+}
+function recordPoolTools({ home, config, pool, tools, program }) {
+  const fresh = readSetupConfig(home) ?? config;
+  const paths = {
+    proofTools: tools.proofTools,
+    exitProofTools: tools.exitProofTools,
+    profile: tools.profile,
+    proofToolsRelease: { dir: tools.dir, sumsSha256: tools.sumsSha256 }
+  };
+  let next;
+  if (fresh.pool === pool) next = { ...fresh, ...paths };
+  else if ((fresh.previousPools ?? []).some((entry) => entry.pool === pool)) {
+    next = { ...fresh, previousPools: fresh.previousPools.map((entry) => entry.pool === pool ? { ...entry, ...paths } : entry) };
+  } else if (program) {
+    next = { ...fresh, previousPools: [...fresh.previousPools ?? [], { pool, program, ...paths }] };
+  } else return fresh;
+  writeSetupConfig(home, next);
+  return next;
+}
+function ensureMoveTarget({ home, config, passphrase: passphrase2, from, to, release, targetTools, open: open3 = openWalletStore, create = createWalletStore }) {
+  const { created, targetSeed } = ensureTargetWallet({ home, passphrase: passphrase2, fromPool: from.pool, toPool: to.pool, open: open3, create });
+  let next = config;
+  let configMoved = false;
+  let setupNeeded = false;
+  if (config.pool === from.pool) {
+    const toolsFit = targetTools !== void 0 || config.program === to.programId && (!config.proofToolsRelease || !release?.proofTools || config.proofToolsRelease.sumsSha256 === release.proofTools.sumsSha256);
+    if (toolsFit) {
+      const own = targetTools === void 0 ? {} : {
+        proofTools: targetTools.proofTools,
+        exitProofTools: targetTools.exitProofTools,
+        profile: targetTools.profile,
+        proofToolsRelease: { dir: targetTools.dir, sumsSha256: targetTools.sumsSha256 }
+      };
+      next = { ...config, pool: to.pool, program: to.programId, ...own, previousPools: withPreviousPool(config) };
+      writeSetupConfig(home, next);
+      configMoved = true;
+    } else {
+      setupNeeded = true;
+    }
+  }
+  return Object.freeze({ created, targetSeed, configMoved, setupNeeded, config: next });
+}
+function withPreviousPool(config) {
+  const kept = (config.previousPools ?? []).filter((entry) => entry.pool !== config.pool);
+  return [...kept, {
+    pool: config.pool,
+    program: config.program,
+    ...config.proofTools ? { proofTools: config.proofTools } : {},
+    ...config.exitProofTools ? { exitProofTools: config.exitProofTools } : {},
+    ...config.profile ? { profile: config.profile } : {},
+    ...config.proofToolsRelease ? { proofToolsRelease: config.proofToolsRelease } : {}
+  }];
+}
+function homeSeedSourcePool({ home, passphrase: passphrase2, toPool, migration, open: open3 = openWalletStore }) {
+  const named = (migration?.from ?? []).map((entry) => entry.pool);
+  let others = [];
+  try {
+    others = readdirSync(home).filter((name) => isPubkey2(name)).sort();
+  } catch {
+    others = [];
+  }
+  for (const pool of [.../* @__PURE__ */ new Set([...named, ...others])]) {
+    if (pool === toPool || !existsSync(homeWalletPath(home, pool))) continue;
+    try {
+      if (open3(homeWalletPath(home, pool), passphrase2).state.pool === pool) return pool;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function ensureTargetWallet({ home, passphrase: passphrase2, fromPool, toPool, open: open3 = openWalletStore, create = createWalletStore }) {
+  const from = { pool: fromPool };
+  const to = { pool: toPool };
+  const sourcePath = homeWalletPath(home, from.pool);
+  const targetPath = homeWalletPath(home, to.pool);
+  const source = open3(sourcePath, passphrase2);
+  let created = false;
+  if (existsSync(targetPath)) {
+    let target;
+    try {
+      target = open3(targetPath, passphrase2);
+    } catch {
+      throw fail31("wallet_move_target_unreadable", `a wallet for the new pool ${to.pool} already exists in this home and does not open with this wallet's passphrase; nothing was moved. Move that folder aside (it is not this wallet), then run shinjuku-wallet move again`);
+    }
+    if (target.state.pool !== to.pool) {
+      throw fail31("wallet_move_target_pool_mismatch", `the wallet file in the folder of the new pool ${to.pool} names another pool; nothing was moved. Move that folder aside, then run shinjuku-wallet move again: it makes the new pool's wallet from this wallet's seed`);
+    }
+    if (target.state.seedHex !== source.state.seedHex) return Object.freeze({ created, targetSeed: "other" });
+  } else {
+    const state = initialWalletState({
+      pool: to.pool,
+      network: source.state.network,
+      asset: source.state.asset,
+      decimals: source.state.decimals,
+      binding: source.state.binding,
+      config: { maxPaymentAtomic: source.state.config?.maxPaymentAtomic, maxCumulativeAtomic: source.state.config?.maxCumulativeAtomic },
+      keys: { seedHex: source.state.seedHex, solanaSecretKey: source.state.solanaSecretKey }
+    });
+    const target = create(targetPath, passphrase2, state);
+    if (target.state.seedHex !== source.state.seedHex || target.state.pool !== to.pool) {
+      throw fail31("wallet_move_target_seed_mismatch", "the new pool's wallet did not read back with this wallet's seed; nothing was moved. Run shinjuku-wallet move again");
+    }
+    created = true;
+  }
+  return Object.freeze({ created, targetSeed: "same" });
+}
+
+// wallet/src/pocket/cli.mjs
+var fail32 = (reason) => {
   throw new Error(`p03_pocket_cli_${reason}`);
 };
 var FILL_REQUIRED = [
@@ -119222,21 +119474,21 @@ function parse3(command, args) {
   const options = {};
   for (let index = 0; index < args.length; index += 1) {
     const key = args[index]?.startsWith("--") ? args[index].slice(2) : void 0;
-    if (!key || options[key] !== void 0) fail31("arguments_invalid");
+    if (!key || options[key] !== void 0) fail32("arguments_invalid");
     if (spec.booleans.includes(key)) {
       options[key] = true;
       continue;
     }
-    if (![...spec.required, ...spec.optional].includes(key) || !args[index + 1] || args[index + 1].startsWith("--")) fail31("arguments_invalid");
+    if (![...spec.required, ...spec.optional].includes(key) || !args[index + 1] || args[index + 1].startsWith("--")) fail32("arguments_invalid");
     options[key] = args[index + 1];
     index += 1;
   }
-  if (spec.required.some((key) => !options[key])) fail31("arguments_missing");
+  if (spec.required.some((key) => !options[key])) fail32("arguments_missing");
   return options;
 }
 var count = (value, fallback) => {
   if (value === void 0) return fallback;
-  if (!/^[1-9][0-9]{0,2}$/.test(value)) fail31("count_invalid");
+  if (!/^[1-9][0-9]{0,2}$/.test(value)) fail32("count_invalid");
   return Number(value);
 };
 var DEFAULT_DWELL_MINUTES = 1;
@@ -119279,9 +119531,9 @@ function ownTransactions(store) {
   return own;
 }
 function poolKeys(store, programId) {
-  const program = new import_web3123.PublicKey(programId);
-  const pool = new import_web3123.PublicKey(store.state.pool);
-  return { program: program.toBase58(), pool: pool.toBase58(), vault: vaultAddress2(program, pool, new import_web3123.PublicKey(store.state.asset)).toBase58() };
+  const program = new import_web3124.PublicKey(programId);
+  const pool = new import_web3124.PublicKey(store.state.pool);
+  return { program: program.toBase58(), pool: pool.toBase58(), vault: vaultAddress2(program, pool, new import_web3124.PublicKey(store.state.asset)).toBase58() };
 }
 function poolEventKind(raw, { program, pool, vault }) {
   if (!raw?.meta || raw.meta.err !== null) return void 0;
@@ -119334,7 +119586,7 @@ async function countOtherPoolEvents({ connection, keys: keys3, deposit, own, pag
 }
 async function vaultPage(connection, keys3) {
   try {
-    const page = await retryRpc2(() => connection.getSignaturesForAddress(new import_web3123.PublicKey(keys3.vault), { limit: DWELL_PAGE }, "finalized"));
+    const page = await retryRpc2(() => connection.getSignaturesForAddress(new import_web3124.PublicKey(keys3.vault), { limit: DWELL_PAGE }, "finalized"));
     return Array.isArray(page) ? page : void 0;
   } catch {
     return void 0;
@@ -119387,7 +119639,7 @@ function dwellGate({ store, connection, history = connection, programId, minutes
     let anchored;
     if (!deposit && store.state.restoredFromRecoveryText === true) {
       anchored = await restoredDepositAnchor({ connection, keys: keys3 });
-      if (!anchored) fail31("dwell_unreadable");
+      if (!anchored) fail32("dwell_unreadable");
       deposit = anchored.deposit;
       say2(`dwell: this wallet was rebuilt from the recovery text (restore) and holds no record of its own deposits, so the dwell counts from the pool's newest transaction that can be a deposit (slot ${deposit.slot}): your own newest deposit is no newer than that one`);
     }
@@ -119430,7 +119682,7 @@ function dwellGate({ store, connection, history = connection, programId, minutes
     } catch {
       now = void 0;
     }
-    if (!Number.isSafeInteger(landedAt) || !Number.isSafeInteger(now)) fail31("dwell_unreadable");
+    if (!Number.isSafeInteger(landedAt) || !Number.isSafeInteger(now)) fail32("dwell_unreadable");
     const capAt = landedAt + minutes * 60;
     if (now >= capAt) {
       passed = true;
@@ -119470,9 +119722,9 @@ function facilitatorOrigin(value) {
   try {
     origin = new URL(value);
   } catch {
-    fail31("facilitator_origin_invalid");
+    fail32("facilitator_origin_invalid");
   }
-  if (origin.protocol !== "https:" && !isOnionOrigin(origin) || origin.pathname !== "/" || origin.search) fail31("facilitator_origin_invalid");
+  if (origin.protocol !== "https:" && !isOnionOrigin(origin) || origin.pathname !== "/" || origin.search) fail32("facilitator_origin_invalid");
   return origin.origin;
 }
 async function withWallet(options, run5) {
@@ -119482,7 +119734,7 @@ async function withWallet(options, run5) {
   try {
     release = await acquireWalletProcessLease(walletLockPath(walletPath2));
   } catch {
-    fail31("wallet_locked");
+    fail32("wallet_locked");
   }
   try {
     const store = openWalletStore(walletPath2, passphrase2);
@@ -119495,17 +119747,17 @@ async function reshieldPocket({ store, connection, options }) {
   const origin = options.serviceBase ?? facilitatorOrigin(options.facilitator);
   reconcileFills(store);
   const accounts = pocketAccounts(store);
-  if (options.pocket === void 0 === (options["pay-to"] === void 0)) fail31("reshield_needs_pocket_or_pay_to");
-  if (options.pocket !== void 0 && !/^(0|[1-9][0-9]{0,9})$/.test(options.pocket)) fail31("reshield_pocket_invalid");
+  if (options.pocket === void 0 === (options["pay-to"] === void 0)) fail32("reshield_needs_pocket_or_pay_to");
+  if (options.pocket !== void 0 && !/^(0|[1-9][0-9]{0,9})$/.test(options.pocket)) fail32("reshield_pocket_invalid");
   const chosen = options.pocket !== void 0 ? accounts.find((account2) => account2.index === Number(options.pocket)) : accounts.find((account2) => account2.payTo === options["pay-to"]);
-  if (!chosen) fail31("reshield_pocket_unknown");
-  if (chosen.status === "filling" || BigInt(chosen.reservedAtomic) > 0n) fail31("reshield_pocket_busy");
+  if (!chosen) fail32("reshield_pocket_unknown");
+  if (chosen.status === "filling" || BigInt(chosen.reservedAtomic) > 0n) fail32("reshield_pocket_busy");
   const prefix = `reshield-${chosen.index}-`;
   const records = store.listWal().filter((name) => name.startsWith(`deposit-${prefix}`)).map((name) => store.readWal(name));
   const open3 = records.find((record) => record && !["published", "foreign_funded", "reclaimed"].includes(record.state));
   let held = 0n;
   try {
-    held = (await getAccount(connection, new import_web3123.PublicKey(chosen.ata), "finalized", TOKEN_PROGRAM_ID)).amount;
+    held = (await getAccount(connection, new import_web3124.PublicKey(chosen.ata), "finalized", TOKEN_PROGRAM_ID)).amount;
   } catch {
     held = 0n;
   }
@@ -119540,6 +119792,15 @@ async function reshieldPocket({ store, connection, options }) {
     note: "the value is a new note of yours in the shielded pool: shinjuku-wallet balance --refresh shows it"
   };
 }
+function scanLegacyPools(env = process.env) {
+  let config;
+  try {
+    config = readSetupConfig(setupHome(env));
+  } catch {
+    config = void 0;
+  }
+  return [.../* @__PURE__ */ new Set([...config ? knownPools(config) : [], ...Object.keys(RETIRED_POOLS)])];
+}
 function pocketReport(store) {
   const book = pocketBook(store);
   return {
@@ -119553,7 +119814,7 @@ function pocketReport(store) {
 }
 async function main4(args = process.argv.slice(2), io = { out: (text3) => console.log(text3) }) {
   const [command, ...rest] = args;
-  if (!SPECS[command]) fail31("command_unknown");
+  if (!SPECS[command]) fail32("command_unknown");
   const options = parse3(command, rest);
   const historyUrl = historyRpcUrl(options["history-rpc"]);
   await withWallet(options, async (store) => {
@@ -119581,14 +119842,14 @@ async function main4(args = process.argv.slice(2), io = { out: (text3) => consol
         const offered = await fetchPocketFeePayer({ origin: origin2, network: store.state.network });
         printFeePayer(await guardFeePayer(async () => recordFeePayer(store, offered, { replace: options["replace-fee-payer"] === true })), origin2);
       } else if (options["replace-fee-payer"]) {
-        fail31("replace_fee_payer_needs_facilitator");
+        fail32("replace_fee_payer_needs_facilitator");
       }
-      const scanned = await scanPockets({ store, connection, gap: count(options.gap, 5) });
+      const scanned = await scanPockets({ store, connection, gap: count(options.gap, 5), legacyPools: scanLegacyPools() });
       io.out(JSON.stringify({ success: true, ...scanned, ...pocketReport(store) }, null, 2));
       return;
     }
     const dwell2 = options["dwell-minutes"] === void 0 ? DEFAULT_DWELL_MINUTES : Number(options["dwell-minutes"]);
-    if (!Number.isSafeInteger(dwell2) || dwell2 < 0 || dwell2 > 10080 || !/^[0-9]{1,5}$/.test(String(options["dwell-minutes"] ?? "0"))) fail31("dwell_minutes_invalid");
+    if (!Number.isSafeInteger(dwell2) || dwell2 < 0 || dwell2 > 10080 || !/^[0-9]{1,5}$/.test(String(options["dwell-minutes"] ?? "0"))) fail32("dwell_minutes_invalid");
     const gate = {};
     const dwellSource = resolveHistorySource(connectSplit(connection, historyUrl), store.state.pool);
     const beforeNewFill = dwellGate({
@@ -119687,18 +119948,18 @@ function yieldIfAsked(shouldYield) {
   }
   if (asked) throw Object.assign(new Error(`${YIELD_CODE}: a payment waits for the wallet`), { readyAt: null });
 }
-var fail32 = (reason, extra = {}) => {
+var fail33 = (reason, extra = {}) => {
   throw Object.assign(new Error(`p03_pocket_auto_${reason}`), extra);
 };
 var firstCode2 = (error) => String(error?.message ?? "").split(/[\s:;(]/, 1)[0];
 var pendingFill3 = (entry) => entry.fills.find((fill) => fill.state === "started" || fill.state === "paid");
 var fillIndex = (unshieldId) => Number(/^pocket-(\d+)-f\d+$/.exec(unshieldId ?? "")?.[1] ?? NaN);
 function assertAutoPocketSize(sizeAtomic = AUTO_POCKET_SIZE_ATOMIC) {
-  if (String(sizeAtomic) !== AUTO_POCKET_SIZE_ATOMIC) fail32("pocket_size_unproven");
+  if (String(sizeAtomic) !== AUTO_POCKET_SIZE_ATOMIC) fail33("pocket_size_unproven");
   return AUTO_POCKET_SIZE_ATOMIC;
 }
 function assertReadyTarget(readyTarget = DEFAULT_READY_POCKETS) {
-  if (!Number.isSafeInteger(readyTarget) || readyTarget < 0 || readyTarget > MAX_READY_POCKETS) fail32("ready_pockets_invalid");
+  if (!Number.isSafeInteger(readyTarget) || readyTarget < 0 || readyTarget > MAX_READY_POCKETS) fail33("ready_pockets_invalid");
   return readyTarget;
 }
 function pendingOf(store) {
@@ -119726,7 +119987,7 @@ function lastPaidAtMs(store, index) {
   return last;
 }
 function idlePocketsDue(store, { now = Date.now(), idleDays = IDLE_RESHIELD_DAYS, floorAtomic = RESHIELD_FLOOR_ATOMIC } = {}) {
-  if (!Number.isFinite(idleDays) || idleDays < 0) fail32("idle_days_invalid");
+  if (!Number.isFinite(idleDays) || idleDays < 0) fail33("idle_days_invalid");
   const floor = BigInt(floorAtomic);
   const due = [];
   for (const account2 of pocketAccounts(store)) {
@@ -119895,20 +120156,20 @@ async function ensureReadyPockets({
 }
 function planPocketFill(store, { payTo, priceAtomic, sizeAtomic = AUTO_POCKET_SIZE_ATOMIC, maxFills = MAX_FILLS_PER_PAYMENT }) {
   const size = BigInt(assertAutoPocketSize(sizeAtomic));
-  if (!/^[1-9][0-9]*$/.test(String(priceAtomic ?? ""))) fail32("price_invalid");
-  if (!Number.isSafeInteger(maxFills) || maxFills < 1 || maxFills > MAX_FILLS_PER_PAYMENT) fail32("max_fills_invalid");
+  if (!/^[1-9][0-9]*$/.test(String(priceAtomic ?? ""))) fail33("price_invalid");
+  if (!Number.isSafeInteger(maxFills) || maxFills < 1 || maxFills > MAX_FILLS_PER_PAYMENT) fail33("max_fills_invalid");
   let key;
   try {
-    key = new import_web3124.PublicKey(payTo).toBase58();
+    key = new import_web3125.PublicKey(payTo).toBase58();
   } catch {
-    fail32("pay_to_invalid");
+    fail33("pay_to_invalid");
   }
   const price = BigInt(priceAtomic);
   const accounts = pocketAccounts(store);
   const fillsFor = (available) => {
     const short = price - available;
     const fills = Number((short + size - 1n) / size);
-    if (fills > maxFills) fail32("fill_count_over_cap", { fills, maxFills });
+    if (fills > maxFills) fail33("fill_count_over_cap", { fills, maxFills });
     return fills;
   };
   const bound = accounts.find((account2) => account2.payTo === key && account2.status !== "flagged");
@@ -119919,7 +120180,7 @@ function planPocketFill(store, { payTo, priceAtomic, sizeAtomic = AUTO_POCKET_SI
     if (available >= price) return { action: "resume", index: bound.index, fills: 0 };
     return { action: "refill", index: bound.index, fills: fillsFor(available) };
   }
-  if (accounts.some((account2) => account2.payTo === key)) fail32("pocket_for_pay_to_flagged");
+  if (accounts.some((account2) => account2.payTo === key)) fail33("pocket_for_pay_to_flagged");
   const ready = accounts.filter((account2) => account2.status === "ready");
   const covering = ready.find((account2) => BigInt(account2.availableAtomic) >= price);
   if (covering) return { action: "pay", index: covering.index };
@@ -119992,7 +120253,7 @@ async function idlePocketReshield({
   limit = 1,
   reshield = reshieldPocket
 }) {
-  if (!options?.facilitator || !options["proof-tools"] || !options.program) fail32("reshield_options_missing");
+  if (!options?.facilitator || !options["proof-tools"] || !options.program) fail33("reshield_options_missing");
   const due = idlePocketsDue(store, { now, idleDays, floorAtomic });
   const reshielded = [];
   const failed = [];
@@ -120016,7 +120277,7 @@ async function scanAfterRestore({ store, connection, origin, gap = 5, fetchImpl,
   return { feePayer, ...await scan({ store, connection, gap }) };
 }
 function createPocketJobs({ underLease, now = Date.now, retryAfterMs: retryAfterMs2 = FILL_RETRY_AFTER_MS }) {
-  if (typeof underLease !== "function") fail32("lease_missing");
+  if (typeof underLease !== "function") fail33("lease_missing");
   const jobs = /* @__PURE__ */ new Map();
   const requests = /* @__PURE__ */ new Map();
   let lastFailure;
@@ -120032,7 +120293,7 @@ function createPocketJobs({ underLease, now = Date.now, retryAfterMs: retryAfter
   return {
     bindRequest(requestId, fingerprint, key) {
       const seen = requests.get(requestId);
-      if (seen && (seen.fingerprint !== fingerprint || seen.key !== key)) fail32("request_id_reused");
+      if (seen && (seen.fingerprint !== fingerprint || seen.key !== key)) fail33("request_id_reused");
       requests.set(requestId, { fingerprint, key });
       return key;
     },
@@ -120660,256 +120921,6 @@ init_secretFile();
 init_processLease();
 init_store();
 
-// wallet/src/move/migration.mjs
-init_fs();
-var import_web3125 = __toESM(require_index_cjs(), 1);
-init_shielded_wallet();
-init_store();
-import { join as join21 } from "node:path";
-init_proxy();
-var DECIMAL4 = /^(0|[1-9][0-9]{0,90})$/;
-var HEX644 = /^[0-9a-f]{64}$/;
-var PRIVATE_HOST2 = /^(localhost|127\.0\.0\.1|\[::1\]|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+)$/;
-var fail33 = (code, detail) => new Error(`${code}: ${detail}`);
-var releaseInvalid = (why) => fail33(
-  "wallet_move_release_invalid",
-  `the facilitator's release document names its pools in a shape this wallet does not accept (${why}); nothing was moved. Update the wallet (npx -y shinjuku-shielded@latest), then run shinjuku-wallet move again`
-);
-var isPubkey2 = (value) => {
-  try {
-    return typeof value === "string" && new import_web3125.PublicKey(value).toBase58() === value;
-  } catch {
-    return false;
-  }
-};
-function poolOrigin(value, pool, facilitator) {
-  let url;
-  try {
-    url = new URL(String(value));
-  } catch {
-    url = void 0;
-  }
-  if (!url || url.username || url.password || url.search || url.hash) throw releaseInvalid("a facilitatorOrigin is not a plain URL");
-  if (!(url.protocol === "https:" || isOnionOrigin(url) || url.protocol === "http:" && PRIVATE_HOST2.test(url.hostname))) {
-    throw releaseInvalid("a facilitatorOrigin is not https");
-  }
-  if (url.origin !== new URL(facilitator).origin) throw releaseInvalid("a facilitatorOrigin is on another host than the facilitator");
-  const path = url.pathname.replace(/\/+$/, "");
-  if (path !== "" && path !== `/pool/${pool.slice(0, 8)}`) throw releaseInvalid("a facilitatorOrigin path is not /pool/<first 8 characters of its pool>");
-  return `${url.origin}${path}`;
-}
-function parseReleasePools(release, facilitator) {
-  const raw = release?.pools;
-  if (raw === void 0 || raw === null) {
-    if (release?.migration) throw releaseInvalid("it announces a migration but names no pools");
-    return Object.freeze({ pools: Object.freeze([]), migration: null });
-  }
-  if (!Array.isArray(raw) || raw.length > 16) throw releaseInvalid("pools is not a short list");
-  const pools = raw.map((entry) => {
-    if (!entry || typeof entry !== "object") throw releaseInvalid("a pool entry is not an object");
-    if (!isPubkey2(entry.pool) || !isPubkey2(entry.programId)) throw releaseInvalid("a pool or programId is not a base58 address");
-    if (!DECIMAL4.test(String(entry.poolDomain ?? ""))) throw releaseInvalid("a poolDomain is not a decimal number");
-    if (entry.role !== "active" && entry.role !== "draining") throw releaseInvalid("a pool role is not active or draining");
-    const tools = entry.proofTools;
-    const proofTools = tools && HEX644.test(String(tools.sumsSha256)) && tools.dir === String(tools.sumsSha256).slice(0, 8) ? Object.freeze({ dir: tools.dir, sumsSha256: tools.sumsSha256 }) : void 0;
-    return Object.freeze({
-      pool: entry.pool,
-      programId: entry.programId,
-      poolDomain: String(entry.poolDomain),
-      role: entry.role,
-      facilitatorOrigin: poolOrigin(entry.facilitatorOrigin, entry.pool, facilitator),
-      ...proofTools ? { proofTools } : {}
-    });
-  });
-  if (new Set(pools.map((entry) => entry.pool)).size !== pools.length) throw releaseInvalid("a pool is listed twice");
-  const byPool = new Map(pools.map((entry) => [entry.pool, entry]));
-  const announced = release.migration;
-  if (announced === void 0 || announced === null) return Object.freeze({ pools: Object.freeze(pools), migration: null });
-  if (typeof announced !== "object" || !Array.isArray(announced.from) || announced.from.length === 0) throw releaseInvalid("migration.from is not a list");
-  const to = byPool.get(announced.to);
-  if (!to || to.role !== "active") throw releaseInvalid("migration.to is not the active pool of the list");
-  const from = announced.from.map((pool) => {
-    const entry = byPool.get(pool);
-    if (!entry || entry.role !== "draining") throw releaseInvalid("a migration.from pool is not a draining pool of the list");
-    return entry;
-  });
-  return Object.freeze({ pools: Object.freeze(pools), migration: Object.freeze({ from: Object.freeze(from), to }) });
-}
-async function readReleasePools({ facilitator, fetchImpl = fetch }) {
-  const release = await fetchRelease(facilitator, { fetchImpl });
-  return Object.freeze({ release, ...parseReleasePools(release, facilitator) });
-}
-var knownPools = (config) => [config.pool, ...(config.previousPools ?? []).map((entry) => entry.pool)];
-function pendingMoves({ home, migration }) {
-  if (!migration) return [];
-  return migration.from.filter((entry) => existsSync(homeWalletPath(home, entry.pool))).map((from) => Object.freeze({ from, to: migration.to }));
-}
-function poolToolPaths(config, pool) {
-  const entry = config.pool === pool ? config : (config.previousPools ?? []).find((item) => item.pool === pool);
-  return entry ? {
-    proofTools: entry.proofTools,
-    exitProofTools: entry.exitProofTools,
-    profile: entry.profile,
-    program: entry.program,
-    ...entry.proofToolsRelease ? { proofToolsRelease: entry.proofToolsRelease } : {}
-  } : void 0;
-}
-function parseMoveTrust(values) {
-  return (values ?? []).map((value) => {
-    const sums = String(value).trim().toLowerCase();
-    if (!HEX644.test(sums)) {
-      throw fail33("wallet_move_proof_tools_trust_invalid", "--trust-proof-tools must be the 64-hex SHA-256 of a proof-tool set's SHA256SUMS; nothing was moved");
-    }
-    return sums;
-  });
-}
-var UNTRUSTED = /^(setup_proof_tools_pin_mismatch|setup_proof_tools_unpinned|wallet_channel_key_unset):/;
-async function poolProofTools({ home, config, entry, release, facilitator, trust = [], fetchImpl = fetch, publicKeyHex, deps = {} }) {
-  const set = entry.proofTools;
-  if (!set) return void 0;
-  const recorded = poolToolPaths(config, entry.pool);
-  if (recorded?.proofToolsRelease?.sumsSha256 === set.sumsSha256 && recorded.proofTools) return void 0;
-  let trusted;
-  if (trust.includes(set.sumsSha256)) {
-    trusted = Object.freeze({ dir: set.dir, sumsSha256: set.sumsSha256, trusted: true });
-  } else {
-    let pin;
-    try {
-      pin = expectedProofTools(facilitator);
-    } catch {
-      pin = void 0;
-    }
-    const keyOption = publicKeyHex === void 0 ? {} : { publicKeyHex };
-    try {
-      trusted = await (deps.trustServedSet ?? trustServedSet)({
-        home,
-        facilitator,
-        release: { ...release, pool: entry.pool, proofTools: set },
-        expected: pin,
-        fetchImpl,
-        ...keyOption
-      });
-    } catch (error) {
-      if (!UNTRUSTED.test(String(error?.message))) throw error;
-      throw fail33("wallet_move_proof_tools_untrusted", `the facilitator names proof-tool set ${set.dir} (SHA256SUMS ${set.sumsSha256}) for pool ${entry.pool}, and neither this wallet build's pin nor the signed release channel vouches for it; nothing was downloaded or moved. Update the wallet (npx -y shinjuku-shielded@latest), or (advanced) after you checked that set out of band run shinjuku-wallet move --trust-proof-tools ${set.sumsSha256} (repeat the flag once per set)`);
-    }
-  }
-  const tools = await (deps.installProofTools ?? installProofTools)({ facilitator, toolsRoot: join21(home, "proof-tools"), expected: trusted, fetchImpl });
-  return Object.freeze({
-    dir: tools.dir,
-    sumsSha256: tools.sumsSha256,
-    proofTools: tools.proofTools,
-    exitProofTools: tools.exitProofTools,
-    profile: tools.profile,
-    installed: tools.downloaded > 0
-  });
-}
-function recordPoolTools({ home, config, pool, tools, program }) {
-  const fresh = readSetupConfig(home) ?? config;
-  const paths = {
-    proofTools: tools.proofTools,
-    exitProofTools: tools.exitProofTools,
-    profile: tools.profile,
-    proofToolsRelease: { dir: tools.dir, sumsSha256: tools.sumsSha256 }
-  };
-  let next;
-  if (fresh.pool === pool) next = { ...fresh, ...paths };
-  else if ((fresh.previousPools ?? []).some((entry) => entry.pool === pool)) {
-    next = { ...fresh, previousPools: fresh.previousPools.map((entry) => entry.pool === pool ? { ...entry, ...paths } : entry) };
-  } else if (program) {
-    next = { ...fresh, previousPools: [...fresh.previousPools ?? [], { pool, program, ...paths }] };
-  } else return fresh;
-  writeSetupConfig(home, next);
-  return next;
-}
-function ensureMoveTarget({ home, config, passphrase: passphrase2, from, to, release, targetTools, open: open3 = openWalletStore, create = createWalletStore }) {
-  const { created, targetSeed } = ensureTargetWallet({ home, passphrase: passphrase2, fromPool: from.pool, toPool: to.pool, open: open3, create });
-  let next = config;
-  let configMoved = false;
-  let setupNeeded = false;
-  if (config.pool === from.pool) {
-    const toolsFit = targetTools !== void 0 || config.program === to.programId && (!config.proofToolsRelease || !release?.proofTools || config.proofToolsRelease.sumsSha256 === release.proofTools.sumsSha256);
-    if (toolsFit) {
-      const own = targetTools === void 0 ? {} : {
-        proofTools: targetTools.proofTools,
-        exitProofTools: targetTools.exitProofTools,
-        profile: targetTools.profile,
-        proofToolsRelease: { dir: targetTools.dir, sumsSha256: targetTools.sumsSha256 }
-      };
-      next = { ...config, pool: to.pool, program: to.programId, ...own, previousPools: withPreviousPool(config) };
-      writeSetupConfig(home, next);
-      configMoved = true;
-    } else {
-      setupNeeded = true;
-    }
-  }
-  return Object.freeze({ created, targetSeed, configMoved, setupNeeded, config: next });
-}
-function withPreviousPool(config) {
-  const kept = (config.previousPools ?? []).filter((entry) => entry.pool !== config.pool);
-  return [...kept, {
-    pool: config.pool,
-    program: config.program,
-    ...config.proofTools ? { proofTools: config.proofTools } : {},
-    ...config.exitProofTools ? { exitProofTools: config.exitProofTools } : {},
-    ...config.profile ? { profile: config.profile } : {},
-    ...config.proofToolsRelease ? { proofToolsRelease: config.proofToolsRelease } : {}
-  }];
-}
-function homeSeedSourcePool({ home, passphrase: passphrase2, toPool, migration, open: open3 = openWalletStore }) {
-  const named = (migration?.from ?? []).map((entry) => entry.pool);
-  let others = [];
-  try {
-    others = readdirSync(home).filter((name) => isPubkey2(name)).sort();
-  } catch {
-    others = [];
-  }
-  for (const pool of [.../* @__PURE__ */ new Set([...named, ...others])]) {
-    if (pool === toPool || !existsSync(homeWalletPath(home, pool))) continue;
-    try {
-      if (open3(homeWalletPath(home, pool), passphrase2).state.pool === pool) return pool;
-    } catch {
-    }
-  }
-  return void 0;
-}
-function ensureTargetWallet({ home, passphrase: passphrase2, fromPool, toPool, open: open3 = openWalletStore, create = createWalletStore }) {
-  const from = { pool: fromPool };
-  const to = { pool: toPool };
-  const sourcePath = homeWalletPath(home, from.pool);
-  const targetPath = homeWalletPath(home, to.pool);
-  const source = open3(sourcePath, passphrase2);
-  let created = false;
-  if (existsSync(targetPath)) {
-    let target;
-    try {
-      target = open3(targetPath, passphrase2);
-    } catch {
-      throw fail33("wallet_move_target_unreadable", `a wallet for the new pool ${to.pool} already exists in this home and does not open with this wallet's passphrase; nothing was moved. Move that folder aside (it is not this wallet), then run shinjuku-wallet move again`);
-    }
-    if (target.state.pool !== to.pool) {
-      throw fail33("wallet_move_target_pool_mismatch", `the wallet file in the folder of the new pool ${to.pool} names another pool; nothing was moved. Move that folder aside, then run shinjuku-wallet move again: it makes the new pool's wallet from this wallet's seed`);
-    }
-    if (target.state.seedHex !== source.state.seedHex) return Object.freeze({ created, targetSeed: "other" });
-  } else {
-    const state = initialWalletState({
-      pool: to.pool,
-      network: source.state.network,
-      asset: source.state.asset,
-      decimals: source.state.decimals,
-      binding: source.state.binding,
-      config: { maxPaymentAtomic: source.state.config?.maxPaymentAtomic, maxCumulativeAtomic: source.state.config?.maxCumulativeAtomic },
-      keys: { seedHex: source.state.seedHex, solanaSecretKey: source.state.solanaSecretKey }
-    });
-    const target = create(targetPath, passphrase2, state);
-    if (target.state.seedHex !== source.state.seedHex || target.state.pool !== to.pool) {
-      throw fail33("wallet_move_target_seed_mismatch", "the new pool's wallet did not read back with this wallet's seed; nothing was moved. Run shinjuku-wallet move again");
-    }
-    created = true;
-  }
-  return Object.freeze({ created, targetSeed: "same" });
-}
-
 // wallet/src/move/job.mjs
 init_fs();
 var import_web3126 = __toESM(require_index_cjs(), 1);
@@ -125176,9 +125187,10 @@ function createWalletTools({
           ...amounts,
           replayed: receipt.replayed === true,
           receiptFinality: receipt.receiptFinality ?? null,
-          ...floatPaid ? { via: "shinjuku" } : {},
+          // Leg 1 (this wallet's private payment to Shinjuku, a pool transaction): the seller may return no settle signature.
+          ...floatPaid ? { via: "shinjuku", shinjukuTransaction: typeof float.floatSettleTransaction === "string" ? float.floatSettleTransaction : null } : {},
           ...one ? { balanceAtomic: one.balanceAtomic, balance: one.balance, breakdown: one.breakdown } : {},
-          next: receipt.replayed === true ? "this request id was already paid: the stored receipt came back and nothing new was paid" : floatPaid ? "paid through Shinjuku (privately: the chain shows Shinjuku paying the seller, not this wallet); tell the user the price (priceAtomic), the fee (feeAtomic), the total (amountAtomic), and the transaction. wallet_balance shows the new balance" : "paid; tell the user what was paid (amountAtomic, transaction). wallet_receipts lists this payment, wallet_balance shows the new balance"
+          next: receipt.replayed === true ? "this request id was already paid: the stored receipt came back and nothing new was paid" : floatPaid ? "paid through Shinjuku (privately: the chain shows Shinjuku paying the seller, not this wallet); tell the user the price (priceAtomic), the fee (feeAtomic), the total (amountAtomic), and the transaction (the seller's settle transaction; null when the seller returned none) or shinjukuTransaction (this wallet's private payment to Shinjuku). wallet_balance shows the new balance" : "paid; tell the user what was paid (amountAtomic, transaction). wallet_receipts lists this payment, wallet_balance shows the new balance"
         }
       }));
     }