shinjuku-shielded 0.3.66 → 0.3.67

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "402e7c3666bf4dfe147de8229872bdf611540526a15d5fdb690392c81b878b9d",
-  "bytes": 12181283,
-  "sourceCommit": "07b54a455cdbafc18b7f79b107b0cf9e5e722be9",
+  "sha256": "4d9b6de27c68f9fb53c414d063679fde5a62eb26a2a46f13bebfde9a4d74b042",
+  "bytes": 12186827,
+  "sourceCommit": "fb9acd3df41de84537c71fc80913c41a37568bf4",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1282,5 +1282,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-22T11:29:33.345Z"
+  "publishedAt": "2026-10-22T12:44:47.481Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.66",
+  "version": "0.3.67",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "402e7c36",
-  "shinjukuSha256": "402e7c3666bf4dfe147de8229872bdf611540526a15d5fdb690392c81b878b9d",
+  "shinjukuRelease": "4d9b6de2",
+  "shinjukuSha256": "4d9b6de27c68f9fb53c414d063679fde5a62eb26a2a46f13bebfde9a4d74b042",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -42650,6 +42650,7 @@ function raceOnions(onions, {
   let startSpares = () => {
   };
   let spareTimer;
+  const startedAt = Date.now();
   const winner = new Promise((resolve38) => {
     let open3 = 0;
     let done = false;
@@ -42662,7 +42663,7 @@ function raceOnions(onions, {
     const failed = () => {
       open3 -= 1;
       if (open3 > 0 || done) return;
-      if (!sparesStarted && !signal.aborted) return startSpares();
+      if (!sparesStarted && !signal.aborted) return startSpares("failed");
       if (!controller.signal.aborted) onNone?.();
       settle(onions[0]);
     };
@@ -42670,15 +42671,15 @@ function raceOnions(onions, {
       open3 += 1;
       probe(onion).then(settle, failed);
     };
-    startSpares = () => {
+    startSpares = (cause) => {
       if (sparesStarted || done || signal.aborted) return;
       sparesStarted = true;
       clearTimeout(spareTimer);
-      onSpares?.();
+      onSpares?.({ afterMs: Date.now() - startedAt, cause });
       for (const onion of spares) start(onion);
     };
     if (!sparesStarted) {
-      spareTimer = setTimeout(() => startSpares(), spareAfterMs);
+      spareTimer = setTimeout(() => startSpares("silent"), spareAfterMs);
       spareTimer.unref?.();
     }
     for (const onion of onions) start(onion);
@@ -42686,7 +42687,7 @@ function raceOnions(onions, {
     clearTimeout(spareTimer);
     controller.abort();
   });
-  return { winner, abort: () => controller.abort(), startSpares: () => startSpares() };
+  return { winner, abort: () => controller.abort(), startSpares: () => startSpares("wait") };
 }
 function facilitatorOrigins(argv2) {
   const origins = /* @__PURE__ */ new Set();
@@ -42755,7 +42756,8 @@ async function routeFacilitatorsOverOnion(argv2, {
           spares,
           waitMs: routeWaitMs,
           label: origin,
-          onSpares: () => err(`tor: no onion of ${origin} has answered yet; its ${spares.length} spare onions ${spareHosts} join (Tor may still be fetching the onion addresses)
+          // The line names the time and the spare wait, so a live run counts how often and when the spares join.
+          onSpares: ({ afterMs, cause }) => err(`tor: the ${spares.length} spare onions ${spareHosts} of ${origin} join after ${(afterMs / 1e3).toFixed(1)} s (${SPARE_CAUSE[cause]}; the spare wait is ${spareAfterMs / 1e3} s; Tor may still be fetching the onion addresses)
 `),
           onNone: () => err(`tor: no onion of ${origin} answered its start probe (${liveOnions(group).length} tried); its requests go to its onions in turn and wait for them (Tor may still be building circuits)
 `)
@@ -42821,9 +42823,9 @@ async function routeFacilitatorsOverOnion(argv2, {
     const spares = group.spares ?? [];
     group.startSpares = race(group, liveOnions(group), {
       ...group.onNone ? { onNone: group.onNone } : {},
-      ...spares.length > 0 ? { spares, spareAfterMs, onSpares: () => {
+      ...spares.length > 0 ? { spares, spareAfterMs, onSpares: (info) => {
         group.live = group.onions.length;
-        group.onSpares?.();
+        group.onSpares?.(info);
       } } : {}
     }).startSpares;
   }
@@ -42899,7 +42901,7 @@ async function routeFacilitatorsOverOnion(argv2, {
     }
   };
 }
-var SITE_ONIONS, SITE_SPARE_ONIONS, PINNED_FACILITATOR_ONIONS, PINNED_SPARE_ONIONS, HISTORY_ONIONS, PINNED_HISTORY_ONIONS, HISTORY_PROBE_PATH, FACILITATOR_FLAGS, V3_ONION, DISCOVERY_TIMEOUT_MS, WARM_TIMEOUT_MS, RACE_TIMEOUT_MS, ROUTE_WAIT_MS, SPARE_AFTER_MS, routedGroups, liveOnions, hostOf, noAnswer, routedOnions, routedOrigins, onionsOfOrigin, routesOverOnion, GLOBAL_DISPATCHER, onionDispatchers;
+var SITE_ONIONS, SITE_SPARE_ONIONS, PINNED_FACILITATOR_ONIONS, PINNED_SPARE_ONIONS, HISTORY_ONIONS, PINNED_HISTORY_ONIONS, HISTORY_PROBE_PATH, FACILITATOR_FLAGS, V3_ONION, DISCOVERY_TIMEOUT_MS, WARM_TIMEOUT_MS, RACE_TIMEOUT_MS, ROUTE_WAIT_MS, SPARE_AFTER_MS, SPARE_CAUSE, routedGroups, liveOnions, hostOf, noAnswer, routedOnions, routedOrigins, onionsOfOrigin, routesOverOnion, GLOBAL_DISPATCHER, onionDispatchers;
 var init_facilitatorOnion = __esm({
   "wallet/src/net/facilitatorOnion.mjs"() {
     "use strict";
@@ -42925,7 +42927,6 @@ var init_facilitatorOnion = __esm({
     HISTORY_ONIONS = Object.freeze([
       "http://d6xg3phhurxhzqcsgh2mh52yf744labhrnd7mducwynlertfsjzyslqd.onion",
       "http://3yccoinnouxbjx3emvdxwhbu56cq4de7sfwgvcp4xb7hveccnpurcrid.onion",
-      "http://zflgixkemk6sa2wnd6gzmmtlxl42si6b57uxwxq3r36g6wwzmmd3nmyd.onion",
       "http://5362sown5vydadla47lmo6rafet2fs6iltisxapo5laf7aqjmmvtvhid.onion"
     ]);
     PINNED_HISTORY_ONIONS = Object.freeze({ [HISTORY_ONIONS[0]]: HISTORY_ONIONS });
@@ -42936,7 +42937,8 @@ var init_facilitatorOnion = __esm({
     WARM_TIMEOUT_MS = 3e4;
     RACE_TIMEOUT_MS = 9e4;
     ROUTE_WAIT_MS = 15e3;
-    SPARE_AFTER_MS = ROUTE_WAIT_MS;
+    SPARE_AFTER_MS = 8e3;
+    SPARE_CAUSE = Object.freeze({ silent: "no pinned onion answered", failed: "every pinned probe failed", wait: "a request's route wait ended" });
     routedGroups = [];
     liveOnions = (group) => group.onions.slice(0, group.live ?? group.onions.length);
     hostOf = (onion) => `${new URL(onion).host.slice(0, 8)}...`;
@@ -46729,11 +46731,12 @@ function markPhase(phase, outcome) {
   } catch {
   }
 }
-var scope;
+var scope, phaseScopeActive;
 var init_phaseTiming = __esm({
   "wallet/src/pay/phaseTiming.mjs"() {
     "use strict";
     scope = new AsyncLocalStorage();
+    phaseScopeActive = () => scope.getStore() !== void 0;
   }
 });
 
@@ -50683,7 +50686,7 @@ function connect2(rpcUrl, commitment = "finalized", { timeoutMs, wrapFetch = (fe
   const connection = countRpcCalls(new import_web395.Connection(rpcUrl, { commitment, fetch: fetch2, disableRetryOnRateLimit: true }));
   let nextId = 0;
   Object.defineProperty(connection, "abortableRpcRequest", {
-    value: async (method, params, signal, onResponse) => {
+    value: async (method, params, signal, onResponse, { id, lane, rejectHttpError = false } = {}) => {
       let reported = false;
       const onResponseHead = (response2) => {
         if (reported) return;
@@ -50693,14 +50696,16 @@ function connect2(rpcUrl, commitment = "finalized", { timeoutMs, wrapFetch = (fe
         } catch {
         }
       };
-      const response = await fetch2(rpcUrl, {
+      const init = {
         method: "POST",
         signal,
         onResponseHead,
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: `abortable-${nextId += 1}`, method, params })
-      });
+        body: JSON.stringify({ jsonrpc: "2.0", id: id ?? `abortable-${nextId += 1}`, method, params })
+      };
+      const response = await fetch2(rpcUrl, lane === void 0 ? init : torLaneInit(lane, init));
       onResponseHead(response);
+      if (rejectHttpError && !response.ok) throw new Error(`${response.status} ${response.statusText}: ${await response.text()}`);
       return response.json();
     },
     enumerable: false,
@@ -54250,33 +54255,37 @@ async function programDataCoverage(args) {
     return programDataCoverageFor(extendedArgs);
   }
 }
-async function programDataCoverageFor({
-  connection,
-  program,
-  initialization,
-  snapshotSlot,
-  firstAvailable,
-  deploymentIdentity,
-  concurrency,
-  prior,
-  attest = attestProgramDataCoverage,
-  // Called once before a full attestation (compact.mjs: a notice line and a timing mark):
-  // { priorRefused, cause } — priorRefused is true when a cached attestation was there but its
-  // two reads refused it; cause is a short fixed word for why (reuseRefusalCause).
-  onFullAttestation,
-  // Called before the two reads are asked once more after a transport failure or a timeout
-  // (compact.mjs: a new Tor circuit). Absent: no second try.
-  onReuseRetry,
-  // The connection for the two reuse reads ONLY (compact.mjs: the split's own RPC, bounded),
-  // so one RPC answers both, at or after snapshotSlot, with no history-source floor below it
-  // (2026-10-16 c1s: the signature read on the proxy cost a -32016 retry, about 0.2 s).
-  // The full attestation and its newest signature keep `connection`. Absent: `connection`.
-  reuseConnection = connection,
-  // The pool snapshot's `programDataReuse` (readFinalizedPoolSliced, 2026-10-22): the same two facts
-  // from the same RPC as the pool account, at its slot. Used instead of the two reads only when it
-  // is at `snapshotSlot` and names the cached attestation's address; checked exactly as they are.
-  reuseAnswer
-}) {
+async function programDataCoverageFor(args) {
+  const {
+    connection,
+    program,
+    initialization,
+    snapshotSlot,
+    firstAvailable,
+    deploymentIdentity,
+    concurrency,
+    prior,
+    attest = attestProgramDataCoverage,
+    // Called once before a full attestation (compact.mjs: a notice line and a timing mark):
+    // { priorRefused, cause } — priorRefused is true when a cached attestation was there but its
+    // two reads refused it; cause is a short fixed word for why (reuseRefusalCause).
+    onFullAttestation,
+    // Called before the two reads are asked once more after a transport failure or a timeout
+    // (compact.mjs: a new Tor circuit). Absent: no second try.
+    onReuseRetry,
+    // The connection for the two reuse reads ONLY (compact.mjs: the split's own RPC, bounded),
+    // so one RPC answers both, at or after snapshotSlot, with no history-source floor below it
+    // (2026-10-16 c1s: the signature read on the proxy cost a -32016 retry, about 0.2 s).
+    // The full attestation and its newest signature keep `connection`. Absent: `connection`.
+    reuseConnection = connection,
+    // The pool snapshot's `programDataReuse` (readFinalizedPoolSliced, 2026-10-22): the same two facts
+    // from the same RPC as the pool account, at its slot. Used instead of the two reads only when it
+    // is at `snapshotSlot` and names the cached attestation's address; checked exactly as they are.
+    reuseAnswer,
+    // Set on the one call after a join (below): it does not join again.
+    joined = false,
+    joinWaitMs = ATTEST_JOIN_WAIT_MS
+  } = args;
   if (deploymentIdentity === void 0) return { coverage: void 0, attestation: void 0, reused: false };
   let priorRefused = false;
   let cause;
@@ -54285,8 +54294,8 @@ async function programDataCoverageFor({
     const address5 = new import_web396.PublicKey(prior.coverage.programDataAddress);
     const deployedAtSlot = BigInt(prior.coverage.deployedAtSlot);
     const reuse = (signature2) => {
-      const coverage2 = Object.freeze({ ...prior.coverage, throughFinalizedSlot: BigInt(snapshotSlot) });
-      return { coverage: coverage2, attestation: { key, newestSignature: signature2, coverage: coverage2 }, reused: true };
+      const coverage = Object.freeze({ ...prior.coverage, throughFinalizedSlot: BigInt(snapshotSlot) });
+      return { coverage, attestation: { key, newestSignature: signature2, coverage }, reused: true };
     };
     const pooled = reuseAnswer !== void 0 && reuseAnswer.slot === snapshotSlot && reuseAnswer.address === address5.toBase58() ? reuseAnswer : void 0;
     if (pooled !== void 0) {
@@ -54303,7 +54312,7 @@ async function programDataCoverageFor({
     } else {
       for (let attempt = 1; ; attempt += 1) {
         try {
-          const [, newest2] = await Promise.all([
+          const [, newest] = await Promise.all([
             readProgramDataHeader({
               connection: reuseConnection,
               address: address5,
@@ -54312,7 +54321,7 @@ async function programDataCoverageFor({
             }),
             newestSignature(reuseConnection, address5, snapshotSlot)
           ]);
-          if (newest2.signature === prior.newestSignature) return reuse(newest2.signature);
+          if (newest.signature === prior.newestSignature) return reuse(newest.signature);
           cause = "programdata_newest_signature_changed";
           break;
         } catch (error) {
@@ -54324,23 +54333,52 @@ async function programDataCoverageFor({
     }
     priorRefused = true;
   }
+  const running = key === void 0 || joined ? void 0 : fullAttestations.get(key);
+  let replace = false;
+  if (running !== void 0) {
+    markPhase("attest-full-joined");
+    let timer;
+    const leader = await Promise.race([
+      running.catch(() => void 0),
+      new Promise((resolve38) => {
+        timer = setTimeout(() => resolve38(JOIN_TIMED_OUT), joinWaitMs);
+      })
+    ]);
+    clearTimeout(timer);
+    if (leader === JOIN_TIMED_OUT) {
+      markPhase("attest-full-join-timeout");
+      replace = true;
+    } else if (leader?.attestation !== void 0) {
+      return programDataCoverageFor({ ...args, prior: leader.attestation, joined: true });
+    }
+  }
   onFullAttestation?.({ priorRefused, ...cause ? { cause } : {} });
-  const available = typeof firstAvailable === "function" ? await firstAvailable() : firstAvailable;
-  const coverage = await attest({
-    connection,
-    program,
-    initialization,
-    snapshotSlot,
-    firstAvailable: available,
-    deploymentIdentity,
-    concurrency
-  });
-  const newest = await newestSignature(connection, new import_web396.PublicKey(coverage.programDataAddress), snapshotSlot);
-  return {
-    coverage,
-    attestation: key !== void 0 && newest.slot <= snapshotSlot ? { key, newestSignature: newest.signature, coverage } : void 0,
-    reused: false
-  };
+  const full = (async () => {
+    const available = typeof firstAvailable === "function" ? await firstAvailable() : firstAvailable;
+    const coverage = await attest({
+      connection,
+      program,
+      initialization,
+      snapshotSlot,
+      firstAvailable: available,
+      deploymentIdentity,
+      concurrency
+    });
+    const newest = await newestSignature(connection, new import_web396.PublicKey(coverage.programDataAddress), snapshotSlot);
+    return {
+      coverage,
+      attestation: key !== void 0 && newest.slot <= snapshotSlot ? { key, newestSignature: newest.signature, coverage } : void 0,
+      reused: false
+    };
+  })();
+  if (key !== void 0 && (replace || !fullAttestations.has(key))) {
+    fullAttestations.set(key, full);
+    const forget = () => {
+      if (fullAttestations.get(key) === full) fullAttestations.delete(key);
+    };
+    full.then(forget, forget);
+  }
+  return full;
 }
 async function attestProgramDataCoverage({
   connection,
@@ -55767,7 +55805,7 @@ function base58Decode(value) {
   while (zeros < value.length && value[zeros] === "1") zeros += 1;
   return Uint8Array.from(Buffer.concat([Buffer.alloc(zeros), body]));
 }
-var import_web396, b58Cache, b58, REPLAY_STORE_INDEXED, CLOSE_REPLAY_TREE_TAG, EXTEND_ANCHOR_RING_TAG, WIDEN_ANCHOR_RING_TAG, WIDE_ANCHOR_RING_POOL_BYTES, LINK_SUCCESSOR_TAG, IMPORT_REPLAY_LEAVES_TAG, SETTLE_MOVE_TAG, SWEEP_PREDECESSOR_VAULT_TAG, RELINK_SUCCESSOR_TAG, ROTATE_PAYMENT_SETTLER_TAG, IMPORT_A_LEAF_BYTES, IMPORT_MEMBERSHIP_BYTES, IMPORT_PRESENT_SHIFT, IMPORT_MAX_ENTRIES, MOVE_HEAD_BYTES, MOVE_INSERTED_VALUES, DEFAULT_KEY, FIELD_BYTES2, PRIMARY_PROOF_BYTES, SUBTREE_LEAVES, PAGE_SIZE, FIELD_MODULUS3, BPF_LOADER_UPGRADEABLE_PROGRAM_ID, SYSTEM_PROGRAM, TEST_EXECUTABLES, derivationMemo, memo, reviewedExecutables, isProgramDataIdentityError, ASSUMED_ORIGINAL_EXECUTABLE, AUTHENTICATED_HISTORY_REPORTS, HISTORY_ATTESTATIONS, SNAPSHOT_POOL_STATES, REPORT_POOL_STATES, hasExecutableEvidence, P03_FINALIZED_HISTORY_SOURCE_MODEL, P03_PROGRAMDATA_COVERAGE_SOURCE_MODEL, P03_RUN_RECOVER_UNAVAILABLE_FROM_CHAIN, PROFILES, P03_SETTLEMENT_TAGS, P03_INLINE_SETTLEMENT_TAGS, P03_PAYMENT_REPLAY_INDICES, NO_CONTEXTS, REFRESH_READ_BYTES, E1_TREE_HEADER_BYTES, E1_TREE_MAGIC, E1_CHANGELOG_BYTES, E1_CHANGELOGS_OFFSET, E1_RIGHTMOST_OFFSET, E1_LEAF_COUNT_OFFSET, E1_CANOPY_OFFSET, E1_CANOPY_NODES, P03_POOL_SLICES_METHOD, POOL_SLICES, PROGRAMDATA_HEADER_BYTES, POOL_SLICES_WITH_PROGRAMDATA, SLICED_ROOTS_OFFSET, SLICED_LEAVES_OFFSET, SLICES_REFUSED_ENDPOINTS, SLICES_REFUSED_CONNECTIONS, REUSE_REFUSED_ENDPOINTS, REUSE_REFUSED_CONNECTIONS, PROGRAMDATA_ADDRESSES, HISTORY_FETCH_CONCURRENCY, HISTORY_BULK_TRANSACTIONS, HISTORY_BULK_ADDRESSES, TRANSIENT_RPC_ATTEMPTS, TRANSIENT_RPC_BASE_DELAY_MS, LAGGING_NODE_STEP_OF_BASE, LAGGING_NODE_MAX_RETRIES, LAGGING_NODE_FAST_RETRIES, LAGGING_NODE_SLOW_STEP_OF_BASE, LAGGING_NODE_RPC_CODES, lastVerifiedE1Tree, e1ReplayCounts, e1TreeCandidate;
+var import_web396, b58Cache, b58, REPLAY_STORE_INDEXED, CLOSE_REPLAY_TREE_TAG, EXTEND_ANCHOR_RING_TAG, WIDEN_ANCHOR_RING_TAG, WIDE_ANCHOR_RING_POOL_BYTES, LINK_SUCCESSOR_TAG, IMPORT_REPLAY_LEAVES_TAG, SETTLE_MOVE_TAG, SWEEP_PREDECESSOR_VAULT_TAG, RELINK_SUCCESSOR_TAG, ROTATE_PAYMENT_SETTLER_TAG, IMPORT_A_LEAF_BYTES, IMPORT_MEMBERSHIP_BYTES, IMPORT_PRESENT_SHIFT, IMPORT_MAX_ENTRIES, MOVE_HEAD_BYTES, MOVE_INSERTED_VALUES, DEFAULT_KEY, FIELD_BYTES2, PRIMARY_PROOF_BYTES, SUBTREE_LEAVES, PAGE_SIZE, FIELD_MODULUS3, BPF_LOADER_UPGRADEABLE_PROGRAM_ID, SYSTEM_PROGRAM, TEST_EXECUTABLES, derivationMemo, memo, reviewedExecutables, isProgramDataIdentityError, ASSUMED_ORIGINAL_EXECUTABLE, AUTHENTICATED_HISTORY_REPORTS, HISTORY_ATTESTATIONS, SNAPSHOT_POOL_STATES, REPORT_POOL_STATES, hasExecutableEvidence, P03_FINALIZED_HISTORY_SOURCE_MODEL, P03_PROGRAMDATA_COVERAGE_SOURCE_MODEL, P03_RUN_RECOVER_UNAVAILABLE_FROM_CHAIN, PROFILES, P03_SETTLEMENT_TAGS, P03_INLINE_SETTLEMENT_TAGS, P03_PAYMENT_REPLAY_INDICES, NO_CONTEXTS, REFRESH_READ_BYTES, E1_TREE_HEADER_BYTES, E1_TREE_MAGIC, E1_CHANGELOG_BYTES, E1_CHANGELOGS_OFFSET, E1_RIGHTMOST_OFFSET, E1_LEAF_COUNT_OFFSET, E1_CANOPY_OFFSET, E1_CANOPY_NODES, P03_POOL_SLICES_METHOD, POOL_SLICES, PROGRAMDATA_HEADER_BYTES, POOL_SLICES_WITH_PROGRAMDATA, SLICED_ROOTS_OFFSET, SLICED_LEAVES_OFFSET, SLICES_REFUSED_ENDPOINTS, SLICES_REFUSED_CONNECTIONS, REUSE_REFUSED_ENDPOINTS, REUSE_REFUSED_CONNECTIONS, PROGRAMDATA_ADDRESSES, fullAttestations, ATTEST_JOIN_WAIT_MS, JOIN_TIMED_OUT, HISTORY_FETCH_CONCURRENCY, HISTORY_BULK_TRANSACTIONS, HISTORY_BULK_ADDRESSES, TRANSIENT_RPC_ATTEMPTS, TRANSIENT_RPC_BASE_DELAY_MS, LAGGING_NODE_STEP_OF_BASE, LAGGING_NODE_MAX_RETRIES, LAGGING_NODE_FAST_RETRIES, LAGGING_NODE_SLOW_STEP_OF_BASE, LAGGING_NODE_RPC_CODES, lastVerifiedE1Tree, e1ReplayCounts, e1TreeCandidate;
 var init_walk = __esm({
   "wallet/src/history/walk.mjs"() {
     "use strict";
@@ -56051,6 +56089,9 @@ var init_walk = __esm({
     REUSE_REFUSED_ENDPOINTS = /* @__PURE__ */ new Set();
     REUSE_REFUSED_CONNECTIONS = /* @__PURE__ */ new WeakSet();
     PROGRAMDATA_ADDRESSES = /* @__PURE__ */ new Map();
+    fullAttestations = /* @__PURE__ */ new Map();
+    ATTEST_JOIN_WAIT_MS = 45e3;
+    JOIN_TIMED_OUT = /* @__PURE__ */ Symbol("join-timed-out");
     HISTORY_FETCH_CONCURRENCY = 4;
     HISTORY_BULK_TRANSACTIONS = 256;
     HISTORY_BULK_ADDRESSES = 256;
@@ -57323,13 +57364,17 @@ function failureCause(error) {
 }
 async function boundedOwnRead(operation) {
   const circuit = torCircuit();
-  const pending = operation();
+  const stalled = new AbortController();
+  const pending = operation(stalled.signal);
   pending.catch(() => {
   });
   let timer;
   try {
     return await Promise.race([pending, new Promise((_, reject) => {
-      timer = setTimeout(() => reject(new Error("ETIMEDOUT: own RPC read stalled")), OWN_READ_TIMEOUT_MS);
+      timer = setTimeout(() => {
+        stalled.abort();
+        reject(new Error("ETIMEDOUT: own RPC read stalled"));
+      }, OWN_READ_TIMEOUT_MS);
     })]);
   } catch (error) {
     if (error?.message === "ETIMEDOUT: own RPC read stalled") {
@@ -57460,14 +57505,81 @@ function ed25519Verifies2(message, signature2, publicKey3) {
 async function ownTransaction(own, signature2) {
   let response;
   try {
-    response = await retryRpc2(() => boundedOwnRead(() => own._rpcRequest("getTransaction", [signature2, {
-      commitment: "finalized",
-      maxSupportedTransactionVersion: 1,
-      encoding: "base64"
-    }])), { attempts: 3 });
+    response = await retryRpc2(() => boundedOwnRead((stalled) => hedgedOwnTransactionRead(own, signature2, { stalled })), { attempts: 3 });
   } catch (error) {
     throw Object.assign(refuse3("p03_compact_history_spot_check_unavailable"), { cause: error });
   }
+  return checkedOwnTransaction(response, signature2);
+}
+async function hedgedOwnTransactionRead(own, signature2, { stalled, hedge = inTorRun, afterMs = SPOT_HEDGE_AFTER_MS } = {}) {
+  const params = [signature2, { commitment: "finalized", maxSupportedTransactionVersion: 1, encoding: "base64" }];
+  if (typeof own.abortableRpcRequest !== "function") return own._rpcRequest("getTransaction", params);
+  const id = `spot-${spotReadId += 1}`;
+  const copies = [];
+  const send3 = (lane) => {
+    const controller = new AbortController();
+    const signal = stalled === void 0 ? controller.signal : AbortSignal.any([stalled, controller.signal]);
+    const copy = { controller, lane, outcome: void 0 };
+    copy.read = own.abortableRpcRequest(
+      "getTransaction",
+      params,
+      signal,
+      void 0,
+      { id, rejectHttpError: true, ...lane === void 0 ? {} : { lane } }
+    );
+    copies.push(copy);
+    return copy;
+  };
+  const hedging = hedge();
+  return new Promise((resolve38, reject) => {
+    let timer;
+    let done = false;
+    const finish = (settle) => {
+      done = true;
+      clearTimeout(timer);
+      for (const copy of copies) if (copy.outcome === void 0) copy.controller.abort();
+      settle();
+    };
+    const settled = () => {
+      if (done || copies.some((copy) => copy.outcome === void 0)) return;
+      const answered = copies.find((copy) => copy.outcome.response !== void 0);
+      finish(() => answered !== void 0 ? resolve38(answered.outcome.response) : reject(copies[0].outcome.error));
+    };
+    const follow = (copy, which) => copy.read.then((response) => {
+      let passes = false;
+      try {
+        checkedOwnTransaction(response, signature2);
+        passes = true;
+      } catch {
+        passes = false;
+      }
+      copy.outcome = { response, passes };
+      if (passes && !done) {
+        if (copies.length > 1) markPhase(`spot-hedge-won-${which}`);
+        finish(() => resolve38(response));
+        return;
+      }
+      if (!done && hedging && copies.length === 1) {
+        sendHedge();
+        return;
+      }
+      settled();
+    }, (error) => {
+      copy.outcome = { error };
+      settled();
+    });
+    const sendHedge = () => {
+      clearTimeout(timer);
+      timer = void 0;
+      if (done || copies.length > 1) return;
+      markPhase("spot-hedge-sent");
+      follow(send3(SPOT_HEDGE_LANE), "hedge");
+    };
+    follow(send3(void 0), "first");
+    timer = hedging ? setTimeout(sendHedge, afterMs) : void 0;
+  });
+}
+function checkedOwnTransaction(response, signature2) {
   const result = response?.result;
   if (!result || typeof result !== "object" || !Number.isSafeInteger(result.slot) || !Array.isArray(result.transaction) || typeof result.transaction[0] !== "string" || result.transaction[1] !== "base64" || !result.meta) {
     throw refuse3("p03_compact_history_spot_check_unavailable");
@@ -58114,7 +58226,7 @@ async function tryCompactP03HistoryReport(options) {
     return { ok: false, reason, ...detail ? { detail } : {}, error };
   }
 }
-var import_web397, P03_COMPACT_HISTORY_SOURCE_MODEL, P03_COMPACT_PAGE, P03_COMPACT_SPOT_CHECKS, FIELD_MODULUS5, SUBTREE_LEAVES3, LOCAL_DEPTH2, OUTER_DEPTH2, PRIMARY_PROOF_BYTES2, FIELD_BYTES3, ED25519_SPKI_PREFIX2, VERSION_1_PREFIX2, HEX64, BASE58, REPLAY_STORE_INDEXED2, PROFILES2, MOVE_HEAD_BYTES2, MOVE_INSERTED_VALUES2, refuse3, hash4, bitAt, zeroRootsMemo, lastFolds, PRE_FOLD_SLICE_MS, preFolds, hex64, droppedPools, verifyQuietMs, VERIFY_SLICE_MS, VERIFY_POLL_MS, verifying, unrefTurn, isSignature, isIndex, IMPORT_KEYS, IMPORT_MAX_VALUES, LIST_ATTEMPTS, pageZeroInFlight, OWN_READ_TIMEOUT_MS, BOUNDED_OWN_METHODS, compactReportsRunning, compactHistoryReadsRunning;
+var import_web397, P03_COMPACT_HISTORY_SOURCE_MODEL, P03_COMPACT_PAGE, P03_COMPACT_SPOT_CHECKS, FIELD_MODULUS5, SUBTREE_LEAVES3, LOCAL_DEPTH2, OUTER_DEPTH2, PRIMARY_PROOF_BYTES2, FIELD_BYTES3, ED25519_SPKI_PREFIX2, VERSION_1_PREFIX2, HEX64, BASE58, REPLAY_STORE_INDEXED2, PROFILES2, MOVE_HEAD_BYTES2, MOVE_INSERTED_VALUES2, refuse3, hash4, bitAt, zeroRootsMemo, lastFolds, PRE_FOLD_SLICE_MS, preFolds, hex64, droppedPools, verifyQuietMs, VERIFY_SLICE_MS, VERIFY_POLL_MS, verifying, unrefTurn, isSignature, isIndex, IMPORT_KEYS, IMPORT_MAX_VALUES, LIST_ATTEMPTS, pageZeroInFlight, OWN_READ_TIMEOUT_MS, BOUNDED_OWN_METHODS, SPOT_HEDGE_AFTER_MS, SPOT_HEDGE_LANE, spotReadId, compactReportsRunning, compactHistoryReadsRunning;
 var init_compact = __esm({
   "wallet/src/history/compact.mjs"() {
     "use strict";
@@ -58247,6 +58359,9 @@ var init_compact = __esm({
     pageZeroInFlight = /* @__PURE__ */ new Map();
     OWN_READ_TIMEOUT_MS = HISTORY_RPC_REQUEST_TIMEOUT_MS;
     BOUNDED_OWN_METHODS = /* @__PURE__ */ new Set(["getAccountInfo", "getAccountInfoAndContext", "getMultipleAccountsInfo", "getMultipleAccountsInfoAndContext"]);
+    SPOT_HEDGE_AFTER_MS = 4e3;
+    SPOT_HEDGE_LANE = "spot-hedge";
+    spotReadId = 0;
     compactReportsRunning = 0;
     compactHistoryReadsRunning = () => compactReportsRunning;
   }
@@ -117115,13 +117230,26 @@ async function runUnshield({
   const owner = new import_web3133.PublicKey(recipientOwner);
   const mint = new import_web3133.PublicKey(store.state.asset);
   const recipient = getAssociatedTokenAddressSync(mint, owner, true, TOKEN_PROGRAM_ID);
-  const walk = (deploymentIdentity) => () => loadWalletP03History({
+  let timing;
+  try {
+    timing = typeof session.timing === "function" ? session.timing() : void 0;
+  } catch {
+    timing = void 0;
+  }
+  const mark = (phase) => {
+    try {
+      timing?.(phase);
+    } catch {
+    }
+  };
+  const scoped = (prefix, fn) => phaseScopeActive() || timing === void 0 ? fn() : withPhaseScope(mark, prefix, fn);
+  const walk = (deploymentIdentity) => () => scoped("unshield-walk", () => loadWalletP03History({
     store,
     connection: connectSplit(session.connection, session.historyUrl),
     programId: session.programId,
     pool: store.state.pool,
     deploymentIdentity
-  });
+  }));
   const name = `self-pay-${unshieldId}`;
   let record = store.readWal(name);
   if (record && record.mode === void 0 && !selfPayMayHaveSigned(store, unshieldId)) {
@@ -117140,7 +117268,22 @@ async function runUnshield({
     }
   }
   if (record?.mode === DIRECT_EXIT_MODE) {
-    return runDirectExit({ session, store, unshieldId, amountAtomic, record, owner, mint, recipient, exitProofTools, facilitatorOrigin: facilitatorOrigin2, onStage, walk });
+    return runDirectExit({
+      session,
+      store,
+      unshieldId,
+      amountAtomic,
+      record,
+      owner,
+      mint,
+      recipient,
+      exitProofTools,
+      facilitatorOrigin: facilitatorOrigin2,
+      onStage,
+      walk,
+      mark,
+      scoped
+    });
   }
   if (record?.mode !== void 0) throw new Error("mcp_unshield_failed: this unshield's record names an exit mode this version does not know; nothing new was signed. Update the wallet");
   if (!selfPayMayHaveSigned(store, unshieldId)) {
@@ -117148,6 +117291,7 @@ async function runUnshield({
   }
   const payerTools = session.proofTools;
   onStage("self-pay");
+  mark("unshield-self-pay");
   const paid = await selfPayStep({
     store,
     connection: session.connection,
@@ -117165,8 +117309,10 @@ async function runUnshield({
   });
   const payment = store.readWal(`${RESOURCE_PAYMENT_WAL_PREFIX2}${sha256Hex2(Buffer.from(selfPayRequestId(unshieldId), "utf8"))}`);
   if (!payment?.memoDigest || !paid.noteCommitment) throw new Error("mcp_unshield_failed: the self-payment record is incomplete; call wallet_unshield again with the same request_id");
+  mark("unshield-paid");
   onStage("exit");
-  const exit = await exitWhenAnchored(() => runRecoveredP03NoteExit({
+  mark("unshield-exit");
+  const exit = await scoped("unshield-exit", () => exitWhenAnchored(() => runRecoveredP03NoteExit({
     store,
     connection: session.connection,
     programId: session.programId,
@@ -117180,12 +117326,29 @@ async function runUnshield({
     relaySubmit: facilitatorExitRelay(facilitatorOrigin2),
     requestAnchor: facilitatorAnchor(facilitatorOrigin2),
     deps: { walkHistory: walk(exitProofTools.deploymentIdentity) }
-  }), { ring: { connection: session.connection, pool: store.state.pool } });
+  }), { ring: { connection: session.connection, pool: store.state.pool } }));
+  mark("unshield-exited");
   const exited = store.readWal(`self-pay-${unshieldId}`);
   store.writeWal(`self-pay-${unshieldId}`, { ...exited, state: "exited", exitTransaction: exit.signature, exitedAtMs: exited?.exitedAtMs ?? Date.now() });
   return { selfPayTransaction: paid.transaction ?? null, exitTransaction: exit.signature ?? null };
 }
-async function runDirectExit({ session, store, unshieldId, amountAtomic, record, owner, mint, recipient, exitProofTools, facilitatorOrigin: facilitatorOrigin2, onStage, walk }) {
+async function runDirectExit({
+  session,
+  store,
+  unshieldId,
+  amountAtomic,
+  record,
+  owner,
+  mint,
+  recipient,
+  exitProofTools,
+  facilitatorOrigin: facilitatorOrigin2,
+  onStage,
+  walk,
+  mark = () => {
+  },
+  scoped = (_prefix, fn) => fn()
+}) {
   const name = `self-pay-${unshieldId}`;
   if (record.amountAtomic !== String(amountAtomic) || record.exitAmountAtomic !== String(amountAtomic)) {
     throw new Error("mcp_request_id_reused: this unshield's direct exit is bound to another amount; nothing new was signed");
@@ -117198,6 +117361,7 @@ async function runDirectExit({ session, store, unshieldId, amountAtomic, record,
   }
   if (!selfPayMayHaveSigned(store, unshieldId)) await checkUnshieldRecipient({ connection: session.connection, mint, owner });
   onStage("exit");
+  mark("unshield-exit");
   const proveExit = async (request) => {
     const proved = await proveRecoveredP03NoteExit({ request, tools: exitProofTools });
     const now = store.readWal(name);
@@ -117207,7 +117371,7 @@ async function runDirectExit({ session, store, unshieldId, amountAtomic, record,
   const exitAmountAtomic = record.exitAmountAtomic === record.noteValueAtomic ? void 0 : record.exitAmountAtomic;
   let exit;
   try {
-    exit = await exitWhenAnchored(() => runRecoveredP03NoteExit({
+    exit = await scoped("unshield-exit", () => exitWhenAnchored(() => runRecoveredP03NoteExit({
       store,
       connection: session.connection,
       programId: session.programId,
@@ -117222,13 +117386,14 @@ async function runDirectExit({ session, store, unshieldId, amountAtomic, record,
       relaySubmit: facilitatorExitRelay(facilitatorOrigin2),
       requestAnchor: facilitatorAnchor(facilitatorOrigin2),
       deps: { walkHistory: walk(exitProofTools.deploymentIdentity), proveExit }
-    }), { ring: { connection: session.connection, pool: store.state.pool } });
+    }), { ring: { connection: session.connection, pool: store.state.pool } }));
   } catch (error) {
     if (/requested recovered note is not uniquely spendable/.test(String(error?.message)) && store.readWal(name)?.state === "started" && !store.readWal(directExitWalName(record)) && !selfPayMayHaveSigned(store, unshieldId)) {
       throw new Error("mcp_unshield_received_payment_gone: the received payment this unshield chose is no longer spendable (another spend took it, or the wallet's last chain read was old); nothing was signed, and this request_id cannot pass");
     }
     throw error;
   }
+  mark("unshield-exited");
   const exited = store.readWal(name);
   store.writeWal(name, { ...exited, state: "exited", exitTransaction: exit.signature, exitedAtMs: exited?.exitedAtMs ?? Date.now() });
   return { selfPayTransaction: null, exitTransaction: exit.signature ?? null };