shinjuku-shielded 0.3.23 → 0.3.25

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "10c8bdfe8bd677ce6f50d143c1af4b28d5b3f653c5c65f6356f1034e6f5840df",
-  "bytes": 11132902,
-  "sourceCommit": "f718d9f247df010a8e2b5045666be78877dd3933",
+  "sha256": "1505ebf0afdb67fbbe6050d5065335f3b13e94cefd356fb422ce946f4fba3253",
+  "bytes": 11138284,
+  "sourceCommit": "d34c7e8fbb9d384d53557aeeac05386f35ce2fb9",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.23",
+  "version": "0.3.25",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "10c8bdfe",
-  "shinjukuSha256": "10c8bdfe8bd677ce6f50d143c1af4b28d5b3f653c5c65f6356f1034e6f5840df",
+  "shinjukuRelease": "1505ebf0",
+  "shinjukuSha256": "1505ebf0afdb67fbbe6050d5065335f3b13e94cefd356fb422ce946f4fba3253",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -59758,6 +59758,16 @@ var init_recoveryCache = __esm({
 });
 
 // wallet/src/succession/successorHistories.mjs
+function withoutProgramHistory(identity) {
+  if (!identity || typeof identity !== "object" || identity.programHistory === void 0) return void 0;
+  const { programHistory: _history, ...rest } = identity;
+  return rest;
+}
+function errorChainText(error) {
+  const parts = [];
+  for (let current = error, depth = 0; current && depth < 8; current = current.cause, depth += 1) parts.push(String(current?.message ?? current));
+  return parts.join(" ");
+}
 async function loadSuccessorHistories({
   history,
   store,
@@ -59775,24 +59785,34 @@ async function loadSuccessorHistories({
     if (typeof target !== "string") return walks;
     if (seen.has(target) || walks.length >= MAX_SUCCESSOR_HOPS) throw new Error("wallet_succession_chain_invalid");
     seen.add(target);
-    const walk = await loadHistory({
+    const identity = deploymentIdentityFor?.(target) ?? deploymentIdentity;
+    const read = (given) => loadHistory({
       store,
       connection,
       programId,
       pool: target,
-      deploymentIdentity: deploymentIdentityFor?.(target) ?? deploymentIdentity,
+      deploymentIdentity: given,
       cache: walletSuccessorHistoryCache(store, target)
     });
+    let walk;
+    try {
+      walk = await read(identity);
+    } catch (error) {
+      const historyFree = withoutProgramHistory(identity);
+      if (!historyFree || !HISTORY_FREE_NEEDED.test(errorChainText(error))) throw error;
+      walk = await read(historyFree);
+    }
     if (walk?.pool !== target) throw new Error("wallet_succession_chain_invalid");
     walks.push(walk);
     current = walk;
   }
 }
-var MAX_SUCCESSOR_HOPS;
+var HISTORY_FREE_NEEDED, MAX_SUCCESSOR_HOPS;
 var init_successorHistories = __esm({
   "wallet/src/succession/successorHistories.mjs"() {
     "use strict";
     init_walletHistory();
+    HISTORY_FREE_NEEDED = /p03_program_history_coverage_interval_invalid_pool_initialized_after_last_upgrade_use_history_free_identity/;
     MAX_SUCCESSOR_HOPS = 8;
   }
 });
@@ -90683,14 +90703,27 @@ function floatRecordOf(store, requestId) {
 function floatInnerRequestId(requestId) {
   return requestId.length <= 122 ? `${requestId}:float` : `float:${hash8(requestId)}`;
 }
-function floatRefundsInFlightAtomic(store, refreshedAtMs) {
+function floatRefundsInFlightAtomic(store, snapshot) {
+  const refreshedAtMs = Date.parse(snapshot?.refreshedAt ?? "");
+  const outputs = Array.isArray(snapshot?.outputs) ? snapshot.outputs : [];
+  const knowsRecipients = outputs.some((output2) => output2?.kind === "note" && output2.diversifier !== void 0);
+  const arrived = (refundTo) => {
+    let address5;
+    try {
+      address5 = decodeShieldedSolanaP03Address(String(refundTo));
+    } catch {
+      return false;
+    }
+    return outputs.some((output2) => output2?.kind === "note" && output2.diversifier === address5.diversifier.toString() && output2.recipientX === address5.recipientX.toString());
+  };
   let total = 0n;
   try {
     for (const name of store.listWal()) {
       if (!name.startsWith(FLOAT_PAYMENT_WAL_PREFIX)) continue;
       const record = store.readWal(name);
       if (record?.schema !== FLOAT_PAYMENT_SCHEMA || record.state !== "refund_pending" || !POSITIVE.test(String(record.paidAtomic))) continue;
-      if (Number.isFinite(refreshedAtMs) && refreshedAtMs >= record.refundPendingAtMs + REFUND_SETTLED_AFTER_MS) continue;
+      if (arrived(record.refundTo)) continue;
+      if (!knowsRecipients && Number.isFinite(refreshedAtMs) && refreshedAtMs >= record.refundPendingAtMs + REFUND_SETTLED_AFTER_MS) continue;
       total += BigInt(record.paidAtomic);
     }
   } catch {
@@ -118895,7 +118928,27 @@ function snapshotFile(store) {
   return file;
 }
 function captureWalStates(store) {
-  return Object.fromEntries(store.listWal().sort().map((name) => [name, String(store.readWal(name)?.state)]));
+  return Object.fromEntries(store.listWal().sort().map((name) => [name, walStateOf(name, store.readWal(name))]));
+}
+var SUCCESSION_JOB_SCHEMA = "carbon-shielded-wallet/pool-succession/v1";
+function walStateOf(name, record) {
+  if (name.startsWith("succ-") && record?.schema === SUCCESSION_JOB_SCHEMA && canonicalAtomic(String(record.movedAtomic))) {
+    return `${record.state}|${record.movedAtomic}`;
+  }
+  return String(record?.state);
+}
+function movedInAfterSnapshot(store, state, snapshot) {
+  let total = 0n;
+  for (const name of store.listWal()) {
+    if (!name.startsWith("succ-")) continue;
+    const record = store.readWal(name);
+    if (record?.schema !== SUCCESSION_JOB_SCHEMA || record.to !== state.pool || !canonicalAtomic(String(record.movedAtomic))) continue;
+    const before = Object.hasOwn(snapshot.walStates, name) ? String(snapshot.walStates[name]) : void 0;
+    const kept = before?.includes("|") ? before.split("|")[1] : before === "moved" ? String(record.movedAtomic) : "0";
+    const moved = BigInt(record.movedAtomic) - (canonicalAtomic(kept) ? BigInt(kept) : 0n);
+    if (moved > 0n) total += moved;
+  }
+  return total;
 }
 function snapshotFromRecovery({ state, programId, recovery, history, walStates, fresh, now = Date.now() }) {
   if (!Array.isArray(recovery?.recovered)) throw new Error("balance_snapshot_recovery_invalid");
@@ -118908,7 +118961,10 @@ function snapshotFromRecovery({ state, programId, recovery, history, walStates,
       leafIndex: String(entry?.leafIndex),
       valueAtomic: value === void 0 ? void 0 : String(value),
       spendStatus: entry?.spendStatus,
-      digest: digestKey(entry?.digest)
+      digest: digestKey(entry?.digest),
+      // A note's one-time recipient (diversifier d and recipient x): a float refund is matched to its
+      // own refund address by these (floatRefundsInFlightAtomic). Public to this wallet only (sealed cache).
+      ...entry?.kind === "note" && /^[0-9]+$/.test(String(entry.note?.d)) && /^[0-9]+$/.test(String(entry.note?.pDX)) ? { diversifier: String(entry.note.d), recipientX: String(entry.note.pDX) } : {}
     };
     if (!["account", "note"].includes(output2.kind) || !canonicalAtomic(output2.valueAtomic) || !canonicalAtomic(output2.commitment) || !canonicalAtomic(output2.leafIndex) || !SPEND_STATUSES.has(output2.spendStatus) || !/^[0-9a-f]{64}$/.test(output2.digest)) {
       throw new Error("balance_snapshot_output_invalid");
@@ -119030,7 +119086,8 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
     ...entry.record.relay?.approvedOnChain ? { approvalStanding: true } : {}
   }));
   const receipts = records.filter((entry) => entry.type === "payment" && entry.phase === "done");
-  const paid = receipts.filter((entry) => !String(entry.record.url ?? "").startsWith(SELF_PAY_ORIGIN2) && !String(entry.record.url ?? "").includes(POOL_MOVE_PATH2));
+  const refunded = new Set(records.filter((entry) => entry.type === "float-payment" && entry.state === "refund_pending").map((entry) => entry.record.innerRequestId).filter((id) => typeof id === "string"));
+  const paid = receipts.filter((entry) => !String(entry.record.url ?? "").startsWith(SELF_PAY_ORIGIN2) && !String(entry.record.url ?? "").includes(POOL_MOVE_PATH2) && !refunded.has(entry.record.requestId));
   const sum2 = (values) => values.reduce((total, value) => total + BigInt(value ?? "0"), 0n);
   const config = state.config ?? {};
   const capOrNone = (value) => String(value) === NO_LIMIT_ATOMIC2 ? "none" : value;
@@ -119110,7 +119167,8 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
   detail.unspentAtomic = unspentAtomic.toString();
   const settling = [];
   const movable = snapshot.outputs.filter((output2) => output2.spendStatus === "succession-movable");
-  const successionMovableAtomic = sum2(movable.map((output2) => output2.valueAtomic));
+  const movedInAtomic = movedInAfterSnapshot(store, state, snapshot);
+  const successionMovableAtomic = sum2(movable.map((output2) => output2.valueAtomic)) + movedInAtomic;
   detail.successionMovableAtomic = successionMovableAtomic.toString();
   detail.unspentAccounts = [...unspent.values()].filter((output2) => output2.kind === "account").length;
   detail.unspentNotes = [...unspent.values()].filter((output2) => output2.kind === "note").length;
@@ -119240,7 +119298,10 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
   const anchorIndex = canonicalAtomic(snapshot.anchorIndex) ? BigInt(snapshot.anchorIndex) : void 0;
   detail.fundedAccounts = unknownInputs ? 0 : [...unspent.values()].filter((output2) => output2.kind === "account" && BigInt(output2.valueAtomic) > 0n && !reserved.has(output2.commitment) && !settlingInputs.has(output2.commitment) && (anchorIndex === void 0 || BigInt(output2.leafIndex) < anchorIndex)).length;
   const next = detail.inFlight.length ? "finish or cancel the work in detail.inFlight; the wallet runs one payment at a time" : pendingDeposits.length ? `deposit ${pendingDeposits[0].depositId} is not finished: rerun the same deposit command with --submit --service <facilitator URL>` : pocketsUnscanned ? scanPockets2 : unspentAtomic === 0n && successionMovableAtomic > 0n ? "this pool was succeeded by a new pool: its value moves there (a move per account, the facilitator pays the fee) and counts in this balance until then" : unspentAtomic === 0n ? "nothing to spend: deposit (shinjuku-wallet help deposit), or run balance --refresh if a payment to this wallet settled" : void 0;
-  if (settling.length) {
+  if (movedInAtomic > 0n) {
+    settlingReasons.push(`${formatAtomic(movedInAtomic, decimals)} moved into this pool from the old pool after the last refresh: the balance counts it; refresh again in a minute`);
+  }
+  if (settling.length || movedInAtomic > 0n) {
     reasons.push(...settlingReasons);
     return report("stale", spendable + successionMovableAtomic, next ?? refreshCommand(state, snapshot.programId));
   }
@@ -122048,6 +122109,7 @@ init_store();
 var import_web3127 = __toESM(require_index_cjs(), 1);
 init_chain2();
 init_walk();
+init_receiptTransaction();
 init_serviceUrl();
 import { randomInt as randomInt4 } from "node:crypto";
 
@@ -122417,6 +122479,18 @@ async function chainNowSeconds(connection) {
   return info.data.readBigInt64LE(32);
 }
 var sameInputs = (context, inputs) => Array.isArray(context.publicInputs) && context.publicInputs.length === inputs.length && context.publicInputs.every((value, index) => fieldHex4(value) === inputs[index]);
+var landedIsLeg = (context, body) => {
+  if (Array.isArray(context.publicInputs)) return sameInputs(context, body.publicInputBytesHex);
+  try {
+    const payload2 = Buffer.concat([
+      Buffer.from(String(body.proofBytesHex).replace(/^0x/, ""), "hex"),
+      ...body.publicInputBytesHex.map((value) => Buffer.from(String(value).replace(/^0x/, ""), "hex"))
+    ]);
+    return contextPayloadMatches(context, payload2);
+  } catch {
+    return false;
+  }
+};
 async function destinationMoves(deps, sourceDomain) {
   if (typeof deps.loadDestinationReport !== "function") {
     throw refuse7("wallet_succession_history_unavailable", "no successor-pool history to confirm the move against");
@@ -122488,6 +122562,9 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
     let rebuilds = 0;
     for (; ; ) {
       if (leg.state === "confirmed" || leg.state === "dropped") return void 0;
+      if (leg.state === "failed" && leg.lastCode === "wallet_succession_leg_receipt_invalid" && typeof leg.transaction === "string" && leg.body) {
+        leg = save2(leg, { state: "relayed" });
+      }
       if (leg.state === "failed") leg = save2(leg, { state: "planned" });
       if (leg.state === "planned") {
         const inputs = [...leg.inputs.account ? [leg.inputs.account] : [], ...leg.inputs.notes];
@@ -122585,7 +122662,7 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
           const moves = await destinationMoves(deps, sourceDomain);
           const landed = moves.find((context) => context.provenance?.signature === leg.transaction);
           if (landed) {
-            if (!sameInputs(landed, leg.body.publicInputBytesHex)) {
+            if (!landedIsLeg(landed, leg.body)) {
               save2(leg, { state: "failed", lastCode: "wallet_succession_leg_receipt_invalid" });
               throw refuse7("wallet_succession_leg_receipt_invalid", "the relay's transaction is not this leg's move; tell the operator");
             }
@@ -122624,7 +122701,7 @@ async function runSuccessionMove({ store, verified, source, facilitator, connect
 
 // wallet/src/succession/scheduler.mjs
 init_successorHistories();
-var SUCCESSION_JOB_SCHEMA = "carbon-shielded-wallet/pool-succession/v1";
+var SUCCESSION_JOB_SCHEMA2 = "carbon-shielded-wallet/pool-succession/v1";
 var SUCCESSION_DELAY_MIN_MS = 5 * 6e4;
 var SUCCESSION_DELAY_MAX_MS = 30 * 6e4;
 var SUCCESSION_LATE_START_MAX_MS = 6e4;
@@ -122724,10 +122801,10 @@ function successionMessage(job) {
 var SUCCESSION_WHY = "Your facilitator upgraded to a new pool. Your balance moves to the new pool so you can keep paying; the money stays yours.";
 function readSuccessionJob(store, fromPool) {
   const record = store.readWal(successionJobName(fromPool));
-  return record?.schema === SUCCESSION_JOB_SCHEMA && record.from === fromPool ? record : void 0;
+  return record?.schema === SUCCESSION_JOB_SCHEMA2 && record.from === fromPool ? record : void 0;
 }
 function successionJobs(store) {
-  return store.listWal().filter((name) => /^succ-[0-9A-Za-z]{1,8}$/.test(name)).map((name) => store.readWal(name)).filter((record) => record?.schema === SUCCESSION_JOB_SCHEMA);
+  return store.listWal().filter((name) => /^succ-[0-9A-Za-z]{1,8}$/.test(name)).map((name) => store.readWal(name)).filter((record) => record?.schema === SUCCESSION_JOB_SCHEMA2);
 }
 var noticeKey = (job) => job.state === "failed-retry" ? `failed:${job.lastCode ?? ""}` : PUBLIC_STATE[job.state];
 var SUCCESSION_NOTICE_SCHEMA = "carbon-shielded-wallet/pool-succession-notice/v1";
@@ -122877,6 +122954,7 @@ function createSuccessionScheduler(options) {
   const startedAtMs = now();
   const lateStart = /* @__PURE__ */ new Map();
   const recordCheckedAt = /* @__PURE__ */ new Map();
+  const receiptRecheck = /* @__PURE__ */ new Set();
   let active;
   let closed = false;
   const listEntries = () => {
@@ -122960,7 +123038,7 @@ function createSuccessionScheduler(options) {
     return job;
   }
   const base = (entry, value, verified) => ({
-    schema: SUCCESSION_JOB_SCHEMA,
+    schema: SUCCESSION_JOB_SCHEMA2,
     from: entry.from,
     to: verified?.successor ?? entry.to,
     record: entry.record,
@@ -123078,8 +123156,13 @@ function createSuccessionScheduler(options) {
       }
       case "move-scheduled":
         return now() >= startAt(job) ? startRun(entry) : job;
-      case "moving":
       case "failed-retry":
+        if (job.lastCode === "wallet_succession_leg_receipt_invalid" && job.updatedAtMs < startedAtMs && !receiptRecheck.has(entry.from)) {
+          receiptRecheck.add(entry.from);
+          job = save2(store, job, { permanent: false, nextTryAtMs: now() });
+        }
+        return now() >= (job.nextTryAtMs ?? 0) ? startRun(entry) : job;
+      case "moving":
         return now() >= (job.nextTryAtMs ?? 0) ? startRun(entry) : job;
       default:
         return job;
@@ -124920,13 +125003,13 @@ function oneBalance(report, store) {
   const shieldedAtomic = report?.split?.shieldedAtomic ?? null;
   const pocketsAtomic = report?.split?.pocketsAtomic ?? null;
   const moving = movingAtomic(store);
-  let refreshedAtMs;
+  let snapshot;
   try {
-    refreshedAtMs = Date.parse(readBalanceSnapshot(store).snapshot?.refreshedAt ?? "");
+    snapshot = readBalanceSnapshot(store).snapshot;
   } catch {
-    refreshedAtMs = void 0;
+    snapshot = void 0;
   }
-  const refunds = floatRefundsInFlightAtomic(store, refreshedAtMs);
+  const refunds = floatRefundsInFlightAtomic(store, snapshot);
   const known = shieldedAtomic !== null && pocketsAtomic !== null;
   const setAside = known ? BigInt(pocketsAtomic) + moving : null;
   const total = known ? BigInt(shieldedAtomic) + setAside + refunds : null;
@@ -125528,6 +125611,13 @@ function createWalletTools({
       next = typeof blocking === "string" && /^[A-Za-z0-9._:-]{1,128}$/.test(blocking) ? `Nothing was paid: an earlier payment (request_id "${blocking}") is not finished, and the wallet pays one at a time. Call x402_pay again with request_id "${blocking}" and that payment's url, method, headers, and body (it finishes it and never pays twice), or close it with wallet_cancel request_id "${blocking}"; then call x402_pay again with request_id "${requestId}"` : `Nothing was paid: an earlier payment is not finished, and the wallet pays one at a time. wallet_balance lists it in detail.inFlight; finish it with x402_pay and its request_id, or close it with wallet_cancel; then call x402_pay again with request_id "${requestId}"`;
     } else if (/accounts_split_merge_first/.test(line)) {
       next = `Nothing was paid: the shielded balance covers this price in total, but it sits in several accounts and one payment draws only one account and at most 3 notes. Tell your owner to join them: shinjuku-wallet merge --wallet <wallet.json> --passphrase-file passphrase.txt --program <program> --proof-tools proof-tools.json --profile public-profile.json --facilitator <facilitator origin> (--dry-run shows the plan; shinjuku-wallet help merge). After it finished and the next pool anchor (up to 5 minutes; about 30 s on a pool with sub-anchors) passed, call x402_pay again with request_id "${requestId}" and the same url, method, headers, and body`;
+    } else if (/^p03_merchant_respend_(insufficient_recovered_value|no_spendable_account)$|^(p03_payer_)?insufficient(_recovered)?_value$/.test(code)) {
+      return refuse9(
+        code,
+        "the shielded balance is less than this payment needs (price + fee); nothing was paid",
+        `Nothing was paid. Tell the user the balance is too low for this price: wallet_balance shows breakdown.shieldedAtomic (a refund still on its way shows as refundsInFlightAtomic and becomes spendable when it arrives). To pay, add USDC with wallet_shield (or wallet_shield_from_elsewhere), wait until wallet_balance counts it, then call x402_pay again with request_id "${requestId}" and the same url, method, headers, and body (it never pays twice)`,
+        { requestId }
+      );
     } else if (code.startsWith("wallet_spend_refused_")) {
       next = "the wallet file's own budget refused it (init --max-payment / --max-cumulative); nothing was paid. Read wallet_balance detail.budget";
     } else if (code.startsWith("wallet_quote_refused_") || code.startsWith("fetch_")) {