shinjuku-shielded 0.3.26 → 0.3.28

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "f2dc55fb5d552bef98fe2d530d37c301045501d0f750a2c9a17ddf63b1a934f3",
-  "bytes": 11150739,
-  "sourceCommit": "b9639dffcfdad92b73571e89117761c8f716ef83",
+  "sha256": "dd6ce54a50e0e58be863f647620b767cb760d1278ee089b74c10c98068383047",
+  "bytes": 11159107,
+  "sourceCommit": "b5316573de1f09bb207ce09a78d5ec4d02fc8035",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "f2dc55fb",
-  "shinjukuSha256": "f2dc55fb5d552bef98fe2d530d37c301045501d0f750a2c9a17ddf63b1a934f3",
+  "shinjukuRelease": "dd6ce54a",
+  "shinjukuSha256": "dd6ce54a50e0e58be863f647620b767cb760d1278ee089b74c10c98068383047",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -119132,7 +119132,7 @@ function publicUrl(value) {
     return null;
   }
 }
-function computeBalance({ store, snapshotRead, source = "local", now = Date.now() }) {
+function computeBalance({ store, snapshotRead, source = "local", now = Date.now(), firstDepositEstimate = false }) {
   const state = store.state;
   const decimals = Number(state.decimals);
   const records = store.listWal().sort().map((name) => {
@@ -119217,6 +119217,12 @@ function computeBalance({ store, snapshotRead, source = "local", now = Date.now(
       }
       return report("empty", 0n, proved ? `deposit ${proved.depositId} is proved but not sent: back up (shinjuku-wallet help backup-export), then rerun the same deposit command with --submit --service <facilitator URL>` : "no deposit yet: deposit one of two ways (shinjuku-wallet help deposit). 1) The more private path, shinjuku-wallet deposit --relay: no SOL is needed; its first run prints a one-time address to fund with USDC from an exchange withdrawal or an outside privacy pool. 2) Send USDC and about 0.01 SOL to your solanaFeePayer address (printed by init), then run shinjuku-wallet deposit without --relay; that deposit edge is public. If this wallet only holds restored keys or receives payments, run balance --refresh");
     }
+    const valueRecords = records.filter((entry) => !["payment-proof", "privacy-cash", "add-funds"].includes(entry.type) && !(entry.type === "deposit" && (entry.phase === "pre-chain" || entry.phase === "void")));
+    const landedDeposits = valueRecords.filter((entry) => entry.type === "deposit" && entry.phase === "done" && typeof entry.record?.receipt?.signature === "string" && entry.record.receipt.signature.length > 0 && canonicalAtomic(entry.record.amountAtomic));
+    if (firstDepositEstimate && !snapshotRead?.unreadable && !state.restoredFromRecoveryText && landedDeposits.length > 0 && landedDeposits.length === valueRecords.length) {
+      reasons.push("the first check of the pool history runs now; this number is your own deposit");
+      return report("stale", sum2(landedDeposits.map((entry) => entry.record.amountAtomic)), refreshCommand(state));
+    }
     reasons.push(snapshotRead?.unreadable ? `the saved balance walk is unreadable (${snapshotRead.unreadable}); it is only a cache` : state.restoredFromRecoveryText && !couldHoldValue ? "this wallet was rebuilt from the recovery text (restore) and has no balance walk yet: its value is on chain, not in this file" : "this wallet has deposit or payment records but no balance walk yet");
     return report("unknown", null, refreshCommand(state));
   }
@@ -121947,7 +121953,8 @@ var CHAIN_RECHECK_MS = 6 * 60 * 6e4;
 var MCP_POLL_LIMIT_MS = 3 * 6e4;
 var firstCode5 = (error) => String(error?.message ?? error ?? "").split(/[\s:;(]/, 1)[0];
 function createMoveScheduler({ session, underLease, log = () => {
-}, env = process.env, deps = {} }) {
+}, env = process.env, onSettled = () => {
+}, deps = {} }) {
   const now = deps.now ?? Date.now;
   const home = deps.home ?? setupHome(env);
   const readConfig = deps.readConfig ?? (() => readSetupConfig(home));
@@ -121981,6 +121988,7 @@ function createMoveScheduler({ session, underLease, log = () => {
   let interval;
   let closed = false;
   const failedAt = /* @__PURE__ */ new Map();
+  const lastCredit = /* @__PURE__ */ new Map();
   const leaseFor = (pool) => async (task) => {
     if (resolve21(homeWalletPath(home, pool)) === sessionPath) return underLease(() => task());
     let free;
@@ -122064,6 +122072,14 @@ function createMoveScheduler({ session, underLease, log = () => {
             withTargetLease: leaseFor(move.to.pool)
           });
           log(`MCP_MOVE ${move.from.pool.slice(0, 8)} ${result.state}${result.code ? ` ${result.code}` : ""}`);
+          const credit = (result.legs ?? []).map((leg) => leg?.creditTransaction).filter((signature) => typeof signature === "string" && signature).at(-1);
+          if (credit && credit !== lastCredit.get(move.from.pool)) {
+            lastCredit.set(move.from.pool, credit);
+            try {
+              onSettled(credit);
+            } catch {
+            }
+          }
         } catch (error) {
           const code = firstCode5(error) || "wallet_move_leg_failed";
           result = { state: code === "wallet_locked" ? "waiting" : "failed", code, fromPool: move.from.pool, toPool: move.to.pool };
@@ -122903,10 +122919,16 @@ var CARRY_WAIT_CODES = /* @__PURE__ */ new Set([
   "wallet_locked"
 ]);
 var carryRefusedForGood = (carry) => carry?.state === "refused" && !CARRY_WAIT_CODES.has(carry.code);
-function pocketCarryText(carry) {
-  if (carry?.state !== "refused") return "";
+function pocketCarryReason(carry) {
+  if (carry && CARRY_DONE.has(carry.state)) return { done: true, waits: false, code: null, reason: "" };
+  if (carry?.state !== "refused") return { done: false, waits: true, code: null, reason: "the wallet has not finished its check of the pool switch" };
   const code = String(carry.code ?? "");
   const reason = code === "p03_pocket_carry_source_fill_pending" || code === "p03_pocket_carry_source_payment_pending" ? "a pocket top-up or a pocket payment is not final yet" : code === "wallet_locked" ? "another wallet command uses the old pool's wallet now" : CARRY_WAIT_CODES.has(code) ? "the wallet has not finished its check of the pool switch" : code === "p03_pocket_carry_target_not_empty" ? "the new pool's wallet already has pocket accounts of its own" : "the pocket records of the two wallets do not match";
+  return { done: false, waits: CARRY_WAIT_CODES.has(code), code, reason };
+}
+function pocketCarryText(carry) {
+  if (carry?.state !== "refused") return "";
+  const { code, reason } = pocketCarryReason(carry);
   if (CARRY_WAIT_CODES.has(code)) {
     return ` Your pocket accounts stay in the old pool's records for now (${reason}). The money in them is safe. The wallet tries again by itself in a minute.`;
   }
@@ -123136,7 +123158,9 @@ function createSuccessionScheduler(options) {
     },
     log = () => {
     },
-    carry = carryPocketBook
+    carry = carryPocketBook,
+    onSettled = () => {
+    }
   } = options;
   const now = options.now ?? Date.now;
   const randomInt9 = options.randomInt ?? cryptoRandomInt;
@@ -123331,6 +123355,12 @@ function createSuccessionScheduler(options) {
           } catch {
           }
         }
+        if (counts.legsDone > (job.legsDone ?? 0) && counts.transactions.length) {
+          try {
+            onSettled(counts.transactions.at(-1));
+          } catch {
+          }
+        }
         if (result.state === "moved") {
           if ((prepared.extraAccounts ?? 0) > 0) return save2(store, job, { ...counts, attempts: 0, lastCode: void 0, nextTryAtMs: now() });
           return save2(store, job, { ...counts, state: "moved", attempts: 0, lastCode: void 0, nextTryAtMs: void 0 });
@@ -123533,11 +123563,30 @@ function createSuccessionScheduler(options) {
     }
     return views;
   }
+  function pocketCarries() {
+    const carries = [];
+    for (const entry of listEntries()) {
+      let job;
+      try {
+        job = readSuccessionJob(storeOf(entry.from), entry.from);
+      } catch {
+        job = void 0;
+      }
+      if (typeof job?.to !== "string") continue;
+      carries.push({
+        from: job.from,
+        to: job.to,
+        pocketCarry: job.pocketCarry ? { state: job.pocketCarry.state, code: job.pocketCarry.code ?? null } : null
+      });
+    }
+    return carries;
+  }
   return Object.freeze({
     tick,
     beforePay,
     status,
     openJobs,
+    pocketCarries,
     running: () => Boolean(active),
     acknowledge(from, state) {
       try {
@@ -123572,6 +123621,7 @@ function startSuccessionScheduler({ store, openStore, session, underLease, log =
       status: () => [],
       acknowledge: () => false,
       openJobs: () => [],
+      pocketCarries: () => [],
       running: () => false
     });
   }
@@ -125228,6 +125278,7 @@ async function runUnshield({
   return { selfPayTransaction: paid.transaction ?? null, exitTransaction: exit.signature ?? null };
 }
 var BALANCE_REFRESH_WAIT_MS = 2e4;
+var BALANCE_REFRESH_GRACE_MS = 2e3;
 function movingAtomic(store) {
   let moving = 0n;
   try {
@@ -125282,6 +125333,9 @@ function localBalanceOf(store) {
 var CAP_BALANCE_WAIT_MS = 35e3;
 var CAP_BALANCE_RETRY_MS = 5e3;
 var REFRESH_RETRY_MS = 6e4;
+var FINALITY_POLL_MS = 2e3;
+var FINALITY_WAIT_MS = 6e4;
+var PUBLIC_READ_ANSWER_MS = 3e3;
 var SWITCH_WAIT_MS = 4e4;
 var ELICIT_TIMEOUT_MS = 5 * 6e4;
 var POLL_SECONDS2 = 30;
@@ -125346,7 +125400,7 @@ function createWalletTools({
     deps: ops.autoPockets ?? {}
   });
   if (money.autoPockets === true) autoPockets.start();
-  const mover = createMoveScheduler({ session, underLease, log, deps: ops.move && typeof ops.move === "object" ? ops.move : {} });
+  const mover = createMoveScheduler({ session, underLease, log, onSettled: refreshAtFinality, deps: ops.move && typeof ops.move === "object" ? ops.move : {} });
   if (ops.move !== false) mover.start();
   const succession = ops.succession === false ? void 0 : {
     successionStatus,
@@ -125452,7 +125506,9 @@ function createWalletTools({
         ...eta === void 0 ? {} : { etaSeconds: eta },
         ...Number.isInteger(item.legsTotal) ? { legsDone: Number.isInteger(item.legsDone) ? item.legsDone : 0, legsTotal: item.legsTotal } : {},
         ...typeof item.lastCode === "string" && item.lastCode ? { code: item.lastCode } : {},
-        ...Number.isFinite(item.updatedAtMs) ? { updatedAt: new Date(item.updatedAtMs).toISOString() } : {}
+        ...Number.isFinite(item.updatedAtMs) ? { updatedAt: new Date(item.updatedAtMs).toISOString() } : {},
+        // The pocket book carry (scheduler.mjs carryPockets): a refused carry keeps the pockets in the old pool's records.
+        ...item.pocketCarry && typeof item.pocketCarry.state === "string" ? { pocketCarry: { state: item.pocketCarry.state, code: typeof item.pocketCarry.code === "string" ? item.pocketCarry.code : null } } : {}
       };
     });
   };
@@ -125478,6 +125534,51 @@ function createWalletTools({
     }
     return refreshRun;
   }
+  let finalityWait;
+  let finalityTarget;
+  let finalityDeadline = 0;
+  let finalityClosed = false;
+  const finalityPollMs = ops.finalityPollMs ?? FINALITY_POLL_MS;
+  const finalityWaitMs = ops.finalityWaitMs ?? FINALITY_WAIT_MS;
+  function refreshAtFinality(signature) {
+    if (typeof signature !== "string" || !signature || finalityClosed) return;
+    finalityTarget = signature;
+    finalityDeadline = Date.now() + finalityWaitMs;
+    if (finalityWait) return;
+    const statuses = ops.signatureStatuses ?? ((signatures) => session.connection.getSignatureStatuses(signatures));
+    finalityWait = (async () => {
+      for (; ; ) {
+        const watched = finalityTarget;
+        let status;
+        try {
+          status = (await statuses([watched]))?.value?.[0] ?? void 0;
+        } catch {
+          status = void 0;
+        }
+        if (finalityClosed) return;
+        if (watched === finalityTarget && status?.err) {
+          log("MCP_FINALITY_WAIT_FAILED_TRANSACTION");
+          return;
+        }
+        if (watched === finalityTarget && status?.confirmationStatus === "finalized") {
+          log("MCP_FINALITY_REFRESH");
+          await refreshShared().catch(() => {
+          });
+          return;
+        }
+        if (Date.now() + finalityPollMs > finalityDeadline) {
+          log("MCP_FINALITY_WAIT_EXPIRED");
+          return;
+        }
+        await new Promise((resolve38) => {
+          const timer = setTimeout(resolve38, finalityPollMs);
+          timer.unref?.();
+        });
+      }
+    })().finally(() => {
+      finalityWait = void 0;
+    });
+  }
   async function refreshIfStale() {
     let stale;
     try {
@@ -125760,6 +125861,7 @@ function createWalletTools({
       const floatPaid = float?.state === "receipt";
       const amounts = floatPaid ? { priceAtomic: float.priceAtomic, feeAtomic: float.feeAtomic, amountAtomic: float.paidAtomic } : { priceAtomic: receipt.amountAtomic ?? null, feeAtomic: "0", amountAtomic: receipt.amountAtomic ?? null };
       const one = paidStore ? localBalanceOf(paidStore) : null;
+      if (receipt.replayed !== true) refreshAtFinality(floatPaid ? float.floatSettleTransaction : transaction);
       mark("mcp-result");
       return answerResult(paidAnswerContent({
         status: response.status,
@@ -125886,21 +125988,23 @@ function createWalletTools({
         );
       }
       const publicRead = withTimeout((ops.readPublicBalance ?? readOwnPublicBalance)({ session, store }), PUBLIC_READ_TIMEOUT_MS).then((read2) => ({ read: read2 }), (error2) => ({ error: error2 }));
-      let report = computeBalance({ store, snapshotRead: readBalanceSnapshot(store), source: "local" });
+      let report = computeBalance({ store, snapshotRead: readBalanceSnapshot(store), source: "local", firstDepositEstimate: true });
       let refresh = {};
       const recentlyFailed = refreshFailedAt && Date.now() - refreshFailedAt < REFRESH_RETRY_MS && !refreshRun;
       if (report.split?.shieldedAtomic != null && report.status === "stale") {
-        if (!recentlyFailed) refreshShared().catch(() => {
+        if (!recentlyFailed && !finalityWait) refreshShared().catch(() => {
         });
         refresh = { refreshing: true };
       } else if (report.split?.shieldedAtomic == null && recentlyFailed) {
         refresh = { refreshed: false, refreshError: refreshFailedCode ?? "mcp_refresh_failed" };
       } else if (report.split?.shieldedAtomic == null) {
         const run5 = refreshShared().then(() => "done", (error2) => ({ failed: errorCode2(error2, "mcp_refresh_failed") }));
-        const outcome = await Promise.race([run5, new Promise((resolve38) => {
-          const timer = setTimeout(() => resolve38("waiting"), balanceRefreshWaitMs);
+        const waitFor = (ms) => Promise.race([run5, new Promise((resolve38) => {
+          const timer = setTimeout(() => resolve38("waiting"), ms);
           timer.unref?.();
         })]);
+        let outcome = await waitFor(balanceRefreshWaitMs);
+        if (outcome === "waiting") outcome = await waitFor(BALANCE_REFRESH_GRACE_MS);
         if (outcome === "done") {
           try {
             store = session.openStore();
@@ -125914,9 +126018,28 @@ function createWalletTools({
           refresh = { refreshed: false, refreshError: outcome.failed };
         }
       }
-      const { read, error } = await publicRead;
+      const answered = await Promise.race([
+        publicRead,
+        new Promise((resolve38) => {
+          const timer = setTimeout(() => resolve38({ reading: true }), PUBLIC_READ_ANSWER_MS);
+          timer.unref?.();
+        })
+      ]);
+      if (answered.reading) {
+        publicRead.then(({ error: late2 }) => {
+          if (late2) log(`MCP_PUBLIC_READ_FAILED_LATE ${late2?.name ?? "Error"}`);
+        });
+      }
+      const { read, error } = answered;
       let unshielded;
-      if (read) {
+      if (answered.reading) {
+        unshielded = {
+          unshieldedAtomic: null,
+          unshielded: null,
+          unshieldedSolLamports: null,
+          unshieldedReason: "reading: the RPC read of the wallet's own USDC account did not answer in 3 s; the shielded balance above does not wait for it. Call wallet_balance again later"
+        };
+      } else if (read) {
         unshielded = {
           unshieldedAtomic: read.unshieldedAtomic,
           unshielded: formatAtomic(BigInt(read.unshieldedAtomic), Number(store.state.decimals)),
@@ -126620,6 +126743,7 @@ function createWalletTools({
       job.result = result;
       log(`MCP_${kind.toUpperCase()}_DONE requestId=${job.requestId}`);
       if (kind !== "unshield") afterShield(job);
+      else refreshAtFinality(result?.exitTransaction ?? result?.selfPayTransaction);
     }, (error) => {
       job.failedStage = job.stage;
       job.state = "failed";
@@ -126853,7 +126977,7 @@ function createWalletTools({
   const moveStatus = {
     name: "wallet_move_status",
     title: "Pool switch status",
-    description: "Use this when the user asks why their balance moved, whether the pool switch is done, or when an answer shows poolSwitch, or when wallet_balance shows movingAtomic or pools. When the facilitator switches to a new pool, this wallet moves the whole balance there by itself (no fee, no step by the user); poolSwitches lists each switch with its state (pending, scheduled, running, done, failed) and a plain message to tell the user. Also called wallet_pool_switch_status. When the facilitator retires a pool, this wallet moves its whole balance from the old pool to the new one by itself (no fee, no step by the user): each leg pays one account of the old pool to the facilitator, which credits the same amount to a one-time address of this wallet in the new pool. This tool reads the move's state and every leg (amountAtomic, state planned|paid|credited|done|failed, moveId); it pays nothing and signs nothing. state: none (no move announced), waiting or running (it continues by itself), done, failed (code, detail, and next say why and what to do).",
+    description: "Use this when the user asks why their balance moved, whether the pool switch is done, or when an answer shows poolSwitch, or when wallet_balance shows movingAtomic or pools. When the facilitator switches to a new pool, this wallet moves the whole balance there by itself (no fee, no step by the user); poolSwitches lists each switch with its state (pending, scheduled, running, done, failed) and a plain message to tell the user, plus pocketCarry when the wallet tried to move the old pool's pocket records to the new pool (state carried, completed, already, none, or refused with a code; the message says what a refusal means). Also called wallet_pool_switch_status. When the facilitator retires a pool, this wallet moves its whole balance from the old pool to the new one by itself (no fee, no step by the user): each leg pays one account of the old pool to the facilitator, which credits the same amount to a one-time address of this wallet in the new pool. This tool reads the move's state and every leg (amountAtomic, state planned|paid|credited|done|failed, moveId); it pays nothing and signs nothing. state: none (no move announced), waiting or running (it continues by itself), done, failed (code, detail, and next say why and what to do).",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     async run() {
@@ -126881,6 +127005,7 @@ function createWalletTools({
   };
   Object.defineProperties(tools, {
     close: { value: () => {
+      finalityClosed = true;
       autoPockets.close();
       mover.close();
       adopter.close();
@@ -126891,7 +127016,14 @@ function createWalletTools({
     startSuccession: { value: () => {
       if (!succession || successionHandle) return;
       try {
-        successionHandle = succession.startSuccessionScheduler({ store: session.openStore(), openStore: () => session.openStore(), session, underLease, log });
+        successionHandle = succession.startSuccessionScheduler({
+          store: session.openStore(),
+          openStore: () => session.openStore(),
+          session,
+          underLease,
+          log,
+          deps: { onSettled: refreshAtFinality }
+        });
       } catch (error) {
         log(`MCP_POOL_SWITCH_SCHEDULER_NOT_STARTED: ${error?.name ?? "Error"}`);
       }
@@ -132516,6 +132648,55 @@ async function spendGate(args, values, deps, io, { amountAtomic, again }) {
   if (!followed || index < 0 || resolve37(followed) === walletFile) return args;
   return [...args.slice(0, index + 1), followed, ...args.slice(index + 2)];
 }
+async function pocketFillGate(args, values, deps, io) {
+  if (!values.has("--wallet") || values.has("--dwell-check")) return args;
+  const walletFile = resolve37(values.get("--wallet"));
+  const session = lazySpendSession(walletFile, values, deps);
+  let handle;
+  try {
+    handle = (deps.startSuccessionScheduler ?? startSuccessionScheduler)({
+      session,
+      openStore: () => session.openStore(),
+      underLease: sessionLease(session),
+      log: () => {
+      },
+      env: deps.env
+    });
+  } catch {
+    return args;
+  }
+  let carries;
+  try {
+    await Promise.resolve(handle.tick?.()).catch(() => {
+    });
+    carries = handle.pocketCarries?.() ?? [];
+  } catch {
+    carries = [];
+  } finally {
+    handle.stop?.();
+  }
+  if (!carries.length) return args;
+  const home = setupHome(deps.env);
+  const pathOf = (pool) => resolve37(homeWalletPath(home, pool));
+  let target = walletFile;
+  for (let hop = 0; hop < carries.length; hop += 1) {
+    const next = carries.find((item) => pathOf(item.from) === target && existsSync(pathOf(item.to)));
+    if (!next) break;
+    target = pathOf(next.to);
+  }
+  for (const item of carries.filter((entry) => pathOf(entry.to) === target)) {
+    const carry = pocketCarryReason(item.pocketCarry);
+    if (carry.done) continue;
+    if (carry.waits) {
+      throw new PublicFailure(`wallet_pool_switch_wait_retry_same_request: Your facilitator switched to a new pool, and your pocket records are not in the new pool's wallet yet (${carry.reason}). Your pockets and the money in them are safe; nothing was filled or signed. Run the same pocket fill command again in 60 s`);
+    }
+    throw new PublicFailure(`wallet_pool_switch_failed: Your facilitator switched to a new pool, and the wallet could not move your pocket records to the new pool's wallet (${carry.reason}). Your pockets and the money in them are safe; nothing was filled or signed. Tell the operator this code. lastCode: ${carry.code}`);
+  }
+  if (target === walletFile) return args;
+  io.err("pool switch: pocket fill uses your wallet of the facilitator's new pool\n");
+  const index = args.indexOf("--wallet");
+  return index < 0 ? args : [...args.slice(0, index + 1), target, ...args.slice(index + 2)];
+}
 async function runCurl(values, deps) {
   const io = deps.io;
   const policy = createSpendPolicy({
@@ -133864,7 +134045,7 @@ var COMMANDS = [
         }
       }
     },
-    run: (args, values, deps) => deps.pocketMain(["fill", ...args])
+    run: async (args, values, deps, io) => deps.pocketMain(["fill", ...await pocketFillGate(args, values, deps, io)])
   },
   {
     name: "pocket release",