@cloak.dev/sdk 0.2.0 → 0.2.2

package/dist/index.d.ts

@@ -1,4 +1,24 @@
-import { PublicKey, Transaction, Connection, AddressLookupTableAccount, TransactionInstruction, Keypair, SendOptions, VersionedTransaction } from '@solana/web3.js';
+import { PublicKey, Transaction, AddressLookupTableAccount, Connection, TransactionInstruction, Keypair, SendOptions, VersionedTransaction } from '@solana/web3.js';
+
+/**
+ * The deployed Cloak program.
+ *
+ * This lived in `core/CloakSDK.ts` until that class was removed. It is protocol
+ * configuration, not client state: every PDA derivation, every scan and every
+ * `transact()` submission is addressed to it, so it belongs beside the other
+ * pinned protocol facts in `config/` rather than inside one client object.
+ */
+
+/**
+ * Address of the Cloak shield-pool program on Solana mainnet.
+ *
+ * The same address is used by every environment the SDK talks to (a local
+ * Surfpool fork mirrors mainnet, so it carries the same program id). Callers
+ * that need a different deployment pass an explicit `programId` to the function
+ * they are calling — `getShieldPoolPDAs`, `transact`, `scanTransactions` and
+ * friends all take one.
+ */
+declare const CLOAK_PROGRAM_ID: PublicKey;
 
 type ComplianceTxType = "deposit" | "withdraw" | "send" | "swap";
 interface TransactionMetadata {
@@ -454,415 +474,6 @@ declare function exportKeys(keys: CloakKeyPair): string;
  */
 declare function importKeys(exported: string): CloakKeyPair;
 
-/**
- * Storage Interface
- *
- * Defines a pluggable storage interface for notes and keys.
- * Applications can implement their own storage (localStorage, IndexedDB, file system, etc.)
- */
-
-/**
- * Storage adapter interface
- *
- * Implement this interface to provide custom storage for notes and keys.
- * The SDK will use this adapter for all persistence operations.
- */
-interface StorageAdapter {
-    /**
-     * Save a note
-     */
-    saveNote(note: CloakNote): Promise<void> | void;
-    /**
-     * Load all notes
-     */
-    loadAllNotes(): Promise<CloakNote[]> | CloakNote[];
-    /**
-     * Update a note
-     */
-    updateNote(commitment: string, updates: Partial<CloakNote>): Promise<void> | void;
-    /**
-     * Delete a note
-     */
-    deleteNote(commitment: string): Promise<void> | void;
-    /**
-     * Clear all notes
-     */
-    clearAllNotes(): Promise<void> | void;
-    /**
-     * Save wallet keys
-     */
-    saveKeys(keys: CloakKeyPair): Promise<void> | void;
-    /**
-     * Load wallet keys
-     */
-    loadKeys(): Promise<CloakKeyPair | null> | CloakKeyPair | null;
-    /**
-     * Delete wallet keys
-     */
-    deleteKeys(): Promise<void> | void;
-}
-/**
- * In-memory storage adapter (default, no persistence)
- *
- * Useful for testing or when storage is handled externally
- */
-declare class MemoryStorageAdapter implements StorageAdapter {
-    private notes;
-    private keys;
-    saveNote(note: CloakNote): void;
-    loadAllNotes(): CloakNote[];
-    updateNote(commitment: string, updates: Partial<CloakNote>): void;
-    deleteNote(commitment: string): void;
-    clearAllNotes(): void;
-    saveKeys(keys: CloakKeyPair): void;
-    loadKeys(): CloakKeyPair | null;
-    deleteKeys(): void;
-}
-/**
- * Browser localStorage adapter (optional, for browser environments)
- *
- * Only use this if you're in a browser environment and want localStorage persistence.
- * Import from a separate browser-specific module.
- */
-declare class LocalStorageAdapter implements StorageAdapter {
-    private notesKey;
-    private keysKey;
-    constructor(notesKey?: string, keysKey?: string);
-    private getStorage;
-    saveNote(note: CloakNote): void;
-    loadAllNotes(): CloakNote[];
-    updateNote(commitment: string, updates: Partial<CloakNote>): void;
-    deleteNote(commitment: string): void;
-    clearAllNotes(): void;
-    saveKeys(keys: CloakKeyPair): void;
-    loadKeys(): CloakKeyPair | null;
-    deleteKeys(): void;
-}
-
-/** Default Cloak Program ID on Solana */
-declare const CLOAK_PROGRAM_ID: PublicKey;
-/**
- * Main Cloak SDK
- *
- * Provides high-level API for interacting with the Cloak protocol,
- * including deposits, withdrawals, and private transfers.
- *
- * Supports two modes:
- * 1. Node.js mode with keypairBytes - for scripts and backend services
- * 2. Wallet adapter mode - for browser applications with wallet integration
- */
-declare class CloakSDK {
-    private config;
-    private keypair?;
-    private wallet?;
-    private cloakKeys?;
-    private relay;
-    private storage;
-    /**
-    * Create a new Cloak SDK client
-     *
-     * @param config - Client configuration
-     *
-     * @example Node.js mode (with keypair)
-     * ```typescript
-     * const sdk = new CloakSDK({
-     *   keypairBytes: keypair.secretKey,
-     *   network: "devnet"
-     * });
-     * ```
-     *
-     * @example Browser mode (with wallet adapter)
-     * ```typescript
-     * const sdk = new CloakSDK({
-     *   wallet: walletAdapter,
-     *   network: "devnet"
-     * });
-     * ```
-     */
-    constructor(config: {
-        /** Keypair bytes for signing (Node.js mode) */
-        keypairBytes?: Uint8Array;
-        /** Wallet adapter for signing (Browser mode) */
-        wallet?: WalletAdapter;
-        network?: Network;
-        cloakKeys?: CloakKeyPair;
-        storage?: StorageAdapter;
-        programId?: PublicKey;
-        relayUrl?: string;
-        /** Enable debug logging with structured output */
-        debug?: boolean;
-    });
-    /**
-     * Get the public key for deposits (from keypair or wallet)
-     */
-    getPublicKey(): PublicKey;
-    /**
-     * Check if the SDK is using a wallet adapter
-     */
-    isWalletMode(): boolean;
-    /**
-     * Deposit SOL into the Cloak protocol
-     *
-     * Creates a new note (or uses a provided one), submits a deposit transaction,
-     * and registers with the indexer.
-     *
-     * @param connection - Solana connection
-     * @param payer - Payer wallet with sendTransaction method
-     * @param amountOrNote - Amount in lamports OR an existing note to deposit
-     * @param options - Optional configuration
-     * @returns Deposit result with note and transaction info
-     *
-     * @example
-     * ```typescript
-     * // Generate and deposit in one step
-     * const result = await client.deposit(
-     *   connection,
-     *   wallet,
-     *   1_000_000_000,
-     *   {
-     *     onProgress: (status) => console.log(status)
-     *   }
-     * );
-     *
-     * // Or deposit a pre-generated note
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.deposit(connection, wallet, note);
-     * ```
-     */
-    deposit(connection: Connection, amountOrNote: number | CloakNote, options?: DepositOptions): Promise<DepositResult>;
-    /**
-     * Private transfer with up to 5 recipients
-     *
-     * Handles the complete private transfer flow:
-     * 1. If note is not deposited, deposits it first and waits for confirmation
-     * 2. Generates a zero-knowledge proof
-     * 3. Submits the withdrawal via relay service to recipients
-     *
-     * This is the main method for performing private transfers - it handles everything!
-     *
-     * @param connection - Solana connection (required for deposit if not already deposited)
-     * @param payer - Payer wallet (required for deposit if not already deposited)
-     * @param note - Note to spend (can be deposited or not)
-     * @param recipients - Array of 1-5 recipients with amounts
-     * @param options - Optional configuration
-     * @returns Transfer result with signature and outputs
-     *
-     * @example
-     * ```typescript
-     * // Create a note (not deposited yet)
-     * const note = client.generateNote(1_000_000_000);
-     *
-     * // privateTransfer handles the full flow: deposit + withdraw
-     * const result = await client.privateTransfer(
-     *   connection,
-     *   wallet,
-     *   note,
-     *   [
-     *     { recipient: new PublicKey("..."), amount: 500_000_000 },
-     *     { recipient: new PublicKey("..."), amount: 492_500_000 }
-     *   ],
-     *   {
-     *     relayFeeBps: 50, // 0.5%
-     *     onProgress: (status) => console.log(status),
-     *     onProofProgress: (pct) => console.log(`Proof: ${pct}%`)
-     *   }
-     * );
-     * console.log(`Success! TX: ${result.signature}`);
-     * ```
-     */
-    privateTransfer(connection: Connection, note: CloakNote, recipients: MaxLengthArray<Transfer, 5>, options?: TransferOptions): Promise<TransferResult>;
-    /**
-     * Withdraw to a single recipient
-     *
-     * Convenience method for withdrawing to one address.
-     * Handles the complete flow: deposits if needed, then withdraws.
-     *
-     * @param connection - Solana connection
-     * @param payer - Payer wallet
-     * @param note - Note to spend
-     * @param recipient - Recipient address
-     * @param options - Optional configuration
-     * @returns Transfer result
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.withdraw(
-     *   connection,
-     *   wallet,
-     *   note,
-     *   new PublicKey("..."),
-     *   { withdrawAll: true }
-     * );
-     * ```
-     */
-    withdraw(connection: Connection, note: CloakNote, recipient: PublicKey, options?: WithdrawOptions): Promise<TransferResult>;
-    /**
-     * Send SOL privately to multiple recipients
-     *
-     * Convenience method that wraps privateTransfer with a simpler API.
-     * Handles the complete flow: deposits if needed, then sends to recipients.
-     *
-     * @param connection - Solana connection
-     * @param note - Note to spend
-     * @param recipients - Array of 1-5 recipients with amounts
-     * @param options - Optional configuration
-     * @returns Transfer result
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.send(
-     *   connection,
-     *   note,
-     *   [
-     *     { recipient: new PublicKey("..."), amount: 500_000_000 },
-     *     { recipient: new PublicKey("..."), amount: 492_500_000 }
-     *   ]
-     * );
-     * ```
-     */
-    send(connection: Connection, note: CloakNote, recipients: MaxLengthArray<Transfer, 5>, options?: TransferOptions): Promise<TransferResult>;
-    /**
-     * Swap SOL for tokens privately
-     *
-     * Withdraws SOL from a note and swaps it for tokens via the relay service.
-     * Handles the complete flow: deposits if needed, generates proof, and submits swap.
-     *
-     * @param connection - Solana connection
-     * @param note - Note to spend
-     * @param recipient - Recipient address (will receive tokens)
-     * @param options - Swap configuration
-     * @returns Swap result with transaction signature
-     *
-     * @example
-     * ```typescript
-     * const note = client.generateNote(1_000_000_000);
-     * const result = await client.swap(
-     *   connection,
-     *   note,
-     *   new PublicKey("..."), // recipient
-     *   {
-     *     outputMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v", // USDC
-     *     slippageBps: 100, // 1%
-     *     getQuote: async (amount, mint, slippage) => {
-     *       // Fetch quote from your swap API
-     *       const quote = await fetchSwapQuote(amount, mint, slippage);
-     *       return {
-     *         outAmount: quote.outAmount,
-     *         minOutputAmount: quote.minOutputAmount
-     *       };
-     *     }
-     *   }
-     * );
-     * ```
-     */
-    swap(connection: Connection, note: CloakNote, recipient: PublicKey, options: SwapOptions): Promise<SwapResult>;
-    /**
-     * Generate a new note without depositing
-     *
-     * @param amountLamports - Amount for the note
-     * @param useWalletKeys - Whether to use wallet keys (v2.0 recommended)
-     * @returns New note (not yet deposited)
-     */
-    generateNote(amountLamports: number, useWalletKeys?: boolean): Promise<CloakNote>;
-    /**
-     * Parse a note from JSON string
-     *
-     * @param jsonString - JSON representation
-     * @returns Parsed note
-     */
-    parseNote(jsonString: string): CloakNote;
-    /**
-     * Export a note to JSON string
-     *
-     * @param note - Note to export
-     * @param pretty - Format with indentation
-     * @returns JSON string
-     */
-    exportNote(note: CloakNote, pretty?: boolean): string;
-    /**
-     * Check if a note is ready for withdrawal
-     *
-     * @param note - Note to check
-     * @returns True if withdrawable
-     */
-    isWithdrawable(note: CloakNote): boolean;
-    /**
-     * Get Merkle proof for a leaf index directly from on-chain state
-     *
-     * @param connection - Solana connection
-     * @param leafIndex - Leaf index in tree
-     * @returns Merkle proof computed from on-chain data
-     */
-    getMerkleProof(connection: Connection, leafIndex: number): Promise<MerkleProof>;
-    /**
-     * Get current Merkle root directly from on-chain state
-     *
-     * @param connection - Solana connection
-     * @returns Current root hash from on-chain tree
-     */
-    getCurrentRoot(connection: Connection): Promise<string>;
-    /**
-     * Get transaction status from relay service
-     *
-     * @param requestId - Request ID from previous submission
-     * @returns Current status
-     */
-    getTransactionStatus(requestId: string): Promise<TxStatus>;
-    /**
-     * Fetch and decrypt this user's transaction metadata history.
-     * DEPRECATED: This functionality is no longer supported
-     */
-    getTransactionMetadata(_options?: {
-        _after?: number;
-        _before?: number;
-    }): Promise<TransactionMetadata[]>;
-    /**
-     * Load all notes from storage
-     *
-     * @returns Array of saved notes
-     */
-    loadNotes(): Promise<CloakNote[]>;
-    /**
-     * Save a note to storage
-     *
-     * @param note - Note to save
-     */
-    saveNote(note: CloakNote): Promise<void>;
-    /**
-     * Find a note by its commitment
-     *
-     * @param commitment - Commitment hash
-     * @returns Note if found
-     */
-    findNote(commitment: string): Promise<CloakNote | undefined>;
-    /**
-     * Import wallet keys from JSON
-     *
-     * @param keysJson - JSON string containing keys
-     */
-    importWalletKeys(keysJson: string): Promise<void>;
-    /**
-     * Export wallet keys to JSON
-     *
-     * WARNING: This exports secret keys! Store securely.
-     *
-     * @returns JSON string with keys
-     */
-    exportWalletKeys(): string;
-    /**
-     * Get the configuration
-     */
-    getConfig(): CloakConfig;
-    /**
-     * Wrap errors with better categorization and user-friendly messages
-     *
-     * @private
-     */
-    private wrapError;
-}
-
 /**
  * Serialize a note to JSON string
  *
@@ -1013,18 +624,12 @@ declare function calculateRelayFee(amountLamports: number, feeBps: number): numb
  * Storage is handled externally via StorageAdapter.
  *
  * Core functionality:
- * - Generate notes (v1.0 and v2.0)
+ * - Generate notes from wallet keys
  * - Parse and validate notes
  * - Note utilities (formatting, fees, etc.)
  * - Key management (without storage)
  */
 
-/**
- * Generate a new note without wallet keys (legacy v1.0)
- * Uses Poseidon hashing to match circuit implementation
- * @deprecated Use generateNoteFromWallet instead for enhanced security
- */
-declare function generateNote(amountLamports: number, network?: Network): Promise<CloakNote>;
 /**
  * Generate a note using wallet's spend key (v2.0 recommended)
  * Uses Poseidon hashing to match circuit implementation
@@ -1087,9 +692,94 @@ declare function getPublicViewKey(keys: CloakKeyPair): string;
  */
 declare function getViewKey(keys: CloakKeyPair): ViewKey;
 /**
- * Get recipient amount after fees
+ * Get recipient amount after fees
+ */
+declare function getRecipientAmount(amountLamports: number): number;
+
+/**
+ * Storage Interface
+ *
+ * Defines a pluggable storage interface for notes and keys.
+ * Applications can implement their own storage (localStorage, IndexedDB, file system, etc.)
+ */
+
+/**
+ * Storage adapter interface
+ *
+ * Implement this interface to provide custom storage for notes and keys.
+ * The SDK will use this adapter for all persistence operations.
+ */
+interface StorageAdapter {
+    /**
+     * Save a note
+     */
+    saveNote(note: CloakNote): Promise<void> | void;
+    /**
+     * Load all notes
+     */
+    loadAllNotes(): Promise<CloakNote[]> | CloakNote[];
+    /**
+     * Update a note
+     */
+    updateNote(commitment: string, updates: Partial<CloakNote>): Promise<void> | void;
+    /**
+     * Delete a note
+     */
+    deleteNote(commitment: string): Promise<void> | void;
+    /**
+     * Clear all notes
+     */
+    clearAllNotes(): Promise<void> | void;
+    /**
+     * Save wallet keys
+     */
+    saveKeys(keys: CloakKeyPair): Promise<void> | void;
+    /**
+     * Load wallet keys
+     */
+    loadKeys(): Promise<CloakKeyPair | null> | CloakKeyPair | null;
+    /**
+     * Delete wallet keys
+     */
+    deleteKeys(): Promise<void> | void;
+}
+/**
+ * In-memory storage adapter (default, no persistence)
+ *
+ * Useful for testing or when storage is handled externally
+ */
+declare class MemoryStorageAdapter implements StorageAdapter {
+    private notes;
+    private keys;
+    saveNote(note: CloakNote): void;
+    loadAllNotes(): CloakNote[];
+    updateNote(commitment: string, updates: Partial<CloakNote>): void;
+    deleteNote(commitment: string): void;
+    clearAllNotes(): void;
+    saveKeys(keys: CloakKeyPair): void;
+    loadKeys(): CloakKeyPair | null;
+    deleteKeys(): void;
+}
+/**
+ * Browser localStorage adapter (optional, for browser environments)
+ *
+ * Only use this if you're in a browser environment and want localStorage persistence.
+ * Import from a separate browser-specific module.
  */
-declare function getRecipientAmount(amountLamports: number): number;
+declare class LocalStorageAdapter implements StorageAdapter {
+    private notesKey;
+    private keysKey;
+    constructor(notesKey?: string, keysKey?: string);
+    private getStorage;
+    saveNote(note: CloakNote): void;
+    loadAllNotes(): CloakNote[];
+    updateNote(commitment: string, updates: Partial<CloakNote>): void;
+    deleteNote(commitment: string): void;
+    clearAllNotes(): void;
+    saveKeys(keys: CloakKeyPair): void;
+    loadKeys(): CloakKeyPair | null;
+    deleteKeys(): void;
+}
 
 interface ViewingKeyPair {
     privateKey: Uint8Array;
@@ -1243,26 +933,13 @@ declare function computeMerkleRoot(leaf: bigint, pathElements: bigint[], pathInd
  * Convert hex string to bigint
  */
 declare function hexToBigint$1(hex: string): bigint;
-/**
- * Compute commitment = Poseidon(amount, r0, r1, pk_spend)
- * where pk_spend = Poseidon(sk0, sk1)
- * (matching withdraw_regular.circom)
- *
- * This is the test-style function that takes bigints directly
- *
- * @param amount - Amount as bigint
- * @param r - Randomness as bigint
- * @param sk_spend - Spending secret key as bigint
- * @returns Commitment hash as bigint
- */
-declare function computeCommitment$1(amount: bigint, r: bigint, sk_spend: bigint): Promise<bigint>;
 /**
  * Generate a Poseidon commitment for a note
  *
  * Formula: Poseidon(amount, r0, r1, pk_spend)
  * where pk_spend = Poseidon(sk0, sk1)
  *
- * This matches the withdraw_regular.circom circuit
+ * Legacy CloakNote commitment layout (see `computeCommitment`).
  *
  * @param amountLamports - Amount in lamports
  * @param r - Randomness bytes (32 bytes)
@@ -1270,110 +947,6 @@ declare function computeCommitment$1(amount: bigint, r: bigint, sk_spend: bigint
  * @returns Commitment hash as bigint
  */
 declare function generateCommitmentAsync(amountLamports: number, r: Uint8Array, skSpend: Uint8Array): Promise<bigint>;
-/**
- * Generate a Poseidon commitment for a note (sync wrapper)
- * Returns bytes instead of bigint for backward compatibility
- *
- * @deprecated Use generateCommitmentAsync instead
- */
-declare function generateCommitment(_amountLamports: number, _r: Uint8Array, _skSpend: Uint8Array): Uint8Array;
-/**
- * Compute nullifier = Poseidon(sk0, sk1, leaf_index)
- * (matching withdraw_regular.circom)
- *
- * This is the test-style function that takes bigint directly
- *
- * @param sk_spend - Spending secret key as bigint
- * @param leafIndex - Index in the Merkle tree as bigint
- * @returns Nullifier as bigint
- */
-declare function computeNullifier$1(sk_spend: bigint, leafIndex: bigint): Promise<bigint>;
-/**
- * Compute nullifier from spending key and leaf index
- *
- * Formula: Poseidon(sk0, sk1, leaf_index)
- *
- * This matches the circuit's nullifier computation
- *
- * @param skSpend - Spending secret key bytes (32 bytes) or hex string
- * @param leafIndex - Index in the Merkle tree
- * @returns Nullifier as bigint
- */
-declare function computeNullifierAsync(skSpend: Uint8Array | string, leafIndex: number): Promise<bigint>;
-/**
- * Compute nullifier (sync wrapper for backward compatibility)
- * @deprecated Use computeNullifierAsync instead
- */
-declare function computeNullifierSync(_skSpend: Uint8Array, _leafIndex: number): Uint8Array;
-/**
- * Compute outputs hash from recipients and amounts
- *
- * Formula: Chain of Poseidon(prev_hash, addr_lo, addr_hi, amount) for each active output
- *
- * This matches the withdraw_regular.circom circuit's outputs hash computation
- *
- * @param outputs - Array of {recipient: PublicKey, amount: number}
- * @returns Outputs hash as bigint
- */
-declare function computeOutputsHashAsync(outputs: Array<{
-    recipient: PublicKey;
-    amount: number;
-}>): Promise<bigint>;
-/**
- * Compute outputs hash for withdraw_regular circuit
- * outputs_hash = chain of Poseidon(prev_hash, addr_lo, addr_hi, amount) for each active output
- *
- * This is the test-style function that takes raw limbs
- *
- * @param outAddr - Array of [lo, hi] limb pairs for each address (5x2 array)
- * @param outAmount - Array of amounts as bigints (5 elements)
- * @param outFlags - Array of flags (1 = active, 0 = inactive) (5 elements)
- * @returns Outputs hash as bigint
- */
-declare function computeOutputsHash(outAddr: bigint[][], outAmount: bigint[], outFlags: number[]): Promise<bigint>;
-/**
- * Compute outputs hash (sync wrapper for backward compatibility)
- * @deprecated Use computeOutputsHashAsync instead
- */
-declare function computeOutputsHashSync(_outputs: Array<{
-    recipient: PublicKey;
-    amount: number;
-}>): Uint8Array;
-/**
- * Compute outputs hash for withdraw_swap circuit
- * outputs_hash = Poseidon(input_mint limbs, output_mint limbs, recipient_ata limbs, min_output_amount, public_amount)
- *
- * This is the test-style function that takes raw limbs
- *
- * @param inputMintLimbs - Input mint address as [lo, hi] limbs
- * @param outputMintLimbs - Output mint address as [lo, hi] limbs
- * @param recipientAtaLimbs - Recipient ATA as [lo, hi] limbs
- * @param minOutputAmount - Minimum output amount as bigint
- * @param publicAmount - Public amount as bigint
- * @returns Outputs hash as bigint
- */
-declare function computeSwapOutputsHash(inputMintLimbs: [bigint, bigint], outputMintLimbs: [bigint, bigint], recipientAtaLimbs: [bigint, bigint], minOutputAmount: bigint, publicAmount: bigint): Promise<bigint>;
-/**
- * Compute outputs hash for swap transactions
- *
- * Formula: Poseidon(input_mint_lo, input_mint_hi, output_mint_lo, output_mint_hi,
- *                   recipient_ata_lo, recipient_ata_hi, min_output_amount, public_amount)
- *
- * This matches the withdraw_swap.circom circuit
- *
- * @param inputMint - Input token mint address (SOL = SystemProgram)
- * @param outputMint - Output token mint address
- * @param recipientAta - Recipient's associated token account
- * @param minOutputAmount - Minimum output amount in token's smallest unit
- * @param amount - Note amount in lamports (public_amount)
- * @returns Outputs hash as bigint
- */
-declare function computeSwapOutputsHashAsync(inputMint: PublicKey, outputMint: PublicKey, recipientAta: PublicKey, minOutputAmount: number, amount: number): Promise<bigint>;
-/**
- * Compute swap outputs hash (sync wrapper for backward compatibility)
- * @deprecated Use computeSwapOutputsHashAsync instead
- */
-declare function computeSwapOutputsHashSync(_outputMint: PublicKey, _recipientAta: PublicKey, _minOutputAmount: number, _amount: number): Uint8Array;
 /**
  * Convert bigint to 32-byte big-endian Uint8Array
  */
@@ -1446,11 +1019,6 @@ interface Groth16Proof {
  * Format: pi_a (64) + pi_b (128) + pi_c (64) = 256 bytes
  */
 declare function proofToBytes(proof: Groth16Proof): Uint8Array;
-/**
- * Build public inputs bytes for on-chain verification
- * Format: root (32) + nullifier (32) + outputs_hash (32) + public_amount (8) = 104 bytes
- */
-declare function buildPublicInputsBytes(root: bigint, nullifier: bigint, outputsHash: bigint, publicAmount: bigint): Uint8Array;
 
 /**
  * Validate a Solana public key
@@ -1692,7 +1260,7 @@ declare class RelayInternalError extends Error {
 /**
  * Raised when a submission's outcome could NOT be established as "landed" from chain state.
  *
- * This is the failure side of settlement verification (see `core/settlement.ts`). It exists
+ * This is the failure side of settlement verification (see `flows/settlement.ts`). It exists
  * because the campaign's worst outcome was not a failed transaction — it was an AMBIGUOUS one
  * whose error text carried no signature (REL-A-10: seven POSTs, the transaction landed, the SDK
  * threw `RelayInternalError`, and the user had nothing to look up). Losing the signature is what
@@ -2124,7 +1692,7 @@ interface VerifyUtxosResult {
 declare function verifyUtxos(utxos: Utxo[], connection: Connection, programId: PublicKey, commitment?: "processed" | "confirmed" | "finalized"): Promise<VerifyUtxosResult>;
 /**
  * Pre-flight gate: throw `UtxoAlreadySpentError` if any input is already
- * spent on-chain. Called at the top of spend entry points in core/transact.
+ * spent on-chain. Called at the top of spend entry points in flows/transact.
  *
  * Browser-safe: uses one batched RPC call.
  */
@@ -2272,7 +1840,7 @@ declare function assertDirectSubmissionLanded(params: {
  * 2026-01-23T00:51:46.489317Z  INFO cloak::module: 📥 Message key=value
  *
  * Enable via:
- * - SDK config: new CloakSDK({ debug: true })
+ * - Code: setDebugMode(true)
  * - Environment: CLOAK_DEBUG=1 or DEBUG=cloak:*
  */
 type LogLevel = "DEBUG" | "INFO" | "WARN" | "ERROR";
@@ -2724,20 +2292,8 @@ declare function getNullifierPDA(poolPubkey: PublicKey, nullifier: Uint8Array |
  */
 declare function getSwapStatePDA(poolPubkey: PublicKey, nullifier: Uint8Array | Buffer, programId?: PublicKey): [PublicKey, number];
 /**
- * H-04: derive the per-pool RefundLedger PDA (conservation counter).
- *
- * Seeds: ["refund_ledger", pool_mint]
- */
-declare function getRefundLedgerPDA(mint?: PublicKey, programId?: PublicKey): [PublicKey, number];
-/**
- * H-04: derive the one-time RefundClaim PDA (replay guard for a voucher).
- *
- * Seeds: ["refund_claim", claim_id]
- */
-declare function getRefundClaimPDA(claimId: Uint8Array | Buffer, programId?: PublicKey): [PublicKey, number];
-/**
- * M-07/H-04: derive the per-pool PoolAuthorityConfig PDA (holds the
- * withdraw-authorizer the refund voucher must be signed by).
+ * M-07: derive the per-pool PoolAuthorityConfig PDA (holds the mint-scoped
+ * withdraw-authorizer).
  *
  * Seeds: ["pool_authority", pool_mint]
  */
@@ -2759,76 +2315,6 @@ declare function getDeliveryRegistryPDA(programId?: PublicKey): PublicKey;
  */
 declare function getChainNoteRegistryPDA(programId?: PublicKey): PublicKey;
 
-/**
- * H-04 — claim-based timeout refund (SDK).
- *
- * When a private swap times out, `CloseSwapState` returns the parked principal
- * to the pool and credits the on-chain `RefundLedger`. The user later reclaims
- * that principal as a FRESH shielded note via `ClaimRefund`, gated by a
- * withdraw-authorizer voucher (signed by the relay) and a deposit-shape Groth16
- * proof — with no on-chain link back to the original swap.
- *
- * This module:
- *   1. asks the relay to sign the 81-byte refund voucher for `claim_id`,
- *   2. generates a deposit-shape proof (publicAmount = +refund_amount, zero
- *      inputs, one fresh output note `C_r`) bound to the live merkle root,
- *   3. builds and submits the `[ed25519 voucher][CU][ClaimRefund]` transaction,
- *   4. returns the fresh refund UTXO for the caller to store/spend later.
- *
- * The proof construction is byte-for-byte the same as the standalone
- * `audit-tests/h-04/gen-claim-proof.cjs` generator that the program-side soak
- * verified, so the proof verifies against the deployed transaction vkey.
- */
-
-/** A relay-signed refund voucher, as returned by `POST /refund-voucher`. */
-interface RefundVoucher {
-    /** base64 Ed25519 signature over the 81-byte message. */
-    signature: string;
-    /** hex 81-byte voucher message. */
-    message: string;
-    /** base58 signer (pool withdraw-authorizer). */
-    signer_pubkey: string;
-    /** expiry slot bound into the voucher. */
-    expiry_slot?: number;
-}
-interface ClaimTimeoutRefundParams {
-    /** Refund principal in lamports (must equal the closed swap's parked amount). */
-    refundAmount: bigint;
-    /** Pool mint; ClaimRefund is SOL-pool only (defaults to WSOL sentinel). */
-    poolMint?: PublicKey;
-    /** 32-byte claim id = H(user secret). Random if omitted. */
-    claimId?: Uint8Array;
-    /** Supply a pre-fetched voucher to skip the relay round-trip. */
-    voucher?: RefundVoucher;
-}
-interface ClaimTimeoutRefundOptions {
-    connection: Connection;
-    programId: PublicKey;
-    /** Relay base URL (used to fetch the voucher when not supplied). */
-    relayUrl?: string;
-    /** Pays fees + signs the claim tx (relay-submitted is a documented follow-up). */
-    payerKeypair: Keypair;
-    onProgress?: (message: string) => void;
-}
-interface ClaimTimeoutRefundResult {
-    /** Submitted ClaimRefund transaction signature. */
-    signature: string;
-    /** The fresh refund note created by the claim — store this to spend later. */
-    refundUtxo: Utxo;
-    /** The claim id consumed (hex). */
-    claimId: string;
-    /** The merkle leaf index where the refund note `C_r` landed. */
-    leafIndex: number;
-}
-/**
- * Reclaim a timed-out swap's principal as a fresh shielded note via ClaimRefund.
- *
- * Front-running note: this self-submits the claim. The production default is
- * relay submission (decision #3) to avoid mempool exposure of the voucher; a
- * relay `/claim-refund` endpoint is the documented follow-up.
- */
-declare function claimTimeoutRefund(params: ClaimTimeoutRefundParams, options: ClaimTimeoutRefundOptions): Promise<ClaimTimeoutRefundResult>;
-
 /**
  * On-chain Merkle proof computation
  *
@@ -2889,6 +2375,86 @@ declare function computeProofForLatestDeposit(connection: Connection, merkleTree
     leafIndex: number;
 }>;
 
+/**
+ * The Cloak endpoints THIS BUILD of the SDK is allowed to talk to.
+ *
+ * ── Why this is a checked-in constant and not configuration ───────────────────────────────────
+ * `dist/` is what `package.json` main/module/types resolve to, so `dist/` is what every consumer
+ * executes. Anything a consumer can set at THEIR build or run time — `NODE_ENV`, an environment
+ * variable, a bundler define, a call option — is not a pin, because we do not own the moment it is
+ * resolved. `process.env.NODE_ENV === "production"` in particular is defeated by one line in a
+ * consumer's bundler config or one `NODE_ENV=development` in front of `node`, so it is deliberately
+ * not used anywhere in this package.
+ *
+ * The only value a published artifact carries that a consumer cannot supply is one that was decided
+ * when WE built it. That is this file. It is compiled into the bundle, it is greppable in the
+ * bundle, and changing it requires editing source and rebuilding.
+ *
+ * ── How to point the SDK somewhere else ───────────────────────────────────────────────────────
+ * REPLACE the entry in {@link RELAY_ORIGIN_ALLOWLIST} with your local origin. Do not append:
+ * appending leaves production reachable from a local build, which is exactly the pairing that made
+ * a rehearsal POST real proof data to production (see SQ-F1 in
+ * `src/__tests__/relay-url-no-production-default.test.ts`). Replacing makes production *unreachable*
+ * from a local build, at every egress point, rather than merely "not the default".
+ *
+ *     export const RELAY_ORIGIN_ALLOWLIST: readonly string[] = ["http://127.0.0.1:5500"];
+ *
+ * Inside this repo nothing else has to happen: jest (`roots: src`), `tsx examples/...` and
+ * `scripts/` all resolve `@cloak.dev/sdk` to `src/index.ts` through the tsconfig path mapping, so
+ * they pick the edit up with no build step. Only a consumer that imports `dist/` — the soak harness,
+ * or a web/mobile checkout linked with `file:` / `npm link` — needs `npm run build` afterwards.
+ *
+ * `src/__tests__/relay-origin-lock.test.ts` goes red while the allowlist is local. That is the
+ * mechanism working: a local allowlist cannot be committed or published without one deliberate red
+ * test and a one-line `git diff` saying so. Run `git checkout src/config/relay.ts` before pushing.
+ *
+ * ── Scope, stated honestly ────────────────────────────────────────────────────────────────────
+ * This is an integrity and product-control mechanism, not a security boundary. Anyone who can run
+ * code in the consumer's process can `sed` this literal in `node_modules`, `patch-package` it, alias
+ * the module, monkey-patch `globalThis.fetch`, or skip the SDK entirely. What it buys is that the
+ * correct endpoint is the only one reachable BY ACCIDENT, and that any deviation is a deliberate,
+ * visible, auditable edit.
+ */
+/**
+ * Identity of Cloak's production endpoint. This is a NAME, never a default: no code path in this
+ * SDK falls back to it, and `resolveRelayUrl` still returns `undefined` when the caller passes
+ * nothing (SQ-F1). It exists so a caller who genuinely wants production can say so by importing a
+ * value instead of re-typing a host.
+ */
+declare const CLOAK_PRODUCTION_RELAY_URL = "https://api.cloak.ag";
+/**
+ * The origins this build may send a request to. Enforced at every network egress in the package by
+ * `assertAllowedRelayOrigin` / `relayFetch` in `src/relay/endpoint.ts`, so it covers the entry
+ * points that take a URL directly (`submitTransactToRelay`, `RelayService`, `fetchCommitments`,
+ * `registerViewingKey`, `readMerkleTreeState`, …) and not only the `relayUrl` transact option.
+ *
+ * Typed `readonly string[]` and not `as const` on purpose: a developer replaces the entry, and a
+ * literal tuple type would make that edit a `tsc` error in unrelated files.
+ */
+declare const RELAY_ORIGIN_ALLOWLIST: readonly string[];
+/**
+ * ONE switch, DERIVED — not a second flag to keep in sync.
+ *
+ * True exactly when {@link RELAY_ORIGIN_ALLOWLIST} names a loopback origin, i.e. when this artifact
+ * was built for a local stack. It is what "this build is a production artifact" means for the
+ * localhost-RPC guard, and because it is derived there is no state where the endpoint is local but
+ * the RPC guard is still armed. The single edit above flips both.
+ *
+ * ── Why the build, and not the program id, the RPC URL, or the relay URL ──────────────────────
+ * - **Program id**: identical on mainnet and on the whole local estate by design — a Surfpool fork
+ *   mirrors mainnet, so it carries the same program id (see `src/program/ids.ts`). Zero
+ *   discriminating power.
+ * - **`detectNetworkFromRpcUrl`**: answers "localnet" for any localhost URL and defaults unknown
+ *   strings to "mainnet" (`src/shared/network.ts`). For Surfpool — a localhost URL mirroring
+ *   mainnet — that is exactly inverted, which is why `src/relay/risk-quote.ts` calls it and
+ *   immediately undoes the answer. It also reads its own environment variable.
+ * - **"the relay URL is the production one"**: the same fact as this flag, reached by string
+ *   comparison, and undefined on the `relayUrl: ""` self-submit path.
+ * - **This flag**: fixed at the same instant the endpoint is fixed, unchangeable by a consumer
+ *   without forking, and needs no run-time classification of an attacker-supplied string.
+ */
+declare const BUILD_ALLOWS_LOCAL_ENDPOINTS: boolean;
+
 /**
  * Relay client utilities for fetching data from the relay service
  */
@@ -3008,11 +2574,11 @@ declare function preflightCheck(relayUrl: string, rootHex: string): Promise<{
  * The merkle-from-chain rebuild was guarded by TWO independently written predicates that disagreed
  * about React Native:
  *
- *   - the GATE in `core/transact.ts` — `!IS_BROWSER && isMerkleClass && relayUrl`, where
+ *   - the GATE in `flows/transact.ts` — `!IS_BROWSER && isMerkleClass && relayUrl`, where
  *     `IS_BROWSER` was `typeof window !== "undefined" || typeof globalThis.document !== "undefined"`,
  *     with NO React-Native carve-out. React Native defines `window`, so RN read as a browser and the
  *     last-resort chain replay was silently skipped there.
- *   - the BUILDER it guards — `utils/relay-client.ts::buildMerkleTreeFromChain`, whose own
+ *   - the BUILDER it guards — `relay/client.ts::buildMerkleTreeFromChain`, whose own
  *     `isBrowser()` short-circuits on `navigator.product === "ReactNative"` and therefore explicitly
  *     PERMITS React Native to rebuild from chain.
  *
@@ -3050,7 +2616,7 @@ declare function preflightCheck(relayUrl: string, rootHex: string): Promise<{
  */
 /**
  * True on React Native. `navigator.product === "ReactNative"` is the canonical flag and is what
- * `utils/proof-generation.ts` has always used.
+ * `proving/artifacts.ts` has always used.
  */
 declare function isReactNative(): boolean;
 /**
@@ -3068,42 +2634,137 @@ declare function isBrowser(): boolean;
 declare function isBrowserLike(): boolean;
 
 /**
- * Circuit artifact releases — the single source of truth for
- * "which bundle version" and "which bytes are that bundle".
- *
- * Why this file exists
- * -------------------
- * The version segment of the artifact base URL and the pinned SHA-256 digests
- * used to be written out by hand in two unrelated places
- * (`utils/proof-generation.ts` held `.../circuits/0.1.0` plus a digest table,
- * `core/transact.ts` held its own copy of the same URL literal). They drifted:
- * the default base pointed at the `0.1.0` bundle while the pinned `transaction`
- * digests were the `0.2.0` trusted-setup ceremony output, so every default-config
- * proof died on a digest mismatch several megabytes into proof generation.
- *
- * Here a bundle is declared once, as a version plus the digests of the artifacts
- * that version contains, and the base URL is *derived* from that version by
- * {@link defineCircuitBundle}. There is no way to write a URL whose version
- * segment disagrees with the digests next to it:
- *
- *  - **compile time** — `baseUrl` is typed `` `${string}/circuits/${V}` ``, where
- *    `V` is the bundle's own `version` literal, and {@link BUNDLE_BY_CIRCUIT} is
- *    an exhaustive `Record<CircuitName, …>`, so a new circuit with no bundle, or
- *    an assertion about a version the bundle does not carry, fails `tsc`.
- *  - **startup** — {@link assertCircuitReleaseConsistency} runs at module load
- *    and throws if a bundle's digests are malformed, if a bundle does not pin the
- *    circuit that maps to it, or if a hand-edited base URL stops ending in its own
- *    version. That is an import-time failure, not a failure deep inside
- *    `groth16.fullProve`.
- *
- * Publication is deliberately *not* assumed. A bundle whose bytes this SDK has
- * not verified at a public location carries `baseUrl: null`; callers must point
- * the SDK at a location themselves (`setCircuitsPath`). Nothing here silently
- * defaults to a URL that has not been checked against the digests below.
- */
-/** Circuits whose artifacts carry a pinned SHA-256 digest in this SDK. */
-type CircuitName = 'withdraw_regular' | 'withdraw_swap' | 'transaction';
-/** Version of the trusted-setup ceremony bundle that froze the `transaction` circuit. */
+ * How long the relay accepts a signed request after its `auth_issued_at`
+ * (`REQUEST_AUTH_MAX_AGE_SECONDS`, `api/request_auth.rs`).
+ *
+ * A FIRST-USE request past this window is rejected outright. The expiry exception the relay grants
+ * applies only to an exact replay of a request whose durable row already exists, which by
+ * definition never happens for a request that has not been accepted once.
+ */
+declare const REQUEST_AUTH_MAX_AGE_SECONDS = 300;
+/**
+ * How far ahead of the relay's clock a request may be stamped
+ * (`REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS`, `api/request_auth.rs`).
+ *
+ * `auth_issued_at` comes from `Date.now()`. On a server that is NTP-disciplined; in a browser it
+ * is the user's own machine clock, and a laptop more than 30 seconds fast cannot authenticate at
+ * all until its clock is corrected.
+ */
+declare const REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
+/**
+ * The exact fields each endpoint signs. Both lists mirror the relay's `*_auth_request` builders and
+ * must stay in lockstep with them: adding a field on one side alone silently invalidates every
+ * signature, and the failure surfaces as a bare 401 with nothing pointing here.
+ */
+declare const TRANSACT_AUTH_FIELDS: readonly ["encrypted_notes", "max_fee", "mint", "proof_bytes", "public_inputs", "recipient", "recipient_delivery_notes", "risk_quote", "sender"];
+declare const TRANSACT_SWAP_AUTH_FIELDS: readonly ["close_timed_out", "dexes", "encrypted_notes", "exclude_dexes", "max_fee", "min_output_amount", "output_mint", "proof_bytes", "public_inputs", "recipient", "recipient_ata", "refund_blinding", "refund_pubkey", "retry_request_id", "risk_quote", "route_retry_attempts", "sender", "slippage_bps", "swap_max_retries"];
+/**
+ * Serialize exactly like the relay's `canonical_json`: keys sorted bytewise, no whitespace.
+ *
+ * SCOPE. This is the SDK's half of a byte-for-byte agreement with one specific Rust function over
+ * one specific schema: the values reachable through {@link TRANSACT_AUTH_FIELDS} and
+ * {@link TRANSACT_SWAP_AUTH_FIELDS}, which are ASCII keys over strings, small unsigned integers,
+ * booleans, nulls, arrays and plain objects. Inside that schema the two implementations agree.
+ *
+ * Outside it they need not, so anything that could serialize differently on the two sides is
+ * REFUSED here rather than signed into a digest that silently fails to match:
+ *
+ *  - Non-integer, non-finite and beyond-safe-integer numbers. `serde_json` renders an f64 as Rust
+ *    does (`1e21`) where JavaScript renders `1e+21`, and `0.1 + 0.2` has no single spelling. Every
+ *    number in both field lists is a small unsigned integer (`slippage_bps`, `route_retry_attempts`,
+ *    `swap_max_retries`); u64 amounts already travel as decimal STRINGS for exactly this reason.
+ *  - Functions and symbols as object VALUES. `JSON.stringify` drops such a key from the wire body
+ *    while it stays in the signed view, so the two digests can never agree.
+ *
+ * `undefined` is NOT refused: it serializes as `null` here, `JSON.stringify` omits the key on the
+ * wire, and every optional field on the relay side is `Option<T>` with `#[serde(default)]`, so the
+ * relay sees `null` too. That is the same agreement {@link buildAuthRequest} relies on. The one
+ * field where it does not hold is `slippage_bps`, which is why that field is checked by name.
+ *
+ * `bigint` is accepted and rendered as a bare decimal integer, matching serde's u64/i64 output.
+ * Note that such a value cannot also go on the wire: `JSON.stringify` throws on a bigint. Use a
+ * decimal string in the body, as every SDK-built body does.
+ */
+declare function canonicalJson(value: unknown): string;
+/**
+ * Everything an authenticated request needs EXCEPT the signature: the three fields that go on the
+ * wire alongside it, plus the exact bytes to sign.
+ *
+ * This exists because the holder of the pen is not always a `Keypair`. A browser wallet adapter
+ * exposes `signMessage(bytes): Promise<Uint8Array>` and no secret key at all, so the scheme has to
+ * be reachable in two halves: build the preimage here, sign it wherever the key actually lives,
+ * then put `sender` / `auth_issued_at` / `auth_nonce` and the base64 signature on the body.
+ *
+ * `message` is a plain ed25519 detached-signature preimage — nothing about the scheme changes
+ * between a local keypair and a wallet, only who signs it.
+ */
+interface RelayAuthPreimage {
+    sender: string;
+    auth_issued_at: string;
+    auth_nonce: string;
+    message: Uint8Array;
+}
+/**
+ * Build the signed view and its preimage for one request, WITHOUT signing.
+ *
+ * `sender` is bound into the signed view and returned for the body — the relay rejects a request
+ * whose authenticated sender is not also present inside the signed payload. It must be the end
+ * user's own wallet: `sender` is the key screened for sanctions on a shield-to-shield send, so
+ * substituting an ephemeral or service key here moves the screening off the actual user.
+ *
+ * `nonce` and `issued_at` are generated here, once per call. Callers that re-POST a request must
+ * reuse the same preimage rather than rebuilding it, or the relay sees a brand-new request.
+ */
+declare function buildRelayAuthPreimage(endpoint: string, programId: PublicKey, body: Record<string, unknown>, sender: PublicKey, nowSeconds?: number, fields?: readonly string[]): RelayAuthPreimage;
+/**
+ * An async message signer standing in for a `Keypair`.
+ *
+ * A browser wallet adapter has no secret key to hand over — it exposes `signMessage`, and what
+ * this scheme needs signed is a plain ed25519 detached signature, which is exactly what that
+ * produces. Only the holder of the pen changes.
+ *
+ * COMPLIANCE — `walletPublicKey` becomes the request's authenticated `sender`, and `sender` is the
+ * key screened for sanctions on a shield-to-shield send. It MUST be the end user's own wallet.
+ * Putting an ephemeral, service-held or otherwise substituted key here moves the screening onto a
+ * key that is not the user: a compliance regression, not a shortcut.
+ */
+interface RelayAuthSigner {
+    /** The end user's real wallet. Becomes the authenticated `sender`. Never an ephemeral key. */
+    walletPublicKey: PublicKey;
+    /** Wallet-adapter `signMessage`; must return the 64-byte ed25519 detached signature. */
+    signMessage: (message: Uint8Array) => Promise<Uint8Array>;
+}
+/**
+ * Turn a relay rejection into something the person in front of the screen can act on.
+ *
+ * Every string matched here is an `Error::Unauthorized` from `api/request_auth.rs`, and all of them
+ * arrive as the same bare 401. Two of them are not the caller's mistake at all: an approval that
+ * sat too long, and a machine clock that is simply wrong. Returns `null` for anything that is not
+ * an authentication rejection, so callers can append it only when there is something to add.
+ */
+declare function explainRelayAuthRejection(responseText: string): string | null;
+
+/**
+ * The circuit artifacts this SDK build proves against.
+ *
+ * One program, one circuit, one bundle: the deployed shield-pool embeds the
+ * ceremony verifying key, so any other artifact set produces proofs the program
+ * rejects (0x1010). There is deliberately no table, no bundle registry and no
+ * version negotiation here -- an SDK build either matches the deployed program
+ * or it is the wrong build.
+ *
+ * The digests are the security control: `loadVerifiedCircuitArtifacts` hashes
+ * whatever it fetched and refuses to prove on a mismatch, so a compromised or
+ * stale CDN cannot feed this build artifacts from another ceremony.
+ *
+ * Published and verified 2026-08-12; re-verify after any publish with
+ * `packages/scripts/publish-circuits.sh --verify-only`. Two things that publish
+ * established, both worth keeping in mind here:
+ *   - the prefix once held a half-finished upload (zkey and wasm, no witness
+ *     helpers), which is exactly what these digests defend against;
+ *   - the edge served the previous wasm for ~50 minutes after a correct upload,
+ *     so uploading the right bytes is not the same as serving them.
+ */
 declare const TRANSACTION_CIRCUITS_VERSION = "0.2.0";
 
 /**
@@ -3123,7 +2784,7 @@ declare const TRANSACTION_CIRCUITS_VERSION = "0.2.0";
  * RN defines `window`, so the old inline `typeof window !== "undefined" || typeof document !==
  * "undefined"` classified RN as a browser and skipped the rebuild, removing RN's only recovery path
  * from a drifted relay tree while the builder was perfectly willing to serve it. Both now come from
- * `utils/environment`, so they cannot disagree about React Native again.
+ * `shared/environment`, so they cannot disagree about React Native again.
  *
  * The SSR conservatism is kept: `isBrowserLike()` is true when EITHER `window` or `document` exists,
  * because an SSR host that polyfills only `document` must not be mistaken for Node and made to run a
@@ -3137,7 +2798,7 @@ declare function canRebuildMerkleTreeFromChain(): boolean;
 /**
  * Base the ceremony-frozen `transaction` artifacts are fetched from by default.
  *
- * Derived from {@link TRANSACTION_CIRCUIT_BUNDLE} — the same record that pins the
+ * Derived from {@link TRANSACTION_CIRCUITS_BASE_URL} — the same record that pins the
  * digests — so the version in the URL and the digests checked against it cannot
  * drift apart. It is `null` while this SDK build pins no location whose bytes
  * were verified to hash to those digests; that makes an unconfigured SDK a
@@ -3151,9 +2812,26 @@ declare const DEFAULT_TRANSACTION_CIRCUITS_URL: string | null;
  * Set circuits base path: local directory containing `transaction_js/` and `transaction_final.zkey`,
  * or an `http(s)` base URL to those artifacts (loaded into memory once per process).
  *
+ * ── Kept, not removed, and now checked ────────────────────────────────────────────────────────
+ * It stays public API for one reason the pin cannot serve: an offline, air-gapped or React-Native
+ * caller must be able to name a LOCAL directory holding the ceremony artifacts, and every example
+ * in this repo calls it. What changed is that the string is no longer honoured verbatim. It goes
+ * through {@link assertAllowedCircuitsBase}, the same shape of check `relayUrl` gets: a local
+ * directory is accepted (it puts nothing on the wire, and the unconditional digest check governs
+ * its bytes), an `http(s)` base must be at or under this build's pinned bundle base, and a loopback
+ * base is accepted only in a build whose relay allowlist is already local.
+ *
+ * Asserted HERE for a good early error, and again at the read itself in `proving/artifacts.ts` —
+ * because this setter is not the only door: `loadVerifiedCircuitArtifacts`, `verifyCircuitIntegrity`,
+ * `assertTransactionCircuitIntegrity` and `verifyAllCircuits` are all exported and all take a base
+ * directly. A setter-only check would have been theatre, exactly as it would have been for the
+ * relay URL.
+ *
  * No cache invalidation is needed here: verified artifact buffers are memoised
- * per base inside `proof-generation.ts`, so a new base loads and re-verifies its
+ * per base inside `proving/artifacts.ts`, so a new base loads and re-verifies its
  * own bytes.
+ *
+ * @throws when `next` names a location this build may not read circuit artifacts from.
  */
 declare function setCircuitsPath(next: string): void;
 /**
@@ -3162,13 +2840,22 @@ declare function setCircuitsPath(next: string): void;
  */
 declare function getCircuitsPath(): string | null;
 /**
- * Resolve a base to prove from: an explicit argument, else `CLOAK_CIRCUITS_PATH`
- * / `CLOAK_CIRCUITS` from the environment, else this build's pinned default.
+ * Resolve a base to prove from: an explicit argument, else this build's pinned default.
+ *
+ * ── The environment reads are gone ────────────────────────────────────────────────────────────
+ * This used to fall back to `CLOAK_CIRCUITS_PATH` / `CLOAK_CIRCUITS`. Both resolve in the
+ * CONSUMER's process, which is the same reason `NODE_ENV` is not used anywhere in this package:
+ * `CLOAK_CIRCUITS_PATH=http://evil.example/circuits node app.js`, or one
+ * `--define:process.env.CLOAK_CIRCUITS_PATH='"http://evil.example/circuits"'` in a consumer's
+ * bundler, silently moved where the witness generator came from — and the witness generator is
+ * handed the spend key. An integrator who genuinely needs a different location passes it
+ * explicitly and it is checked against the pin like any other.
  *
  * Use this instead of writing an artifact URL out by hand — a hand-written URL
  * is exactly how the base's version segment came to disagree with the digests
  * this SDK checks against. Throws an explanatory error (naming the expected
- * bundle version and both expected digests) when nothing resolves.
+ * bundle version and both expected digests) when nothing resolves, and refuses a
+ * base this build may not read from.
  */
 declare function resolveCircuitsBase(explicit?: string): string;
 /**
@@ -3182,6 +2869,68 @@ declare function resolveCircuitsBase(explicit?: string): string;
  */
 declare function computeChainNoteHash(publicAmount: bigint, extDataHash: bigint, noteTimestamp: bigint, noteCommitment: bigint, noteSalt: bigint, outAmount0: bigint, outPubkey0: bigint, noteIsSendToSelfKey0: bigint): Promise<bigint>;
 declare function computeExtDataHash(recipient: PublicKey | null, relayerFee: bigint, relayer: PublicKey | null, maxFee?: bigint): Promise<bigint>;
+/**
+ * Adapter for a third-party fee-payer relayer (e.g. Kora, https://github.com/solana-foundation/kora)
+ * that lets the depositor pay network fees — and, via `buildTopUpInstructions`, the on-chain rent
+ * this deposit itself needs — in an SPL token instead of native SOL. Only consulted on the deposit
+ * path (externalAmount > 0); ignored for transfers/withdrawals/swaps, which already go through the
+ * relay's own SOL-funded fee payer. Optional — omitting this leaves every existing caller (including
+ * the web app) byte-for-byte unchanged: the depositor remains the fee payer and must hold SOL.
+ */
+interface ExternalFeePayerAdapter {
+    /** Returns the external fee payer's pubkey (Kora's `getPayerSigner`). */
+    getPayerPubkey: () => Promise<PublicKey>;
+    /**
+     * Instructions to insert right after the risk-quote instruction (if any) and before every
+     * instruction that spends the depositor's own SOL balance — typically a single
+     * `SystemProgram.transfer(payerPubkey → depositor, neededLamports)`, so the depositor never
+     * needs to hold SOL up front. Return an empty array when no top-up is needed (the depositor
+     * already has enough SOL for on-chain rent).
+     *
+     * A plain transfer works because the external payer's own fee-pricing engine (e.g. Kora's
+     * `calculate_fee_payer_outflow`) already accounts for ANY lamport outflow from its own account
+     * across the whole transaction — not just the base network fee — when it prices
+     * `getPaymentInstruction`. No swap instruction or DEX integration is needed on the client: the
+     * payer's server-side pricing (margin/fixed, its own config) charges for this transfer
+     * automatically. The payer is expected to replenish its own SOL out-of-band (e.g. periodically
+     * converting collected SPL fees back to SOL) — that is entirely the payer's operational concern,
+     * invisible to this adapter and to the depositor.
+     *
+     * Must NOT be inserted before the risk-quote instruction: the on-chain program verifies the risk
+     * quote's Ed25519 signature via instruction introspection at a fixed transaction-level index (0),
+     * so the risk-quote instruction must remain first no matter what else this adapter adds.
+     *
+     * Must NOT include ComputeBudgetProgram instructions of its own — the transaction already
+     * carries one of each, sized for the whole thing including this top-up; a second pair is
+     * rejected by the runtime as duplicate instructions.
+     */
+    buildTopUpInstructions: (payerPubkey: PublicKey) => Promise<TransactionInstruction[]>;
+    /**
+     * Given a base64-encoded, unsigned V0 transaction (feePayer = the external payer's pubkey, every
+     * instruction the deposit needs including any top-up, fresh blockhash), returns the fee-payment
+     * instruction to append before final signing (Kora's `getPaymentInstruction`).
+     */
+    getPaymentInstruction: (unsignedTxBase64: string) => Promise<TransactionInstruction>;
+    /**
+     * Given a base64-encoded transaction the depositor has already partially signed (their own signer
+     * slot filled; the external payer's slot still empty — same instructions plus the payment
+     * instruction, fresh blockhash), returns the fully co-signed transaction, base64-encoded (Kora's
+     * `signTransaction`).
+     */
+    cosign: (partiallySignedTxBase64: string) => Promise<string>;
+    /**
+     * Optional: accounts the payment instruction will reference, resolvable BEFORE that instruction
+     * exists (for Kora: the fee payer's and depositor's fee-token ATAs).
+     *
+     * Purely a size optimization, never correctness — the real accounts always come from
+     * `getPaymentInstruction`. Without it, the supplemental ALT built for the quote transaction can't
+     * know about the payment instruction's accounts, so a deposit that lands just over the packet
+     * limit once that instruction is appended needs a SECOND supplemental ALT (an extra on-chain
+     * transaction and extra rent, paid by the external payer). Measured on the first real deposit:
+     * 1236 bytes vs the 1232 limit — over by 4. With the hint, one ALT covers the final transaction.
+     */
+    getPaymentAccountHints?: () => Promise<PublicKey[]>;
+}
 /**
  * Options for transact operation
  */
@@ -3199,8 +2948,19 @@ interface TransactOptions {
     /** Relayer address for fee payment */
     relayer?: PublicKey;
     /**
-     * Relay URL. Never defaulted: resolved from this option, then from `CLOAK_RELAY_URL`.
-     * Name production explicitly (`https://api.cloak.ag`).
+     * Cloak endpoint to submit through.
+     *
+     * This option no longer SELECTS the endpoint — the endpoint is pinned when the SDK is built
+     * (`RELAY_ORIGIN_ALLOWLIST` in `src/config/relay.ts`). Only two values are accepted:
+     *
+     *  - an origin on this build's allowlist — say `CLOAK_PRODUCTION_RELAY_URL` rather than typing a
+     *    host; anything else throws, naming the value and the allowlist;
+     *  - `""`, which means NO endpoint: the caller signs and submits the deposit itself. Unchanged,
+     *    still supported, and checked before any validation.
+     *
+     * Never defaulted. Omitting it still yields `undefined` (SQ-F1), not production. To point at a
+     * local stack, edit `src/config/relay.ts` and rebuild — not an option, not an environment
+     * variable, because a published build must not be repointable at either.
      */
     relayUrl?: string;
     /** Keypair of the depositor (signs the deposit transaction) - for programmatic use */
@@ -3219,6 +2979,16 @@ interface TransactOptions {
     walletPublicKey?: PublicKey;
     /** Maximum retries on RootNotFound error (default: 5) */
     maxRootRetries?: number;
+    /**
+     * How many times a wallet adapter may be asked to approve ONE swap (default: 5).
+     *
+     * Only applies to the wallet-adapter path, and only to `swapUtxo` / `swapWithChange`: a swap
+     * re-proves on every retry, so every retry needs a fresh approval, and `maxRootRetries` alone
+     * would allow 41 dialogs for a single swap. A `depositorKeypair` signs without prompting and is
+     * bounded by `maxRootRetries` as before. A private send or withdrawal signs exactly once,
+     * whatever happens on the network.
+     */
+    maxWalletApprovals?: number;
     /** Delay between retries in ms (default: 3000) */
     retryDelayMs?: number;
     /**
@@ -3231,6 +3001,12 @@ interface TransactOptions {
      * Used for deposits when riskOracleQueue is set. The backend must return a signed
      * quote instruction for the depositor wallet so the program can verify at index 0.
      * Defaults to `${relayUrl}/range-quote` when relayUrl is set.
+     *
+     * Held to the SAME build-pinned allowlist as `relayUrl`: it is fetched directly and it is
+     * converted back into a base URL by `deriveRelayUrlFromRiskQuoteUrl`, so leaving it unchecked
+     * would leave a second door onto the first. It must therefore be an ABSOLUTE URL on this build's
+     * allowlist; a relative path (e.g. `/api/risk-quote`) is no longer resolved against the page
+     * origin. `""` disables the SDK-side prefetch, unchanged.
      */
     riskQuoteUrl?: string;
     /**
@@ -3251,6 +3027,15 @@ interface TransactOptions {
      * to compress account addresses from 32 bytes to 1-byte indices.
      */
     addressLookupTableAccounts?: AddressLookupTableAccount[];
+    /**
+     * Opt-in: when true and `relayUrl` is set, an SPL deposit that needs a supplemental lookup
+     * table asks the relay to extend its shared table (`${relayUrl}/supplemental-alt`) instead of
+     * creating a depositor-signed throwaway table, so the user signs exactly once. Any relay
+     * failure — a bad response, a missing address, or the client-side slot gate never clearing —
+     * falls back to the old depositor-signed ephemeral-ALT path automatically. Off (the default)
+     * preserves the old behaviour exactly.
+     */
+    relaySupplementalAlt?: boolean;
     /**
      * Optional Range.org API key for direct SDK-side quote fetching.
      *
@@ -3352,7 +3137,7 @@ interface TransactOptions {
     useUniqueNullifiers?: boolean;
     /**
      * Optional DEX allow-list for swaps (Jupiter `dexes`).
-     * Example: ["Orca V2", "Raydium CLMM"]
+     * Example: ["Meteora DLMM", "Raydium CLMM"]
      */
     swapDexes?: string[];
     /**
@@ -3392,8 +3177,24 @@ interface TransactOptions {
      * Use when relay may be behind the chain (e.g. commitment_sync lag) to avoid ProofInvalid.
      */
     useChainRootForProof?: boolean;
+    /**
+     * Optional external fee-payer adapter (e.g. Kora) for deposits only. When set, the depositor no
+     * longer needs to hold SOL: the adapter's payer covers the network fee (and, via
+     * `buildTopUpInstructions`, any on-chain rent) and is reimbursed in an SPL token within the same
+     * transaction. Omit for unchanged default behavior.
+     */
+    externalFeePayer?: ExternalFeePayerAdapter;
 }
-/** Switchboard-style response: pre-built instruction. */
+/**
+ * Switchboard-style response: a pre-built instruction.
+ *
+ * @deprecated No longer accepted. `fetchRiskQuote` rejects this shape outright:
+ * a relay that can name the program id, the account metas and the data of an
+ * instruction the user's wallet signs is a signing oracle. The relay only ever
+ * returns `{ signature, message, signer_pubkey }`, which the SDK verifies and
+ * rebuilds locally as an account-free Ed25519 instruction. The type is kept as
+ * an export purely so consumers importing it still compile.
+ */
 interface RiskQuoteInstructionResponse {
     instruction: {
         programId: string;
@@ -3470,12 +3271,23 @@ type RelaySubmissionResult = {
     kind: "failed";
     error: Error;
 };
+
 interface SubmitTransactToRelayArgs {
     relayUrl: string;
     /** The exact body to POST. Auth fields are added ONCE, in place, and then never changed. */
     requestBody: Record<string, unknown>;
     programId: PublicKey;
     depositorKeypair?: Keypair;
+    /**
+     * Wallet-adapter alternative to `depositorKeypair` for request authentication, used only when
+     * no keypair is supplied. Lets a browser or mobile caller — which holds no secret key — submit
+     * through this same function instead of hand-rolling the scheme.
+     *
+     * COMPLIANCE: `walletPublicKey` becomes the authenticated `sender`, which is the key screened
+     * for sanctions on shield-to-shield sends. It must be the end user's real wallet; an ephemeral
+     * or server-side key here is a compliance regression, not a shortcut.
+     */
+    relayAuthSigner?: RelayAuthSigner;
     settlement: SettlementContext;
     /** True while the caller still has a re-prove budget for a stale root. */
     canRetryStaleRoot: boolean;
@@ -3606,9 +3418,9 @@ interface UtxoSwapResult extends TransactResult {
  * Execute a UTXO swap withdrawal
  *
  * This spends input UTXOs and creates a SwapState PDA for swapping SOL to SPL tokens.
- * After this transaction, the relay can execute:
- * 1. PrepareSwapSol - Wrap SOL to wSOL
- * 2. ExecuteSwapViaOrca - Execute the swap on Orca
+ * The swap is then completed on-chain in two follow-up instructions:
+ * 1. PrepareSwapSol - Wrap the SOL held by the SwapState PDA into wSOL
+ * 2. ExecuteSwap - Route the wSOL through Jupiter and deliver the output token to `recipientAta`
  *
  * @param params Swap parameters
  * @param options Transaction options
@@ -3630,129 +3442,59 @@ declare function swapUtxo(params: UtxoSwapParams, options: TransactOptions): Pro
 declare function swapWithChange(inputUtxos: Utxo[], swapAmount: bigint, outputMint: PublicKey, recipientAta: PublicKey, minOutputAmount: bigint, options: TransactOptions, recipientWallet?: PublicKey): Promise<UtxoSwapResult>;
 
 /**
- * Direct Circom WASM Proof Generation
- *
- * This module provides direct proof generation using snarkjs and Circom WASM,
- * matching the approach used in services-new/tests/src/proof.ts
- *
- * Artifacts come from the pinned per-bundle hosts in `config/circuit-release`,
- * verified by digest; no backend prover service is required.
- */
-
-/**
- * Default base URL for the legacy `withdraw_regular` / `withdraw_swap` artifacts.
+ * Circuit artifact loading and integrity verification.
  *
- * Derived from {@link LEGACY_WITHDRAW_CIRCUIT_BUNDLE}, so the version segment is
- * the same one the pinned digests were declared under. Do not write this URL out
- * by hand anywhere — change the bundle instead.
- *
- * This is NOT the base for the ceremony-frozen `transaction` circuit: that
- * circuit lives in a different bundle ({@link TRANSACTION_CIRCUIT_BUNDLE}) with
- * different digests, and is configured through `setCircuitsPath()`.
- *
- * `string | null` — null when the bundle has no published host, which is the
- * case for the legacy withdraw artifacts.
- *
- * RESOLVED LAZILY ON PURPOSE. This was previously
- * `requirePinnedBaseUrl('withdraw_regular')` evaluated at module scope, so an
- * unpinned bundle made merely IMPORTING the SDK throw — breaking every consumer,
- * including those that never touch a legacy withdraw path. The diagnostic is
- * still raised, by `resolveCircuitsUrl` and `getDefaultCircuitsPath` at the
- * point of use, where a caller can actually act on it.
- */
-declare const DEFAULT_CIRCUITS_URL: string | null;
-interface WithdrawRegularInputs {
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    sk: [bigint, bigint];
-    r: [bigint, bigint];
-    pathElements: bigint[];
-    pathIndices: number[];
-    num_outputs: number;
-    out_addr: bigint[][];
-    out_amount: bigint[];
-    out_flags: number[];
-    var_fee: bigint;
-    rem: bigint;
-}
-interface WithdrawSwapInputs {
-    sk_spend: bigint;
-    r: bigint;
-    amount: bigint;
-    leaf_index: bigint;
-    path_elements: bigint[];
-    path_indices: number[];
-    root: bigint;
-    nullifier: bigint;
-    outputs_hash: bigint;
-    public_amount: bigint;
-    input_mint: bigint[];
-    output_mint: bigint[];
-    recipient_ata: bigint[];
-    min_output_amount: bigint;
-    var_fee: bigint;
-    rem: bigint;
-}
-interface ProofResult {
-    proof: Groth16Proof;
-    publicSignals: string[];
-    proofBytes: Uint8Array;
-    publicInputsBytes: Uint8Array;
-}
-/**
- * Generate Groth16 proof for regular withdrawal using Circom WASM
+ * Artifacts come from the pinned bundle in `config/circuits`, verified
+ * by digest; no backend prover service is required. Proof generation itself
+ * lives with the flows that own it (`flows/transact.ts`), which passes the
+ * verified buffers this module returns straight to `snarkjs.groth16.fullProve`.
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * The bytes are canonical HERE and copied out: every hand-off mints a fresh buffer from an
+ * intrinsic captured at module load, and hashes a twin of that buffer, so the digest covers what is
+ * used and not merely what was once loaded, and the buffer that is used was allocated by something
+ * a consumer cannot redefine. See the note on `_verifiedArtifacts` for the break that made the copy
+ * necessary (F7), and THE PRIMORDIALS for the one that made the copy's PROVENANCE necessary (F9).
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ * Only the ceremony-frozen `transaction` circuit exists here. The deployed
+ * program verifies proofs against that circuit's verifying key and nothing
+ * else, so the pre-ceremony `withdraw_regular` / `withdraw_swap` circuits —
+ * and every code path that loaded them — were removed rather than kept as
+ * compatibility the program would reject anyway.
  */
-declare function generateWithdrawRegularProof(inputs: WithdrawRegularInputs, circuitsPath: string): Promise<ProofResult>;
+
 /**
- * Generate Groth16 proof for swap withdrawal using Circom WASM
+ * Base URL of the only bundle this SDK pins: the ceremony `transaction` bundle.
  *
- * This matches the approach in services-new/tests/src/proof.ts
+ * Identical to `DEFAULT_TRANSACTION_CIRCUITS_URL` in `flows/transact`; kept
+ * under this name so existing imports keep resolving. Derived from
+ * {@link TRANSACTION_CIRCUITS_BASE_URL}, so the version segment is the same one
+ * the pinned digests were declared under — do not write this URL out by hand
+ * anywhere; change the bundle instead.
  *
- * @param inputs - Circuit inputs
- * @param circuitsPath - Ignored. Proof generation always uses pinned S3 circuits.
+ * `string | null` — `null` when this build pins no location whose bytes were
+ * verified against the bundle's digests.
  */
-declare function generateWithdrawSwapProof(inputs: WithdrawSwapInputs, circuitsPath: string): Promise<ProofResult>;
-/**
- * Check if circuits are available from the pinned S3 source.
- */
-declare function areCircuitsAvailable(circuitsPath: string): Promise<boolean>;
-/**
- * Get default circuits URL.
- */
-declare function getDefaultCircuitsPath(): Promise<string>;
+declare const DEFAULT_CIRCUITS_URL: string;
 /**
  * Pinned circuit artifact hashes (SHA-256), flattened from the release table in
- * `config/circuit-release.ts`.
+ * `proving/circuits.ts`.
  *
- * This is a *view*, not the source of truth: edit the bundle, not this object.
- * It stays writable because the artifact TOCTOU tests re-pin it to synthetic
- * fixtures; production code must not mutate it.
+ * A read-only VIEW of {@link PINNED_TRANSACTION_WASM_DIGEST} / {@link PINNED_TRANSACTION_ZKEY_DIGEST},
+ * kept because it is part of the published surface and integrators print it in start-up
+ * diagnostics. FROZEN: it is not the source of truth and must not be able to pretend it is. Writing
+ * to it throws in strict mode (every ES module is strict) and is a silent no-op in sloppy CJS
+ * scope — either way the digests the check uses are unchanged.
  */
-declare const EXPECTED_CIRCUIT_HASHES: {
-    withdraw_regular_wasm: string;
-    withdraw_regular_zkey: string;
-    withdraw_swap_wasm: string;
-    withdraw_swap_zkey: string;
+declare const EXPECTED_CIRCUIT_HASHES: Readonly<{
     transaction_wasm: string;
     transaction_zkey: string;
-};
+}>;
 /**
  * Circuit verification result
  */
 interface CircuitVerificationResult {
     /** Whether verification passed */
     valid: boolean;
-    /** Which circuit was checked */
-    circuit: CircuitName;
     /** Error message if verification failed */
     error?: string;
     computed?: {
@@ -3764,13 +3506,25 @@ interface CircuitVerificationResult {
         zkey: string;
     };
 }
-/** Circuit artifact bytes together with the digests computed over those bytes. */
+/**
+ * Circuit artifact bytes together with the digests computed over those bytes.
+ *
+ * The buffers are a PRIVATE COPY, minted for this call from an intrinsic captured at module load
+ * and hashed via a throwaway twin after they were copied. Nothing outside this module was handed
+ * the object or a view onto it, so `digests` describes `wasm`/`zkey` as of the moment they were
+ * handed over rather than as of some earlier load. Mutate them if you like; the SDK's canonical
+ * bytes are elsewhere and the next call re-copies and re-hashes.
+ *
+ * The guarantee stops at the hand-off, and stops honestly. Once these buffers are inside
+ * `snarkjs.groth16.fullProve` what snarkjs does with them is snarkjs's business; what this module
+ * promises is that the bytes it handed over are the bytes whose SHA-256 it reported.
+ */
 interface VerifiedCircuitArtifacts {
-    /** `<circuit>_js/<circuit>.wasm` bytes. */
+    /** `<circuit>_js/<circuit>.wasm` bytes. A fresh copy, not shared with any other caller. */
     wasm: Uint8Array;
-    /** `<circuit>_final.zkey` bytes. */
+    /** `<circuit>_final.zkey` bytes. A fresh copy, not shared with any other caller. */
     zkey: Uint8Array;
-    /** SHA-256 (lowercase hex) of the buffers in this object. */
+    /** SHA-256 (lowercase hex) of the buffers in this object, computed over these very buffers. */
     digests: {
         wasm: string;
         zkey: string;
@@ -3789,8 +3543,23 @@ interface VerifiedCircuitArtifacts {
  * Fails closed: any digest mismatch, unreachable artifact, or environment that
  * cannot produce bytes (a browser pointed at a local directory) throws rather
  * than falling back to an unverified source.
+ *
+ * Returns a FRESH COPY on every call, hashed after it was copied — see
+ * {@link copyAndVerify} and the note on {@link _verifiedArtifacts}. Two calls never share a buffer,
+ * and the digests in the returned object are the digests of the buffers in that same object, taken
+ * at that call. Mutating what you are given affects nothing but your own copy.
+ *
+ * The environment cannot switch any of this off. It used to be skippable with
+ * `CLOAK_SKIP_CIRCUIT_INTEGRITY_CHECK=1`, and that escape hatch was the worst hole in the package:
+ * the variable resolves in the CONSUMER's process, so one deploy variable — or one
+ * `--define:process.env.CLOAK_SKIP_CIRCUIT_INTEGRITY_CHECK='"1"'` in a consumer's bundler, which
+ * compiles the guard down to a constant `true` — made this function accept whatever bytes the base
+ * served. Paired with a repointable base that meant attacker wasm, and attacker wasm sees the spend
+ * key. A check an environment variable disables is not a check. If a local build genuinely needs
+ * different artifacts it needs different DIGESTS, which is a source edit and a rebuild, exactly
+ * like the endpoint pin.
  */
-declare function loadVerifiedCircuitArtifacts(circuitsPath: string | null, circuit: CircuitName): Promise<VerifiedCircuitArtifacts>;
+declare function loadVerifiedCircuitArtifacts(circuitsPath: string | null): Promise<VerifiedCircuitArtifacts>;
 /**
  * Report whether a circuit's artifacts match the digests pinned in this SDK.
  *
@@ -3800,35 +3569,38 @@ declare function loadVerifiedCircuitArtifacts(circuitsPath: string | null, circu
  * Proof paths must call {@link loadVerifiedCircuitArtifacts} and hand the bytes
  * it returns to snarkjs.
  *
+ * Reports digests, never bytes. It can read the canonical memo to avoid a second download, but the
+ * result object carries only hex strings, so calling this cannot obtain a handle on the bytes a
+ * later proof will run over — which is the other half of the F7 fix, and the reason this function
+ * and `loadVerifiedCircuitArtifacts` can no longer disagree about the same cache entry.
+ *
  * IMPORTANT: If the hashes don't match, the circuit may produce proofs
  * that will be rejected by the on-chain verifier!
  *
- * @param circuitsPath - Ignored for the legacy withdraw circuits (they always use
- *                       their own pinned bundle); honoured for `transaction`.
+ * @param circuitsPath - Base directory or URL holding the circuit's artifacts;
+ *                       honoured verbatim.
  * @param circuit - Which circuit to verify
  * @returns Verification result
  *
  * @example
  * ```typescript
- * const result = await verifyCircuitIntegrity(DEFAULT_CIRCUITS_URL, 'withdraw_regular');
+ * const result = await verifyCircuitIntegrity(getCircuitsPath(), 'transaction');
  * if (!result.valid) {
  *   console.error('Circuit verification failed:', result.error);
  *   // Don't proceed with proof generation!
  * }
  * ```
  */
-declare function verifyCircuitIntegrity(circuitsPath: string | null, circuit: CircuitName, prefetched?: {
+declare function verifyCircuitIntegrity(circuitsPath: string | null, prefetched?: {
     wasm: Uint8Array;
     zkey: Uint8Array;
 }): Promise<CircuitVerificationResult>;
 /**
  * Assert the ceremony-frozen `transaction` circuit artifacts are the pinned ones.
  *
- * Throws (fail-closed) when the digests do not match, mirroring how
- * `generateWithdrawRegularProof` / `generateWithdrawSwapProof` gate the legacy
- * circuits. Proving against an unpinned zkey silently produces proofs the
- * on-chain verifying key rejects, so failing here is strictly better than
- * failing on-chain.
+ * Throws (fail-closed) when the digests do not match. Proving against an
+ * unpinned zkey silently produces proofs the on-chain verifying key rejects,
+ * so failing here is strictly better than failing on-chain.
  *
  * @param circuitsPath - Base directory or URL holding `transaction_js/transaction.wasm`
  *                       and `transaction_final.zkey`.
@@ -3839,18 +3611,21 @@ declare function assertTransactionCircuitIntegrity(circuitsPath: string | null,
     zkey: Uint8Array;
 }): Promise<void>;
 /**
- * Verify all circuits before use
+ * Verify every circuit this SDK pins — which is exactly one: the ceremony
+ * `transaction` circuit.
  *
  * Call this at SDK initialization to ensure circuits are valid.
  *
- * @param circuitsPath - For the legacy withdraw circuits this is ignored; verification
- *                       always uses their own pinned bundle.
- * @param transactionCircuitsPath - Base for the ceremony-frozen `transaction` circuit.
+ * @param circuitsPath - Base for the ceremony-frozen `transaction` circuit.
  *                       Pass `getCircuitsPath()` when the caller has reconfigured it;
  *                       `null` reports the "no base configured" state rather than throwing.
+ * @param transactionCircuitsPath - Same base; takes precedence when given. Kept so
+ *                       two-argument callers from before the legacy withdraw
+ *                       circuits were removed keep compiling, with unchanged
+ *                       behaviour for the `transaction` entry.
  * @returns Array of verification results (one per circuit)
  */
-declare function verifyAllCircuits(circuitsPath: string, transactionCircuitsPath?: string | null): Promise<CircuitVerificationResult[]>;
+declare function verifyAllCircuits(circuitsPath: string | null, transactionCircuitsPath?: string | null): Promise<CircuitVerificationResult[]>;
 
 /**
  * Pending Operations Manager
@@ -4000,7 +3775,7 @@ declare function cleanupStalePendingOperations(maxAgeMs?: number): {
  *
  * ── Crypto ────────────────────────────────────────────────────────────────────────────────────
  * X25519 ECDH + XSalsa20-Poly1305, i.e. `nacl.box`, reusing the exact construction already in
- * `core/keys.ts` (`nacl.box.before` + `nacl.secretbox`). No new primitive is introduced here.
+ * `notes/keypair.ts` (`nacl.box.before` + `nacl.secretbox`). No new primitive is introduced here.
  */
 
 /** Ephemeral X25519 public key, at offset 0. */
@@ -4126,7 +3901,7 @@ declare function parseDeliveryCarrierMemo(data: Uint8Array): ParsedDeliveryCarri
  * transaction actually published. That equality is the authentication: it is not a heuristic, and a
  * wrong `nk` cannot produce it. Zero extra bytes on chain, no new envelope, no relay change.
  *
- * This is the same shape already blessed for swap timeout refunds in `core/swap-refund.ts`
+ * This is the same shape already blessed for swap timeout refunds in `notes/swap-refund.ts`
  * (PRF(nk, nullifier0)), for the same reason: unrecoverable randomness becomes recoverable
  * randomness without changing anything an observer can see.
  *
@@ -4213,6 +3988,137 @@ interface MatchDepositNoteParams {
  */
 declare function matchDepositNote(params: MatchDepositNoteParams): Promise<RecoveredDepositNote | null>;
 
+/**
+ * Recoverable change notes (VK-01, change shape).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A partial withdrawal spends a note worth more than the withdrawal and puts the remainder back in
+ * the pool as a change note. `partialWithdraw` built that note with plain `createUtxo`, whose
+ * blinding comes from `randomFieldElement()` — a 252-bit CSPRNG draw written to exactly one place:
+ * whatever the caller does with `TransactResult.outputUtxos`. A caller that drops it, or a throw
+ * between the relay accepting the transaction and the caller persisting the result, destroys the
+ * only copy. The inputs are spent, the change is on chain, and it can never be spent by anyone.
+ *
+ * This is not hypothetical. It stranded 19.939819 USDC on 2026-09-02 (commitment
+ * `138d126b58521b5d14e5bc85ed4e38db3f1218ef4061ad86e07ad4784ee40b6c`, leaf 2290 of the USDC tree):
+ * a payment-link claim ran `partialWithdraw`, the claim page never read `outputUtxos`, and the
+ * blinding died with the page. Every other value needed to spend that note is still recoverable —
+ * amount, owner key, mint, commitment, leaf index. Only the randomness is gone.
+ *
+ * The SDK already ships key-only recovery for DEPOSITS (`notes/deposit-note.ts`, PRF(nk, noteSalt)),
+ * for RECEIVED transfers (`notes/delivery-note.ts`, CLKD1 envelope) and for SWAP REFUNDS
+ * (`notes/swap-refund.ts`, PRF(nk, nullifier0)). Change was the one shape with no recovery path at
+ * all, and it is the shape every withdrawal produces.
+ *
+ * ── Why derivation, and why nothing else was available ────────────────────────────────────────
+ * The CLKD1 delivery envelope is the only rail in the protocol that publishes a blinding, and it
+ * rejects this shape twice over: `buildRecipientDeliveryNotes` returns `undefined` when
+ * `externalAmount !== 0` (a withdrawal) and again when the note's owner is the spender (change is
+ * self-owned). Both gates are correct — a delivery envelope exists to reach someone else, and
+ * change has no one to reach. So make the chain note the protocol already emits carry the recovery
+ * instead, at zero additional bytes:
+ *
+ *     seed     = BLAKE3("cloak_change_note_v1" || nk || noteSalt(32B BE) || outputIndex(1B) || "blinding")
+ *     blinding = seed reduced into the field
+ *
+ * The output index is in the preimage because one transaction carries one salt but two output
+ * slots, and a send-to-self puts a self-owned note in BOTH. Without the index those two notes would
+ * derive one blinding, and `transact`'s fail-closed check could not tell which slot it was looking
+ * at. With it, every slot has its own answer.
+ *
+ * ── Why only the blinding, when deposits derive the keypair too ───────────────────────────────
+ * A deposit's output note has no prior owner, so `deposit-note.ts` is free to give it a per-deposit
+ * key and gains unlinkability by doing so. A change note is different: its owner is already fixed —
+ * it is the keypair of the note being spent (`inputUtxos[0].keypair`), which the spender by
+ * definition holds, and which callers rely on to keep spending their own change. Re-owning it under
+ * a derived key would change `outPubkey0`, break that expectation, and buy nothing, because the
+ * spender's key is the one value in a change note that was never at risk. Only the randomness was.
+ *
+ * ── What a cold scan can rebuild, and what it cannot ──────────────────────────────────────────
+ * For the shape that lost the money — a partial withdrawal — recovery is COMPLETE from `nk` alone.
+ * `partialWithdraw` emits the change as `outputUtxos[0]`, and a v4 chain note binds
+ * `noteSemantics = Poseidon(outAmount0, outPubkey0, isSendToSelfKey0)` and carries all three in its
+ * (encrypted, authenticated) plaintext. So a scanner holding `nk` decrypts the note, reads
+ * `noteSalt`, `outAmount0` and `outPubkey0`, replays the line above, recomputes
+ * `Poseidon(amount, pubkey, blinding, mint)` and requires it to equal a commitment the transaction
+ * actually published. That equality is the authentication, exactly as in `matchDepositNote`.
+ *
+ * For `transfer`, change is `outputUtxos[1]` — the recipient note has to be output 0 because the
+ * delivery carrier is bound to `output_commitments[0]`. A v4 chain note describes output 0 only, so
+ * a cold scan does not learn the change AMOUNT and cannot finish the match on its own. The blinding
+ * is still derived and still recoverable, which turns "permanently unspendable" into "spendable as
+ * soon as the amount is known" — and a sender who knows what they sent knows the amount. Closing
+ * that last gap needs the chain note to describe output 1 as well, which is a format change and is
+ * deliberately not attempted here.
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [M-04] `noteSalt` stays a private input to `chainNoteHash`; it is only ever published inside the
+ * note's own authenticated ciphertext, so nothing an observer can see changes. [H-04-shaped] the
+ * reduction forces non-zero, because a zero blinding is an unspendable note. Callers that pass no
+ * `nk` keep the previous random-blinding behaviour unchanged, so this is additive.
+ */
+
+/** A change note recovered from `nk` (plus the owner key the spender already holds). */
+interface RecoveredChangeNote {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+    amount: bigint;
+    mintAddress: PublicKey;
+    /** The commitment the transaction published, reproduced from the derived blinding. */
+    commitment: bigint;
+    /** The salt the chain note carried, which anchored the derivation. */
+    noteSalt: bigint;
+}
+/** A fresh 96-bit chain-note salt, from the same fail-closed source `transact` uses. */
+declare function randomChangeNoteSalt(): bigint;
+/**
+ * Derive a change note's blinding from `(nk, noteSalt)`.
+ *
+ * Deterministic by design: this is the whole reason a cold scan can rebuild the note. Both the
+ * builder and the scanner call it, so there is exactly one definition of what a change note is.
+ */
+declare function deriveChangeNoteBlinding(viewingKeyNk: Uint8Array, noteSalt: bigint, outputIndex: number): bigint;
+/**
+ * Build a change output note whose blinding a cold `(rpc, programId, nk)` scan can re-derive.
+ *
+ * Returns the UTXO AND the salt that anchored it. The SAME salt must reach `transact` as
+ * `options.chainNoteSalt`, because the chain note is what publishes it — a salt that does not reach
+ * the note leaves the change exactly as unrecoverable as before. `partialWithdraw` and `transfer`
+ * do this for you; the pairing is only your concern if you call `transact` directly.
+ */
+declare function createRecoverableChangeUtxo(amount: bigint, keypair: UtxoKeypair, viewingKeyNk: Uint8Array, mintAddress?: PublicKey, noteSalt?: bigint, outputIndex?: number): Promise<{
+    utxo: Utxo;
+    noteSalt: bigint;
+}>;
+interface MatchChangeNoteParams {
+    /** The spending wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** `noteSalt`, read out of the decrypted chain note. */
+    noteSalt: bigint;
+    /** Candidate note amount — `outAmount0` for a partial withdrawal's change. */
+    amount: bigint;
+    /**
+     * The change note's owner keypair. For a match, only `publicKey` is used (`outPubkey0` from the
+     * chain note is enough); supply the private key too if you intend to spend the result.
+     */
+    keypair: UtxoKeypair;
+    /** Pool mint the commitment was computed under. */
+    mintAddress: PublicKey;
+    /** Which output slot the note occupied — part of the derivation, so it must match. */
+    outputIndex: number;
+    /** Output commitments the transaction actually published, hex or field elements. */
+    outputCommitments: Array<string | bigint>;
+}
+/**
+ * Decide whether a published commitment is a change note this `nk` can rebuild, and if so return it
+ * in spendable form. Returns `null` for everything that is not ours.
+ *
+ * The commitment equality is the authentication. Nothing here trusts the chain note's own claim
+ * about what it describes; the note supplies `noteSalt`, `amount` and the owner key, and the derived
+ * blinding has to reproduce a value the transaction published or the candidate is discarded.
+ */
+declare function matchChangeNote(params: MatchChangeNoteParams): Promise<RecoveredChangeNote | null>;
+
 /**
  * Swap timeout-refund discovery (VK-02).
  *
@@ -4464,6 +4370,25 @@ interface ScanResult {
      * Additive, for the same reason as `deliveredNotes`: note secrets are not compliance rows.
      */
     recoveredDepositNotes: RecoveredDepositNoteRecord[];
+    /**
+     * This wallet's OWN withdrawal/swap change, rebuilt from `nk` alone (VK-01, change shape).
+     *
+     * `partialWithdraw` and `swapWithChange` emit change as output 0, and a v4 chain note carries
+     * `outAmount0`/`outPubkey0`, so `nk` plus the derived blinding is everything the note needs.
+     *
+     * One difference from `recoveredDepositNotes`: a change note's owner key is NOT derived — it is
+     * the keypair of the note that was spent, deliberately, so that holding a viewing key never
+     * confers spend authority. So `keypair.privateKey` comes back as `0n` and the caller must supply
+     * their own before spending. Everything else is complete.
+     */
+    recoveredChangeNotes: RecoveredChangeNoteRecord[];
+}
+/** A recovered change note plus the chain coordinates it was recovered from. */
+interface RecoveredChangeNoteRecord extends RecoveredChangeNote {
+    /** Signature of the withdrawal/swap transaction. */
+    signature: string;
+    /** Millisecond timestamp from the chain note. */
+    timestamp: bigint;
 }
 /** A recovered deposit note plus the chain coordinates it was recovered from. */
 interface RecoveredDepositNoteRecord extends RecoveredDepositNote {
@@ -4749,8 +4674,8 @@ declare class SimpleWallet {
  * @packageDocumentation
  */
 
-declare const VERSION = "0.2.0";
+declare const VERSION = "0.2.1";
 /** True when scanner supports TransactSwap (tag 1). Check this to verify the correct SDK bundle is loaded. */
 declare const SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 
-export { type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitName, type CircuitVerificationResult, type ClaimTimeoutRefundOptions, type ClaimTimeoutRefundParams, type ClaimTimeoutRefundResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, CloakSDK, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, type ProofResult, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, type RecipientDeliveryNote, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RefundVoucher, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawRegularInputs, type WithdrawSubmissionResult, type WithdrawSwapInputs, areCircuitsAvailable, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildPublicInputsBytes, buildRecipientDeliveryNotes, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, chainNoteFromBase64, chainNoteToBase64, claimTimeoutRefund, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeCommitment$1 as computeCommitment, computeExtDataHash, computeMerkleRoot, computeNullifier$1 as computeNullifier, computeNullifierAsync, computeNullifierSync, computeOutputsHash, computeOutputsHashAsync, computeOutputsHashSync, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapOutputsHash, computeSwapOutputsHashAsync, computeSwapOutputsHashSync, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitment, generateCommitmentAsync, generateMasterSeed, generateNote, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, generateWithdrawRegularProof, generateWithdrawSwapProof, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDefaultCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRefundClaimPDA, getRefundLedgerPDA, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };
+export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchChangeNoteParams, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredChangeNote, type RecoveredChangeNoteRecord, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableChangeUtxo, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveChangeNoteBlinding, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchChangeNote, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomChangeNoteSalt, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };