shinjuku-shielded 0.3.153 → 0.3.155

package/README.md

@@ -6,19 +6,19 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.153. The npm packages `shinjuku-shield` and
+This is version 0.3.155. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files. The command is `shinjuku`.
 
 ## Set up
 
 ```sh
-npm install -g shinjuku@0.3.153
+npm install -g shinjuku@0.3.155
 shinjuku setup
 ```
 
 Type the two lines as they are. `npx install shinjuku` does not work: npx
 reads `install` as the name of another npm package. To set up without
-installing, type `npx shinjuku@0.3.153 setup`.
+installing, type `npx shinjuku@0.3.155 setup`.
 
 Setup makes the wallet on this machine, a private passphrase file, and the
 checked proof tools (about 191 MB), and writes `config.json`. It also writes
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.153 mcp
+claude mcp add --scope user shinjuku -- npx -y --no-audit --no-fund shinjuku-shield@0.3.155 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.153", "mcp"] } } }
+{ "mcpServers": { "shinjuku": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.155", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and
@@ -55,7 +55,7 @@ Codex (the Codex app and Codex CLI read the same file, `~/.codex/config.toml`):
 ```toml
 [mcp_servers.shinjuku]
 command = "npx"
-args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.153", "mcp"]
+args = ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.155", "mcp"]
 startup_timeout_sec = 120
 tool_timeout_sec = 300
 ```

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "d446c36da9b526aea16cf685fb7b1532542f1eea13d0f2acabca373711bace8f",
-  "bytes": 9048030,
-  "sourceCommit": "9c091872009ec4e8a82ff9d5540fe00015cc93d1",
+  "sha256": "65d2837cf983622ed22a9d2bfb488a3a6ff0f276cb0d561b1be6074415daab0f",
+  "bytes": 9055610,
+  "sourceCommit": "5645304267acd2efd47b75cf75ae25ffae3096c5",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1038,5 +1038,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-11-03T05:08:33.860Z"
+  "publishedAt": "2026-11-03T05:58:09.739Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.153",
+  "version": "0.3.155",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "d446c36d",
-  "shinjukuSha256": "d446c36da9b526aea16cf685fb7b1532542f1eea13d0f2acabca373711bace8f",
+  "shinjukuRelease": "65d2837c",
+  "shinjukuSha256": "65d2837cf983622ed22a9d2bfb488a3a6ff0f276cb0d561b1be6074415daab0f",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-shield#readme",

package/shinjuku-wallet.mjs

@@ -17386,7 +17386,7 @@ var require_receiver = __commonJS({
 var require_sender = __commonJS({
   "node_modules/ws/lib/sender.js"(exports, module) {
     "use strict";
-    var { Duplex } = __require("stream");
+    var { Duplex: Duplex2 } = __require("stream");
     var { randomFillSync } = __require("crypto");
     var {
       types: { isUint8Array }
@@ -18264,10 +18264,10 @@ var require_websocket = __commonJS({
     var EventEmitter = __require("events");
     var https = __require("https");
     var http3 = __require("http");
-    var net2 = __require("net");
+    var net3 = __require("net");
     var tls = __require("tls");
     var { randomBytes: randomBytes33, createHash: createHash34 } = __require("crypto");
-    var { Duplex, Readable } = __require("stream");
+    var { Duplex: Duplex2, Readable } = __require("stream");
     var { URL: URL4 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
     var Receiver = require_receiver();
@@ -19008,12 +19008,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net2.connect(options);
+      return net3.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net2.isIP(options.host) ? "" : options.host;
+        options.servername = net3.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -19158,7 +19158,7 @@ var require_stream = __commonJS({
   "node_modules/ws/lib/stream.js"(exports, module) {
     "use strict";
     var WebSocket = require_websocket();
-    var { Duplex } = __require("stream");
+    var { Duplex: Duplex2 } = __require("stream");
     function emitClose(stream) {
       stream.emit("close");
     }
@@ -19176,7 +19176,7 @@ var require_stream = __commonJS({
     }
     function createWebSocketStream(ws, options) {
       let terminateOnDestroy = true;
-      const duplex = new Duplex({
+      const duplex = new Duplex2({
         ...options,
         autoDestroy: false,
         emitClose: false,
@@ -19302,7 +19302,7 @@ var require_websocket_server = __commonJS({
     "use strict";
     var EventEmitter = __require("events");
     var http3 = __require("http");
-    var { Duplex } = __require("stream");
+    var { Duplex: Duplex2 } = __require("stream");
     var { createHash: createHash34 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
@@ -42866,12 +42866,15 @@ var init_keepAlive = __esm({
 });
 
 // wallet/src/net/tunnelGuard.mjs
-function tunnelClient(Dispatcher, proxyPort) {
+import net from "node:net";
+import { Duplex } from "node:stream";
+function tunnelClient(Dispatcher, proxyPort, proxyHost) {
   const direct = new Dispatcher({ httpProxy: "", httpsProxy: "", noProxy: "*" });
   const closedInRow = /* @__PURE__ */ new Map();
   return {
     async connect(params) {
       const target = String(params?.path ?? "");
+      if (optimisticTarget(target)) return optimisticConnect(params, { proxyHost, proxyPort, closedInRow });
       try {
         const answer = await direct.connect(params);
         closedInRow.delete(target);
@@ -42903,14 +42906,143 @@ function proxyDispatcher(Dispatcher, proxy) {
     noProxy: "",
     keepAliveTimeout: KEEP_ALIVE_MS,
     keepAliveMaxTimeout: KEEP_ALIVE_MS,
-    clientFactory: () => tunnelClient(Dispatcher, port)
+    clientFactory: () => tunnelClient(Dispatcher, port, url.hostname)
+  });
+}
+function optimisticTarget(target) {
+  return String(process.env[RUN_MARK] ?? "").startsWith("tor ") && /:443$/.test(target);
+}
+function tunnelRefused(statusCode) {
+  return Object.assign(new Error(`Proxy response (${statusCode}) !== 200 when HTTP Tunneling`), { name: "AbortError", code: "UND_ERR_ABORTED" });
+}
+function optimisticConnect(params, { proxyHost, proxyPort, closedInRow }) {
+  const target = String(params.path);
+  const head = `CONNECT ${target} HTTP/1.1\r
+${Object.entries(params.headers ?? {}).filter(([name, value2]) => value2 !== void 0 && !/[\r\n]/.test(`${name}${value2}`)).map(([name, value2]) => `${name}: ${value2}\r
+`).join("")}\r
+`;
+  const sent = [];
+  let socket;
+  let ready = false;
+  let open4 = false;
+  let reply = Buffer.alloc(0);
+  let pendingReject;
+  const stream = new Duplex({
+    // Backpressure (Codex review): the tunnel socket pauses when this buffer is full and resumes when TLS reads.
+    read() {
+      if (socket && !socket.destroyed && socket.isPaused()) socket.resume();
+    },
+    write(chunk, encoding, done) {
+      if (!open4) sent.push(Buffer.from(chunk, encoding));
+      if (!ready || socket.destroyed) {
+        done();
+        return;
+      }
+      socket.write(chunk, encoding, done);
+    },
+    final(done) {
+      socket?.end();
+      done();
+    },
+    destroy(error, done) {
+      socket?.destroy();
+      done(error);
+    }
+  });
+  stream.on("error", () => {
+  });
+  const abortReason = () => params.signal?.reason ?? Object.assign(new Error("This operation was aborted"), { name: "AbortError", code: "ABORT_ERR" });
+  if (params.signal?.aborted) return Promise.reject(abortReason());
+  const onAbort = () => {
+    if (pendingReject) {
+      const reject = pendingReject;
+      pendingReject = void 0;
+      socket?.destroy();
+      stream.destroy();
+      reject(abortReason());
+      return;
+    }
+    stream.destroy(abortReason());
+  };
+  params.signal?.addEventListener?.("abort", onAbort, { once: true });
+  const dial = (first) => new Promise((resolve39, reject) => {
+    if (first) pendingReject = reject;
+    reply = Buffer.alloc(0);
+    ready = false;
+    socket = net.connect(proxyPort, proxyHost);
+    socket.setNoDelay(true);
+    let connected = false;
+    socket.once("connect", () => {
+      connected = true;
+      socket.write(head);
+      for (const chunk of sent) socket.write(chunk);
+      ready = true;
+      if (first) pendingReject = void 0;
+      resolve39();
+    });
+    socket.on("data", (chunk) => {
+      if (open4) {
+        if (!stream.push(chunk)) socket.pause();
+        return;
+      }
+      reply = Buffer.concat([reply, chunk]);
+      const end = reply.indexOf("\r\n\r\n");
+      if (end < 0) return;
+      const status = Number(/^HTTP\/1\.[01] (\d{3})/.exec(reply.subarray(0, reply.indexOf("\r\n")).toString("latin1"))?.[1] ?? 0);
+      if (status !== 200) {
+        stream.destroy(tunnelRefused(status));
+        return;
+      }
+      open4 = true;
+      sent.length = 0;
+      closedInRow.delete(target);
+      const rest = reply.subarray(end + 4);
+      reply = Buffer.alloc(0);
+      if (rest.length && !stream.push(rest)) socket.pause();
+    });
+    socket.on("error", (error) => {
+      if (!connected) {
+        if (first) {
+          if (pendingReject) {
+            pendingReject = void 0;
+            reject(error);
+          }
+        } else stream.destroy(error);
+        return;
+      }
+      if (open4) stream.destroy(error);
+    });
+    socket.on("close", () => {
+      if (!connected || stream.destroyed) return;
+      if (open4) {
+        stream.push(null);
+        return;
+      }
+      const closed = (closedInRow.get(target) ?? 0) + 1;
+      if (closed < TUNNEL_CLOSED_TRIES) {
+        closedInRow.set(target, closed);
+        dial(false).catch((error) => stream.destroy(error));
+        return;
+      }
+      closedInRow.delete(target);
+      stream.destroy(Object.assign(
+        new Error(`the local proxy closed ${TUNNEL_CLOSED_TRIES} tunnels in a row with no answer`),
+        { code: "ECONNREFUSED", port: proxyPort, tunnelClosed: true }
+      ));
+    });
+  });
+  stream.once("close", () => params.signal?.removeEventListener?.("abort", onAbort));
+  return dial(true).then(() => ({ statusCode: 200, socket: stream, headers: {} }), (error) => {
+    params.signal?.removeEventListener?.("abort", onAbort);
+    throw error;
   });
 }
-var TUNNEL_CLOSED_TRIES;
+var RUN_MARK, TUNNEL_CLOSED_TRIES;
 var init_tunnelGuard = __esm({
   "wallet/src/net/tunnelGuard.mjs"() {
     "use strict";
     init_keepAlive();
+    RUN_MARK = "SHINJUKU_WALLET_PROXIED";
     TUNNEL_CLOSED_TRIES = 3;
   }
 });
@@ -47239,7 +47371,7 @@ import { spawn } from "node:child_process";
 import { randomBytes as randomBytes5 } from "node:crypto";
 import dns from "node:dns";
 import http from "node:http";
-import net from "node:net";
+import net2 from "node:net";
 function proxyRefusedConnection(error) {
   if (ownProxyRefused) return true;
   const proxied = process.env[MARK];
@@ -47335,8 +47467,8 @@ function refuseDirectSockets(proxy) {
   const host = target.hostname.replace(/^\[|\]$/g, "");
   const loopback = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
   const isProxy = (candidateHost, candidatePort) => Number(candidatePort) === port && (candidateHost === host || loopback.has(candidateHost) && loopback.has(host));
-  const connect3 = net.Socket.prototype.connect;
-  net.Socket.prototype.connect = function guardedConnect(...args) {
+  const connect3 = net2.Socket.prototype.connect;
+  net2.Socket.prototype.connect = function guardedConnect(...args) {
     const [first] = args;
     const options = Array.isArray(first) ? first[0] : first;
     const allowed = options !== null && typeof options === "object" ? options.path !== void 0 || isProxy(options.host ?? "localhost", options.port) : typeof first === "string" && !/^\d+$/.test(first) || isProxy(typeof args[1] === "string" ? args[1] : "localhost", first);
@@ -47365,7 +47497,7 @@ function localTorCheck(proxy) {
   return new Promise((resolvePromise) => {
     let text3 = "";
     let done = false;
-    const socket = net.connect({ host, port });
+    const socket = net2.connect({ host, port });
     const finish = (answer, version3) => {
       if (done) return;
       done = true;
@@ -59547,7 +59679,7 @@ async function readCompactP03HistoryNow({
   poolPreRead,
   // walletHistory.mjs, with poolPreRead: page 0 asked beside the same refresh (requestCompactFirstPage).
   // Used as this read's page 0 when this read asks page 0 at all; readPages checks it as any page.
-  // Ignored with knownSnapshot.
+  // Ignored with knownSnapshot, except in the read again after a refused tail hit (`tail` false).
   firstPreRead,
   // compactP03HistoryReport: run beside the spot checks once the initialization is verified
   // ({ snapshot, initialization, contexts }); its result comes back as `alongside`.
@@ -59561,7 +59693,7 @@ async function readCompactP03HistoryNow({
   // result and any throw are ignored.
   onList,
   // compactP03HistoryReport: the records of a compact cache that is not warm (cached.served). When the
-  // list is read (no knownSnapshot), these records (or `served`'s, when the pool outgrew them) that pass
+  // list is read (no page 0 handed over by a behind wait), these records (or `served`'s, when the pool outgrew them) that pass
   // the start of the pool's last grid page take that page instead of every page (3b, combineCompactTail);
   // page 0 still goes out and is read to its end.
   prefix,
@@ -59570,8 +59702,8 @@ async function readCompactP03HistoryNow({
   // false: no tail path (compactP03HistoryReport's read again after a refused tail hit; it sent its set already).
   tail = true,
   // compactP03HistoryReport's read again (with tail false): the set the refused tail hit sent at this same count
-  // (sendRestOfSet's { pages, tail }), so the read again takes its pages instead of asking them a second time.
-  // Ignored with knownSnapshot.
+  // (sendRestOfSet's { pages, tail }), so the read again takes its pages instead of asking them a second time,
+  // with knownSnapshot too.
   restPreRead,
   // compactP03HistoryReport: called on a tail hit with { first (page 0's answer promise), snapshot (the pool
   // account read), check, rest (the set sent at the count) }, so a refused list can be read again from that same
@@ -59596,7 +59728,7 @@ async function readCompactP03HistoryNow({
   const hintIndex = knownSnapshot?.currentIndex ?? knownIndex;
   const cachedReachesKnown = hintIndex !== void 0 && served !== void 0 && Array.isArray(served.records) && Boolean(served.initialization) && BigInt(served.records.length) * SUBTREE_LEAVES3 >= hintIndex;
   const reusedFirst = knownSnapshot !== void 0 && knownFirst !== void 0 ? knownFirst : void 0;
-  const preFirst = knownSnapshot === void 0 ? firstPreRead : void 0;
+  const preFirst = knownSnapshot === void 0 || !tail ? firstPreRead : void 0;
   const first = reusedFirst ?? (served === void 0 || hintIndex !== void 0 && !cachedReachesKnown ? preFirst ?? requestPage(source, poolString, 0, signal) : void 0);
   if (first !== void 0 && reusedFirst === void 0) markPhase(preFirst !== void 0 ? "compact-page0-handed-over" : "compact-page0-sent");
   let early = heldPicks.early;
@@ -59660,7 +59792,7 @@ async function readCompactP03HistoryNow({
   const count2 = Number(snapshot.currentIndex / SUBTREE_LEAVES3);
   if (!Number.isSafeInteger(count2)) throw refuse3("p03_compact_history_snapshot_invalid");
   const anchors = freezeFinalizedAnchors(snapshot);
-  const preRest = knownSnapshot === void 0 ? restPreRead : void 0;
+  const preRest = knownSnapshot === void 0 || !tail ? restPreRead : void 0;
   let rest;
   const restOfSet = () => rest ??= preRest ?? sendRestOfSet(source, poolString, count2, tailGrid, signal);
   let aheadHere;
@@ -59705,7 +59837,7 @@ async function readCompactP03HistoryNow({
   };
   let prefixCheck;
   const readTailOrPages = async () => {
-    if (knownSnapshot !== void 0 || !tail) return readServedPages();
+    if (reusedFirst !== void 0 || !tail) return readServedPages();
     const zero = first ?? preFirst ?? requestPage(source, poolString, 0, signal);
     if (first === void 0 && preFirst === void 0) markPhase("compact-page0-sent");
     const from = tailFrom(count2, tailGrid);
@@ -127519,13 +127651,13 @@ function networkPreference(network) {
   return { network: n };
 }
 function offerSupport(a, prefer) {
-  const net2 = a.network.toLowerCase();
+  const net3 = a.network.toLowerCase();
   if (prefer.any || prefer.solana) {
-    if (net2 !== "solana" && net2 !== SOLANA_MAINNET.toLowerCase()) return prefer.any ? 1 : 0;
+    if (net3 !== "solana" && net3 !== SOLANA_MAINNET.toLowerCase()) return prefer.any ? 1 : 0;
     if (a.scheme === null) return 1;
     return a.asset === SOLANA_USDC && SOLANA_SCHEMES.has(a.scheme) ? 2 : 1;
   }
-  return net2 === prefer.network ? 2 : 0;
+  return net3 === prefer.network ? 2 : 0;
 }
 function pickOffer(accepts, prefer) {
   let best = accepts[0];
@@ -127538,8 +127670,8 @@ function pickOffer(accepts, prefer) {
     }
   }
   const atomic4 = best?.amount == null ? null : String(best.amount);
-  const net2 = String(best?.network ?? "").toLowerCase();
-  const usdc7 = atomic4 !== null && /^[0-9]{1,31}$/.test(atomic4) && best.asset === SOLANA_USDC && (net2 === "solana" || net2 === SOLANA_MAINNET.toLowerCase()) ? formatUsdc(atomic4) : void 0;
+  const net3 = String(best?.network ?? "").toLowerCase();
+  const usdc7 = atomic4 !== null && /^[0-9]{1,31}$/.test(atomic4) && best.asset === SOLANA_USDC && (net3 === "solana" || net3 === SOLANA_MAINNET.toLowerCase()) ? formatUsdc(atomic4) : void 0;
   const price2 = best ? { atomic: atomic4, ...usdc7 === void 0 ? {} : { usdc: usdc7 }, asset: best.asset || null, network: best.network || null, scheme: best.scheme ?? null } : { atomic: null, asset: null, network: null, scheme: null };
   return { price: price2, support };
 }
@@ -144559,13 +144691,30 @@ var init_homeScreen = __esm({
 
 // wallet/src/inference/brand.mjs
 function columnsOf(text3) {
+  const parts = GRAPHEMES ? Array.from(GRAPHEMES.segment(text3), (part) => part.segment) : Array.from(text3);
   let count2 = 0;
-  for (const ch of text3) {
-    const code2 = ch.codePointAt(0);
-    count2 += code2 >= 11904 && code2 <= 42191 || code2 >= 65280 && code2 <= 65376 ? 2 : 1;
+  for (const part of parts) {
+    if (/^[\p{M}\p{Cf}]+$/u.test(part)) continue;
+    count2 += new RegExp("\\p{Extended_Pictographic}|[\\u{1F1E6}-\\u{1F1FF}]|\u20E3", "u").test(part) || wideCode(part.codePointAt(0)) ? 2 : 1;
   }
   return count2;
 }
+function expandTabs(line, start = 0) {
+  if (!line.includes("	")) return line;
+  let out = "";
+  let column = start;
+  for (const piece of line.match(/\x1b\[[0-9;]*m|\t|[^\t\x1b]+|\x1b/g) ?? []) {
+    if (piece === "	") {
+      const spaces = 8 - column % 8;
+      out += " ".repeat(spaces);
+      column += spaces;
+    } else {
+      out += piece;
+      if (!piece.startsWith("\x1B[")) column += columnsOf(piece);
+    }
+  }
+  return out;
+}
 function brandColor(stream = process.stderr, env = process.env) {
   if (!stream?.isTTY || (env.CI ?? "") !== "" || env.TERM === "dumb") return 0;
   return screenColor(stream, env);
@@ -144640,10 +144789,57 @@ function brandLine({ model: model2, tor = true, color = 0 }) {
     ...tor ? [[" \xB7 ", "ash"], ["Tor on", "brass"]] : []
   ], color);
 }
+function fitColumns(text3, columns, { prefix = "" } = {}) {
+  const width = Math.floor(Number(columns));
+  if (!(width >= 1)) return `${prefix}${text3}`;
+  const visible = (part) => part.replace(/\x1b\[[0-9;]*m/g, "");
+  return String(text3).split("\n").map((raw, index) => {
+    const head = index === 0 ? prefix : "";
+    const headColumns = columnsOf(visible(head));
+    const line = expandTabs(raw, headColumns);
+    if (headColumns + columnsOf(visible(line)) <= width) return `${head}${raw}`;
+    const pad = " ".repeat(Math.min(visible(line).match(/^ */)[0].length, Math.max(0, width - 1)));
+    const out = [];
+    let current = head;
+    let used = headColumns;
+    let hasWord = false;
+    let spaces = "";
+    for (const piece of line.match(/ +|(?:\x1b\[[0-9;]*m|\x1b|[^ \x1b])+/g) ?? []) {
+      if (piece[0] === " ") {
+        if (hasWord) spaces += piece;
+        else {
+          const kept3 = Math.max(0, Math.min(piece.length, width - 1 - used));
+          current += " ".repeat(kept3);
+          used += kept3;
+        }
+        continue;
+      }
+      const seen = columnsOf(visible(piece));
+      if (seen === 0) {
+        current += piece;
+        continue;
+      }
+      if (hasWord && used + spaces.length + seen > width) {
+        out.push(current);
+        current = pad;
+        used = pad.length;
+      } else {
+        current += spaces;
+        used += spaces.length;
+      }
+      spaces = "";
+      current += piece;
+      used += seen;
+      hasWord = true;
+    }
+    out.push(current);
+    return out.join("\n");
+  }).join("\n");
+}
 function paidLine(atomic4, { color = 0, tail = "" } = {}) {
   return paint([["\u2713 ", "brass"], ["paid privately ", "dim"], [usdcWords(atomic4), "verm"], ...tail ? [[tail, "mute"]] : []], color);
 }
-var HEADER_COLUMNS, STATEMENTS, KATAKANA2, PRIVATE_AI, TONES, joinParts2;
+var HEADER_COLUMNS, STATEMENTS, KATAKANA2, GRAPHEMES, wideCode, PRIVATE_AI, TONES, joinParts2;
 var init_brand = __esm({
   "wallet/src/inference/brand.mjs"() {
     "use strict";
@@ -144653,6 +144849,8 @@ var init_brand = __esm({
     HEADER_COLUMNS = 80;
     STATEMENTS = "Shield once. Take it everywhere. Pay unseen.";
     KATAKANA2 = Array.from({ length: 65438 - 65382 }, (_, index) => String.fromCharCode(65382 + index));
+    GRAPHEMES = typeof Intl.Segmenter === "function" ? new Intl.Segmenter("en", { granularity: "grapheme" }) : void 0;
+    wideCode = (code2) => code2 >= 4352 && code2 <= 4447 || code2 >= 11904 && code2 <= 42191 || code2 >= 44032 && code2 <= 55203 || code2 >= 63744 && code2 <= 64255 || code2 >= 65072 && code2 <= 65103 || code2 >= 65280 && code2 <= 65376 || code2 >= 65504 && code2 <= 65510 || code2 >= 131072 && code2 <= 262141;
     PRIVATE_AI = [["Private ", "bone"], ["AI", "crim"]];
     TONES = { b: "brass", c: "crim", o: "crimdim" };
     joinParts2 = (cells) => cells.reduce((parts, [ch, cls]) => {
@@ -144947,7 +145145,8 @@ async function runChat({ io, values, deps = {} }) {
   servedNow();
   const color = brandColor(process.stderr, env);
   const answerColor = brandColor(process.stdout, env);
-  const say3 = (line) => io.err(`${line}
+  const fitErr = (text3) => fitColumns(text3, process.stderr.isTTY ? process.stderr.columns : 0);
+  const say3 = (line) => io.err(`${fitErr(line)}
 `);
   const modeName = () => state.mode === "each" ? "one question at a time" : "a conversation";
   const youPrompt = () => paint([
@@ -145482,7 +145681,7 @@ When it says ready, type your message here.`);
       lineAbove = (text3) => {
         lastLineAt = Date.now();
         clearStatus();
-        io.err(String(text3).endsWith("\n") ? String(text3) : `${text3}
+        io.err(`${fitErr(String(text3).replace(/\n$/, ""))}
 `);
         if (inPlace) status();
       };
@@ -145551,7 +145750,11 @@ When it says ready, type your message here.`);
       }
       state.answers += 1;
       if (state.mode === "talk") state.history = [...turn.messages, { role: "assistant", content }];
-      io.out(`${answerColor ? paint([["AI  ", "crim"], ["\u203A ", "ash"]], answerColor) : ""}${content}
+      io.out(`${fitColumns(
+        content,
+        process.stdout.isTTY ? process.stdout.columns : 0,
+        { prefix: answerColor ? paint([["AI  ", "crim"], ["\u203A ", "ash"]], answerColor) : "" }
+      )}
 `);
       const cut2 = result.finishReason === "length" ? `(the answer stopped at its ${turn.maxTokens}-token limit) ` : "";
       const plainPaid = paid !== void 0 && !replayed && !unpaid;
@@ -148452,8 +148655,8 @@ async function programFeeRule(connection, ids) {
   const data = Buffer.from(info.data);
   return { withdrawalFeeRate: BigInt(data.readUInt16LE(WITHDRAWAL_FEE_RATE_OFFSET)), feeErrorMargin: BigInt(data.readUInt16LE(FEE_ERROR_MARGIN_OFFSET)) };
 }
-function programMinimumFee(net2, rule) {
-  const expected = BigInt(net2) * rule.withdrawalFeeRate / 10000n;
+function programMinimumFee(net3, rule) {
+  const expected = BigInt(net3) * rule.withdrawalFeeRate / 10000n;
   return expected === 0n ? 0n : expected * (10000n - rule.feeErrorMargin) / 10000n;
 }
 function transactAccounts({ ids, nullifiers, signer, signerTokenAccount, recipient, recipientTokenAccount, feeRecipientTokenAccount }) {
@@ -148658,14 +148861,14 @@ async function readRelayConfig2({ serviceUrl: serviceUrl2, ids, fetchImpl = fetc
     computeUnitPrice: BigInt(config.computeUnitPriceMicroLamports)
   });
 }
-async function buildLocalWithdrawal({ internals, sdk, connection, ids, encryptionService, notes, tree, net: net2, fee, relay, recipient }) {
+async function buildLocalWithdrawal({ internals, sdk, connection, ids, encryptionService, notes, tree, net: net3, fee, relay, recipient }) {
   const mint = ids.mint;
   const lightWasm = sdk.lightWasm;
   const dummyKey = new internals.UtxoKeypair(encryptionService.deriveUtxoPrivateKey(), lightWasm);
   const inputs = [notes[0].utxo, notes[1]?.utxo ?? new internals.Utxo({ lightWasm, keypair: dummyKey, amount: "0", mintAddress: mint, blinding: blinding() })];
   const paths = [tree.path(notes[0].index).pathElements, notes[1] ? tree.path(notes[1].index).pathElements : zeroPath()];
   const total = inputs.reduce((sum2, utxo) => sum2 + BigInt(utxo.amount.toString()), 0n);
-  const change = total - net2 - fee;
+  const change = total - net3 - fee;
   if (change < 0n) fail43("withdraw_balance_insufficient");
   const owner = new import_web3136.PublicKey(recipient);
   const recipientTokenAccount = getAssociatedTokenAddressSync(new import_web3136.PublicKey(mint), owner, false, TOKEN_PROGRAM_ID);
@@ -148678,7 +148881,7 @@ async function buildLocalWithdrawal({ internals, sdk, connection, ids, encryptio
     root: tree.root(),
     nextIndex: tree.elements().length,
     outputAmount: change,
-    extAmount: -net2,
+    extAmount: -net3,
     fee,
     recipientTokenAccount,
     feeRecipientTokenAccount: relay.feeTokenAccount,
@@ -149850,11 +150053,11 @@ async function privacyCashDeposit({ store, rpcUrl, treeRpcUrl, keyFile: keyFile2
   });
 }
 var withdrawFee = (gross, rate, rentFee) => Math.floor(gross * rate + UNITS * rentFee);
-function grossForNet(net2, rate, rentFee) {
+function grossForNet(net3, rate, rentFee) {
   const netOf = (gross2) => gross2 - withdrawFee(gross2, rate, rentFee);
-  let gross = Math.ceil((net2 + UNITS * rentFee) / (1 - rate));
-  while (netOf(gross) < net2) gross += 1;
-  while (netOf(gross - 1) >= net2) gross -= 1;
+  let gross = Math.ceil((net3 + UNITS * rentFee) / (1 - rate));
+  while (netOf(gross) < net3) gross += 1;
+  while (netOf(gross - 1) >= net3) gross -= 1;
   return gross;
 }
 async function feeConfig(utils) {
@@ -150004,17 +150207,17 @@ function crowdLines({ crowd, uncounted, gross }) {
   const deposits2 = `deposits of ${usdc4(gross)} USDC or more landed in Privacy Cash after ${ANCHOR_WORDS[crowd.anchor]}${crowd.lowerBound ? ` (at least: ${where})` : ""}, with no withdrawal of any amount within 5 minutes after them`;
   return short ? `--hold-override: only ${crowd.count} ${deposits2}, of the ${crowd.needed} this hold waits for: an observer who pairs deposits and withdrawals by time and amount has few candidates besides yours` : `cover: ${crowd.count} ${deposits2}: to an observer who pairs deposits and withdrawals by time and amount, each could have funded this withdrawal as well as yours`;
 }
-function withdrawLines({ owner, net: net2, fee, via = "sdk", relayer = PRIVACY_CASH.relayer }) {
+function withdrawLines({ owner, net: net3, fee, via = "sdk", relayer = PRIVACY_CASH.relayer }) {
   const reads = `reads of ${owner}'s USDC balance; no read names your source wallet`;
   if (via === "local") {
     return {
-      chain: `our facilitator's relayer (${relayer}) pays ${usdc4(net2)} USDC out of Privacy Cash's pool to the one-time address ${owner} and lets it hold USDC, and takes a ${usdc4(fee)} USDC fee in the same transaction; the amount and the time are public, and no transfer from your source wallet to ${owner} appears`,
+      chain: `our facilitator's relayer (${relayer}) pays ${usdc4(net3)} USDC out of Privacy Cash's pool to the one-time address ${owner} and lets it hold USDC, and takes a ${usdc4(fee)} USDC fee in the same transaction; the amount and the time are public, and no transfer from your source wallet to ${owner} appears`,
       privacyCash: `${PRIVACY_CASH.server} sees nothing: this wallet read the tree from the chain and built the proof itself; our facilitator sees your IP address, ${owner}, the amount, the time, and the notes this withdrawal spends (if it never lands and those notes are spent later, the facilitator can link that spend to ${owner})`,
       rpc: `your IP address (a Tor exit with --tor), the Privacy Cash tree reads (every transaction of its USDC tree), and reads of ${owner}'s USDC balance; no read names your source wallet or one of your notes (this wallet finds which notes are spent in the tree it read), except on a rerun after an earlier proof's spend paid ${owner} or went through a lookup table: that rerun reads the proof's nullifier records on chain`
     };
   }
   return {
-    chain: `Privacy Cash's relayer (${PRIVACY_CASH.relayer}) pays ${usdc4(net2)} USDC out of its pool to the one-time address ${owner} and lets it hold USDC; Privacy Cash keeps a ${usdc4(fee)} USDC fee; the amount and the time are public, and no transfer from your source wallet to ${owner} appears`,
+    chain: `Privacy Cash's relayer (${PRIVACY_CASH.relayer}) pays ${usdc4(net3)} USDC out of its pool to the one-time address ${owner} and lets it hold USDC; Privacy Cash keeps a ${usdc4(fee)} USDC fee; the amount and the time are public, and no transfer from your source wallet to ${owner} appears`,
     privacyCash: `${PRIVACY_CASH.server} sees your IP address, which notes are yours (so it can find the deposits that made them), the notes this withdrawal spends, and ${owner}: it can link this withdrawal to your deposit`,
     rpc: `your IP address (a Tor exit with --tor), the reads that check your notes, and ${reads}`
   };