@chainvue/verus-sapling 0.0.0

package/dist/browser/lightwalletd-web.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Browser lightwalletd client — a `LightwalletdTransport` over gRPC-web (`fetch`)
+ * instead of Node `@grpc/grpc-js`. Point it at a gRPC-web proxy (grpcwebproxy /
+ * Envoy) in front of lightwalletd; over an SSH forward that is
+ * `http://localhost:8080`, in production a TLS tunnel hostname.
+ *
+ * Same interface as the Node `LightwalletdClient`, so `../wallet`'s
+ * `detectNotes` / `buildShieldedSpend` work unchanged in the extension. Message
+ * (de)serialization is hand-coded against the CompactTxStreamer protobuf field
+ * numbers with the minimal `./protobuf` codec — no protobuf runtime dependency.
+ */
+import type { CompactBlock, CompactOutput, CompactTx, LightwalletdTransport, TreeState } from '../lightwalletd.js';
+/** Browser (gRPC-web) implementation of the lightwalletd transport. */
+export declare class LightwalletdWebClient implements LightwalletdTransport {
+    private readonly baseUrl;
+    /** @param baseUrl gRPC-web proxy origin, e.g. "http://localhost:8080". */
+    constructor(baseUrl: string);
+    getLatestHeight(): Promise<number>;
+    getTreeState(height: number): Promise<TreeState>;
+    getTransaction(txidDisplayHex: string): Promise<{
+        data: Uint8Array;
+        height: string;
+    }>;
+    getBlockRange(start: number, end: number): AsyncGenerator<CompactBlock>;
+    sendTransaction(txHex: string): Promise<{
+        errorCode: number;
+        errorMessage: string;
+    }>;
+    /** gRPC-web has no channel to close; provided for interface parity. */
+    close(): void;
+}
+export declare function decodeCompactOutput(msg: Uint8Array): CompactOutput;
+export declare function decodeCompactTx(msg: Uint8Array): CompactTx;
+export declare function decodeCompactBlock(msg: Uint8Array): CompactBlock;
+/** Convenience for hex txids from a decoded block (display/big-endian order). */
+export declare function blockTxid(tx: CompactTx): string;

package/dist/browser/lightwalletd-web.js

@@ -0,0 +1,186 @@
+/**
+ * Browser lightwalletd client — a `LightwalletdTransport` over gRPC-web (`fetch`)
+ * instead of Node `@grpc/grpc-js`. Point it at a gRPC-web proxy (grpcwebproxy /
+ * Envoy) in front of lightwalletd; over an SSH forward that is
+ * `http://localhost:8080`, in production a TLS tunnel hostname.
+ *
+ * Same interface as the Node `LightwalletdClient`, so `../wallet`'s
+ * `detectNotes` / `buildShieldedSpend` work unchanged in the extension. Message
+ * (de)serialization is hand-coded against the CompactTxStreamer protobuf field
+ * numbers with the minimal `./protobuf` codec — no protobuf runtime dependency.
+ */
+import { bytesToHex, hexToBytes, reverseBytes } from '../hex.js';
+import { ProtoReader, ProtoWriter } from './protobuf.js';
+import { serverStream, unary } from './grpcweb.js';
+const EMPTY = new Uint8Array(0);
+/** BlockID { height=1 } — request for GetTreeState / nested in BlockRange. */
+function blockId(height) {
+    return new ProtoWriter().varintField(1, height).finish();
+}
+/** Browser (gRPC-web) implementation of the lightwalletd transport. */
+export class LightwalletdWebClient {
+    baseUrl;
+    /** @param baseUrl gRPC-web proxy origin, e.g. "http://localhost:8080". */
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl;
+    }
+    async getLatestHeight() {
+        // GetLatestBlock(ChainSpec{}) -> BlockID{ height=1 }
+        const res = await unary(this.baseUrl, 'GetLatestBlock', EMPTY);
+        const r = new ProtoReader(res);
+        let height = 0;
+        while (!r.done) {
+            const { field, wire } = r.tag();
+            if (field === 1 && wire === 0)
+                height = r.varint();
+            else
+                r.skip(wire);
+        }
+        return height;
+    }
+    async getTreeState(height) {
+        // GetTreeState(BlockID{height}) -> TreeState{ network=1,height=2,hash=3,time=4,tree=5 }
+        const res = await unary(this.baseUrl, 'GetTreeState', blockId(height));
+        const r = new ProtoReader(res);
+        const out = { network: '', height: '0', hash: '', time: 0, tree: '' };
+        while (!r.done) {
+            const { field, wire } = r.tag();
+            if (field === 1 && wire === 2)
+                out.network = r.string();
+            else if (field === 2 && wire === 0)
+                out.height = String(r.varint());
+            else if (field === 3 && wire === 2)
+                out.hash = r.string();
+            else if (field === 4 && wire === 0)
+                out.time = r.varint();
+            else if (field === 5 && wire === 2)
+                out.tree = r.string();
+            else
+                r.skip(wire);
+        }
+        return out;
+    }
+    async getTransaction(txidDisplayHex) {
+        // GetTransaction(TxFilter{ hash=3 }) -> RawTransaction{ data=1, height=2 }
+        const hashInternal = reverseBytes(hexToBytes(txidDisplayHex));
+        const req = new ProtoWriter().bytesField(3, hashInternal).finish();
+        const res = await unary(this.baseUrl, 'GetTransaction', req);
+        const r = new ProtoReader(res);
+        let data = EMPTY;
+        let height = '0';
+        while (!r.done) {
+            const { field, wire } = r.tag();
+            if (field === 1 && wire === 2)
+                data = Uint8Array.from(r.bytes());
+            else if (field === 2 && wire === 0)
+                height = String(r.varint());
+            else
+                r.skip(wire);
+        }
+        return { data, height };
+    }
+    async *getBlockRange(start, end) {
+        // GetBlockRange(BlockRange{ start=1:BlockID, end=2:BlockID }) -> stream CompactBlock
+        const req = new ProtoWriter().messageField(1, blockId(start)).messageField(2, blockId(end)).finish();
+        for await (const msg of serverStream(this.baseUrl, 'GetBlockRange', req)) {
+            yield decodeCompactBlock(msg);
+        }
+    }
+    async sendTransaction(txHex) {
+        // SendTransaction(RawTransaction{ data=1, height=2 }) -> SendResponse{ errorCode=1, errorMessage=2 }
+        const req = new ProtoWriter().bytesField(1, hexToBytes(txHex)).varintField(2, 0).finish();
+        const res = await unary(this.baseUrl, 'SendTransaction', req);
+        const r = new ProtoReader(res);
+        let errorCode = 0;
+        let errorMessage = '';
+        while (!r.done) {
+            const { field, wire } = r.tag();
+            if (field === 1 && wire === 0)
+                errorCode = r.varint();
+            else if (field === 2 && wire === 2)
+                errorMessage = r.string();
+            else
+                r.skip(wire);
+        }
+        // The transport retries a broadcast once on a dropped connection (see
+        // grpcweb `post`), which can re-submit a tx that already reached the daemon.
+        // A "transaction already known / in mempool" reply means the FIRST attempt
+        // succeeded — report success rather than a spurious failure.
+        if (errorCode !== 0 && /already[ -](in[ -]?mempool|known|in the mem)|txn-already|in the memory pool/i.test(errorMessage)) {
+            return { errorCode: 0, errorMessage: `already accepted: ${errorMessage}` };
+        }
+        return { errorCode, errorMessage };
+    }
+    /** gRPC-web has no channel to close; provided for interface parity. */
+    close() {
+        /* no-op */
+    }
+}
+// The decoders below are exported for unit testing (see test/lightwalletd-web.test.ts).
+// They are not part of the public `./browser` barrel.
+export function decodeCompactOutput(msg) {
+    const r = new ProtoReader(msg);
+    const out = { cmu: EMPTY, epk: EMPTY, ciphertext: EMPTY };
+    while (!r.done) {
+        const { field, wire } = r.tag();
+        if (field === 1 && wire === 2)
+            out.cmu = Uint8Array.from(r.bytes());
+        else if (field === 2 && wire === 2)
+            out.epk = Uint8Array.from(r.bytes());
+        else if (field === 3 && wire === 2)
+            out.ciphertext = Uint8Array.from(r.bytes());
+        else
+            r.skip(wire);
+    }
+    return out;
+}
+export function decodeCompactTx(msg) {
+    const r = new ProtoReader(msg);
+    const tx = { index: '0', hash: EMPTY, spends: [], outputs: [] };
+    while (!r.done) {
+        const { field, wire } = r.tag();
+        if (field === 1 && wire === 0)
+            tx.index = String(r.varint());
+        else if (field === 2 && wire === 2)
+            tx.hash = Uint8Array.from(r.bytes());
+        else if (field === 4 && wire === 2) {
+            // CompactSpend{ nf=1 }
+            const sr = new ProtoReader(r.bytes());
+            let nf = EMPTY;
+            while (!sr.done) {
+                const t = sr.tag();
+                if (t.field === 1 && t.wire === 2)
+                    nf = Uint8Array.from(sr.bytes());
+                else
+                    sr.skip(t.wire);
+            }
+            tx.spends.push({ nf });
+        }
+        else if (field === 5 && wire === 2) {
+            tx.outputs.push(decodeCompactOutput(r.bytes()));
+        }
+        else
+            r.skip(wire);
+    }
+    return tx;
+}
+export function decodeCompactBlock(msg) {
+    const r = new ProtoReader(msg);
+    const block = { height: '0', hash: EMPTY, vtx: [] };
+    while (!r.done) {
+        const { field, wire } = r.tag();
+        if (field === 2 && wire === 0)
+            block.height = String(r.varint());
+        else if (field === 3 && wire === 2)
+            block.hash = Uint8Array.from(r.bytes());
+        else if (field === 7 && wire === 2)
+            block.vtx.push(decodeCompactTx(r.bytes()));
+        else
+            r.skip(wire);
+    }
+    return block;
+}
+/** Convenience for hex txids from a decoded block (display/big-endian order). */
+export function blockTxid(tx) {
+    return bytesToHex(reverseBytes(tx.hash));
+}

package/dist/browser/protobuf.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal protobuf3 reader/writer — just the wire-format primitives the
+ * lightwalletd message codecs need (varint, length-delimited bytes/strings,
+ * embedded messages). Zero dependency, to keep the browser transport as light as
+ * the rest of the package.
+ *
+ * Only wire types 0 (varint) and 2 (length-delimited) are used by the
+ * CompactTxStreamer messages we touch; unknown fields are skipped. Field values
+ * stay within 2^53 (heights, zatoshi), so plain `number` varints are safe here.
+ */
+/** Sequential reader over a protobuf message body. */
+export declare class ProtoReader {
+    private readonly buf;
+    private off;
+    constructor(buf: Uint8Array);
+    get done(): boolean;
+    varint(): number;
+    bytes(): Uint8Array;
+    string(): string;
+    /** Read a field tag → { field, wire }. */
+    tag(): {
+        field: number;
+        wire: number;
+    };
+    /** Skip a field of the given wire type (unknown fields). */
+    skip(wire: number): void;
+}
+/** Accumulating writer for a protobuf message body. */
+export declare class ProtoWriter {
+    private readonly chunks;
+    private pushVarint;
+    private tag;
+    varintField(field: number, value: number): this;
+    bytesField(field: number, value: Uint8Array): this;
+    /** Embed a nested message (its already-serialized bytes) as a length-delimited field. */
+    messageField(field: number, value: Uint8Array): this;
+    finish(): Uint8Array;
+}

package/dist/browser/protobuf.js

@@ -0,0 +1,115 @@
+/**
+ * Minimal protobuf3 reader/writer — just the wire-format primitives the
+ * lightwalletd message codecs need (varint, length-delimited bytes/strings,
+ * embedded messages). Zero dependency, to keep the browser transport as light as
+ * the rest of the package.
+ *
+ * Only wire types 0 (varint) and 2 (length-delimited) are used by the
+ * CompactTxStreamer messages we touch; unknown fields are skipped. Field values
+ * stay within 2^53 (heights, zatoshi), so plain `number` varints are safe here.
+ */
+const WIRE_VARINT = 0;
+const WIRE_I64 = 1;
+const WIRE_LEN = 2;
+const WIRE_I32 = 5;
+/** Sequential reader over a protobuf message body. */
+export class ProtoReader {
+    buf;
+    off = 0;
+    constructor(buf) {
+        this.buf = buf;
+    }
+    get done() {
+        return this.off >= this.buf.length;
+    }
+    varint() {
+        let shift = 0;
+        let result = 0;
+        for (;;) {
+            if (this.off >= this.buf.length)
+                throw new RangeError('protobuf: varint past end');
+            const b = this.buf[this.off++];
+            result += (b & 0x7f) * 2 ** shift;
+            if ((b & 0x80) === 0)
+                break;
+            shift += 7;
+            if (shift > 49)
+                throw new RangeError('protobuf: varint too long');
+        }
+        // Values are server-controlled; above 2^53 float64 rounds silently. Reject
+        // rather than return an imprecise number (guards the money/height crossing).
+        if (result > Number.MAX_SAFE_INTEGER) {
+            throw new RangeError('protobuf: varint exceeds safe integer range');
+        }
+        return result;
+    }
+    bytes() {
+        const len = this.varint();
+        if (this.off + len > this.buf.length)
+            throw new RangeError('protobuf: bytes past end');
+        const out = this.buf.subarray(this.off, this.off + len);
+        this.off += len;
+        return out;
+    }
+    string() {
+        return new TextDecoder().decode(this.bytes());
+    }
+    /** Read a field tag → { field, wire }. */
+    tag() {
+        const key = this.varint();
+        return { field: key >>> 3, wire: key & 0x7 };
+    }
+    /** Skip a field of the given wire type (unknown fields). */
+    skip(wire) {
+        switch (wire) {
+            case WIRE_VARINT:
+                this.varint();
+                break;
+            case WIRE_LEN:
+                this.bytes();
+                break;
+            case WIRE_I64:
+                this.off += 8;
+                break;
+            case WIRE_I32:
+                this.off += 4;
+                break;
+            default:
+                throw new RangeError(`protobuf: unknown wire type ${wire}`);
+        }
+    }
+}
+/** Accumulating writer for a protobuf message body. */
+export class ProtoWriter {
+    chunks = [];
+    pushVarint(n) {
+        let v = n;
+        while (v > 0x7f) {
+            this.chunks.push((v & 0x7f) | 0x80);
+            v = Math.floor(v / 128);
+        }
+        this.chunks.push(v & 0x7f);
+    }
+    tag(field, wire) {
+        this.pushVarint(field * 8 + wire);
+    }
+    varintField(field, value) {
+        this.tag(field, WIRE_VARINT);
+        this.pushVarint(value);
+        return this;
+    }
+    bytesField(field, value) {
+        this.tag(field, WIRE_LEN);
+        this.pushVarint(value.length);
+        for (const b of value)
+            this.chunks.push(b);
+        return this;
+    }
+    /** Embed a nested message (its already-serialized bytes) as a length-delimited field. */
+    messageField(field, value) {
+        return this.bytesField(field, value);
+    }
+    finish() {
+        return Uint8Array.from(this.chunks);
+    }
+}

package/dist/browser/prover-worker.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Web Worker entry for Sapling proving. The spend prove is ~20 s single-threaded
+ * — running it on the main thread would freeze the extension UI, so it lives
+ * here. Detection is cheap but is offered too, so a caller can keep ALL wasm off
+ * the main thread if it wants.
+ *
+ * Protocol (postMessage):
+ *   → { type:'init', wasmBytes, spendParams, outputParams }   ⇒ { type:'ready' }
+ *   → { type:'spend',  id, spec }   ⇒ { type:'result', id, value }  | { type:'error', id, message }
+ *   → { type:'detect', id, spec }   ⇒ { type:'result', id, value }  | { type:'error', id, message }
+ *
+ * Bundle this as a module worker:
+ *   new Worker(new URL('./prover-worker.js', import.meta.url), { type: 'module' })
+ *
+ * The params (~50 MB) are transferred in once at init and held for every prove,
+ * so they cross the worker boundary only once.
+ */
+export {};

package/dist/browser/prover-worker.js

@@ -0,0 +1,61 @@
+/**
+ * Web Worker entry for Sapling proving. The spend prove is ~20 s single-threaded
+ * — running it on the main thread would freeze the extension UI, so it lives
+ * here. Detection is cheap but is offered too, so a caller can keep ALL wasm off
+ * the main thread if it wants.
+ *
+ * Protocol (postMessage):
+ *   → { type:'init', wasmBytes, spendParams, outputParams }   ⇒ { type:'ready' }
+ *   → { type:'spend',  id, spec }   ⇒ { type:'result', id, value }  | { type:'error', id, message }
+ *   → { type:'detect', id, spec }   ⇒ { type:'result', id, value }  | { type:'error', id, message }
+ *
+ * Bundle this as a module worker:
+ *   new Worker(new URL('./prover-worker.js', import.meta.url), { type: 'module' })
+ *
+ * The params (~50 MB) are transferred in once at init and held for every prove,
+ * so they cross the worker boundary only once.
+ */
+import { detectNotes, initSapling, readNote, spendShielded, verifyCanonicalParams, } from '../wasm.js';
+// Minimal worker-global shape — avoids pulling in the `webworker` lib (which
+// conflicts with `dom`'s `self`) while staying type-safe about what we use.
+const ctx = globalThis;
+let params;
+ctx.addEventListener('message', (e) => {
+    const msg = e.data;
+    void handle(msg);
+});
+async function handle(msg) {
+    try {
+        if (msg.type === 'init') {
+            await initSapling(msg.wasmBytes);
+            const loaded = { spend: msg.spendParams, output: msg.outputParams };
+            // Refuse to prove with non-canonical params (the prover skips group-element
+            // checks for speed, so unverified params are attack surface).
+            await verifyCanonicalParams(loaded);
+            params = loaded;
+            ctx.postMessage({ type: 'ready' });
+            return;
+        }
+        if (msg.type === 'spend') {
+            if (!params)
+                throw new Error('worker not initialized (send { type: "init" } first)');
+            const hex = spendShielded(msg.spec, params);
+            ctx.postMessage({ type: 'result', id: msg.id, value: hex });
+            return;
+        }
+        if (msg.type === 'detect') {
+            const notes = detectNotes(msg.spec);
+            ctx.postMessage({ type: 'result', id: msg.id, value: notes });
+            return;
+        }
+        if (msg.type === 'read') {
+            const note = readNote(msg.spec);
+            ctx.postMessage({ type: 'result', id: msg.id, value: note });
+            return;
+        }
+    }
+    catch (err) {
+        const id = 'id' in msg ? msg.id : -1;
+        ctx.postMessage({ type: 'error', id, message: err instanceof Error ? err.message : String(err) });
+    }
+}

package/dist/browser/worker-prover.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Main-thread handle to the proving Web Worker. Wraps the postMessage protocol
+ * of `./prover-worker` into promise-returning `SpendProver` / `DetectProver`
+ * callbacks that plug straight into `../wallet`'s `detectNotes` /
+ * `buildShieldedSpend`.
+ *
+ * The caller constructs the `Worker` (its URL is bundler-specific) and passes
+ * the wasm bytes + the two Sapling params; this initializes the worker once and
+ * hands back the callbacks. Keeps the ~20 s spend prove off the UI thread.
+ *
+ *   const worker = new Worker(new URL('./prover-worker.js', import.meta.url), { type: 'module' });
+ *   const prover = await createWorkerProver(worker, { wasmBytes, spendParams, outputParams });
+ *   const { hex } = await buildShieldedSpend(client, prover.spend, { ... });
+ */
+import type { DetectProver, SpendProver } from '../wallet.js';
+import type { ReadNoteResult } from '../wasm.js';
+/** Fully decrypt one incoming output (value + recipient + memo) in the worker. */
+export type ReadProver = (specJson: string) => Promise<ReadNoteResult | null>;
+export interface WorkerProverInit {
+    /** The `.wasm` bytes (fetch `crate/pkg/verus_sapling_prover_bg.wasm`). */
+    readonly wasmBytes: ArrayBuffer;
+    /** sapling-spend.params bytes. */
+    readonly spendParams: Uint8Array;
+    /** sapling-output.params bytes. */
+    readonly outputParams: Uint8Array;
+}
+export interface WorkerProver {
+    /** Prove + sign a shielded spend in the worker (~20 s). */
+    readonly spend: SpendProver;
+    /** Trial-decrypt notes in the worker (cheap; use only to keep wasm off-thread). */
+    readonly detect: DetectProver;
+    /** Fully decrypt one incoming output → value + recipient + memo (cheap). */
+    readonly read: ReadProver;
+    /** Terminate the worker. */
+    readonly terminate: () => void;
+}
+/** Initialize the worker (loads wasm + params once) and return the prover callbacks. */
+export declare function createWorkerProver(worker: Worker, init: WorkerProverInit): Promise<WorkerProver>;

package/dist/browser/worker-prover.js

@@ -0,0 +1,51 @@
+/**
+ * Main-thread handle to the proving Web Worker. Wraps the postMessage protocol
+ * of `./prover-worker` into promise-returning `SpendProver` / `DetectProver`
+ * callbacks that plug straight into `../wallet`'s `detectNotes` /
+ * `buildShieldedSpend`.
+ *
+ * The caller constructs the `Worker` (its URL is bundler-specific) and passes
+ * the wasm bytes + the two Sapling params; this initializes the worker once and
+ * hands back the callbacks. Keeps the ~20 s spend prove off the UI thread.
+ *
+ *   const worker = new Worker(new URL('./prover-worker.js', import.meta.url), { type: 'module' });
+ *   const prover = await createWorkerProver(worker, { wasmBytes, spendParams, outputParams });
+ *   const { hex } = await buildShieldedSpend(client, prover.spend, { ... });
+ */
+/** Initialize the worker (loads wasm + params once) and return the prover callbacks. */
+export function createWorkerProver(worker, init) {
+    const pending = new Map();
+    let nextId = 1;
+    let readyResolve;
+    const ready = new Promise((r) => (readyResolve = r));
+    worker.addEventListener('message', (e) => {
+        const msg = e.data;
+        if (msg.type === 'ready') {
+            readyResolve?.();
+            return;
+        }
+        const entry = pending.get(msg.id);
+        if (!entry)
+            return;
+        pending.delete(msg.id);
+        if (msg.type === 'error')
+            entry.reject(new Error(msg.message));
+        else
+            entry.resolve(msg.value);
+    });
+    const call = (type, spec) => {
+        const id = nextId++;
+        return new Promise((resolve, reject) => {
+            pending.set(id, { resolve, reject });
+            worker.postMessage({ type, id, spec });
+        });
+    };
+    // Transfer the big params buffers into the worker (no copy).
+    worker.postMessage({ type: 'init', wasmBytes: init.wasmBytes, spendParams: init.spendParams, outputParams: init.outputParams }, [init.wasmBytes, init.spendParams.buffer, init.outputParams.buffer]);
+    return ready.then(() => ({
+        spend: (spec) => call('spend', spec),
+        detect: (spec) => call('detect', spec),
+        read: (spec) => call('read', spec),
+        terminate: () => worker.terminate(),
+    }));
+}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Errors for the shielded package.
+ *
+ * These extend a LOCAL base (`Error`), NOT @chainvue/verus-sdk's `VerusError`:
+ * importing anything from the SDK pulls its Node-bundled `dist/bundle.js`
+ * (@bitgo/utxo-lib + `crypto`/`buffer`/…) into the browser bundle. To stay
+ * browser-safe the base is local, but it mirrors `VerusError`'s shape — a
+ * machine-readable `.code` plus `.name` — so callers can branch on those.
+ */
+/** Base class for all shielded-package errors. */
+export declare class ShieldedError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Thrown when the shielded input contract is violated (bad amount, memo, address). */
+export declare class ShieldedInputError extends ShieldedError {
+    constructor(message: string);
+}

package/dist/errors.js

@@ -0,0 +1,25 @@
+/**
+ * Errors for the shielded package.
+ *
+ * These extend a LOCAL base (`Error`), NOT @chainvue/verus-sdk's `VerusError`:
+ * importing anything from the SDK pulls its Node-bundled `dist/bundle.js`
+ * (@bitgo/utxo-lib + `crypto`/`buffer`/…) into the browser bundle. To stay
+ * browser-safe the base is local, but it mirrors `VerusError`'s shape — a
+ * machine-readable `.code` plus `.name` — so callers can branch on those.
+ */
+/** Base class for all shielded-package errors. */
+export class ShieldedError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ShieldedError';
+    }
+}
+/** Thrown when the shielded input contract is violated (bad amount, memo, address). */
+export class ShieldedInputError extends ShieldedError {
+    constructor(message) {
+        super('ERR_SHIELDED_INPUT', message);
+        this.name = 'ShieldedInputError';
+    }
+}

package/dist/hex.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Buffer-free hex ↔ bytes helpers, so the core (parsers, orchestration, address
+ * decode) runs unchanged in the browser as well as Node. Node's `Buffer` is not
+ * available in a browser/extension context; these use only `Uint8Array`.
+ */
+/** Lowercase hex of a byte array. */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Parse a hex string (even length) to bytes. Throws on odd length / non-hex. */
+export declare function hexToBytes(hex: string): Uint8Array;
+/** Reverse byte order (e.g. txid display ↔ internal). */
+export declare function reverseBytes(bytes: Uint8Array): Uint8Array;

package/dist/hex.js

@@ -0,0 +1,32 @@
+/**
+ * Buffer-free hex ↔ bytes helpers, so the core (parsers, orchestration, address
+ * decode) runs unchanged in the browser as well as Node. Node's `Buffer` is not
+ * available in a browser/extension context; these use only `Uint8Array`.
+ */
+const HEX = '0123456789abcdef';
+/** Lowercase hex of a byte array. */
+export function bytesToHex(bytes) {
+    let out = '';
+    for (const b of bytes)
+        out += HEX[b >> 4] + HEX[b & 0x0f];
+    return out;
+}
+/** Parse a hex string (even length) to bytes. Throws on odd length / non-hex. */
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        throw new Error(`hex: odd length ${hex.length}`);
+    // Strict: reject any non-hex char up front. `Number.parseInt` otherwise accepts
+    // "+1"/" 1" and stops at the first bad char in a pair ("1z" -> 1), silently
+    // producing wrong bytes.
+    if (!/^[0-9a-fA-F]*$/.test(hex))
+        throw new Error('hex: invalid character');
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = Number.parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return out;
+}
+/** Reverse byte order (e.g. txid display ↔ internal). */
+export function reverseBytes(bytes) {
+    return Uint8Array.from(bytes).reverse();
+}

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @chainvue/verus-sapling
+ *
+ * Offline signing of Verus shielded (Sapling) transactions — t→z, z→z, z→t,
+ * with memo — plus client-side note detection and memo reading. Companion to
+ * @chainvue/verus-sdk: it builds and signs bytes; the consumer broadcasts. No
+ * full node on the signing host (z→z / z→t need witness data from a Verus
+ * lightwalletd, reached through a `LightwalletdTransport`).
+ *
+ * Verus shielded = stock Zcash Sapling (stock circuit, byte-identical MPC
+ * params, consensus branch id 0x76b809bb).
+ *
+ * The API:
+ *  - `initSapling` + the wasm builders (`shieldT2z` / `spendShielded` /
+ *    `detectNotesWasm` / `readNote`) — the prover boundary (`wasm.ts`).
+ *  - the lightwalletd-driven orchestration (`detectNotes`, `buildShieldedSpend`)
+ *    over a `LightwalletdTransport` (`wallet.ts`).
+ *  - pure helpers: v4/tree parsers, `parseSats`/`toSafeNumber`, hex, `zs` decode.
+ *
+ * Entry points: the package root is browser-safe and pulls in no `@grpc/grpc-js`.
+ * Browser consumers also import `@chainvue/verus-sapling/browser` (gRPC-web
+ * client + Web Worker prover); Node consumers import
+ * `@chainvue/verus-sapling/lightwalletd` (the gRPC client).
+ */
+export * from './types.js';
+export * from './errors.js';
+export * from './parse.js';
+export { CONSENSUS_BRANCH_ID, parseSats, toSafeNumber } from './money.js';
+export { bytesToHex, hexToBytes, reverseBytes } from './hex.js';
+export { decodeSaplingAddress, saplingAddressToHex } from './zaddr.js';
+export { initSapling, shieldT2z, spendShielded, detectNotes as detectNotesWasm, readNote, verifyCanonicalParams, PARAM_SHA256, type SaplingParams, type DetectedNoteRaw, type ReadNoteResult, } from './wasm.js';
+export { detectNotes, buildShieldedSpend, type DetectKey, type DetectProver, type SpendProver, type DetectNotesParams, type SpendableNote, type BuildShieldedSpendParams, type ShieldedRecipient, type TransparentRecipient, } from './wallet.js';
+export type { LightwalletdTransport, TreeState, CompactOutput, CompactTx, CompactBlock, LightdInfo, } from './lightwalletd.js';