shinjuku-shielded 0.3.46 → 0.3.47

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "fe90fa0a418682c08b49b05bcda64ffd7b6cf8803166f95968205c80a2fcab4b",
-  "bytes": 11282021,
-  "sourceCommit": "4664c1b8a728712acc576493a6cabb03ccbe4167",
+  "sha256": "efd1a80db30f354b1fd326c9619666b7d63ce4051428a5e7a4f267a04ca568ea",
+  "bytes": 11284496,
+  "sourceCommit": "d84d9e95e8794f78eb2eeac89bf1671735c23e66",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.46",
+  "version": "0.3.47",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "fe90fa0a",
-  "shinjukuSha256": "fe90fa0a418682c08b49b05bcda64ffd7b6cf8803166f95968205c80a2fcab4b",
+  "shinjukuRelease": "efd1a80d",
+  "shinjukuSha256": "efd1a80db30f354b1fd326c9619666b7d63ce4051428a5e7a4f267a04ca568ea",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -62324,7 +62324,9 @@ var init_errorCodes = __esm({
       "p03_quote_anchor_evidence_invalid",
       "p03_quote_anchor_invalid",
       "p03_quote_anchor_not_current",
+      "p03_quote_anchor_read_invalid",
       "p03_quote_anchor_reader_missing",
+      "p03_quote_anchor_stale",
       "p03_quote_commitment_invalid",
       "p03_quote_crypto_address_base58_empty",
       "p03_quote_crypto_address_base58_invalid",
@@ -63987,6 +63989,13 @@ var init_errorCodes = __esm({
       "requirement_invalid",
       "paid_mismatch",
       "duplicate_payment",
+      // Float fronting (float.mjs signFronted / attach, 2026-10-16): refusals and the loss reasons.
+      "front_paused",
+      "front_above_limit",
+      "front_duplicate",
+      "attach_mismatch",
+      "fronted_nullifier_spent",
+      "fronted_quote_expired",
       "p03_payer_float_history_unreadable",
       "p03_payer_float_dead_proof_failed",
       "p03_payer_float_watch_failed",
@@ -92811,6 +92820,8 @@ async function payViaFloat({
     const finishingUntil = Date.now() + FINISHING_LIMIT_MS;
     for (; ; ) {
       const seen = {};
+      const innerRecord = store.readWal(`resource-payment-${hash8(record.innerRequestId)}`);
+      const front = innerRecord === void 0 || Array.isArray(innerRecord?.request?.headers) && innerRecord.request.headers.some(([name]) => name === FLOAT_FRONT_HEADER);
       let result;
       try {
         result = await pay({
@@ -92824,9 +92835,15 @@ async function payViaFloat({
           maximumAtomic: record.paidAtomic,
           method: "POST",
           body: Buffer.from(record.bodyBase64, "base64"),
-          headers: { "content-type": "application/json" },
+          headers: { "content-type": "application/json", ...front ? { [FLOAT_FRONT_HEADER]: "1" } : {} },
           // settlePriorBeforeQuote: a prior answer that holds every input is settled before the leg-1 402 (one quote, one row).
-          deps: { ...withoutCallerBody(deps), fetchImpl: floatFetch(fetchImpl, seen), settlePriorBeforeQuote: true }
+          // acceptFrontedReceipt: only this request (our float route) may answer with a fronted receipt.
+          deps: {
+            ...withoutCallerBody(deps),
+            fetchImpl: floatFetch(fetchImpl, seen),
+            settlePriorBeforeQuote: true,
+            acceptFrontedReceipt: front
+          }
         });
       } catch (error) {
         if (seen.refusal) {
@@ -92941,7 +92958,7 @@ function paidResult(record, replayed) {
     float: { floatId: record.floatId }
   };
 }
-var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, CONFIG_TIMEOUT_MS, CONFIG_CACHE_MS, DECIMAL3, POSITIVE, PENDING_CODES, hash8, fail18, floatPaymentWalName, configCache, poolDomains, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText;
+var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, CONFIG_TIMEOUT_MS, CONFIG_CACHE_MS, DECIMAL3, POSITIVE, PENDING_CODES, FLOAT_FRONT_HEADER, hash8, fail18, floatPaymentWalName, configCache, poolDomains, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText;
 var init_floatPay = __esm({
   "wallet/src/pay/floatPay.mjs"() {
     "use strict";
@@ -92974,6 +92991,7 @@ var init_floatPay = __esm({
     DECIMAL3 = /^(0|[1-9][0-9]*)$/;
     POSITIVE = /^[1-9][0-9]*$/;
     PENDING_CODES = /* @__PURE__ */ new Set(["float_paid_finishing", "payment_pending_retry_same_payment"]);
+    FLOAT_FRONT_HEADER = "x-shinjuku-float-front";
     hash8 = (value) => sha256Hex2(Buffer.from(value, "utf8"));
     fail18 = (code, extra = {}) => {
       throw Object.assign(new Error(code), extra);
@@ -93440,7 +93458,7 @@ async function finalizePendingReceipt({ store, connection, programId, name, time
 }
 function writeFinalized(store, name, record, settlement) {
   const settledTransaction = settlement.provenance?.signature;
-  const finalized = settledTransaction === record.receipt.transaction ? { ...record, receiptFinality: "finalized" } : { ...record, receiptFinality: "finalized", receiptMismatch: "transaction", settledTransaction };
+  const finalized = record.fronted === true && record.receipt.transaction === "" ? { ...record, receiptFinality: "finalized", settledTransaction } : settledTransaction === record.receipt.transaction ? { ...record, receiptFinality: "finalized" } : { ...record, receiptFinality: "finalized", receiptMismatch: "transaction", settledTransaction };
   store.writeWal(name, finalized);
   return finalized;
 }
@@ -93589,15 +93607,18 @@ function reserveBudget(store, requestKey, fingerprint, amount) {
   };
   store.save();
 }
-function validateReceipt(receipt, record, state, programId) {
+function validateReceipt(receipt, record, state, programId, { acceptFronted = false } = {}) {
   const required = record.paymentRequired.accepts.find((entry) => entry.scheme === "shielded-exact");
+  const fronted = acceptFronted === true && receipt?.transaction === "" && receipt?.extra?.finality === "fronted";
   let signature;
-  try {
-    signature = base58btcDecode2(receipt?.transaction);
-  } catch {
-    fail19("receipt_signature_invalid");
+  if (!fronted) {
+    try {
+      signature = base58btcDecode2(receipt?.transaction);
+    } catch {
+      fail19("receipt_signature_invalid");
+    }
   }
-  if (receipt?.success !== true || signature?.length !== 64 || receipt.network !== state.network || receipt.amount !== required.amount || receipt.extra?.binding !== "carbon-shielded-exact/svm-v3" || !["confirmed", "finalized"].includes(receipt.extra.finality) || receipt.extra.pool !== state.pool || receipt.extra.programId !== String(programId) || !sameQuoteCommitment(receipt.extra.quoteCommitment, required.extra.quoteCommitment) || receipt.extra.memoAvailabilityDigest !== record.memoDigest) fail19("receipt_binding_mismatch");
+  if (receipt?.success !== true || !fronted && signature?.length !== 64 || receipt.network !== state.network || receipt.amount !== required.amount || receipt.extra?.binding !== "carbon-shielded-exact/svm-v3" || !(fronted || ["confirmed", "finalized"].includes(receipt.extra.finality)) || receipt.extra.pool !== state.pool || receipt.extra.programId !== String(programId) || !sameQuoteCommitment(receipt.extra.quoteCommitment, required.extra.quoteCommitment) || receipt.extra.memoAvailabilityDigest !== record.memoDigest) fail19("receipt_binding_mismatch");
 }
 async function payResource(options) {
   const timing = options?.deps?.timing;
@@ -94121,7 +94142,7 @@ async function payResourceOnce({
   let receipt;
   try {
     receipt = decodePaymentResponseHeader(encoded);
-    validateReceipt(receipt, record, store.state, programId);
+    validateReceipt(receipt, record, store.state, programId, { acceptFronted: deps.acceptFrontedReceipt === true });
   } catch (error) {
     if (landed) {
       await response.body?.cancel();
@@ -94136,7 +94157,8 @@ async function payResourceOnce({
     if (landed) recordLandedWithoutAnswer(store, walName2, record);
     throw error;
   }
-  const answeredSettleSlot = receiptSettleSlot(receipt.extra?.settleSlot);
+  const fronted = receipt.extra.finality === "fronted";
+  const answeredSettleSlot = fronted ? void 0 : receiptSettleSlot(receipt.extra?.settleSlot);
   store.writeWal(walName2, {
     ...record,
     state: "receipt",
@@ -94144,6 +94166,7 @@ async function payResourceOnce({
     resultBase64,
     receiptFinality: "pending",
     answeredAtMs: Date.now(),
+    ...fronted ? { fronted: true } : {},
     ...answeredSettleSlot !== void 0 ? { answeredSettleSlot } : {}
   });
   mark("receipt-pending");
@@ -95955,7 +95978,7 @@ function deriveShieldedSolanaP03PoolDomain(input) {
   ]);
 }
 function parseAnchorEvidence(raw) {
-  if (!isPlainObject3(raw)) throw new Error("p03_quote_anchor_evidence_invalid");
+  if (!isPlainObject3(raw)) throw new Error("p03_quote_anchor_read_invalid");
   assertExactKeys(
     raw,
     ["anchorIndex", "anchorRoot", "chainTimestamp", "epoch", "finalizedSlot", "retainedAnchors"].filter((key) => raw[key] !== void 0),
@@ -96225,6 +96248,9 @@ var init_ShieldedSolanaP03Quote = __esm({
         const parsed = this.parseAuthentication(input);
         const evidence = parseAnchorEvidence(await this.readCurrentQuoteAnchor());
         if (evidence.chainTimestamp >= parsed.validBefore) throw new Error("p03_quote_expired");
+        if (parsed.anchor.epoch > evidence.current.epoch || parsed.anchor.epoch === evidence.current.epoch && parsed.anchor.anchorIndex > evidence.current.anchorIndex) {
+          throw new Error("p03_quote_anchor_stale");
+        }
         const anchor = [evidence.current, ...evidence.retained].find((candidate) => candidate.epoch === parsed.anchor.epoch && candidate.anchorIndex === parsed.anchor.anchorIndex && candidate.anchorRoot === parsed.anchor.anchorRoot);
         if (!anchor) throw new Error("p03_quote_anchor_evidence_invalid");
         return this.authenticateParsed(input, parsed);
@@ -98520,7 +98546,9 @@ var init_service = __esm({
       "p03_http_payload_shape_invalid",
       "p03_append_payload_forbidden",
       "p03_payload_binding_invalid",
-      "p03_payment_proof_rejected"
+      "p03_payment_proof_rejected",
+      // The quote's anchor left the facilitator's anchor ring (2026-10-16): it can never pass again.
+      "p03_quote_anchor_evidence_invalid"
     ]);
     definiteVerifyRefusal = (verified) => verified?.isValid === false && typeof verified.invalidMessage === "string" && DEFINITE_VERIFY_REFUSALS.has(verified.invalidMessage);
     refusedBeforeSettlement = (answer) => answer?.success === false && answer.extra?.refusedBeforeRecord === true;
@@ -127697,11 +127725,13 @@ function selfPayMayHaveSigned(store, unshieldId) {
 function leg1SettleSlot(store, float, requestId) {
   try {
     const inner = typeof float?.innerRequestId === "string" && float.innerRequestId ? float.innerRequestId : floatInnerRequestId(requestId);
-    return store?.readWal(`${RESOURCE_PAYMENT_WAL_PREFIX2}${sha256Hex2(Buffer.from(inner, "utf8"))}`)?.answeredSettleSlot;
+    const record = store?.readWal(`${RESOURCE_PAYMENT_WAL_PREFIX2}${sha256Hex2(Buffer.from(inner, "utf8"))}`);
+    return { slot: record?.answeredSettleSlot, fronted: record?.fronted === true };
   } catch {
-    return void 0;
+    return { slot: void 0, fronted: false };
   }
 }
+var FRONTED_SETTLE_MARGIN_SLOTS = 20;
 function bindUnshieldRecipient(store, unshieldId, amountAtomic, to) {
   const name = `self-pay-${unshieldId}`;
   const record = store.readWal(name);
@@ -128138,12 +128168,14 @@ function createWalletTools({
     Promise.resolve().then(() => (ops.slot ?? ((c) => session.connection.getSlot(c)))(commitment)),
     ops.slotReadMs ?? PUBLIC_READ_TIMEOUT_MS
   );
-  function refreshAtFinality(settleSlot) {
+  function refreshAtFinality(settleSlot, { tipMarginSlots = 0 } = {}) {
     if (finalityClosed) return;
     const given = typeof settleSlot === "number" && Number.isSafeInteger(settleSlot) && settleSlot >= 0 ? settleSlot : typeof settleSlot === "string" && /^(0|[1-9][0-9]{0,15})$/.test(settleSlot) && Number.isSafeInteger(Number(settleSlot)) ? Number(settleSlot) : void 0;
+    const margin = Number.isSafeInteger(tipMarginSlots) && tipMarginSlots > 0 ? tipMarginSlots : 0;
     const next = readSlot("confirmed").catch(() => void 0).then((tip) => {
       if (!Number.isSafeInteger(tip)) return given;
-      if (given === void 0 || given > tip || given < tip - FINALITY_SETTLE_WINDOW_SLOTS) return tip;
+      if (given === void 0) return tip + margin;
+      if (given > tip || given < tip - FINALITY_SETTLE_WINDOW_SLOTS) return tip;
       return given;
     });
     const prior = finalityTarget;
@@ -128491,7 +128523,12 @@ function createWalletTools({
       const amounts = floatPaid ? { priceAtomic: float.priceAtomic, feeAtomic: float.feeAtomic, amountAtomic: float.paidAtomic } : { priceAtomic: receipt.amountAtomic ?? null, feeAtomic: "0", amountAtomic: receipt.amountAtomic ?? null };
       const one = paidStore ? localBalanceOf(paidStore, (phase, outcome) => mark(`result:${phase}`, void 0, outcome)) : null;
       mark("mcp-result-balance");
-      if (receipt.replayed !== true) refreshAtFinality(floatPaid ? leg1SettleSlot(paidStore, float, requestId) : receipt.extra?.settleSlot);
+      if (receipt.replayed !== true) {
+        if (floatPaid) {
+          const leg1 = leg1SettleSlot(paidStore, float, requestId);
+          refreshAtFinality(leg1.slot, { tipMarginSlots: leg1.fronted ? FRONTED_SETTLE_MARGIN_SLOTS : 0 });
+        } else refreshAtFinality(receipt.extra?.settleSlot);
+      }
       mark("mcp-result");
       return answerResult(paidAnswerContent({
         status: response.status,
@@ -128807,7 +128844,8 @@ function createWalletTools({
           host,
           scheme: shielded ? "shielded-exact" : "exact",
           amountAtomic: typeof amount === "string" ? amount : null,
-          transaction: typeof record.receipt?.transaction === "string" ? record.receipt.transaction : null,
+          // A fronted receipt (2026-10-16) names no transaction (""): the settle's own, once finalized, or null.
+          transaction: typeof record.receipt?.transaction === "string" && record.receipt.transaction !== "" ? record.receipt.transaction : typeof record.settledTransaction === "string" ? record.settledTransaction : null,
           answeredAt: Number.isSafeInteger(record.answeredAtMs) ? new Date(record.answeredAtMs).toISOString() : null,
           ...typeof record.receiptFinality === "string" ? { receiptFinality: record.receiptFinality } : {},
           at: Number.isSafeInteger(record.answeredAtMs) ? record.answeredAtMs : -1