shinjuku-shielded 0.3.22 → 0.3.24

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "00da3f6dfb766d83cd9f1fdb8c3a335c2de51a5dbab0d13b0e6ce3d50106cf02",
-  "bytes": 11131156,
-  "sourceCommit": "de187f4fedfed133b529b7763adc27c639613f2f",
+  "sha256": "5e07378e3416f54223cbb56fc04d28bed3106dfbdef58b62570ad0469f27aade",
+  "bytes": 11135322,
+  "sourceCommit": "6427ce901fd81417ad60ea6364079db32785626c",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "00da3f6d",
-  "shinjukuSha256": "00da3f6dfb766d83cd9f1fdb8c3a335c2de51a5dbab0d13b0e6ce3d50106cf02",
+  "shinjukuRelease": "5e07378e",
+  "shinjukuSha256": "5e07378e3416f54223cbb56fc04d28bed3106dfbdef58b62570ad0469f27aade",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -50603,12 +50603,15 @@ var init_chain2 = __esm({
       "45mhosfA2MuygZWeqYRVcEZX2Q3gA8KR8FwP6AZkK1zR": "http://d6xg3phhurxhzqcsgh2mh52yf744labhrnd7mducwynlertfsjzyslqd.onion/",
       // Production E1 pool F7MW (since 2026-10-12): the same proxy serves it beside 45mh, which
       // stays while its wallets move out (the move walks 45mh).
-      F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "http://d6xg3phhurxhzqcsgh2mh52yf744labhrnd7mducwynlertfsjzyslqd.onion/"
+      F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "http://d6xg3phhurxhzqcsgh2mh52yf744labhrnd7mducwynlertfsjzyslqd.onion/",
+      // Production E1 pool CDtx (succession of F7MW, 2026-10-14): the same proxy; F7MW stays while its wallets move out.
+      CDtxyRjCUs2pu7t3U9TwtpnZwyxBFZ4dKXvb4RCmXHXv: "http://d6xg3phhurxhzqcsgh2mh52yf744labhrnd7mducwynlertfsjzyslqd.onion/"
     });
     PINNED_HISTORY_HTTPS = Object.freeze({
       AAG16mNWTtC1sBeu2tTVTwWjqWXCefLTCByVPj5X3kV8: "https://pay.shinjukustaition.com/history-proxy/",
       "45mhosfA2MuygZWeqYRVcEZX2Q3gA8KR8FwP6AZkK1zR": "https://pay.shinjukustaition.com/history-proxy/",
-      F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "https://pay.shinjukustaition.com/history-proxy/"
+      F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "https://pay.shinjukustaition.com/history-proxy/",
+      CDtxyRjCUs2pu7t3U9TwtpnZwyxBFZ4dKXvb4RCmXHXv: "https://pay.shinjukustaition.com/history-proxy/"
     });
     HISTORY_RPC_OWN = "own";
     historyRpcErrors = /* @__PURE__ */ new WeakSet();
@@ -117774,7 +117777,9 @@ var NPX_PACKAGE = "shinjuku-shielded";
 var MCP_SERVER_NAME = "shinjuku-shielded";
 var P03_BINDING2 = "carbon-shielded-exact/svm-v3";
 var PRODUCTION = Object.freeze({
-  pool: "F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV",
+  // CDtx since the succession F7MW -> CDtx (2026-10-14, link slot 456,964,330); a build pinned to F7MW still sets up
+  // through the signed successions file (setup.mjs successorChain).
+  pool: "CDtxyRjCUs2pu7t3U9TwtpnZwyxBFZ4dKXvb4RCmXHXv",
   program: "8PYPw3FSFTMbvSneXdcoH6jNoN4VD23nHwPY2A2riUy1",
   network: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
   asset: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
@@ -118890,7 +118895,27 @@ function snapshotFile(store) {
   return file;
 }
 function captureWalStates(store) {
-  return Object.fromEntries(store.listWal().sort().map((name) => [name, String(store.readWal(name)?.state)]));
+  return Object.fromEntries(store.listWal().sort().map((name) => [name, walStateOf(name, store.readWal(name))]));
+}
+var SUCCESSION_JOB_SCHEMA = "carbon-shielded-wallet/pool-succession/v1";
+function walStateOf(name, record) {
+  if (name.startsWith("succ-") && record?.schema === SUCCESSION_JOB_SCHEMA && canonicalAtomic(String(record.movedAtomic))) {
+    return `${record.state}|${record.movedAtomic}`;
+  }
+  return String(record?.state);
+}
+function movedInAfterSnapshot(store, state, snapshot) {
+  let total = 0n;
+  for (const name of store.listWal()) {
+    if (!name.startsWith("succ-")) continue;
+    const record = store.readWal(name);
+    if (record?.schema !== SUCCESSION_JOB_SCHEMA || record.to !== state.pool || !canonicalAtomic(String(record.movedAtomic))) continue;
+    const before = Object.hasOwn(snapshot.walStates, name) ? String(snapshot.walStates[name]) : void 0;
+    const kept = before?.includes("|") ? before.split("|")[1] : before === "moved" ? String(record.movedAtomic) : "0";
+    const moved = BigInt(record.movedAtomic) - (canonicalAtomic(kept) ? BigInt(kept) : 0n);
+    if (moved > 0n) total += moved;
+  }
+  return total;
 }
 function snapshotFromRecovery({ state, programId, recovery, history, walStates, fresh, now = Date.now() }) {
   if (!Array.isArray(recovery?.recovered)) throw new Error("balance_snapshot_recovery_invalid");
@@ -119105,7 +119130,8 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
   detail.unspentAtomic = unspentAtomic.toString();
   const settling = [];
   const movable = snapshot.outputs.filter((output2) => output2.spendStatus === "succession-movable");
-  const successionMovableAtomic = sum2(movable.map((output2) => output2.valueAtomic));
+  const movedInAtomic = movedInAfterSnapshot(store, state, snapshot);
+  const successionMovableAtomic = sum2(movable.map((output2) => output2.valueAtomic)) + movedInAtomic;
   detail.successionMovableAtomic = successionMovableAtomic.toString();
   detail.unspentAccounts = [...unspent.values()].filter((output2) => output2.kind === "account").length;
   detail.unspentNotes = [...unspent.values()].filter((output2) => output2.kind === "note").length;
@@ -119235,7 +119261,10 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
   const anchorIndex = canonicalAtomic(snapshot.anchorIndex) ? BigInt(snapshot.anchorIndex) : void 0;
   detail.fundedAccounts = unknownInputs ? 0 : [...unspent.values()].filter((output2) => output2.kind === "account" && BigInt(output2.valueAtomic) > 0n && !reserved.has(output2.commitment) && !settlingInputs.has(output2.commitment) && (anchorIndex === void 0 || BigInt(output2.leafIndex) < anchorIndex)).length;
   const next = detail.inFlight.length ? "finish or cancel the work in detail.inFlight; the wallet runs one payment at a time" : pendingDeposits.length ? `deposit ${pendingDeposits[0].depositId} is not finished: rerun the same deposit command with --submit --service <facilitator URL>` : pocketsUnscanned ? scanPockets2 : unspentAtomic === 0n && successionMovableAtomic > 0n ? "this pool was succeeded by a new pool: its value moves there (a move per account, the facilitator pays the fee) and counts in this balance until then" : unspentAtomic === 0n ? "nothing to spend: deposit (shinjuku-wallet help deposit), or run balance --refresh if a payment to this wallet settled" : void 0;
-  if (settling.length) {
+  if (movedInAtomic > 0n) {
+    settlingReasons.push(`${formatAtomic(movedInAtomic, decimals)} moved into this pool from the old pool after the last refresh: the balance counts it; refresh again in a minute`);
+  }
+  if (settling.length || movedInAtomic > 0n) {
     reasons.push(...settlingReasons);
     return report("stale", spendable + successionMovableAtomic, next ?? refreshCommand(state, snapshot.programId));
   }
@@ -122043,6 +122072,7 @@ init_store();
 var import_web3127 = __toESM(require_index_cjs(), 1);
 init_chain2();
 init_walk();
+init_receiptTransaction();
 init_serviceUrl();
 import { randomInt as randomInt4 } from "node:crypto";
 
@@ -122412,6 +122442,18 @@ async function chainNowSeconds(connection) {
   return info.data.readBigInt64LE(32);
 }
 var sameInputs = (context, inputs) => Array.isArray(context.publicInputs) && context.publicInputs.length === inputs.length && context.publicInputs.every((value, index) => fieldHex4(value) === inputs[index]);
+var landedIsLeg = (context, body) => {
+  if (Array.isArray(context.publicInputs)) return sameInputs(context, body.publicInputBytesHex);
+  try {
+    const payload2 = Buffer.concat([
+      Buffer.from(String(body.proofBytesHex).replace(/^0x/, ""), "hex"),
+      ...body.publicInputBytesHex.map((value) => Buffer.from(String(value).replace(/^0x/, ""), "hex"))
+    ]);
+    return contextPayloadMatches(context, payload2);
+  } catch {
+    return false;
+  }
+};
 async function destinationMoves(deps, sourceDomain) {
   if (typeof deps.loadDestinationReport !== "function") {
     throw refuse7("wallet_succession_history_unavailable", "no successor-pool history to confirm the move against");
@@ -122483,6 +122525,9 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
     let rebuilds = 0;
     for (; ; ) {
       if (leg.state === "confirmed" || leg.state === "dropped") return void 0;
+      if (leg.state === "failed" && leg.lastCode === "wallet_succession_leg_receipt_invalid" && typeof leg.transaction === "string" && leg.body) {
+        leg = save2(leg, { state: "relayed" });
+      }
       if (leg.state === "failed") leg = save2(leg, { state: "planned" });
       if (leg.state === "planned") {
         const inputs = [...leg.inputs.account ? [leg.inputs.account] : [], ...leg.inputs.notes];
@@ -122580,7 +122625,7 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
           const moves = await destinationMoves(deps, sourceDomain);
           const landed = moves.find((context) => context.provenance?.signature === leg.transaction);
           if (landed) {
-            if (!sameInputs(landed, leg.body.publicInputBytesHex)) {
+            if (!landedIsLeg(landed, leg.body)) {
               save2(leg, { state: "failed", lastCode: "wallet_succession_leg_receipt_invalid" });
               throw refuse7("wallet_succession_leg_receipt_invalid", "the relay's transaction is not this leg's move; tell the operator");
             }
@@ -122619,7 +122664,7 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
 
 // wallet/src/succession/scheduler.mjs
 init_successorHistories();
-var SUCCESSION_JOB_SCHEMA = "carbon-shielded-wallet/pool-succession/v1";
+var SUCCESSION_JOB_SCHEMA2 = "carbon-shielded-wallet/pool-succession/v1";
 var SUCCESSION_DELAY_MIN_MS = 5 * 6e4;
 var SUCCESSION_DELAY_MAX_MS = 30 * 6e4;
 var SUCCESSION_LATE_START_MAX_MS = 6e4;
@@ -122719,10 +122764,10 @@ function successionMessage(job) {
 var SUCCESSION_WHY = "Your facilitator upgraded to a new pool. Your balance moves to the new pool so you can keep paying; the money stays yours.";
 function readSuccessionJob(store, fromPool) {
   const record = store.readWal(successionJobName(fromPool));
-  return record?.schema === SUCCESSION_JOB_SCHEMA && record.from === fromPool ? record : void 0;
+  return record?.schema === SUCCESSION_JOB_SCHEMA2 && record.from === fromPool ? record : void 0;
 }
 function successionJobs(store) {
-  return store.listWal().filter((name) => /^succ-[0-9A-Za-z]{1,8}$/.test(name)).map((name) => store.readWal(name)).filter((record) => record?.schema === SUCCESSION_JOB_SCHEMA);
+  return store.listWal().filter((name) => /^succ-[0-9A-Za-z]{1,8}$/.test(name)).map((name) => store.readWal(name)).filter((record) => record?.schema === SUCCESSION_JOB_SCHEMA2);
 }
 var noticeKey = (job) => job.state === "failed-retry" ? `failed:${job.lastCode ?? ""}` : PUBLIC_STATE[job.state];
 var SUCCESSION_NOTICE_SCHEMA = "carbon-shielded-wallet/pool-succession-notice/v1";
@@ -122872,6 +122917,7 @@ function createSuccessionScheduler(options) {
   const startedAtMs = now();
   const lateStart = /* @__PURE__ */ new Map();
   const recordCheckedAt = /* @__PURE__ */ new Map();
+  const receiptRecheck = /* @__PURE__ */ new Set();
   let active;
   let closed = false;
   const listEntries = () => {
@@ -122955,7 +123001,7 @@ function createSuccessionScheduler(options) {
     return job;
   }
   const base = (entry, value, verified) => ({
-    schema: SUCCESSION_JOB_SCHEMA,
+    schema: SUCCESSION_JOB_SCHEMA2,
     from: entry.from,
     to: verified?.successor ?? entry.to,
     record: entry.record,
@@ -123073,8 +123119,13 @@ function createSuccessionScheduler(options) {
       }
       case "move-scheduled":
         return now() >= startAt(job) ? startRun(entry) : job;
-      case "moving":
       case "failed-retry":
+        if (job.lastCode === "wallet_succession_leg_receipt_invalid" && job.updatedAtMs < startedAtMs && !receiptRecheck.has(entry.from)) {
+          receiptRecheck.add(entry.from);
+          job = save2(store, job, { permanent: false, nextTryAtMs: now() });
+        }
+        return now() >= (job.nextTryAtMs ?? 0) ? startRun(entry) : job;
+      case "moving":
         return now() >= (job.nextTryAtMs ?? 0) ? startRun(entry) : job;
       default:
         return job;
@@ -127472,15 +127523,25 @@ function proverPlatform({ platform = process.platform, hasWsl = wslAvailable } =
     detail: `the provers are Linux x86-64 programs, and ${platform === "darwin" ? "macOS" : "this system"} cannot run them. Run the wallet on a Linux machine, in a Linux container, or on Windows with WSL. Nothing was created`
   };
 }
-function identityOf(facilitator, release) {
+function successorChain(body, pool) {
+  const chain = [pool];
+  for (let at = pool; ; ) {
+    const next = (body?.successions ?? []).find((entry) => entry.from === at)?.to;
+    if (!next || chain.includes(next)) return chain;
+    chain.push(next);
+    at = next;
+  }
+}
+function identityOf(facilitator, release, successors = []) {
   const served = { pool: release.pool, program: release.programId, network: release.network, asset: release.asset };
   if (new URL(facilitator).origin === new URL(PRODUCTION.memoService).origin) {
+    const pool = successors.includes(served.pool) ? served.pool : PRODUCTION.pool;
     for (const [name, value] of Object.entries(served)) {
-      if (value !== null && value !== void 0 && value !== PRODUCTION[name]) {
-        throw fail34("setup_identity_mismatch", `the production facilitator's release names another ${name} than this wallet build; nothing was created. Update the wallet (npx -y shinjuku-shielded@latest setup)`);
+      if (value !== null && value !== void 0 && value !== (name === "pool" ? pool : PRODUCTION[name])) {
+        throw fail34("setup_identity_mismatch", `the production facilitator's release names another ${name} than this wallet build, and no signed succession links it; nothing was created. Run npx -y shinjuku-shielded@latest setup; if the latest build says the same, the facilitator is not serving the production pool`);
       }
     }
-    return { pool: PRODUCTION.pool, program: PRODUCTION.program, network: PRODUCTION.network, asset: PRODUCTION.asset };
+    return { pool, program: PRODUCTION.program, network: PRODUCTION.network, asset: PRODUCTION.asset };
   }
   if (Object.values(served).some((value) => typeof value !== "string" || !value)) {
     throw fail34("setup_identity_mismatch", "this facilitator's release names no pool identity (it runs no public facilitator); nothing was created");
@@ -127566,7 +127627,16 @@ async function runSetup(options, deps = {}) {
   let identity;
   if (release) {
     expected = await trustServedSet({ home, facilitator, release, expected, fetchImpl: deps.fetchImpl ?? fetch });
-    identity = identityOf(facilitator, release);
+    let successions;
+    const needsChain = release.pool !== PRODUCTION.pool || old && old.pool !== release.pool;
+    if (needsChain) {
+      try {
+        successions = await (deps.loadSuccessions ?? loadSuccessions)({ home, facilitator, release, fetchImpl: deps.fetchImpl ?? fetch });
+      } catch {
+        successions = void 0;
+      }
+    }
+    identity = identityOf(facilitator, release, successorChain(successions, PRODUCTION.pool));
     try {
       releasePools = parseReleasePools(release, facilitator);
     } catch {
@@ -127574,7 +127644,8 @@ async function runSetup(options, deps = {}) {
     }
     if (old && old.pool !== identity.pool && !(retired && RETIRED_POOLS[retired] === identity.pool)) {
       const pools = releasePools;
-      if (!(pools?.migration?.to.pool === identity.pool && pools.migration.from.some((entry) => entry.pool === old.pool))) {
+      const succeeded = successorChain(successions, old.pool).includes(identity.pool);
+      if (!succeeded && !(pools?.migration?.to.pool === identity.pool && pools.migration.from.some((entry) => entry.pool === old.pool))) {
         throw fail34("setup_identity_mismatch", "config.json names another pool than the facilitator serves now; setup changes no existing wallet. Move config.json aside to set up the new pool");
       }
       movedFrom = old.pool;
@@ -131836,7 +131907,7 @@ var CLI2 = "shinjuku-wallet";
 var P03_BINDING3 = "carbon-shielded-exact/svm-v3";
 var GUIDE = Object.freeze({
   program: "8PYPw3FSFTMbvSneXdcoH6jNoN4VD23nHwPY2A2riUy1",
-  pool: "F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV",
+  pool: "CDtxyRjCUs2pu7t3U9TwtpnZwyxBFZ4dKXvb4RCmXHXv",
   mint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
   network: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
   facilitator: DEFAULT_FACILITATOR_ORIGIN
@@ -132454,7 +132525,8 @@ function setupDependencies(deps) {
     fetchImpl: deps.fetch,
     init: (options) => deps.setupInit(options, deps),
     openWalletStore: deps.openWalletStore,
-    now: () => new Date(deps.now())
+    now: () => new Date(deps.now()),
+    ...deps.loadSuccessions ? { loadSuccessions: deps.loadSuccessions } : {}
   };
 }
 async function setupInit({ home, passphrase: passphrase2, args }, deps) {
@@ -134241,7 +134313,9 @@ var RELAYED_DEPOSIT_UNIT = Object.freeze({
   // The production E1 pool since the tag-28 window (its pool plan: poolDenominationAtomic 1000000).
   "45mhosfA2MuygZWeqYRVcEZX2Q3gA8KR8FwP6AZkK1zR": "1000000",
   // The production E1 pool since 2026-10-12 (GET /api/x402/deposit: depositUnitAtomic 1000000).
-  F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "1000000"
+  F7MWGF8vG8Bv3Y4pRRFqky5YzZndGtQaUXbMMvpmtoRV: "1000000",
+  // The production E1 pool since the succession of 2026-10-14 (same deposit unit as F7MW).
+  CDtxyRjCUs2pu7t3U9TwtpnZwyxBFZ4dKXvb4RCmXHXv: "1000000"
 });
 async function runDeposit(args, values, deps) {
   const unit = values.has("--relay") && !values.has("--pool-denomination") ? RELAYED_DEPOSIT_UNIT[values.get("--pool")] : void 0;