@cloak.dev/sdk 0.2.1 → 0.2.2-staging.0f03668

package/dist/index.d.cts

@@ -3027,6 +3027,15 @@ interface TransactOptions {
      * to compress account addresses from 32 bytes to 1-byte indices.
      */
     addressLookupTableAccounts?: AddressLookupTableAccount[];
+    /**
+     * Opt-in: when true and `relayUrl` is set, an SPL deposit that needs a supplemental lookup
+     * table asks the relay to extend its shared table (`${relayUrl}/supplemental-alt`) instead of
+     * creating a depositor-signed throwaway table, so the user signs exactly once. Any relay
+     * failure — a bad response, a missing address, or the client-side slot gate never clearing —
+     * falls back to the old depositor-signed ephemeral-ALT path automatically. Off (the default)
+     * preserves the old behaviour exactly.
+     */
+    relaySupplementalAlt?: boolean;
     /**
      * Optional Range.org API key for direct SDK-side quote fetching.
      *
@@ -3979,6 +3988,137 @@ interface MatchDepositNoteParams {
  */
 declare function matchDepositNote(params: MatchDepositNoteParams): Promise<RecoveredDepositNote | null>;
 
+/**
+ * Recoverable change notes (VK-01, change shape).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A partial withdrawal spends a note worth more than the withdrawal and puts the remainder back in
+ * the pool as a change note. `partialWithdraw` built that note with plain `createUtxo`, whose
+ * blinding comes from `randomFieldElement()` — a 252-bit CSPRNG draw written to exactly one place:
+ * whatever the caller does with `TransactResult.outputUtxos`. A caller that drops it, or a throw
+ * between the relay accepting the transaction and the caller persisting the result, destroys the
+ * only copy. The inputs are spent, the change is on chain, and it can never be spent by anyone.
+ *
+ * This is not hypothetical. It stranded 19.939819 USDC on 2026-09-02 (commitment
+ * `138d126b58521b5d14e5bc85ed4e38db3f1218ef4061ad86e07ad4784ee40b6c`, leaf 2290 of the USDC tree):
+ * a payment-link claim ran `partialWithdraw`, the claim page never read `outputUtxos`, and the
+ * blinding died with the page. Every other value needed to spend that note is still recoverable —
+ * amount, owner key, mint, commitment, leaf index. Only the randomness is gone.
+ *
+ * The SDK already ships key-only recovery for DEPOSITS (`notes/deposit-note.ts`, PRF(nk, noteSalt)),
+ * for RECEIVED transfers (`notes/delivery-note.ts`, CLKD1 envelope) and for SWAP REFUNDS
+ * (`notes/swap-refund.ts`, PRF(nk, nullifier0)). Change was the one shape with no recovery path at
+ * all, and it is the shape every withdrawal produces.
+ *
+ * ── Why derivation, and why nothing else was available ────────────────────────────────────────
+ * The CLKD1 delivery envelope is the only rail in the protocol that publishes a blinding, and it
+ * rejects this shape twice over: `buildRecipientDeliveryNotes` returns `undefined` when
+ * `externalAmount !== 0` (a withdrawal) and again when the note's owner is the spender (change is
+ * self-owned). Both gates are correct — a delivery envelope exists to reach someone else, and
+ * change has no one to reach. So make the chain note the protocol already emits carry the recovery
+ * instead, at zero additional bytes:
+ *
+ *     seed     = BLAKE3("cloak_change_note_v1" || nk || noteSalt(32B BE) || outputIndex(1B) || "blinding")
+ *     blinding = seed reduced into the field
+ *
+ * The output index is in the preimage because one transaction carries one salt but two output
+ * slots, and a send-to-self puts a self-owned note in BOTH. Without the index those two notes would
+ * derive one blinding, and `transact`'s fail-closed check could not tell which slot it was looking
+ * at. With it, every slot has its own answer.
+ *
+ * ── Why only the blinding, when deposits derive the keypair too ───────────────────────────────
+ * A deposit's output note has no prior owner, so `deposit-note.ts` is free to give it a per-deposit
+ * key and gains unlinkability by doing so. A change note is different: its owner is already fixed —
+ * it is the keypair of the note being spent (`inputUtxos[0].keypair`), which the spender by
+ * definition holds, and which callers rely on to keep spending their own change. Re-owning it under
+ * a derived key would change `outPubkey0`, break that expectation, and buy nothing, because the
+ * spender's key is the one value in a change note that was never at risk. Only the randomness was.
+ *
+ * ── What a cold scan can rebuild, and what it cannot ──────────────────────────────────────────
+ * For the shape that lost the money — a partial withdrawal — recovery is COMPLETE from `nk` alone.
+ * `partialWithdraw` emits the change as `outputUtxos[0]`, and a v4 chain note binds
+ * `noteSemantics = Poseidon(outAmount0, outPubkey0, isSendToSelfKey0)` and carries all three in its
+ * (encrypted, authenticated) plaintext. So a scanner holding `nk` decrypts the note, reads
+ * `noteSalt`, `outAmount0` and `outPubkey0`, replays the line above, recomputes
+ * `Poseidon(amount, pubkey, blinding, mint)` and requires it to equal a commitment the transaction
+ * actually published. That equality is the authentication, exactly as in `matchDepositNote`.
+ *
+ * For `transfer`, change is `outputUtxos[1]` — the recipient note has to be output 0 because the
+ * delivery carrier is bound to `output_commitments[0]`. A v4 chain note describes output 0 only, so
+ * a cold scan does not learn the change AMOUNT and cannot finish the match on its own. The blinding
+ * is still derived and still recoverable, which turns "permanently unspendable" into "spendable as
+ * soon as the amount is known" — and a sender who knows what they sent knows the amount. Closing
+ * that last gap needs the chain note to describe output 1 as well, which is a format change and is
+ * deliberately not attempted here.
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [M-04] `noteSalt` stays a private input to `chainNoteHash`; it is only ever published inside the
+ * note's own authenticated ciphertext, so nothing an observer can see changes. [H-04-shaped] the
+ * reduction forces non-zero, because a zero blinding is an unspendable note. Callers that pass no
+ * `nk` keep the previous random-blinding behaviour unchanged, so this is additive.
+ */
+
+/** A change note recovered from `nk` (plus the owner key the spender already holds). */
+interface RecoveredChangeNote {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+    amount: bigint;
+    mintAddress: PublicKey;
+    /** The commitment the transaction published, reproduced from the derived blinding. */
+    commitment: bigint;
+    /** The salt the chain note carried, which anchored the derivation. */
+    noteSalt: bigint;
+}
+/** A fresh 96-bit chain-note salt, from the same fail-closed source `transact` uses. */
+declare function randomChangeNoteSalt(): bigint;
+/**
+ * Derive a change note's blinding from `(nk, noteSalt)`.
+ *
+ * Deterministic by design: this is the whole reason a cold scan can rebuild the note. Both the
+ * builder and the scanner call it, so there is exactly one definition of what a change note is.
+ */
+declare function deriveChangeNoteBlinding(viewingKeyNk: Uint8Array, noteSalt: bigint, outputIndex: number): bigint;
+/**
+ * Build a change output note whose blinding a cold `(rpc, programId, nk)` scan can re-derive.
+ *
+ * Returns the UTXO AND the salt that anchored it. The SAME salt must reach `transact` as
+ * `options.chainNoteSalt`, because the chain note is what publishes it — a salt that does not reach
+ * the note leaves the change exactly as unrecoverable as before. `partialWithdraw` and `transfer`
+ * do this for you; the pairing is only your concern if you call `transact` directly.
+ */
+declare function createRecoverableChangeUtxo(amount: bigint, keypair: UtxoKeypair, viewingKeyNk: Uint8Array, mintAddress?: PublicKey, noteSalt?: bigint, outputIndex?: number): Promise<{
+    utxo: Utxo;
+    noteSalt: bigint;
+}>;
+interface MatchChangeNoteParams {
+    /** The spending wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** `noteSalt`, read out of the decrypted chain note. */
+    noteSalt: bigint;
+    /** Candidate note amount — `outAmount0` for a partial withdrawal's change. */
+    amount: bigint;
+    /**
+     * The change note's owner keypair. For a match, only `publicKey` is used (`outPubkey0` from the
+     * chain note is enough); supply the private key too if you intend to spend the result.
+     */
+    keypair: UtxoKeypair;
+    /** Pool mint the commitment was computed under. */
+    mintAddress: PublicKey;
+    /** Which output slot the note occupied — part of the derivation, so it must match. */
+    outputIndex: number;
+    /** Output commitments the transaction actually published, hex or field elements. */
+    outputCommitments: Array<string | bigint>;
+}
+/**
+ * Decide whether a published commitment is a change note this `nk` can rebuild, and if so return it
+ * in spendable form. Returns `null` for everything that is not ours.
+ *
+ * The commitment equality is the authentication. Nothing here trusts the chain note's own claim
+ * about what it describes; the note supplies `noteSalt`, `amount` and the owner key, and the derived
+ * blinding has to reproduce a value the transaction published or the candidate is discarded.
+ */
+declare function matchChangeNote(params: MatchChangeNoteParams): Promise<RecoveredChangeNote | null>;
+
 /**
  * Swap timeout-refund discovery (VK-02).
  *
@@ -4230,6 +4370,25 @@ interface ScanResult {
      * Additive, for the same reason as `deliveredNotes`: note secrets are not compliance rows.
      */
     recoveredDepositNotes: RecoveredDepositNoteRecord[];
+    /**
+     * This wallet's OWN withdrawal/swap change, rebuilt from `nk` alone (VK-01, change shape).
+     *
+     * `partialWithdraw` and `swapWithChange` emit change as output 0, and a v4 chain note carries
+     * `outAmount0`/`outPubkey0`, so `nk` plus the derived blinding is everything the note needs.
+     *
+     * One difference from `recoveredDepositNotes`: a change note's owner key is NOT derived — it is
+     * the keypair of the note that was spent, deliberately, so that holding a viewing key never
+     * confers spend authority. So `keypair.privateKey` comes back as `0n` and the caller must supply
+     * their own before spending. Everything else is complete.
+     */
+    recoveredChangeNotes: RecoveredChangeNoteRecord[];
+}
+/** A recovered change note plus the chain coordinates it was recovered from. */
+interface RecoveredChangeNoteRecord extends RecoveredChangeNote {
+    /** Signature of the withdrawal/swap transaction. */
+    signature: string;
+    /** Millisecond timestamp from the chain note. */
+    timestamp: bigint;
 }
 /** A recovered deposit note plus the chain coordinates it was recovered from. */
 interface RecoveredDepositNoteRecord extends RecoveredDepositNote {
@@ -4519,4 +4678,4 @@ declare const VERSION = "0.2.1";
 /** True when scanner supports TransactSwap (tag 1). Check this to verify the correct SDK bundle is loaded. */
 declare const SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 
-export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };
+export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchChangeNoteParams, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredChangeNote, type RecoveredChangeNoteRecord, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableChangeUtxo, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveChangeNoteBlinding, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchChangeNote, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomChangeNoteSalt, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };

package/dist/index.d.ts

@@ -3027,6 +3027,15 @@ interface TransactOptions {
      * to compress account addresses from 32 bytes to 1-byte indices.
      */
     addressLookupTableAccounts?: AddressLookupTableAccount[];
+    /**
+     * Opt-in: when true and `relayUrl` is set, an SPL deposit that needs a supplemental lookup
+     * table asks the relay to extend its shared table (`${relayUrl}/supplemental-alt`) instead of
+     * creating a depositor-signed throwaway table, so the user signs exactly once. Any relay
+     * failure — a bad response, a missing address, or the client-side slot gate never clearing —
+     * falls back to the old depositor-signed ephemeral-ALT path automatically. Off (the default)
+     * preserves the old behaviour exactly.
+     */
+    relaySupplementalAlt?: boolean;
     /**
      * Optional Range.org API key for direct SDK-side quote fetching.
      *
@@ -3979,6 +3988,137 @@ interface MatchDepositNoteParams {
  */
 declare function matchDepositNote(params: MatchDepositNoteParams): Promise<RecoveredDepositNote | null>;
 
+/**
+ * Recoverable change notes (VK-01, change shape).
+ *
+ * ── The defect this closes ────────────────────────────────────────────────────────────────────
+ * A partial withdrawal spends a note worth more than the withdrawal and puts the remainder back in
+ * the pool as a change note. `partialWithdraw` built that note with plain `createUtxo`, whose
+ * blinding comes from `randomFieldElement()` — a 252-bit CSPRNG draw written to exactly one place:
+ * whatever the caller does with `TransactResult.outputUtxos`. A caller that drops it, or a throw
+ * between the relay accepting the transaction and the caller persisting the result, destroys the
+ * only copy. The inputs are spent, the change is on chain, and it can never be spent by anyone.
+ *
+ * This is not hypothetical. It stranded 19.939819 USDC on 2026-09-02 (commitment
+ * `138d126b58521b5d14e5bc85ed4e38db3f1218ef4061ad86e07ad4784ee40b6c`, leaf 2290 of the USDC tree):
+ * a payment-link claim ran `partialWithdraw`, the claim page never read `outputUtxos`, and the
+ * blinding died with the page. Every other value needed to spend that note is still recoverable —
+ * amount, owner key, mint, commitment, leaf index. Only the randomness is gone.
+ *
+ * The SDK already ships key-only recovery for DEPOSITS (`notes/deposit-note.ts`, PRF(nk, noteSalt)),
+ * for RECEIVED transfers (`notes/delivery-note.ts`, CLKD1 envelope) and for SWAP REFUNDS
+ * (`notes/swap-refund.ts`, PRF(nk, nullifier0)). Change was the one shape with no recovery path at
+ * all, and it is the shape every withdrawal produces.
+ *
+ * ── Why derivation, and why nothing else was available ────────────────────────────────────────
+ * The CLKD1 delivery envelope is the only rail in the protocol that publishes a blinding, and it
+ * rejects this shape twice over: `buildRecipientDeliveryNotes` returns `undefined` when
+ * `externalAmount !== 0` (a withdrawal) and again when the note's owner is the spender (change is
+ * self-owned). Both gates are correct — a delivery envelope exists to reach someone else, and
+ * change has no one to reach. So make the chain note the protocol already emits carry the recovery
+ * instead, at zero additional bytes:
+ *
+ *     seed     = BLAKE3("cloak_change_note_v1" || nk || noteSalt(32B BE) || outputIndex(1B) || "blinding")
+ *     blinding = seed reduced into the field
+ *
+ * The output index is in the preimage because one transaction carries one salt but two output
+ * slots, and a send-to-self puts a self-owned note in BOTH. Without the index those two notes would
+ * derive one blinding, and `transact`'s fail-closed check could not tell which slot it was looking
+ * at. With it, every slot has its own answer.
+ *
+ * ── Why only the blinding, when deposits derive the keypair too ───────────────────────────────
+ * A deposit's output note has no prior owner, so `deposit-note.ts` is free to give it a per-deposit
+ * key and gains unlinkability by doing so. A change note is different: its owner is already fixed —
+ * it is the keypair of the note being spent (`inputUtxos[0].keypair`), which the spender by
+ * definition holds, and which callers rely on to keep spending their own change. Re-owning it under
+ * a derived key would change `outPubkey0`, break that expectation, and buy nothing, because the
+ * spender's key is the one value in a change note that was never at risk. Only the randomness was.
+ *
+ * ── What a cold scan can rebuild, and what it cannot ──────────────────────────────────────────
+ * For the shape that lost the money — a partial withdrawal — recovery is COMPLETE from `nk` alone.
+ * `partialWithdraw` emits the change as `outputUtxos[0]`, and a v4 chain note binds
+ * `noteSemantics = Poseidon(outAmount0, outPubkey0, isSendToSelfKey0)` and carries all three in its
+ * (encrypted, authenticated) plaintext. So a scanner holding `nk` decrypts the note, reads
+ * `noteSalt`, `outAmount0` and `outPubkey0`, replays the line above, recomputes
+ * `Poseidon(amount, pubkey, blinding, mint)` and requires it to equal a commitment the transaction
+ * actually published. That equality is the authentication, exactly as in `matchDepositNote`.
+ *
+ * For `transfer`, change is `outputUtxos[1]` — the recipient note has to be output 0 because the
+ * delivery carrier is bound to `output_commitments[0]`. A v4 chain note describes output 0 only, so
+ * a cold scan does not learn the change AMOUNT and cannot finish the match on its own. The blinding
+ * is still derived and still recoverable, which turns "permanently unspendable" into "spendable as
+ * soon as the amount is known" — and a sender who knows what they sent knows the amount. Closing
+ * that last gap needs the chain note to describe output 1 as well, which is a format change and is
+ * deliberately not attempted here.
+ *
+ * ── Guardrails preserved ──────────────────────────────────────────────────────────────────────
+ * [M-04] `noteSalt` stays a private input to `chainNoteHash`; it is only ever published inside the
+ * note's own authenticated ciphertext, so nothing an observer can see changes. [H-04-shaped] the
+ * reduction forces non-zero, because a zero blinding is an unspendable note. Callers that pass no
+ * `nk` keep the previous random-blinding behaviour unchanged, so this is additive.
+ */
+
+/** A change note recovered from `nk` (plus the owner key the spender already holds). */
+interface RecoveredChangeNote {
+    keypair: UtxoKeypair;
+    blinding: bigint;
+    amount: bigint;
+    mintAddress: PublicKey;
+    /** The commitment the transaction published, reproduced from the derived blinding. */
+    commitment: bigint;
+    /** The salt the chain note carried, which anchored the derivation. */
+    noteSalt: bigint;
+}
+/** A fresh 96-bit chain-note salt, from the same fail-closed source `transact` uses. */
+declare function randomChangeNoteSalt(): bigint;
+/**
+ * Derive a change note's blinding from `(nk, noteSalt)`.
+ *
+ * Deterministic by design: this is the whole reason a cold scan can rebuild the note. Both the
+ * builder and the scanner call it, so there is exactly one definition of what a change note is.
+ */
+declare function deriveChangeNoteBlinding(viewingKeyNk: Uint8Array, noteSalt: bigint, outputIndex: number): bigint;
+/**
+ * Build a change output note whose blinding a cold `(rpc, programId, nk)` scan can re-derive.
+ *
+ * Returns the UTXO AND the salt that anchored it. The SAME salt must reach `transact` as
+ * `options.chainNoteSalt`, because the chain note is what publishes it — a salt that does not reach
+ * the note leaves the change exactly as unrecoverable as before. `partialWithdraw` and `transfer`
+ * do this for you; the pairing is only your concern if you call `transact` directly.
+ */
+declare function createRecoverableChangeUtxo(amount: bigint, keypair: UtxoKeypair, viewingKeyNk: Uint8Array, mintAddress?: PublicKey, noteSalt?: bigint, outputIndex?: number): Promise<{
+    utxo: Utxo;
+    noteSalt: bigint;
+}>;
+interface MatchChangeNoteParams {
+    /** The spending wallet's incoming viewing base. */
+    viewingKeyNk: Uint8Array;
+    /** `noteSalt`, read out of the decrypted chain note. */
+    noteSalt: bigint;
+    /** Candidate note amount — `outAmount0` for a partial withdrawal's change. */
+    amount: bigint;
+    /**
+     * The change note's owner keypair. For a match, only `publicKey` is used (`outPubkey0` from the
+     * chain note is enough); supply the private key too if you intend to spend the result.
+     */
+    keypair: UtxoKeypair;
+    /** Pool mint the commitment was computed under. */
+    mintAddress: PublicKey;
+    /** Which output slot the note occupied — part of the derivation, so it must match. */
+    outputIndex: number;
+    /** Output commitments the transaction actually published, hex or field elements. */
+    outputCommitments: Array<string | bigint>;
+}
+/**
+ * Decide whether a published commitment is a change note this `nk` can rebuild, and if so return it
+ * in spendable form. Returns `null` for everything that is not ours.
+ *
+ * The commitment equality is the authentication. Nothing here trusts the chain note's own claim
+ * about what it describes; the note supplies `noteSalt`, `amount` and the owner key, and the derived
+ * blinding has to reproduce a value the transaction published or the candidate is discarded.
+ */
+declare function matchChangeNote(params: MatchChangeNoteParams): Promise<RecoveredChangeNote | null>;
+
 /**
  * Swap timeout-refund discovery (VK-02).
  *
@@ -4230,6 +4370,25 @@ interface ScanResult {
      * Additive, for the same reason as `deliveredNotes`: note secrets are not compliance rows.
      */
     recoveredDepositNotes: RecoveredDepositNoteRecord[];
+    /**
+     * This wallet's OWN withdrawal/swap change, rebuilt from `nk` alone (VK-01, change shape).
+     *
+     * `partialWithdraw` and `swapWithChange` emit change as output 0, and a v4 chain note carries
+     * `outAmount0`/`outPubkey0`, so `nk` plus the derived blinding is everything the note needs.
+     *
+     * One difference from `recoveredDepositNotes`: a change note's owner key is NOT derived — it is
+     * the keypair of the note that was spent, deliberately, so that holding a viewing key never
+     * confers spend authority. So `keypair.privateKey` comes back as `0n` and the caller must supply
+     * their own before spending. Everything else is complete.
+     */
+    recoveredChangeNotes: RecoveredChangeNoteRecord[];
+}
+/** A recovered change note plus the chain coordinates it was recovered from. */
+interface RecoveredChangeNoteRecord extends RecoveredChangeNote {
+    /** Signature of the withdrawal/swap transaction. */
+    signature: string;
+    /** Millisecond timestamp from the chain note. */
+    timestamp: bigint;
 }
 /** A recovered deposit note plus the chain coordinates it was recovered from. */
 interface RecoveredDepositNoteRecord extends RecoveredDepositNote {
@@ -4519,4 +4678,4 @@ declare const VERSION = "0.2.1";
 /** True when scanner supports TransactSwap (tag 1). Check this to verify the correct SDK bundle is loaded. */
 declare const SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 
-export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };
+export { BUILD_ALLOWS_LOCAL_ENDPOINTS, type BuildRecipientDeliveryNotesParams, CHAIN_NOTE_SALT_BITS, CLOAK_PRODUCTION_RELAY_URL, CLOAK_PROGRAM_ID, type ChainNoteTxType, type CircuitVerificationResult, type CloakConfig, CloakError, type CloakKeyPair, type CloakNote, type CommitmentEntry, type CommitmentsResponse, type CompactChainNote, type ComplianceReport, type ComplianceTxType, type ConfirmSettlementParams, DEFAULT_CIRCUITS_URL, DEFAULT_TRANSACTION_CIRCUITS_URL, DELIVERY_MEMO_TAG, DELIVERY_REGISTRY_SEED, type DeliveredNote, type DepositInstructionParams, type DepositNoteSecrets, type DepositOptions, type DepositResult, type DepositStatus, type DiscoverSwapRefundsOptions, type DiscoveredSwapRefund, EXPECTED_CIRCUIT_HASHES, type EncryptedMetadataBundle, type EncryptedNote$1 as EncryptedNote, type ErrorCategory, type ExpandedSpendKey, type ExternalFeePayerAdapter, FIXED_FEE_LAMPORTS, type Groth16Proof, InsecureRandomnessError, LAMPORTS_PER_SOL, LocalStorageAdapter, type LogLevel, type Logger, MERKLE_TREE_HEIGHT, MIN_DEPOSIT_LAMPORTS, type MasterKey, type MatchChangeNoteParams, type MatchDepositNoteParams, type MatchSwapRefundLeafParams, type MaxLengthArray, MemoryStorageAdapter, type MerkleProof, type MerkleRootResponse, MerkleTree, NATIVE_SOL_MINT, type Network, type NoteData, type OnchainMerkleProof, type ParsedDeliveryCarrier, type PendingDeposit, type PendingWithdrawal, RECIPIENT_DELIVERY_CIPHERTEXT_LEN, RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN, RECIPIENT_DELIVERY_NONCE_LEN, RECIPIENT_DELIVERY_NOTE_BYTES, RECIPIENT_DELIVERY_PLAINTEXT_LEN, RECIPIENT_DELIVERY_TAG_LEN, RELAY_ORIGIN_ALLOWLIST, REQUEST_AUTH_MAX_AGE_SECONDS, REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS, type RecipientDeliveryNote, type RecoveredChangeNote, type RecoveredChangeNoteRecord, type RecoveredDepositNote, type RecoveredDepositNoteRecord, type RecoveredSwapRefund, type RelayAuthPreimage, type RelayAuthSigner, RelayInternalError, RelayService, type RelaySubmissionResult, type RiskQuoteInstructionResponse, RootNotFoundError, SCANNER_SUPPORTS_TRANSACT_SWAP, SIGN_IN_MESSAGE, SanctionsQuoteError, type ScanOptions, type ScanRecipientDeliveryOptions, type ScanResult, type ScanSummary, type ScannedTransaction, type SettlementConnection, type SettlementContext, type SettlementStatus, type SettlementVerdict, SettlementVerificationError, ShieldPoolErrors, type ShieldPoolPDAs, SimpleWallet, type SpendKey, type StorageAdapter, type SubmitTransactToRelayArgs, type SwapOptions, type SwapParams, type SwapRefundAuthorization, type SwapResult, TRANSACTION_CIRCUITS_VERSION, TRANSACT_AUTH_FIELDS, TRANSACT_SWAP_AUTH_FIELDS, type TransactOptions, type TransactParams, type TransactRequestBodyParams, type TransactResult, type TransactionMetadata, type Transfer, type TransferOptions, type TransferResult, type TxStatus, type UserFriendlyError, type Utxo, UtxoAlreadySpentError, type EncryptedNote as UtxoEncryptedNote, type UtxoKeypair, type UtxoSwapParams, type UtxoSwapResult, UtxoWallet, VARIABLE_FEE_DENOMINATOR, VARIABLE_FEE_NUMERATOR, VARIABLE_FEE_RATE, VERSION, type VerifyUtxosResult, type ViewKey, type ViewingKeyPair, type WalletAdapter, type WalletUtxo, type WithdrawOptions, type WithdrawSubmissionResult, assertDirectSubmissionLanded, assertTransactionCircuitIntegrity, bigintToBytes32$1 as bigintToBytes32, bigintToHex, buildMerkleTree, buildMerkleTreeFromChain, buildMerkleTreeFromRelay, buildRecipientDeliveryNotes, buildRelayAuthPreimage, buildTransactRequestBody, bytesToHex, calculateFee, calculateFeeBigint, calculateRelayFee, canRebuildMerkleTreeFromChain, canonicalJson, chainNoteFromBase64, chainNoteToBase64, classifyRelayError, cleanupStalePendingOperations, clearPendingDeposits, clearPendingWithdrawals, computeChainNoteHash, computeExtDataHash, computeMerkleRoot, computeProofForLatestDeposit, computeProofFromChain, computeSignature, computeSwapRefundCommitment, computeCommitment as computeUtxoCommitment, computeNullifier as computeUtxoNullifier, confirmTransactSettlement, copyNoteToClipboard, createCloakError, createDepositInstruction, createLogger, createRecoverableChangeUtxo, createRecoverableDepositUtxo, createUtxo, createZeroUtxo, decryptCompactChainNote, decryptComplianceMetadataWithMasterKey, decryptTransactionMetadata, deriveChangeNoteBlinding, deriveDepositNoteSecrets, deriveDiversifiedViewingKey, deriveDiversifier, deriveInputNullifierPdas, derivePublicKey, deriveSpendKey, deriveSwapRefundAuthorization, deriveUserCompliancePublicKey, deriveUserComplianceScalar, deriveUtxoKeypairFromSpendKey, deriveViewKey, deriveViewingKeyFromNk, deriveViewingKeyFromSpendKey, deriveViewingKeyFromUtxoPrivateKey, deserializeUtxo, detectNetworkFromRpcUrl, discoverSwapRefunds, downloadNote, encodeDeliveryCarrierMemo, encodeNoteSimple, encodeRecipientDeliveryNote, encryptCompactChainNote, encryptNoteForRecipient, encryptTransactionMetadata, encryptTransactionMetadataBundle, expandSpendKey, explainRelayAuthRejection, exportKeys, exportNote, exportWalletKeys, fetchCommitments, fetchRiskQuoteInstruction, fetchRiskQuoteIx, filterNotesByNetwork, filterWithdrawableNotes, findNoteByCommitment, formatAmount, formatComplianceCsv, formatErrorForLogging, formatSol, fullWithdraw, generateCloakKeys, generateCommitmentAsync, generateMasterSeed, generateNoteFromWallet, generateUtxoKeypair, generateViewingKeyPair, getAddressExplorerUrl, getChainNoteRegistryPDA, getCircuitsPath, getDeliveryRegistryPDA, getDistributableAmount, getExplorerUrl, getNkFromUtxoPrivateKey, getNullifierPDA, getPendingOperationsSummary, getPoolAuthorityConfigPDA, getPublicKey, getPublicViewKey, getRecipientAmount, getRpcUrlForNetwork, getShieldPoolPDAs, getSwapStatePDA, getViewKey, hasPendingOperations, hexToBigint$1 as hexToBigint, hexToBytes, importKeys, importWalletKeys, isBrowser, isBrowserLike, isDebugEnabled, isPlausibleSignature, isReactNative, isRootNotFoundError, isSubmissionOutcomeUnknownResponse, isValidHex, isValidRpcUrl, isValidSolanaAddress, isWithdrawAmountSufficient, isWithdrawable, keypairToAdapter, loadPendingDeposits, loadPendingWithdrawals, loadVerifiedCircuitArtifacts, matchChangeNote, matchDepositNote, matchSwapRefundLeaf, openRecipientDeliveryNote, parseAmount, parseDeliveryCarrierMemo, parseError, parseNote, parseRelayErrorResponse, parseRelayErrorSignature, parseTransactionError, partialWithdraw, poseidonHash, preflightCheck, preflightNullifiers, prepareEncryptedOutput, prepareEncryptedOutputForRecipient, proofToBytes, pubkeyToFieldElement, pubkeyToLimbs, randomBytes, randomChangeNoteSalt, randomDepositNoteSalt, randomFieldElement, readMerkleTreeState, recipientDeliveryNoteToBase64, registerViewingKey, removePendingDeposit, removePendingWithdrawal, resolveCircuitsBase, savePendingDeposit, savePendingWithdrawal, scanNotesForWallet, scanRecipientDeliveryNotes, scanTransactions, sdkLogger, selectUtxos, sendTransaction, serializeNote, serializeUtxo, setCircuitsPath, setDebugMode, signTransaction, splitTo2Limbs, submitTransactToRelay, sumUtxoAmounts, swapUtxo, swapWithChange, toComplianceReport, transact, transfer, truncate, tryDecryptNote, updateNoteWithDeposit, updatePendingDeposit, updatePendingWithdrawal, bigintToBytes32 as utxoBigintToBytes32, utxoEquals, hexToBigint as utxoHexToBigint, validateDepositParams, validateNote, validateOutputsSum, validateRoot, validateTransfers, validateWalletConnected, validateWithdrawableNote, verifyAllCircuits, verifyCircuitIntegrity, verifyUtxos, waitForRoot, withTiming };