@cloak.dev/sdk 0.1.8 → 0.2.0

package/dist/index.d.ts

@@ -1394,10 +1394,27 @@ declare function hexToBytes(hex: string): Uint8Array;
  */
 declare function bytesToHex(bytes: Uint8Array, prefix?: boolean): string;
 /**
- * Generate random bytes using Web Crypto API
+ * Thrown when no cryptographically secure randomness source is reachable.
+ *
+ * `randomBytes` backs note spend keys, blindings, salts and nonces. A predictable
+ * value there is unrecoverable — it deanonymizes and can drain the note — so the
+ * SDK fails closed instead of degrading to a non-cryptographic generator.
+ */
+declare class InsecureRandomnessError extends CloakError {
+    constructor(message: string, originalError?: Error);
+}
+/**
+ * Generate cryptographically secure random bytes.
+ *
+ * Source order: `globalThis.crypto.getRandomValues` first (works in every runtime
+ * this SDK supports, under both ESM and CJS), then `node:crypto.randomFillSync`.
+ * There is deliberately **no** insecure fallback: if neither source is usable this
+ * throws {@link InsecureRandomnessError} naming every source that was tried and why
+ * it failed.
  *
  * @param length - Number of bytes to generate
  * @returns Random bytes
+ * @throws {InsecureRandomnessError} If no cryptographically secure source is available
  */
 declare function randomBytes(length: number): Uint8Array;
 /**
@@ -1672,6 +1689,67 @@ declare class RelayInternalError extends Error {
      */
     cachedTreeFromChain?: MerkleTree | undefined);
 }
+/**
+ * Raised when a submission's outcome could NOT be established as "landed" from chain state.
+ *
+ * This is the failure side of settlement verification (see `core/settlement.ts`). It exists
+ * because the campaign's worst outcome was not a failed transaction — it was an AMBIGUOUS one
+ * whose error text carried no signature (REL-A-10: seven POSTs, the transaction landed, the SDK
+ * threw `RelayInternalError`, and the user had nothing to look up). Losing the signature is what
+ * turns a landed transaction into a support ticket.
+ *
+ * `outcome` is deliberately unambiguous for the caller:
+ *
+ *   "landed"      the transaction DID land — the input nullifier PDAs exist — but the relay never
+ *                 returned a usable response, so the SDK cannot hand back commitment indices.
+ *                 DO NOT RETRY: a retry spends nothing and fails 0x1020. Rescan to recover notes.
+ *   "not-landed"  provably nothing landed. The inputs are unspent; retrying is safe.
+ *   "unknown"     the evidence is contradictory or unavailable. Check `signature` on an
+ *                 independent RPC before doing anything else.
+ *   "failed"      the transaction is on chain and failed during execution. Inputs are unspent.
+ */
+declare class SettlementVerificationError extends Error {
+    /** What the chain evidence supports. See the class doc — each value implies a different action. */
+    readonly outcome: "landed" | "not-landed" | "unknown" | "failed";
+    /**
+     * The signature to look up, when one is known. `null` means no counterparty ever gave the SDK
+     * one — which is itself part of the report, not something to paper over.
+     */
+    readonly signature: string | null;
+    /** The verifier's own statement of what was and was not proven. */
+    readonly reason: string;
+    /** True when the input nullifier PDAs were observed on chain. */
+    readonly nullifiersSpent: boolean;
+    /** The underlying relay/RPC error, when the failure started as one. */
+    readonly cause?: unknown | undefined;
+    constructor(message: string, 
+    /** What the chain evidence supports. See the class doc — each value implies a different action. */
+    outcome: "landed" | "not-landed" | "unknown" | "failed", 
+    /**
+     * The signature to look up, when one is known. `null` means no counterparty ever gave the SDK
+     * one — which is itself part of the report, not something to paper over.
+     */
+    signature: string | null, 
+    /** The verifier's own statement of what was and was not proven. */
+    reason: string, 
+    /** True when the input nullifier PDAs were observed on chain. */
+    nullifiersSpent?: boolean, 
+    /** The underlying relay/RPC error, when the failure started as one. */
+    cause?: unknown | undefined);
+    /** True when retrying this exact spend is safe (nothing was consumed on chain). */
+    get safeToRetry(): boolean;
+}
+/**
+ * Pull the signature out of a relay error body.
+ *
+ * The relay's `SubmissionOutcomeUnknown` response is a 503 whose JSON carries
+ * `{"code":"submission_outcome_unknown","retryable":true,"signature":"<sig>"}` (relay
+ * `src/error.rs`). The SDK used to funnel that body into a generic retry and then throw an error
+ * built from a LATER attempt's message, dropping the one field the user needs.
+ */
+declare function parseRelayErrorSignature(responseText: string): string | null;
+/** True when a relay error body is the relay's own "I do not know if this landed" report. */
+declare function isSubmissionOutcomeUnknownResponse(responseText: string): boolean;
 /**
  * Classify a relay error (response body text + HTTP status) into one of the
  * structured error types above, or fall back to RelayInternalError.
@@ -2052,6 +2130,141 @@ declare function verifyUtxos(utxos: Utxo[], connection: Connection, programId: P
  */
 declare function preflightNullifiers(utxos: Utxo[], connection: Connection, programId: PublicKey, commitment?: "processed" | "confirmed" | "finalized"): Promise<void>;
 
+/**
+ * Settlement verification — decide from CHAIN STATE whether a submission landed.
+ *
+ * Why this module exists (adversarial campaign, tier 2):
+ *
+ *   X-S-01B  A hostile relay answered `/transact` with a well-formed success body carrying a
+ *            phantom signature and commitment indices [4242, 4243]. The SDK returned SUCCESS.
+ *            Real-RPC `getSignatureStatuses(searchTransactionHistory)` -> null, and BOTH input
+ *            nullifier PDAs read `exists=false`. Nothing had landed.
+ *   X-S-03a  A hostile RPC swallowed `sendTransaction` and fabricated
+ *            `{err: null, confirmationStatus: "finalized"}`. `confirmTransaction` was satisfied and
+ *            the SDK returned a signature for a transaction that was never forwarded. (A control
+ *            deposit landed honestly through the same proxy, so account reads were NOT tampered
+ *            with — only the submission and its status were.)
+ *
+ * Both defects have the same shape: the SDK reported success on the strength of what its
+ * counterparty SAID, never on the strength of what the chain SHOWS.
+ *
+ * The ground truth used here is the one the campaign itself used to prove nothing landed: the
+ * input NULLIFIER PDAs. Their addresses are derived locally from the proof's own public inputs
+ * (`["nullifier", pool, nullifier]`), and the program creates one per non-zero input nullifier on
+ * every landed transact — including deposits, whose padding slots still emit real nullifiers
+ * (transaction.circom: "the slot still emits a real nullifier ... and consumed on-chain";
+ * shield-pool/src/instructions/transact.rs skips only all-zero nullifiers).
+ *
+ * Nullifier presence is strictly stronger evidence than a signature status:
+ *
+ *   - it is ACCOUNT STATE, so it survives an RPC that has no signature history for the slot
+ *     (Surfpool forks, pruned nodes, a load-balanced endpoint that missed the write); and
+ *   - the nullifier and the output commitments are fields of the SAME proof's public inputs, so
+ *     the only transaction that can create these PDAs is one that also appended exactly our
+ *     output commitments. "Nullifiers exist" therefore means "our outputs are in the tree".
+ *
+ * The signature status is still checked, because it is the only signal that can prove a
+ * DEFINITIVE FAILURE (`err != null`) and because a signature the RPC has never heard of is the
+ * fingerprint of a phantom. It is corroboration, never the sole basis for success.
+ *
+ * LIMIT, stated plainly: a single RPC endpoint that lies about ACCOUNT READS as well cannot be
+ * caught by any single-endpoint client, and this module does not pretend to. It closes the two
+ * observed attacks — a lying relay, and an RPC that lies only about submission/status — and it
+ * downgrades every unproven outcome to an explicit, signature-carrying "unknown" instead of
+ * silently reporting success.
+ */
+
+/**
+ * The RPC surface settlement verification needs, as a structural type rather than a hard
+ * dependency on `Connection`. A real `web3.js` Connection satisfies it; so does a test stub, which
+ * is what lets the phantom-relay / lying-RPC regressions be reproduced without a validator.
+ */
+interface SettlementConnection {
+    getSignatureStatuses(signatures: string[], config?: {
+        searchTransactionHistory?: boolean;
+    }): Promise<{
+        value: Array<{
+            err: unknown | null;
+            confirmationStatus?: string | null;
+        } | null>;
+    }>;
+    getMultipleAccountsInfo(publicKeys: PublicKey[], commitmentOrConfig?: any): Promise<Array<unknown | null>>;
+}
+/**
+ * What the chain says about a submission.
+ *
+ *  - `landed`      the input nullifier PDAs exist: the proof was consumed, so its output
+ *                  commitments are in the tree. This is the ONLY status that may be reported as
+ *                  success.
+ *  - `failed`      the signature is on chain and carries an execution error. Nothing was applied;
+ *                  the inputs are still spendable.
+ *  - `not-landed`  no nullifier PDA exists and the signature (if any) is unknown to the RPC even
+ *                  with `searchTransactionHistory`. The phantom-signature fingerprint.
+ *  - `unknown`     the evidence is contradictory or incomplete — most importantly the case where
+ *                  a status claims confirmation while no nullifier PDA exists. NEVER report this
+ *                  as success and NEVER silently retry it: the caller must surface the signature.
+ */
+type SettlementStatus = "landed" | "failed" | "not-landed" | "unknown";
+interface SettlementVerdict {
+    status: SettlementStatus;
+    /** The signature that was checked, when one was supplied and syntactically usable. */
+    signature: string | null;
+    /** Human-readable statement of what was and was not proven. Safe to put in an error message. */
+    reason: string;
+    /** True when every checkable input nullifier PDA was present on chain. */
+    nullifiersSpent: boolean;
+    /** What `getSignatureStatuses` reported for `signature`. */
+    signatureStatus: "finalized" | "confirmed" | "processed" | "absent" | "error" | "unchecked";
+}
+interface ConfirmSettlementParams {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    /** The proof's public input nullifiers. All-zero entries are padding and are skipped. */
+    inputNullifiers: bigint[];
+    /** The signature the counterparty reported, if it reported one. */
+    signature?: string | null;
+    /** Total time to wait for evidence to appear before giving a verdict. */
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    onProgress?: (status: string) => void;
+}
+declare function isPlausibleSignature(value: string | null | undefined): value is string;
+/**
+ * Derive the nullifier PDA for each non-zero input nullifier. Zero entries are the program's own
+ * padding sentinel (`transact.rs`: "Skip zero nullifiers (padding inputs)") and create no account.
+ */
+declare function deriveInputNullifierPdas(programId: PublicKey, mint: PublicKey, inputNullifiers: bigint[]): PublicKey[];
+/**
+ * Establish, from chain state, whether a submission landed.
+ *
+ * Polls until either side of the question is answered or `timeoutMs` elapses. Every RPC error is
+ * absorbed into the verdict rather than thrown: "I could not check" is `unknown`, which the caller
+ * must surface — it is never success.
+ */
+declare function confirmTransactSettlement(params: ConfirmSettlementParams): Promise<SettlementVerdict>;
+/**
+ * Gate a DIRECT (self-signed) submission on chain state — X-S-03a.
+ *
+ * `connection.confirmTransaction` is not proof of anything: the campaign's proxy swallowed
+ * `sendTransaction` and answered the follow-up status poll with a fabricated
+ * `{err: null, confirmationStatus: "finalized"}`, and the SDK handed the caller a signature for a
+ * transaction that was never forwarded. A control deposit landed honestly through the same proxy,
+ * so this was not broken plumbing — it was the client believing a status field.
+ *
+ * Throws `SettlementVerificationError` unless the input nullifier PDAs prove the transaction was
+ * applied. The signature is always carried on the error so the caller can look it up.
+ */
+declare function assertDirectSubmissionLanded(params: {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    nullifiers: Array<Uint8Array | bigint>;
+    signature: string;
+    timeoutMs?: number;
+    onProgress?: (status: string) => void;
+}): Promise<SettlementVerdict>;
+
 /**
  * Structured Logger for Cloak SDK
  *
@@ -2510,6 +2723,111 @@ declare function getNullifierPDA(poolPubkey: PublicKey, nullifier: Uint8Array |
  * @returns [PublicKey, bump] - The swap state PDA and its bump seed
  */
 declare function getSwapStatePDA(poolPubkey: PublicKey, nullifier: Uint8Array | Buffer, programId?: PublicKey): [PublicKey, number];
+/**
+ * H-04: derive the per-pool RefundLedger PDA (conservation counter).
+ *
+ * Seeds: ["refund_ledger", pool_mint]
+ */
+declare function getRefundLedgerPDA(mint?: PublicKey, programId?: PublicKey): [PublicKey, number];
+/**
+ * H-04: derive the one-time RefundClaim PDA (replay guard for a voucher).
+ *
+ * Seeds: ["refund_claim", claim_id]
+ */
+declare function getRefundClaimPDA(claimId: Uint8Array | Buffer, programId?: PublicKey): [PublicKey, number];
+/**
+ * M-07/H-04: derive the per-pool PoolAuthorityConfig PDA (holds the
+ * withdraw-authorizer the refund voucher must be signed by).
+ *
+ * Seeds: ["pool_authority", pool_mint]
+ */
+declare function getPoolAuthorityConfigPDA(mint?: PublicKey, programId?: PublicKey): [PublicKey, number];
+/**
+ * Registry PDA the relay's recipient-delivery carrier (CLKD1) touches so the carrier transaction is
+ * enumerable via `getSignaturesForAddress`.
+ *
+ * Seed: ["cloak_delivery_registry"] — `DELIVERY_REGISTRY_SEED` in
+ * `services/relay/src/solana/mod.rs::emit_recipient_delivery_carrier`. Mint-independent, exactly
+ * like the chain-note registry: one registry per program, not per pool.
+ */
+declare function getDeliveryRegistryPDA(programId?: PublicKey): PublicKey;
+/**
+ * Registry PDA the relay's compliance chain-note carrier (CLK1) touches.
+ *
+ * Seed: ["cloak_chain_note_registry"] — `CHAIN_NOTE_REGISTRY_SEED` in
+ * `services/relay/src/solana/mod.rs::emit_chain_note_carrier`.
+ */
+declare function getChainNoteRegistryPDA(programId?: PublicKey): PublicKey;
+
+/**
+ * H-04 — claim-based timeout refund (SDK).
+ *
+ * When a private swap times out, `CloseSwapState` returns the parked principal
+ * to the pool and credits the on-chain `RefundLedger`. The user later reclaims
+ * that principal as a FRESH shielded note via `ClaimRefund`, gated by a
+ * withdraw-authorizer voucher (signed by the relay) and a deposit-shape Groth16
+ * proof — with no on-chain link back to the original swap.
+ *
+ * This module:
+ *   1. asks the relay to sign the 81-byte refund voucher for `claim_id`,
+ *   2. generates a deposit-shape proof (publicAmount = +refund_amount, zero
+ *      inputs, one fresh output note `C_r`) bound to the live merkle root,
+ *   3. builds and submits the `[ed25519 voucher][CU][ClaimRefund]` transaction,
+ *   4. returns the fresh refund UTXO for the caller to store/spend later.
+ *
+ * The proof construction is byte-for-byte the same as the standalone
+ * `audit-tests/h-04/gen-claim-proof.cjs` generator that the program-side soak
+ * verified, so the proof verifies against the deployed transaction vkey.
+ */
+
+/** A relay-signed refund voucher, as returned by `POST /refund-voucher`. */
+interface RefundVoucher {
+    /** base64 Ed25519 signature over the 81-byte message. */
+    signature: string;
+    /** hex 81-byte voucher message. */
+    message: string;
+    /** base58 signer (pool withdraw-authorizer). */
+    signer_pubkey: string;
+    /** expiry slot bound into the voucher. */
+    expiry_slot?: number;
+}
+interface ClaimTimeoutRefundParams {
+    /** Refund principal in lamports (must equal the closed swap's parked amount). */
+    refundAmount: bigint;
+    /** Pool mint; ClaimRefund is SOL-pool only (defaults to WSOL sentinel). */
+    poolMint?: PublicKey;
+    /** 32-byte claim id = H(user secret). Random if omitted. */
+    claimId?: Uint8Array;
+    /** Supply a pre-fetched voucher to skip the relay round-trip. */
+    voucher?: RefundVoucher;
+}
+interface ClaimTimeoutRefundOptions {
+    connection: Connection;
+    programId: PublicKey;
+    /** Relay base URL (used to fetch the voucher when not supplied). */
+    relayUrl?: string;
+    /** Pays fees + signs the claim tx (relay-submitted is a documented follow-up). */
+    payerKeypair: Keypair;
+    onProgress?: (message: string) => void;
+}
+interface ClaimTimeoutRefundResult {
+    /** Submitted ClaimRefund transaction signature. */
+    signature: string;
+    /** The fresh refund note created by the claim — store this to spend later. */
+    refundUtxo: Utxo;
+    /** The claim id consumed (hex). */
+    claimId: string;
+    /** The merkle leaf index where the refund note `C_r` landed. */
+    leafIndex: number;
+}
+/**
+ * Reclaim a timed-out swap's principal as a fresh shielded note via ClaimRefund.
+ *
+ * Front-running note: this self-submits the claim. The production default is
+ * relay submission (decision #3) to avoid mempool exposure of the voucher; a
+ * relay `/claim-refund` endpoint is the documented follow-up.
+ */
+declare function claimTimeoutRefund(params: ClaimTimeoutRefundParams, options: ClaimTimeoutRefundOptions): Promise<ClaimTimeoutRefundResult>;
 
 /**
  * On-chain Merkle proof computation
@@ -2625,7 +2943,12 @@ declare function buildMerkleTreeFromRelay(relayUrl: string, options?: {
     maxRetries?: number;
     waitForIndex?: number;
 }): Promise<MerkleTree>;
-declare function buildMerkleTreeFromChain(connection: Connection, programId: PublicKey, merkleTree: PublicKey, onProgress?: (message: string) => void): Promise<MerkleTree>;
+declare function buildMerkleTreeFromChain(connection: Connection, programId: PublicKey, merkleTree: PublicKey, onProgress?: (message: string) => void, 
+/**
+ * The pool mint this tree belongs to. Required in practice: without it a `CloseSwapState` refund
+ * leaf cannot be attributed to a tree, and reconstruction fails closed rather than guess.
+ */
+mint?: PublicKey): Promise<MerkleTree>;
 /**
  * Pre-flight root validation
  *
@@ -2679,288 +3002,186 @@ declare function preflightCheck(relayUrl: string, rootHex: string): Promise<{
 }>;
 
 /**
- * Direct Circom WASM Proof Generation
+ * The SDK's host-environment predicates, in one place (X-S-02C).
  *
- * This module provides direct proof generation using snarkjs and Circom WASM,
- * matching the approach used in services-new/tests/src/proof.ts
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * The merkle-from-chain rebuild was guarded by TWO independently written predicates that disagreed
+ * about React Native:
  *
- * This uses pinned S3-hosted circuit artifacts and does not require
- * a backend prover service.
- */
-
-/**
- * Default URL for fetching circuit artifacts
- * Hosted in S3 and versioned by build.
- */
-declare const DEFAULT_CIRCUITS_URL = "https://storage.googleapis.com/cloak-circuits/circuits/0.1.0";
-interface WithdrawRegularInputs {
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    sk: [bigint, bigint];
-    r: [bigint, bigint];
-    pathElements: bigint[];
-    pathIndices: number[];
-    num_outputs: number;
-    out_addr: bigint[][];
-    out_amount: bigint[];
-    out_flags: number[];
-    var_fee: bigint;
-    rem: bigint;
-}
-interface WithdrawSwapInputs {
-    sk_spend: bigint;
-    r: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    path_elements: bigint[];
-    path_indices: number[];
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    input_mint: bigint[];
-    output_mint: bigint[];
-    recipient_ata: bigint[];
-    min_output_amount: bigint;
-    var_fee: bigint;
-    rem: bigint;
-}
-interface ProofResult {
-    proof: Groth16Proof;
-    publicSignals: string[];
-    proofBytes: Uint8Array;
-    publicInputsBytes: Uint8Array;
-}
-/**
- * Generate Groth16 proof for regular withdrawal using Circom WASM
+ *   - the GATE in `core/transact.ts` — `!IS_BROWSER && isMerkleClass && relayUrl`, where
+ *     `IS_BROWSER` was `typeof window !== "undefined" || typeof globalThis.document !== "undefined"`,
+ *     with NO React-Native carve-out. React Native defines `window`, so RN read as a browser and the
+ *     last-resort chain replay was silently skipped there.
+ *   - the BUILDER it guards — `utils/relay-client.ts::buildMerkleTreeFromChain`, whose own
+ *     `isBrowser()` short-circuits on `navigator.product === "ReactNative"` and therefore explicitly
+ *     PERMITS React Native to rebuild from chain.
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * So one half of the same mechanism classified RN as a browser and the other half classified it as
+ * not-a-browser.
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
- */
-declare function generateWithdrawRegularProof(inputs: WithdrawRegularInputs, circuitsPath: string): Promise<ProofResult>;
-/**
- * Generate Groth16 proof for swap withdrawal using Circom WASM
+ * ── The decision: the BUILDER is right, and the gate was wrong ────────────────────────────────
+ * The browser fails closed for a stated reason — a full signature-history scan is too slow and too
+ * unreliable on a browser main thread, and a browser always has a reachable relay whose tree it can
+ * use instead. Neither half of that reasoning holds for React Native: it is not a browser, it has no
+ * DOM, it is not running on a page's main thread, and on a local node it has no relay-tree fallback
+ * at all. Closing the gate against RN removed its ONLY recovery path from a drifted relay tree —
+ * precisely the class of failure the fallback exists for — while leaving the builder it calls happy
+ * to serve it.
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * The alternative reading (make the builder refuse RN too, so the two agree by failing closed
+ * everywhere) was rejected: it agrees by breaking the Cloak mobile wallet, whose merkle path depends
+ * on the carve-out, and it discards a documented, deliberate decision in favour of an undocumented
+ * accident. The gate's own comment never mentions React Native — it argues about SSR — which is what
+ * an accident looks like.
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ * ── Two predicates, deliberately, and the difference is not RN ────────────────────────────────
+ * `isBrowser()` is a HARD REFUSAL — "this host cannot do it at all" — so it demands a real DOM
+ * (`window` AND `document`).
+ * `isBrowserLike()` is a CONSERVATIVE OPT-OUT — "don't start something slow here" — so `window` OR
+ * `document` is enough, which keeps an SSR host that polyfills only `document` from being mistaken
+ * for Node and made to attempt a chain replay.
+ *
+ * They differ on SSR on purpose. They must NEVER differ on React Native again, which is why both are
+ * built from the single `isReactNative()` below.
+ *
+ * All three are functions, not module-scope constants: a constant is frozen at import time, so any
+ * host that installs its globals after the bundle loads — and any test that wants to pin the three
+ * environments — reads a stale answer.
  */
-declare function generateWithdrawSwapProof(inputs: WithdrawSwapInputs, circuitsPath: string): Promise<ProofResult>;
 /**
- * Check if circuits are available from the pinned S3 source.
+ * True on React Native. `navigator.product === "ReactNative"` is the canonical flag and is what
+ * `utils/proof-generation.ts` has always used.
  */
-declare function areCircuitsAvailable(circuitsPath: string): Promise<boolean>;
+declare function isReactNative(): boolean;
 /**
- * Get default circuits URL.
+ * True only on a real browser: a DOM host with both `window` and `document`, and not React Native.
+ *
+ * Use for HARD refusals — work this host genuinely cannot perform.
  */
-declare function getDefaultCircuitsPath(): Promise<string>;
+declare function isBrowser(): boolean;
 /**
- * Pinned circuit artifact hashes (SHA-256).
+ * True on a browser OR on a DOM-ish host such as SSR that defines only one of `window`/`document`,
+ * and false on React Native and on Node.
  *
- * These hashes must be updated whenever the trusted circuit artifacts change.
+ * Use for CONSERVATIVE opt-outs — expensive work that should not be started speculatively.
  */
-declare const EXPECTED_CIRCUIT_HASHES: {
-    withdraw_regular_wasm: string;
-    withdraw_regular_zkey: string;
-    withdraw_swap_wasm: string;
-    withdraw_swap_zkey: string;
-};
+declare function isBrowserLike(): boolean;
+
 /**
- * Circuit verification result
- */
-interface CircuitVerificationResult {
-    /** Whether verification passed */
-    valid: boolean;
-    /** Which circuit was checked */
-    circuit: 'withdraw_regular' | 'withdraw_swap';
-    /** Error message if verification failed */
-    error?: string;
-    computed?: {
-        wasm: string;
-        zkey: string;
-    };
-    expected?: {
-        wasm: string;
-        zkey: string;
-    };
-}
+ * Circuit artifact releases — the single source of truth for
+ * "which bundle version" and "which bytes are that bundle".
+ *
+ * Why this file exists
+ * -------------------
+ * The version segment of the artifact base URL and the pinned SHA-256 digests
+ * used to be written out by hand in two unrelated places
+ * (`utils/proof-generation.ts` held `.../circuits/0.1.0` plus a digest table,
+ * `core/transact.ts` held its own copy of the same URL literal). They drifted:
+ * the default base pointed at the `0.1.0` bundle while the pinned `transaction`
+ * digests were the `0.2.0` trusted-setup ceremony output, so every default-config
+ * proof died on a digest mismatch several megabytes into proof generation.
+ *
+ * Here a bundle is declared once, as a version plus the digests of the artifacts
+ * that version contains, and the base URL is *derived* from that version by
+ * {@link defineCircuitBundle}. There is no way to write a URL whose version
+ * segment disagrees with the digests next to it:
+ *
+ *  - **compile time** — `baseUrl` is typed `` `${string}/circuits/${V}` ``, where
+ *    `V` is the bundle's own `version` literal, and {@link BUNDLE_BY_CIRCUIT} is
+ *    an exhaustive `Record<CircuitName, …>`, so a new circuit with no bundle, or
+ *    an assertion about a version the bundle does not carry, fails `tsc`.
+ *  - **startup** — {@link assertCircuitReleaseConsistency} runs at module load
+ *    and throws if a bundle's digests are malformed, if a bundle does not pin the
+ *    circuit that maps to it, or if a hand-edited base URL stops ending in its own
+ *    version. That is an import-time failure, not a failure deep inside
+ *    `groth16.fullProve`.
+ *
+ * Publication is deliberately *not* assumed. A bundle whose bytes this SDK has
+ * not verified at a public location carries `baseUrl: null`; callers must point
+ * the SDK at a location themselves (`setCircuitsPath`). Nothing here silently
+ * defaults to a URL that has not been checked against the digests below.
+ */
+/** Circuits whose artifacts carry a pinned SHA-256 digest in this SDK. */
+type CircuitName = 'withdraw_regular' | 'withdraw_swap' | 'transaction';
+/** Version of the trusted-setup ceremony bundle that froze the `transaction` circuit. */
+declare const TRANSACTION_CIRCUITS_VERSION = "0.2.0";
+
 /**
- * Verify circuit integrity by checking verification key hashes
+ * UTXO Transaction Methods
  *
- * This function fetches the verification key and computes its hash,
- * then compares against the expected hash embedded in the SDK.
+ * This module provides high-level methods for UTXO transactions:
+ * - transact(): Core UTXO transaction
+ * - transfer(): Shield-to-shield transfer
+ * - partialWithdraw(): Withdraw with change
+ */
+
+/**
+ * Can this host attempt the last-resort "rebuild the merkle tree from chain" recovery?
  *
- * IMPORTANT: If the hashes don't match, the circuit may produce proofs
- * that will be rejected by the on-chain verifier!
+ * X-S-02C: this gate and the builder it guards (`buildMerkleTreeFromChain`, which refuses only on a
+ * real browser and EXPLICITLY permits React Native) used to be written separately and disagreed —
+ * RN defines `window`, so the old inline `typeof window !== "undefined" || typeof document !==
+ * "undefined"` classified RN as a browser and skipped the rebuild, removing RN's only recovery path
+ * from a drifted relay tree while the builder was perfectly willing to serve it. Both now come from
+ * `utils/environment`, so they cannot disagree about React Native again.
  *
- * @param circuitsPath - Ignored. Verification always uses pinned S3 circuits.
- * @param circuit - Which circuit to verify ('withdraw_regular' or 'withdraw_swap')
- * @returns Verification result
+ * The SSR conservatism is kept: `isBrowserLike()` is true when EITHER `window` or `document` exists,
+ * because an SSR host that polyfills only `document` must not be mistaken for Node and made to run a
+ * full signature-history scan.
  *
- * @example
- * ```typescript
- * const result = await verifyCircuitIntegrity('https://storage.googleapis.com/cloak-circuits/circuits/0.1.0', 'withdraw_regular');
- * if (!result.valid) {
- *   console.error('Circuit verification failed:', result.error);
- *   // Don't proceed with proof generation!
- * }
- * ```
+ * A function, not a module-scope constant: the constant was frozen at import time, so a host that
+ * installs its globals after the bundle loads read a stale answer.
  */
-declare function verifyCircuitIntegrity(circuitsPath: string, circuit: 'withdraw_regular' | 'withdraw_swap'): Promise<CircuitVerificationResult>;
+declare function canRebuildMerkleTreeFromChain(): boolean;
+
 /**
- * Verify all circuits before use
- *
- * Call this at SDK initialization to ensure circuits are valid.
+ * Base the ceremony-frozen `transaction` artifacts are fetched from by default.
  *
- * @param circuitsPath - Ignored. Verification always uses pinned S3 circuits.
- * @returns Array of verification results (one per circuit)
+ * Derived from {@link TRANSACTION_CIRCUIT_BUNDLE} — the same record that pins the
+ * digests — so the version in the URL and the digests checked against it cannot
+ * drift apart. It is `null` while this SDK build pins no location whose bytes
+ * were verified to hash to those digests; that makes an unconfigured SDK a
+ * `tsc` error at the call site (`setCircuitsPath(DEFAULT_TRANSACTION_CIRCUITS_URL)`
+ * does not type-check against `string`) and an immediate, explanatory throw at
+ * runtime, instead of a digest mismatch ~22 MB into proof generation.
  */
-declare function verifyAllCircuits(circuitsPath: string): Promise<CircuitVerificationResult[]>;
+declare const DEFAULT_TRANSACTION_CIRCUITS_URL: string | null;
 
 /**
- * Pending Operations Manager
- *
- * Utility for persisting pending deposit/withdrawal operations in browser storage.
- * This enables recovery if the browser crashes or user navigates away mid-operation.
+ * Set circuits base path: local directory containing `transaction_js/` and `transaction_final.zkey`,
+ * or an `http(s)` base URL to those artifacts (loaded into memory once per process).
  *
- * IMPORTANT: This uses localStorage by default which has security implications.
- * Notes contain sensitive spending keys - consider using more secure storage
- * in production (e.g., encrypted IndexedDB, secure enclave).
+ * No cache invalidation is needed here: verified artifact buffers are memoised
+ * per base inside `proof-generation.ts`, so a new base loads and re-verifies its
+ * own bytes.
  */
-
+declare function setCircuitsPath(next: string): void;
 /**
- * Pending deposit record
+ * Get the current circuits path, or `null` when none is configured and this SDK
+ * build pins no verified default (see `DEFAULT_TRANSACTION_CIRCUITS_URL`).
  */
-interface PendingDeposit {
-    /** The note (contains spending secrets!) */
-    note: CloakNote;
-    /** When the deposit was initiated */
-    startedAt: number;
-    /** Transaction signature if available */
-    txSignature?: string;
-    /** Status of the deposit */
-    status: "pending" | "tx_sent" | "confirmed" | "failed";
-    /** Error message if failed */
-    error?: string;
-}
+declare function getCircuitsPath(): string | null;
 /**
- * Pending withdrawal record
+ * Resolve a base to prove from: an explicit argument, else `CLOAK_CIRCUITS_PATH`
+ * / `CLOAK_CIRCUITS` from the environment, else this build's pinned default.
+ *
+ * Use this instead of writing an artifact URL out by hand — a hand-written URL
+ * is exactly how the base's version segment came to disagree with the digests
+ * this SDK checks against. Throws an explanatory error (naming the expected
+ * bundle version and both expected digests) when nothing resolves.
  */
-interface PendingWithdrawal {
-    /** The relay request ID (for resumption) */
-    requestId: string;
-    /** The note commitment being withdrawn */
-    commitment: string;
-    /** The nullifier being used */
-    nullifier: string;
-    /** When the withdrawal was initiated */
-    startedAt: number;
-    /** Status of the withdrawal */
-    status: "pending" | "processing" | "completed" | "failed";
-    /** Transaction signature if completed */
-    txSignature?: string;
-    /** Error message if failed */
-    error?: string;
-}
+declare function resolveCircuitsBase(explicit?: string): string;
 /**
- * Save a pending deposit
- * Call this BEFORE sending the on-chain transaction to ensure note is persisted
+ * Chain note v4.
+ *
+ * v4 binds noteSemantics = Poseidon(outAmount[0], outPubkey[0], noteIsSendToSelfKey0) into the note
+ * tail, matching the ceremony circuit. The tail is therefore a 4-input hash, not 3.
+ *
+ * noteIsSendToSelfKey0 is 1 only when publicAmount == 0 AND output 0 went to the spender's own key,
+ * exactly as the circuit computes it.
  */
-declare function savePendingDeposit(deposit: PendingDeposit): void;
-/**
- * Load all pending deposits
- */
-declare function loadPendingDeposits(): PendingDeposit[];
-/**
- * Update a pending deposit status
- */
-declare function updatePendingDeposit(commitment: string, updates: Partial<PendingDeposit>): void;
-/**
- * Remove a pending deposit (e.g., after successful confirmation)
- */
-declare function removePendingDeposit(commitment: string): void;
-/**
- * Clear all pending deposits
- */
-declare function clearPendingDeposits(): void;
-/**
- * Save a pending withdrawal
- * Call this when you receive the request_id from the relay
- */
-declare function savePendingWithdrawal(withdrawal: PendingWithdrawal): void;
-/**
- * Load all pending withdrawals
- */
-declare function loadPendingWithdrawals(): PendingWithdrawal[];
-/**
- * Update a pending withdrawal status
- */
-declare function updatePendingWithdrawal(requestId: string, updates: Partial<PendingWithdrawal>): void;
-/**
- * Remove a pending withdrawal (e.g., after successful completion)
- */
-declare function removePendingWithdrawal(requestId: string): void;
-/**
- * Clear all pending withdrawals
- */
-declare function clearPendingWithdrawals(): void;
-/**
- * Check if there are any pending operations that need recovery
- * Call this on page load to determine if recovery UI should be shown
- */
-declare function hasPendingOperations(): boolean;
-/**
- * Get summary of pending operations for recovery UI
- */
-declare function getPendingOperationsSummary(): {
-    deposits: PendingDeposit[];
-    withdrawals: PendingWithdrawal[];
-    totalPending: number;
-};
-/**
- * Clean up stale pending operations
- * Call this periodically to remove old failed/completed operations
- *
- * @param maxAgeMs Maximum age in milliseconds before an operation is removed (default: 24 hours)
- */
-declare function cleanupStalePendingOperations(maxAgeMs?: number): {
-    removedDeposits: number;
-    removedWithdrawals: number;
-};
-
-/**
- * UTXO Transaction Methods
- *
- * This module provides high-level methods for UTXO transactions:
- * - transact(): Core UTXO transaction
- * - transfer(): Shield-to-shield transfer
- * - partialWithdraw(): Withdraw with change
- */
-
-declare const DEFAULT_TRANSACTION_CIRCUITS_URL = "https://storage.googleapis.com/cloak-circuits/circuits/0.1.0";
-/**
- * Set circuits base path: local directory containing `transaction_js/` and `transaction_final.zkey`,
- * or an `http(s)` base URL to those artifacts (Node will download once per process to a temp dir).
- */
-declare function setCircuitsPath(next: string): void;
-/**
- * Get the current circuits path
- */
-declare function getCircuitsPath(): string;
-declare function computeChainNoteHash(publicAmount: bigint, extDataHash: bigint, noteTimestamp: bigint, noteCommitment: bigint): Promise<bigint>;
-/**
- * Compute extDataHash for binding proof to external parameters
- *
- * extDataHash = Poseidon(recipient, relayerFee, relayer)
- */
-declare function computeExtDataHash(recipient: PublicKey | null, relayerFee: bigint, relayer: PublicKey | null): Promise<bigint>;
+declare function computeChainNoteHash(publicAmount: bigint, extDataHash: bigint, noteTimestamp: bigint, noteCommitment: bigint, noteSalt: bigint, outAmount0: bigint, outPubkey0: bigint, noteIsSendToSelfKey0: bigint): Promise<bigint>;
+declare function computeExtDataHash(recipient: PublicKey | null, relayerFee: bigint, relayer: PublicKey | null, maxFee?: bigint): Promise<bigint>;
 /**
  * Options for transact operation
  */
@@ -2978,8 +3199,8 @@ interface TransactOptions {
     /** Relayer address for fee payment */
     relayer?: PublicKey;
     /**
-     * Relay URL override.
-     * Defaults to `https://api.cloak.ag` when omitted.
+     * Relay URL. Never defaulted: resolved from this option, then from `CLOAK_RELAY_URL`.
+     * Name production explicitly (`https://api.cloak.ag`).
      */
     relayUrl?: string;
     /** Keypair of the depositor (signs the deposit transaction) - for programmatic use */
@@ -3065,6 +3286,13 @@ interface TransactOptions {
      * Each entry must be base64-encoded note bytes.
      */
     encryptedNotes?: string[];
+    /**
+     * Omit the on-chain encrypted chain-note envelope entirely. The chainNoteHash public input
+     * is unaffected (proof still binds it); only the optional ciphertext blob the program emits
+     * for wallet auto-scan is dropped. Use when the caller tracks UTXOs out-of-band and needs the
+     * smaller packet — e.g. V3 + SPL deposits that would otherwise overflow the 1232-byte limit.
+     */
+    disableChainNotes?: boolean;
     /**
      * Optional nk (32 bytes, hex or bytes) for diversified chain note encryption (Phase 3).
      * When provided, 2 per-output encrypted notes are embedded on-chain.
@@ -3076,6 +3304,32 @@ interface TransactOptions {
      * passing nk at every call site — e.g. pass a getter from your key manager.
      */
     getChainNoteViewingKeyNk?: () => Promise<string | Uint8Array | null>;
+    /**
+     * Pin the chain note's 96-bit `noteSalt` instead of drawing a fresh one (VK-01).
+     *
+     * Pass the `noteSalt` returned by {@link createRecoverableDepositUtxo}. That helper derives the
+     * deposit note's keypair and blinding as `PRF(nk, noteSalt)`, and the chain note is the ONLY place
+     * the salt is published — so a cold `(rpc, programId, nk)` scan can only rebuild the note if the
+     * salt that anchored it is the salt that reaches the note. Leaving this unset draws a random salt,
+     * which is correct for every non-derived flow.
+     *
+     * Requires an explicit `chainNoteViewingKeyNk` / `getChainNoteViewingKeyNk`; `transact` refuses
+     * otherwise rather than pairing the salt with an nk inferred from the note's own key.
+     */
+    chainNoteSalt?: bigint;
+    /**
+     * The RECIPIENT's 32-byte X25519 public viewing key, for a shield-to-shield send.
+     *
+     * Supply `deriveViewingKeyFromNk(recipientNk).publicKey` (hex or bytes). When present, the SDK
+     * seals `{amount, blinding}` of output 0 to this key and ships it as `recipient_delivery_notes`,
+     * which the relay publishes as a CLKD1 carrier the recipient can find with their `nk` alone.
+     *
+     * When absent, the send still succeeds but the recipient CANNOT discover the note from chain —
+     * it must be handed over out of band. That was the shipped behaviour and is what campaign rows
+     * S2S-08 / VK-01 measured. Ignored on deposits and withdrawals: the relay rejects the field
+     * outright on anything that is not a send.
+     */
+    recipientViewingPublicKey?: Uint8Array | string;
     /**
      * Cached Merkle tree from a previous transaction.
      * When provided, the SDK skips fetching commitments from the relay and uses this
@@ -3151,17 +3405,119 @@ interface RiskQuoteInstructionResponse {
         data: string;
     };
 }
-/**
- * Fetch the risk quote instruction from a backend (e.g. relay /risk-quote).
- * The backend should call Switchboard's fetchQuoteIx for the given wallet
- * (Range Risk API) and return the serialized instruction.
- * See: https://www.range.org/blog/integrate-range-onchain-risk-verifier-into-your-solana-program
- */
-declare function fetchRiskQuoteInstruction(riskQuoteUrl: string, wallet: PublicKey, options?: {
+declare function fetchRiskQuoteInstruction(riskQuoteUrl: string, wallet: PublicKey, options: {
+    poolMint: PublicKey;
     recipient?: PublicKey;
     amount?: bigint;
     token?: PublicKey;
+    commitment?: string | Uint8Array;
+    context?: "deposit" | "send" | "withdraw";
+    nullifier0?: string;
+    nullifier1?: string;
 }): Promise<TransactionInstruction>;
+/** Everything the `/transact` relay body is built from. */
+interface TransactRequestBodyParams {
+    proofB64: string;
+    publicInputsB64: string;
+    mint: PublicKey;
+    recipient?: PublicKey | null;
+    relayer?: PublicKey | null;
+    relayerFee: bigint;
+    maxFee: bigint;
+    encryptedNotes?: string[];
+    riskQuote?: {
+        signature: string;
+        message: string;
+        signer_pubkey: string;
+    };
+    /** Present only on shield-to-shield sends, where the relay enforces sanctions on the sender. */
+    sender?: PublicKey | null;
+    /** Signed public amount; zero is a shield-to-shield send. */
+    externalAmount: bigint;
+    /** Base64 CLKD1 envelopes, from `buildRecipientDeliveryNotes`. Omitted when the rail is off. */
+    recipientDeliveryNotes?: string[];
+}
+/**
+ * Assemble the `/transact` body.
+ *
+ * Extracted so the wire shape is testable without a proof. The field set is a contract with
+ * `services/relay/src/api/transact.rs`, and `recipient_delivery_notes` in particular is part of the
+ * relay's signed field view (`TRANSACT_AUTH_FIELDS`) — so a body that carries it must be signed
+ * with it present, and a body that omits it must be signed with an explicit null. `buildAuthRequest`
+ * handles that, but only if the field is genuinely absent rather than set to `undefined`-ish values.
+ */
+declare function buildTransactRequestBody(params: TransactRequestBodyParams): Record<string, unknown>;
+/** Everything settlement verification needs to check THIS proof against chain state. */
+interface SettlementContext {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    /** The proof's public input nullifiers — the ground truth for "did this land". */
+    inputNullifiers: bigint[];
+}
+type RelaySubmissionResult = {
+    kind: "submitted";
+    signature: string;
+    commitmentIndices?: [number, number];
+    viewingKeyRegistered?: boolean;
+    settlement: SettlementVerdict;
+}
+/** The relay rejected the proof's root; the caller must rebuild the tree and re-prove. */
+ | {
+    kind: "stale-root";
+    error: Error;
+} | {
+    kind: "failed";
+    error: Error;
+};
+interface SubmitTransactToRelayArgs {
+    relayUrl: string;
+    /** The exact body to POST. Auth fields are added ONCE, in place, and then never changed. */
+    requestBody: Record<string, unknown>;
+    programId: PublicKey;
+    depositorKeypair?: Keypair;
+    settlement: SettlementContext;
+    /** True while the caller still has a re-prove budget for a stale root. */
+    canRetryStaleRoot: boolean;
+    maxNetworkRetries?: number;
+    requestTimeoutMs?: number;
+    /** Injection seam for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    onProgress?: (status: string) => void;
+    /** Total window allowed for the on-chain settlement check after a reported success. */
+    settlementTimeoutMs?: number;
+    /** Shorter window used to ask "did it land anyway?" after a terminal relay failure. */
+    failureProbeTimeoutMs?: number;
+}
+/**
+ * POST one logical `/transact` request and REPORT ONLY WHAT THE CHAIN CONFIRMS.
+ *
+ * Extracted from `transact()` so the two campaign defects it fixes are reproducible without a
+ * validator: a stub `fetchImpl` plays the hostile relay, a stub `SettlementConnection` plays the
+ * RPC. Its control flow is the caller's old inline network-retry loop, unchanged except where
+ * noted below.
+ *
+ * THREE fixes live here, all of them the same root cause — trusting the counterparty:
+ *
+ * 1. REL-A-1 (root cause of REL-A-10): the request is signed ONCE, before the retry loop, and
+ *    every retry re-POSTs the byte-identical body. The relay's recovery contract is keyed on
+ *    `(auth_nonce, endpoint, sender, request_digest)` — `request_auth.rs::authenticate_relay_request`
+ *    — and `handle_transact` answers an exact replay from its durable row: `Completed` replays the
+ *    stored response, `Prepared` reconciles the stored signature against chain, `Processing`
+ *    returns a retryable 503. The shipped client re-signed with a FRESH `randomUUID()` nonce inside
+ *    the loop, so every retry was a NEW request that could only collide with its own predecessor's
+ *    nullifier reservation (503) — measured: 7 POSTs, 7 nonces, byte-identical business fields, and
+ *    the recovery path unreachable. Re-signing here is not a fallback: a nonce that has aged past
+ *    the relay's 300s freshness window is still accepted for an EXACT replay whose row exists, and
+ *    when no row exists nothing was mutated, so the 401 is both correct and safe.
+ * 2. X-S-01B: a reported success is verified against chain before it is returned. The relay's word
+ *    plus its commitment indices are not evidence; the input nullifier PDAs are.
+ * 3. REL-A-10 / (b): the signature the relay puts in a `submission_outcome_unknown` body is
+ *    captured across attempts, and every terminal failure that could plausibly have been submitted
+ *    is resolved against chain into a `SettlementVerificationError` that states the outcome and
+ *    carries the signature.
+ */
+declare function submitTransactToRelay(args: SubmitTransactToRelayArgs): Promise<RelaySubmissionResult>;
 declare function transact(params: TransactParams, options: TransactOptions): Promise<TransactResult>;
 /**
  * Execute a shield-to-shield transfer
@@ -3226,6 +3582,25 @@ interface UtxoSwapResult extends TransactResult {
     nullifier: string;
     /** Relay request ID for swap execution status */
     requestId?: string;
+    /**
+     * V3-04 refund-fallback secret. **Persist this** to recover the swap principal if the swap times
+     * out before TX2. On a timeout close the program builds the amount-bound note
+     *   R_fb = Poseidon(amountAfterFee, publicKey, blinding, WSOL)
+     * where `amountAfterFee` is the principal it locked (read authoritatively from the on-chain
+     * `SwapState.sol_amount`, = gross swap amount minus the on-chain swap fee). `ClaimRefund` then spends
+     * `R_fb` with `privateKey` (a plain ZK membership proof of the refund tree). All values are hex.
+     *
+     * VK-02: when `derivedFromNk` is true this secret is ALSO recoverable from the wallet's `nk` plus
+     * the swap's public first input nullifier — see `matchSwapRefundLeaf`. Persisting it is still the
+     * fast path; losing it is no longer terminal. When false (no `nk` was supplied to the swap) this
+     * object is the only copy that will ever exist.
+     */
+    refund: {
+        privateKey: string;
+        publicKey: string;
+        blinding: string;
+        derivedFromNk: boolean;
+    };
 }
 /**
  * Execute a UTXO swap withdrawal
@@ -3255,24 +3630,755 @@ declare function swapUtxo(params: UtxoSwapParams, options: TransactOptions): Pro
 declare function swapWithChange(inputUtxos: Utxo[], swapAmount: bigint, outputMint: PublicKey, recipientAta: PublicKey, minOutputAmount: bigint, options: TransactOptions, recipientWallet?: PublicKey): Promise<UtxoSwapResult>;
 
 /**
- * Compact deterministic chain note format (current format only).
+ * Direct Circom WASM Proof Generation
+ *
+ * This module provides direct proof generation using snarkjs and Circom WASM,
+ * matching the approach used in services-new/tests/src/proof.ts
+ *
+ * Artifacts come from the pinned per-bundle hosts in `config/circuit-release`,
+ * verified by digest; no backend prover service is required.
+ */
+
+/**
+ * Default base URL for the legacy `withdraw_regular` / `withdraw_swap` artifacts.
+ *
+ * Derived from {@link LEGACY_WITHDRAW_CIRCUIT_BUNDLE}, so the version segment is
+ * the same one the pinned digests were declared under. Do not write this URL out
+ * by hand anywhere — change the bundle instead.
+ *
+ * This is NOT the base for the ceremony-frozen `transaction` circuit: that
+ * circuit lives in a different bundle ({@link TRANSACTION_CIRCUIT_BUNDLE}) with
+ * different digests, and is configured through `setCircuitsPath()`.
+ *
+ * `string | null` — null when the bundle has no published host, which is the
+ * case for the legacy withdraw artifacts.
+ *
+ * RESOLVED LAZILY ON PURPOSE. This was previously
+ * `requirePinnedBaseUrl('withdraw_regular')` evaluated at module scope, so an
+ * unpinned bundle made merely IMPORTING the SDK throw — breaking every consumer,
+ * including those that never touch a legacy withdraw path. The diagnostic is
+ * still raised, by `resolveCircuitsUrl` and `getDefaultCircuitsPath` at the
+ * point of use, where a caller can actually act on it.
+ */
+declare const DEFAULT_CIRCUITS_URL: string | null;
+interface WithdrawRegularInputs {
+    root: bigint;
+    nullifier: bigint;
+    outputs_hash: bigint;
+    public_amount: bigint;
+    amount: bigint;
+    leaf_index: bigint;
+    sk: [bigint, bigint];
+    r: [bigint, bigint];
+    pathElements: bigint[];
+    pathIndices: number[];
+    num_outputs: number;
+    out_addr: bigint[][];
+    out_amount: bigint[];
+    out_flags: number[];
+    var_fee: bigint;
+    rem: bigint;
+}
+interface WithdrawSwapInputs {
+    sk_spend: bigint;
+    r: bigint;
+    amount: bigint;
+    leaf_index: bigint;
+    path_elements: bigint[];
+    path_indices: number[];
+    root: bigint;
+    nullifier: bigint;
+    outputs_hash: bigint;
+    public_amount: bigint;
+    input_mint: bigint[];
+    output_mint: bigint[];
+    recipient_ata: bigint[];
+    min_output_amount: bigint;
+    var_fee: bigint;
+    rem: bigint;
+}
+interface ProofResult {
+    proof: Groth16Proof;
+    publicSignals: string[];
+    proofBytes: Uint8Array;
+    publicInputsBytes: Uint8Array;
+}
+/**
+ * Generate Groth16 proof for regular withdrawal using Circom WASM
+ *
+ * This matches the approach in services-new/tests/src/proof.ts
+ *
+ * @param inputs - Circuit inputs
+ * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ */
+declare function generateWithdrawRegularProof(inputs: WithdrawRegularInputs, circuitsPath: string): Promise<ProofResult>;
+/**
+ * Generate Groth16 proof for swap withdrawal using Circom WASM
+ *
+ * This matches the approach in services-new/tests/src/proof.ts
+ *
+ * @param inputs - Circuit inputs
+ * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ */
+declare function generateWithdrawSwapProof(inputs: WithdrawSwapInputs, circuitsPath: string): Promise<ProofResult>;
+/**
+ * Check if circuits are available from the pinned S3 source.
+ */
+declare function areCircuitsAvailable(circuitsPath: string): Promise<boolean>;
+/**
+ * Get default circuits URL.
+ */
+declare function getDefaultCircuitsPath(): Promise<string>;
+/**
+ * Pinned circuit artifact hashes (SHA-256), flattened from the release table in
+ * `config/circuit-release.ts`.
  *
- * Envelope: [version 1][ciphertext (timestamp + tag)]
+ * This is a *view*, not the source of truth: edit the bundle, not this object.
+ * It stays writable because the artifact TOCTOU tests re-pin it to synthetic
+ * fixtures; production code must not mutate it.
+ */
+declare const EXPECTED_CIRCUIT_HASHES: {
+    withdraw_regular_wasm: string;
+    withdraw_regular_zkey: string;
+    withdraw_swap_wasm: string;
+    withdraw_swap_zkey: string;
+    transaction_wasm: string;
+    transaction_zkey: string;
+};
+/**
+ * Circuit verification result
+ */
+interface CircuitVerificationResult {
+    /** Whether verification passed */
+    valid: boolean;
+    /** Which circuit was checked */
+    circuit: CircuitName;
+    /** Error message if verification failed */
+    error?: string;
+    computed?: {
+        wasm: string;
+        zkey: string;
+    };
+    expected?: {
+        wasm: string;
+        zkey: string;
+    };
+}
+/** Circuit artifact bytes together with the digests computed over those bytes. */
+interface VerifiedCircuitArtifacts {
+    /** `<circuit>_js/<circuit>.wasm` bytes. */
+    wasm: Uint8Array;
+    /** `<circuit>_final.zkey` bytes. */
+    zkey: Uint8Array;
+    /** SHA-256 (lowercase hex) of the buffers in this object. */
+    digests: {
+        wasm: string;
+        zkey: string;
+    };
+}
+/**
+ * Load circuit artifacts and return the very bytes whose digest was checked.
+ *
+ * This is the only supported way to obtain proving artifacts: the caller passes
+ * the returned buffers straight to `snarkjs.groth16.fullProve`, which accepts a
+ * `Uint8Array` for both the wasm and the zkey. Passing snarkjs a URL or a file
+ * path instead would re-read the artifact independently of the digest check, so
+ * a CDN (or a concurrent writer on disk) could serve good bytes to the check and
+ * different bytes to the prover.
+ *
+ * Fails closed: any digest mismatch, unreachable artifact, or environment that
+ * cannot produce bytes (a browser pointed at a local directory) throws rather
+ * than falling back to an unverified source.
+ */
+declare function loadVerifiedCircuitArtifacts(circuitsPath: string | null, circuit: CircuitName): Promise<VerifiedCircuitArtifacts>;
+/**
+ * Report whether a circuit's artifacts match the digests pinned in this SDK.
+ *
+ * This is a *reporting* helper (used by `verifyAllCircuits` for start-up checks
+ * and diagnostics). It is NOT what gates proving: a check that only inspects the
+ * source cannot say anything about the bytes a later, independent read returns.
+ * Proof paths must call {@link loadVerifiedCircuitArtifacts} and hand the bytes
+ * it returns to snarkjs.
+ *
+ * IMPORTANT: If the hashes don't match, the circuit may produce proofs
+ * that will be rejected by the on-chain verifier!
+ *
+ * @param circuitsPath - Ignored for the legacy withdraw circuits (they always use
+ *                       their own pinned bundle); honoured for `transaction`.
+ * @param circuit - Which circuit to verify
+ * @returns Verification result
+ *
+ * @example
+ * ```typescript
+ * const result = await verifyCircuitIntegrity(DEFAULT_CIRCUITS_URL, 'withdraw_regular');
+ * if (!result.valid) {
+ *   console.error('Circuit verification failed:', result.error);
+ *   // Don't proceed with proof generation!
+ * }
+ * ```
+ */
+declare function verifyCircuitIntegrity(circuitsPath: string | null, circuit: CircuitName, prefetched?: {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+}): Promise<CircuitVerificationResult>;
+/**
+ * Assert the ceremony-frozen `transaction` circuit artifacts are the pinned ones.
+ *
+ * Throws (fail-closed) when the digests do not match, mirroring how
+ * `generateWithdrawRegularProof` / `generateWithdrawSwapProof` gate the legacy
+ * circuits. Proving against an unpinned zkey silently produces proofs the
+ * on-chain verifying key rejects, so failing here is strictly better than
+ * failing on-chain.
+ *
+ * @param circuitsPath - Base directory or URL holding `transaction_js/transaction.wasm`
+ *                       and `transaction_final.zkey`.
+ * @param prefetched - Already-downloaded artifact bytes, to avoid a second fetch.
+ */
+declare function assertTransactionCircuitIntegrity(circuitsPath: string | null, prefetched?: {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+}): Promise<void>;
+/**
+ * Verify all circuits before use
+ *
+ * Call this at SDK initialization to ensure circuits are valid.
+ *
+ * @param circuitsPath - For the legacy withdraw circuits this is ignored; verification
+ *                       always uses their own pinned bundle.
+ * @param transactionCircuitsPath - Base for the ceremony-frozen `transaction` circuit.
+ *                       Pass `getCircuitsPath()` when the caller has reconfigured it;
+ *                       `null` reports the "no base configured" state rather than throwing.
+ * @returns Array of verification results (one per circuit)
+ */
+declare function verifyAllCircuits(circuitsPath: string, transactionCircuitsPath?: string | null): Promise<CircuitVerificationResult[]>;
+
+/**
+ * Pending Operations Manager
+ *
+ * Utility for persisting pending deposit/withdrawal operations in browser storage.
+ * This enables recovery if the browser crashes or user navigates away mid-operation.
+ *
+ * IMPORTANT: This uses localStorage by default which has security implications.
+ * Notes contain sensitive spending keys - consider using more secure storage
+ * in production (e.g., encrypted IndexedDB, secure enclave).
+ */
+
+/**
+ * Pending deposit record
+ */
+interface PendingDeposit {
+    /** The note (contains spending secrets!) */
+    note: CloakNote;
+    /** When the deposit was initiated */
+    startedAt: number;
+    /** Transaction signature if available */
+    txSignature?: string;
+    /** Status of the deposit */
+    status: "pending" | "tx_sent" | "confirmed" | "failed";
+    /** Error message if failed */
+    error?: string;
+}
+/**
+ * Pending withdrawal record
+ */
+interface PendingWithdrawal {
+    /** The relay request ID (for resumption) */
+    requestId: string;
+    /** The note commitment being withdrawn */
+    commitment: string;
+    /** The nullifier being used */
+    nullifier: string;
+    /** When the withdrawal was initiated */
+    startedAt: number;
+    /** Status of the withdrawal */
+    status: "pending" | "processing" | "completed" | "failed";
+    /** Transaction signature if completed */
+    txSignature?: string;
+    /** Error message if failed */
+    error?: string;
+}
+/**
+ * Save a pending deposit
+ * Call this BEFORE sending the on-chain transaction to ensure note is persisted
+ */
+declare function savePendingDeposit(deposit: PendingDeposit): void;
+/**
+ * Load all pending deposits
+ */
+declare function loadPendingDeposits(): PendingDeposit[];
+/**
+ * Update a pending deposit status
+ */
+declare function updatePendingDeposit(commitment: string, updates: Partial<PendingDeposit>): void;
+/**
+ * Remove a pending deposit (e.g., after successful confirmation)
+ */
+declare function removePendingDeposit(commitment: string): void;
+/**
+ * Clear all pending deposits
+ */
+declare function clearPendingDeposits(): void;
+/**
+ * Save a pending withdrawal
+ * Call this when you receive the request_id from the relay
+ */
+declare function savePendingWithdrawal(withdrawal: PendingWithdrawal): void;
+/**
+ * Load all pending withdrawals
+ */
+declare function loadPendingWithdrawals(): PendingWithdrawal[];
+/**
+ * Update a pending withdrawal status
+ */
+declare function updatePendingWithdrawal(requestId: string, updates: Partial<PendingWithdrawal>): void;
+/**
+ * Remove a pending withdrawal (e.g., after successful completion)
+ */
+declare function removePendingWithdrawal(requestId: string): void;
+/**
+ * Clear all pending withdrawals
+ */
+declare function clearPendingWithdrawals(): void;
+/**
+ * Check if there are any pending operations that need recovery
+ * Call this on page load to determine if recovery UI should be shown
+ */
+declare function hasPendingOperations(): boolean;
+/**
+ * Get summary of pending operations for recovery UI
+ */
+declare function getPendingOperationsSummary(): {
+    deposits: PendingDeposit[];
+    withdrawals: PendingWithdrawal[];
+    totalPending: number;
+};
+/**
+ * Clean up stale pending operations
+ * Call this periodically to remove old failed/completed operations
+ *
+ * @param maxAgeMs Maximum age in milliseconds before an operation is removed (default: 24 hours)
+ */
+declare function cleanupStalePendingOperations(maxAgeMs?: number): {
+    removedDeposits: number;
+    removedWithdrawals: number;
+};
+
+/**
+ * Recipient-addressed delivery envelope (CLKD1).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A shield-to-shield send creates an output note OWNED BY THE RECIPIENT. The only discovery
+ * artefact the SDK used to publish for it was the CLK1 compliance chain note, which is encrypted
+ * under the SENDER's `nk` and keyed (HKDF salt) by the output commitment. That note is openable by
+ * the sender and by nobody else — so the recipient's money sat on chain, valid and spendable, with
+ * its owner unable to see it (campaign rows S2S-08 / VK-01).
+ *
+ * This envelope is the recipient's half. It is encrypted to the RECIPIENT's X25519 public viewing
+ * key — the one derived by `deriveViewingKeyFromNk(nk)` — so a cold scan holding nothing but
+ * `(rpc, programId, nk)` can open it. That triple is exactly the cold-scan contract VK-01 tested.
+ *
+ * ── Wire format — dictated by the relay, not by us ────────────────────────────────────────────
+ * `services/relay/src/api/transact.rs:176-205` accepts EXACTLY ONE base64 envelope of EXACTLY
+ * 112 bytes and only on a shield-to-shield send (`public_amount == 0`); anything else is a 400 and
+ * no carrier is written. `services/relay/src/solana/mod.rs:2338` then publishes
+ *
+ *     "CLKD1" || hex(output_commitment[0]) || hex(envelope)
+ *
+ * as an SPL Memo in a transaction that touches the PDA at seed `b"cloak_delivery_registry"`, which
+ * is what makes it enumerable via `getSignaturesForAddress`.
+ *
+ * The 112 bytes are:
+ *
+ *     [0  ..32)  ephemeral X25519 public key
+ *     [32 ..56)  24-byte XSalsa20-Poly1305 nonce
+ *     [56..112)  56-byte ciphertext = 40-byte plaintext + 16-byte Poly1305 tag
+ *
+ * and the 40-byte plaintext is `amount(u64 LE) || blinding(u256 BE)` — precisely what a recipient
+ * needs, alongside their own keypair and the pool mint, to recompute the commitment and spend it.
+ * Amount is LE to match every other u64 the SDK writes (`chain-note.ts`, public inputs); blinding
+ * is BE to match `bigintToBytes32` and the on-chain field-element convention.
+ *
+ * ── Crypto ────────────────────────────────────────────────────────────────────────────────────
+ * X25519 ECDH + XSalsa20-Poly1305, i.e. `nacl.box`, reusing the exact construction already in
+ * `core/keys.ts` (`nacl.box.before` + `nacl.secretbox`). No new primitive is introduced here.
+ */
+
+/** Ephemeral X25519 public key, at offset 0. */
+declare const RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN = 32;
+/** XSalsa20-Poly1305 nonce, immediately after the ephemeral key. */
+declare const RECIPIENT_DELIVERY_NONCE_LEN = 24;
+/** amount(8) + blinding(32) — everything the owner needs to rebuild and spend the note. */
+declare const RECIPIENT_DELIVERY_PLAINTEXT_LEN = 40;
+/** Poly1305 authentication tag. */
+declare const RECIPIENT_DELIVERY_TAG_LEN = 16;
+/** Sealed payload = plaintext + tag. */
+declare const RECIPIENT_DELIVERY_CIPHERTEXT_LEN: number;
+/**
+ * Total envelope size. The relay rejects any other length outright
+ * (`RECIPIENT_DELIVERY_NOTE_BYTES` in `services/relay/src/api/transact.rs`), so this constant is a
+ * contract with a shipped binary, not a preference.
+ */
+declare const RECIPIENT_DELIVERY_NOTE_BYTES: number;
+/** PDA seed the relay derives the carrier's registry account from. */
+declare const DELIVERY_REGISTRY_SEED = "cloak_delivery_registry";
+/** ASCII tag prefixing the carrier memo payload. */
+declare const DELIVERY_MEMO_TAG = "CLKD1";
+/** The spendable contents of a delivery envelope. */
+interface RecipientDeliveryNote {
+    /** Note amount in the pool mint's smallest unit. */
+    amount: bigint;
+    /** Note blinding factor (BN254 field element). */
+    blinding: bigint;
+}
+/**
+ * Seal `{amount, blinding}` to a recipient's X25519 public viewing key.
+ *
+ * Every input is length-checked here rather than at the relay: a malformed envelope costs a
+ * confirmed transaction's worth of latency before the 400 comes back, and the send has already
+ * generated its proof by then.
+ */
+declare function encodeRecipientDeliveryNote(note: RecipientDeliveryNote, recipientViewingPublicKey: Uint8Array): Uint8Array;
+/**
+ * Trial-open an envelope with a viewing secret. Returns `null` — never throws — when the envelope
+ * is not ours, because a scanner runs this against every carrier in the registry.
+ */
+declare function openRecipientDeliveryNote(envelope: Uint8Array, viewingSecretKey: Uint8Array): RecipientDeliveryNote | null;
+declare function recipientDeliveryNoteToBase64(envelope: Uint8Array): string;
+/** Parameters the send path already has in hand when it assembles the relay body. */
+interface BuildRecipientDeliveryNotesParams {
+    /** Signed public amount. Zero — and only zero — is a shield-to-shield send. */
+    externalAmount: bigint;
+    /** External withdrawal recipient, if any. A send has none. */
+    recipient?: PublicKey | null;
+    /** The recipient's 32-byte X25519 public viewing key (`deriveViewingKeyFromNk(nk).publicKey`). */
+    recipientViewingPublicKey?: Uint8Array | string | null;
+    /**
+     * The output note being delivered. MUST be output 0: the relay binds the carrier to
+     * `public_inputs.output_commitments[0]` (`services/relay/src/api/transact.rs:1015`).
+     */
+    note?: Pick<Utxo, "amount" | "blinding"> | null;
+    /** UTXO public key that owns `note` (i.e. `paddedOutputs[0].keypair.publicKey`). */
+    noteOwnerPublicKey?: bigint;
+    /** UTXO public key doing the spending (i.e. `paddedInputs[0].keypair.publicKey`). */
+    spenderPublicKey?: bigint;
+}
+/**
+ * Build the `recipient_delivery_notes` field for `/transact`, or `undefined` when the rail does not
+ * apply. Returning `undefined` (rather than an empty array) matters: the relay's signed field view
+ * treats omitted and null identically, and an empty array on a withdrawal would still be a 400.
+ */
+declare function buildRecipientDeliveryNotes(params: BuildRecipientDeliveryNotesParams): string[] | undefined;
+/** Render the carrier memo byte-for-byte as `emit_recipient_delivery_carrier` does. */
+declare function encodeDeliveryCarrierMemo(outputCommitment: bigint | Uint8Array, envelope: Uint8Array): Uint8Array;
+interface ParsedDeliveryCarrier {
+    /** Lowercase 64-char hex of the output commitment the carrier declares. */
+    commitment: string;
+    /** The raw 112-byte envelope. */
+    note: Uint8Array;
+}
+/**
+ * Parse one SPL Memo payload. Returns `null` for anything that is not a well-formed CLKD1 carrier —
+ * the memo program accepts arbitrary UTF-8 from anyone, so this must fail closed on exact lengths
+ * (I-12: exact `!==` gates, never `<`).
+ */
+declare function parseDeliveryCarrierMemo(data: Uint8Array): ParsedDeliveryCarrier | null;
+
+/**
+ * Recoverable deposit notes (VK-01, deposit shape).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A cold scan holding exactly `(rpc, programId, nk)` — the contract the SDK advertises for viewing
+ * keys — found the WITHDRAWAL change note and did NOT find the DEPOSIT. The control that makes the
+ * miss attributable is the withdrawal: the same scanner, the same 300-signature window, the same
+ * key, one shape found and one not.
+ *
+ * Two things were missing, and only one of them was visible from the failing arm:
+ *
+ *  1. `outPubkey0`. The deposit's chain note is v3 (timestamp + noteSalt), and `chainNoteHash` binds
+ *     `noteSemantics = Poseidon(outAmount0, outPubkey0, isSendToSelfKey0)`. `outPubkey0` is the
+ *     output note's OWNER key, which is not derivable from `nk` — the key hierarchy runs
+ *     `skSpend → nk` through BLAKE3 and does not run backwards. So the scanner could decrypt the
+ *     note and then had to drop it, because the hash it recomputed could never match. That is why
+ *     the widened arm needed an undocumented `ownUtxoPublicKey`: it was feeding the scanner the one
+ *     value the advertised contract does not carry.
+ *  2. The BLINDING. Even with `ownUtxoPublicKey` the deposit is only VISIBLE, not RECOVERABLE — the
+ *     blinding came from `randomFieldElement()` inside `createUtxo` and is written nowhere. A note
+ *     you can see and cannot spend is not a recovered note.
+ *
+ * ── Why derivation, and not another envelope ──────────────────────────────────────────────────
+ * The shielded-send shape was fixed with a CLKD1 delivery envelope because a send's output is owned
+ * by SOMEONE ELSE: the only way to reach them is to encrypt to their key. A deposit's output is
+ * SELF-owned. There is nobody to deliver to, and an envelope would cost 112 bytes on the one
+ * transaction in the protocol that is wallet-signed and already tight against the 1232-byte packet
+ * limit (a v4 chain note's extra 41 bytes is measured at 1282 and is exactly why deposits stay v3).
+ *
+ * So make the existing chain-note path recoverable instead. Both missing values become a PRF of the
+ * wallet's own `nk` and the note salt the chain note ALREADY carries:
+ *
+ *     seed        = BLAKE3("cloak_deposit_note_v1" || nk || noteSalt(32B BE) || info)
+ *     privateKey  = seed("sk")       reduced into the field
+ *     blinding    = seed("blinding") reduced into the field
+ *     publicKey   = PoseidonEx(privateKey, KEYPAIR_)      [L-02, matches keypair.circom]
+ *
+ * A cold scanner decrypts the chain note with `nk` (AES-GCM, HKDF-salted by the output commitment),
+ * reads `noteSalt` out of the plaintext, replays those three lines, recomputes
+ * `Poseidon(amount, publicKey, blinding, mint)` and requires it to equal a commitment the
+ * transaction actually published. That equality is the authentication: it is not a heuristic, and a
+ * wrong `nk` cannot produce it. Zero extra bytes on chain, no new envelope, no relay change.
+ *
+ * This is the same shape already blessed for swap timeout refunds in `core/swap-refund.ts`
+ * (PRF(nk, nullifier0)), for the same reason: unrecoverable randomness becomes recoverable
+ * randomness without changing anything an observer can see.
+ *
+ * ── The consequence to be explicit about ──────────────────────────────────────────────────────
+ * The deposit note is owned by a PER-DEPOSIT key rather than by the wallet's single long-lived UTXO
+ * keypair. It is still fully spendable — the wallet re-derives `privateKey` from `nk` whenever it
+ * needs it — and it is strictly better for privacy, because `outPubkey0` no longer links a wallet's
+ * deposits to each other. But it means the caller MUST persist (or be able to re-derive) `nk`, which
+ * a Cloak wallet already does, and it means `transact` must be given an explicit `nk` rather than
+ * inferring one from the output note's own key. `transact` enforces that rather than trusting it.
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [L-02] the public key comes from the capacity-tagged `derivePublicKey`. [H-04-shaped] a zero
+ * public key or blinding would be an unspendable note, so the reduction forces non-zero and the
+ * derivation refuses to return a degenerate pair. [M-04] `noteSalt` stays a private input to
+ * `chainNoteHash`; it is only ever published inside the note's own authenticated ciphertext.
+ */
+
+/**
+ * The chain note salt is 96 bits — the circuit constrains it with `Num2Bits(96)` and `transact`
+ * generates exactly 12 bytes. A salt outside that range would produce a proof the circuit rejects,
+ * so it is refused here rather than at proof time.
+ */
+declare const CHAIN_NOTE_SALT_BITS = 96;
+/** The secrets a deposit note is built from — and the ones a cold scan re-derives. */
+interface DepositNoteSecrets {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+}
+/** A deposit note recovered from `nk` alone, in spendable form. */
+interface RecoveredDepositNote extends DepositNoteSecrets {
+    amount: bigint;
+    mintAddress: PublicKey;
+    /** The commitment the transaction published, reproduced from the derived secrets. */
+    commitment: bigint;
+    /** The salt the chain note carried, which anchored the derivation. */
+    noteSalt: bigint;
+}
+/** A fresh 96-bit chain-note salt, from the same fail-closed source `transact` uses. */
+declare function randomDepositNoteSalt(): bigint;
+/**
+ * Derive a deposit note's keypair and blinding from `(nk, noteSalt)`.
+ *
+ * Deterministic by design: this is the whole reason a cold scan can rebuild the note. Both the
+ * builder and the scanner call it, so there is exactly one definition of what a deposit note is.
+ */
+declare function deriveDepositNoteSecrets(viewingKeyNk: Uint8Array, noteSalt: bigint): Promise<DepositNoteSecrets>;
+/**
+ * Build a deposit output note that a cold `(rpc, programId, nk)` scan can recover.
+ *
+ * Returns the UTXO to pass as `outputUtxos[0]` AND the salt that anchored it. The SAME salt must be
+ * handed to `transact` as `options.chainNoteSalt`, because the chain note is what publishes it — a
+ * salt that does not reach the note leaves the deposit exactly as undiscoverable as before.
+ *
+ * ```ts
+ * const { utxo, noteSalt } = await createRecoverableDepositUtxo(amount, nk, mint);
+ * await transact({ ..., outputUtxos: [utxo], externalAmount: amount },
+ *                { chainNoteViewingKeyNk: nk, chainNoteSalt: noteSalt, ... });
+ * ```
+ */
+declare function createRecoverableDepositUtxo(amount: bigint, viewingKeyNk: Uint8Array, mintAddress?: PublicKey, noteSalt?: bigint): Promise<{
+    utxo: Utxo;
+    noteSalt: bigint;
+}>;
+interface MatchDepositNoteParams {
+    /** The scanning wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** `noteSalt`, read out of the decrypted chain note. */
+    noteSalt: bigint;
+    /** Candidate note amount — for a shield with no inputs this is the public deposit amount. */
+    amount: bigint;
+    /** Pool mint the commitment was computed under. */
+    mintAddress: PublicKey;
+    /** Output commitments the transaction actually published, hex or field elements. */
+    outputCommitments: Array<string | bigint>;
+}
+/**
+ * Decide whether a deposit's published commitment is one this `nk` can rebuild, and if so return
+ * the note in spendable form. Returns `null` for everything that is not ours.
+ *
+ * The commitment equality is the authentication. Nothing here trusts the chain note's own claim
+ * about what it describes; the note only supplies `noteSalt`, and the derived secrets have to
+ * reproduce a value the transaction published or the candidate is discarded.
+ */
+declare function matchDepositNote(params: MatchDepositNoteParams): Promise<RecoveredDepositNote | null>;
+
+/**
+ * Swap timeout-refund discovery (VK-02).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * When a private swap exhausts its retry budget, `CloseSwapState` appends
+ *
+ *     R_fb = Poseidon(amount_after_fee, refund_pubkey, refund_blinding, field(WSOL))
+ *
+ * to the main pool tree. `swapUtxo` generated `refund_pubkey` / `refund_blinding` from raw
+ * randomness and returned them only in the in-memory `UtxoSwapResult.refund`. Lose that object —
+ * a crashed tab, a different device, a scan from cold key material — and the leaf is real, funded,
+ * and permanently unrecoverable: campaign row VK-02 observed R_fb under BOTH the refund note's own
+ * viewing key and the swap creator's, and found nothing under either.
+ *
+ * ── The fix, and why it is SDK-only ───────────────────────────────────────────────────────────
+ * Derive the refund authorization as a PRF of the owner's `nk` and the swap's own first input
+ * nullifier:
+ *
+ *     seed = BLAKE3("cloak_swap_refund_v1" || nk || nullifier0)
+ *
+ * `nullifier0` is published in the TransactSwap public inputs, so a cold scanner enumerating
+ * program transactions can replay this derivation for every swap it sees, recompute R_fb, and
+ * match it against the commitment `CloseSwapState` declared. `nk` is secret, so no third party can
+ * predict, front-run or link the refund key — the on-chain artefacts are unchanged in shape and
+ * every existing binding still holds.
+ *
+ * This changes NOTHING on chain or in the relay. `refund_pubkey` / `refund_blinding` remain
+ * caller-supplied values bound into `computeSwapExtDataHash`; only their provenance changes, from
+ * "unrecoverable randomness" to "recoverable randomness".
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [H-04 / DD-01] the derivation is rejected unless publicKey and blinding are both non-zero, and
+ * it is unique per swap because `nullifier0` is unique per spend. [L-02] the public key comes from
+ * the capacity-tagged `derivePublicKey`, matching `keypair.circom`.
+ *
+ * ── FORWARD-LOOKING ONLY ──────────────────────────────────────────────────────────────────────
+ * Everything here — including `discoverSwapRefunds`, the RPC walker at the bottom of this file —
+ * recovers only refunds whose authorization was DERIVED. Swaps already on chain whose refund keypair
+ * and blinding came from raw randomness stay unrecoverable, permanently, by any key-only scan. There
+ * is nothing to replay: those secrets existed only in the caller's in-memory `UtxoSwapResult.refund`.
+ * Do not let this note get softened — a wallet that reports "no stranded refunds" on the strength of
+ * an empty scan would be making a claim this code cannot support.
+ */
+
+/** A refund authorization: what `swapUtxo` binds into the swap ext-data hash. */
+interface SwapRefundAuthorization {
+    privateKey: bigint;
+    publicKey: bigint;
+    blinding: bigint;
+}
+/** A refund leaf matched back to its owner, ready to spend. */
+interface RecoveredSwapRefund {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+    amount: bigint;
+    /** R_fb as a field element, identical to the commitment `CloseSwapState` appended. */
+    commitment: bigint;
+}
+/**
+ * Derive a swap's refund authorization from the owner's `nk` and the swap's first input nullifier.
+ *
+ * Deterministic by design: this is what makes the refund leaf recoverable from key material alone.
+ */
+declare function deriveSwapRefundAuthorization(viewingKeyNk: Uint8Array, inputNullifier: Uint8Array | bigint): Promise<SwapRefundAuthorization>;
+/**
+ * R_fb, exactly as `CloseSwapState` computes it. The swap principal is always WSOL-locked, so the
+ * mint term is the native-SOL sentinel.
+ */
+declare function computeSwapRefundCommitment(amountAfterFee: bigint, refundPublicKey: bigint, refundBlinding: bigint): Promise<bigint>;
+interface MatchSwapRefundLeafParams {
+    /** The scanning wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** First input nullifier of the candidate swap, read from its TransactSwap public inputs. */
+    inputNullifier: Uint8Array | bigint;
+    /** Principal returned to the pool, from the `cloak/refund_leaf/v1` event. */
+    amountAfterFee: bigint;
+    /** R_fb as appended on chain. */
+    commitment: bigint | Uint8Array;
+}
+/**
+ * Decide whether a public refund leaf belongs to the holder of `viewingKeyNk`, and if so return it
+ * in spendable form. Returns `null` for every leaf that is not ours — a scanner runs this against
+ * every close it can see.
+ */
+declare function matchSwapRefundLeaf(params: MatchSwapRefundLeafParams): Promise<RecoveredSwapRefund | null>;
+/** One recovered refund leaf, with the chain coordinates that produced it. */
+interface DiscoveredSwapRefund extends RecoveredSwapRefund {
+    /** Signature of the `CloseSwapState` transaction that appended the leaf. */
+    signature: string;
+    /** Leaf index, straight from the `cloak/refund_leaf/v1` event. */
+    leafIndex: bigint;
+    /** First input nullifier of the swap this refund belongs to (the PRF's second input). */
+    inputNullifier: Uint8Array;
+    /** Signature of the `TransactSwap` that opened the swap, when it was inside the scanned window. */
+    swapSignature?: string;
+}
+interface DiscoverSwapRefundsOptions {
+    /** Maximum program signatures to walk. Omit or 0 to walk the whole history. */
+    limit?: number;
+    /** Stop when this signature is reached (exclusive) — the cursor from a previous run. */
+    untilSignature?: string;
+    /** `getTransaction` concurrency (default 50). */
+    batchSize?: number;
+    /** Progress/status callback. */
+    onStatus?: (status: string) => void;
+    /**
+     * Pool mint whose `swap_state` PDAs to derive. Swap input is wSOL-locked, so the default is the
+     * native-SOL sentinel and there is no reason to change it outside a test.
+     */
+    poolMint?: PublicKey;
+}
+/**
+ * Find every swap timeout-refund leaf on chain that belongs to the holder of `viewingKeyNk`, and
+ * return each in spendable form (`keypair`, `blinding`, `amount`, `commitment`).
+ *
+ * Key material only — no relay, no local note store, no prior knowledge of the swap. This is the
+ * recovery path for the exact situation VK-02 described: `CloseSwapState` appended a funded leaf and
+ * its owner could not see it under any key they held.
+ *
+ * FORWARD-LOOKING ONLY. This finds refunds whose authorization was DERIVED as PRF(nk, nullifier0).
+ * A swap whose refund keypair and blinding were drawn from raw randomness — every swap submitted
+ * before that derivation shipped, and any swap built without an `nk` — has no derivation to replay,
+ * and no key-only scan can ever recover it. Those secrets existed solely in the caller's in-memory
+ * `UtxoSwapResult.refund`. An empty result is therefore NOT proof that a wallet has no stranded
+ * refund; it means none of the leaves in the scanned window were derivable from this `nk`.
+ *
+ * @param connection    Solana RPC connection.
+ * @param programId     Shield-pool program id.
+ * @param viewingKeyNk  32-byte `nk` — the same value chain notes are decrypted with.
+ */
+declare function discoverSwapRefunds(connection: Connection, programId: PublicKey, viewingKeyNk: Uint8Array, options?: DiscoverSwapRefundsOptions): Promise<DiscoveredSwapRefund[]>;
+
+/**
+ * Compact deterministic chain note format.
+ *
+ * Envelope: [version 1][ciphertext (plaintext + AES-GCM tag)]
+ *
+ * Plaintext layout by version:
+ * - v3: [timestamp: u64 LE (8)][noteSalt: u256 BE (32)]
+ * - v2: [timestamp: u64 LE (8)]
  */
 type ChainNoteTxType = "deposit" | "withdraw" | "transfer" | "swap" | "unknown";
 interface CompactChainNote {
     timestamp: bigint;
     commitment: string;
+    noteSalt?: bigint;
+    /** v4 only: the three terms that make up `noteSemantics`. */
+    outAmount0?: bigint;
+    outPubkey0?: bigint;
+    isSendToSelfKey0?: bigint;
 }
 /**
  * Encrypt a compact deterministic chain note.
- * Payload is minimal to keep relay withdrawals under Solana packet size limits.
- * Envelope: [version 1][ciphertext (timestamp + tag)]
+ *
+ * v3 carries noteSalt so the recipient can recompute and verify the public
+ * chainNoteHash without making the output commitment linkable by observers.
  */
-declare function encryptCompactChainNote(timestamp: bigint, nk: Uint8Array, commitmentHex: string): Promise<Uint8Array>;
+declare function encryptCompactChainNote(timestamp: bigint, nk: Uint8Array, commitmentHex: string, noteSalt: bigint, semantics?: {
+    outAmount0: bigint;
+    outPubkey0: bigint;
+    isSendToSelfKey0: bigint;
+}): Promise<Uint8Array>;
 /**
  * Decrypt a compact deterministic chain note with candidate output commitments.
  * Tries each commitment-derived key until AES-GCM authentication succeeds.
+ * Accepts current v3 notes and legacy v2 notes.
  */
 declare function decryptCompactChainNote(noteBytes: Uint8Array, nk: Uint8Array, candidateCommitments: string[]): Promise<CompactChainNote>;
 declare function chainNoteToBase64(noteBytes: Uint8Array): string;
@@ -3341,6 +4447,30 @@ interface ScanResult {
     lastSignature?: string;
     /** Number of RPC getTransaction calls actually made (for diagnostics). */
     rpcCallsMade: number;
+    /**
+     * Notes delivered TO this wallet by other people's shield-to-shield sends, recovered from the
+     * CLKD1 registry. These are SPENDABLE note secrets, not history records — they are intentionally
+     * kept out of `transactions`/`summary` so the compliance report shape is unchanged.
+     */
+    deliveredNotes: DeliveredNote[];
+    /**
+     * This wallet's OWN deposits, rebuilt in SPENDABLE form from `nk` alone (VK-01).
+     *
+     * `transactions` records that a deposit happened and for how much. These carry the keypair and
+     * blinding as well, which is the difference between seeing a note and being able to spend it.
+     * Only deposits built with {@link createRecoverableDepositUtxo} appear here; a deposit whose
+     * blinding came from raw randomness has nothing to rebuild and shows up as a history row only.
+     *
+     * Additive, for the same reason as `deliveredNotes`: note secrets are not compliance rows.
+     */
+    recoveredDepositNotes: RecoveredDepositNoteRecord[];
+}
+/** A recovered deposit note plus the chain coordinates it was recovered from. */
+interface RecoveredDepositNoteRecord extends RecoveredDepositNote {
+    /** Signature of the deposit transaction. */
+    signature: string;
+    /** Millisecond timestamp from the chain note. */
+    timestamp: bigint;
 }
 /** Options for `scanTransactions`. */
 interface ScanOptions {
@@ -3376,15 +4506,74 @@ interface ScanOptions {
      * matching the wallet's associated token account against the on-chain recipient ATA.
      */
     walletPublicKey?: string;
+    /**
+     * Sweep the CLKD1 recipient-delivery registry for notes sent TO this wallet (default: true).
+     * Costs one extra `getSignaturesForAddress` page plus one `getTransaction` per carrier.
+     */
+    includeRecipientDeliveries?: boolean;
+    /**
+     * This wallet's UTXO public key. Supply it to authenticate each delivery carrier's declared
+     * commitment (see `ScanRecipientDeliveryOptions.ownerUtxoPublicKey`). Without it the commitment
+     * is reported unverified.
+     */
+    ownerUtxoPublicKey?: bigint;
+    /** Candidate pool mints for delivery-carrier commitment verification. Defaults to native SOL. */
+    deliveryMints?: PublicKey[];
+}
+/** A note delivered TO the scanning wallet by someone else's shield-to-shield send. */
+interface DeliveredNote {
+    /** Output commitment (lowercase hex) the carrier declares. */
+    commitment: string;
+    /** Note amount, decrypted from the envelope. */
+    amount: bigint;
+    /** Note blinding, decrypted from the envelope. */
+    blinding: bigint;
+    /** Carrier transaction signature (the discovery record, NOT the source transaction). */
+    carrierSignature: string;
+    /** Carrier block time in seconds, when the RPC supplied one. */
+    blockTime?: number;
+    /**
+     * Pool mint the note lives in, resolved by recomputing the commitment. Present only when
+     * `ownerUtxoPublicKey` was supplied — without it the declared commitment cannot be checked.
+     */
+    mint?: string;
+    /**
+     * True when the declared commitment was recomputed from the decrypted note and matched. The
+     * memo's commitment field is unauthenticated; only this recomputation binds it.
+     */
+    commitmentVerified: boolean;
+}
+interface ScanRecipientDeliveryOptions {
+    connection: Connection;
+    programId: PublicKey;
+    /** nk (32 bytes). The X25519 opening key is `deriveViewingKeyFromNk(nk).privateKey`. */
+    viewingKeyNk: Uint8Array;
+    /**
+     * The scanning wallet's UTXO public key. Supply it to authenticate the carrier's declared
+     * commitment: the memo's commitment field is written by the relay and is not covered by the
+     * envelope's Poly1305 tag, so a carrier can claim any commitment it likes. With this set, a
+     * carrier survives only if `Poseidon(amount, ownerPubkey, blinding, mint)` reproduces it.
+     */
+    ownerUtxoPublicKey?: bigint;
+    /** Candidate pool mints to try when verifying. Defaults to the native-SOL sentinel. */
+    mints?: PublicKey[];
+    onStatus?: (status: string) => void;
+    debug?: boolean;
 }
 /**
- * Scan on-chain transactions for the Cloak program, extract chain
- * notes, trial-decrypt with the provided viewing key, verify integrity,
- * and return a sorted list of the caller's transactions.
+ * Sweep the recipient-delivery registry (CLKD1) and trial-open every carrier with the caller's
+ * viewing key.
  *
- * This is fully self-contained — it only needs a Solana RPC connection
- * and the user's viewing key (private).
+ * This is the READ half of the fix for S2S-08 / VK-01. The pre-existing sweep
+ * (`scanSwapNoteCarriers`) reads the CLK1 registry, which carries the SENDER-encrypted compliance
+ * note — which is why a cold scan found the withdrawal change note and nothing that was sent TO the
+ * scanning wallet. This registry carries the recipient-encrypted envelope, and is the only place a
+ * recipient's own note is discoverable from `(rpc, programId, nk)` alone.
  */
+declare function scanRecipientDeliveryNotes(opts: ScanRecipientDeliveryOptions): Promise<{
+    notes: DeliveredNote[];
+    rpcCalls: number;
+}>;
 declare function scanTransactions(opts: ScanOptions): Promise<ScanResult>;
 /** JSON-serializable compliance report (numbers instead of bigint). Used for cache and display. */
 interface ComplianceReport {
@@ -3560,8 +4749,8 @@ declare class SimpleWallet {
  * @packageDocumentation
  */
 
-declare const VERSION = "0.1.5";
+declare const VERSION = "0.2.0";
 /** True when scanner supports TransactSwap (tag 1). Check this to verify the correct SDK bundle is loaded. */
 declare const SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 
-export { CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, CloakSDK, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, type DepositInstructionParams, type DepositOptions, type DepositResult, type DepositStatus, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, FIXED_FEE_LAMPORTS, type Groth16Proof, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type PendingDeposit, type PendingWithdrawal, type ProofResult, RelayInternalError, RelayService, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanResult, type ScanSummary, type ScannedTransaction, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SwapOptions, type SwapParams, type SwapResult, type TransactOptions, type TransactParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawRegularInputs, type WithdrawSubmissionResult, type WithdrawSwapInputs, areCircuitsAvailable, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildPublicInputsBytes, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeCommitment$1 as computeCommitment, computeExtDataHash, computeMerkleRoot, computeNullifier$1 as computeNullifier, computeNullifierAsync, computeNullifierSync, computeOutputsHash, computeOutputsHashAsync, computeOutputsHashSync, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapOutputsHash, computeSwapOutputsHashAsync, computeSwapOutputsHashSync, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDiversifiedViewingKey, deriveDiversifier, derivePublicKey, deriveSpendKey, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, downloadNote, encodeNoteSimple, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitment, generateCommitmentAsync, generateMasterSeed, generateNote, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, generateWithdrawRegularProof, generateWithdrawSwapProof, getAddressExplorerUrl, getCircuitsPath, getDefaultCircuitsPath, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isDebugEnabled, isRootNotFoundError, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, parseAmount, parseError, parseNote, parseRelayErrorResponse, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomFieldElement, readMerkleTreeState, registerViewingKey, removePendingDeposit, removePendingWithdrawal, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };
+export { type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitName, type CircuitVerificationResult, type ClaimTimeoutRefundOptions, type ClaimTimeoutRefundParams, type ClaimTimeoutRefundResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, CloakSDK, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, type ProofResult, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, type RecipientDeliveryNote, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RefundVoucher, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawRegularInputs, type WithdrawSubmissionResult, type WithdrawSwapInputs, areCircuitsAvailable, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildPublicInputsBytes, buildRecipientDeliveryNotes, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, chainNoteFromBase64, chainNoteToBase64, claimTimeoutRefund, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeCommitment$1 as computeCommitment, computeExtDataHash, computeMerkleRoot, computeNullifier$1 as computeNullifier, computeNullifierAsync, computeNullifierSync, computeOutputsHash, computeOutputsHashAsync, computeOutputsHashSync, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapOutputsHash, computeSwapOutputsHashAsync, computeSwapOutputsHashSync, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitment, generateCommitmentAsync, generateMasterSeed, generateNote, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, generateWithdrawRegularProof, generateWithdrawSwapProof, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDefaultCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRefundClaimPDA, getRefundLedgerPDA, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };