@cloak.dev/sdk 0.2.2 → 0.2.3-staging.005e3de

package/dist/index.cjs

@@ -455,7 +455,7 @@ async function deserializeUtxo(bytes) {
   const blindingBytes = bytes.slice(40, 72);
   const blinding = bytesToBigint2(blindingBytes);
   const mintBytes = bytes.slice(72, 104);
-  const mintAddress = new import_web33.PublicKey(mintBytes);
+  const mintAddress = new import_web34.PublicKey(mintBytes);
   const index = view.getUint32(104, true);
   const utxo = {
     amount,
@@ -523,18 +523,18 @@ function selectUtxos(available, targetAmount) {
   }
   return selected;
 }
-var import_web33, import_circomlibjs2, import_blake33, FIELD_MODULUS, KEYPAIR_DOMAIN_TAG, UTXO_KEY_DOMAIN, NATIVE_SOL_MINT, poseidonInstance;
+var import_web34, import_circomlibjs2, import_blake33, FIELD_MODULUS, KEYPAIR_DOMAIN_TAG, UTXO_KEY_DOMAIN, NATIVE_SOL_MINT, poseidonInstance;
 var init_utxo = __esm({
   "src/notes/utxo.ts"() {
     "use strict";
-    import_web33 = require("@solana/web3.js");
+    import_web34 = require("@solana/web3.js");
     import_circomlibjs2 = require("circomlibjs");
     import_blake33 = require("@noble/hashes/blake3");
     init_inputs();
     FIELD_MODULUS = BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
     KEYPAIR_DOMAIN_TAG = BigInt("5423839527465210463");
     UTXO_KEY_DOMAIN = new TextEncoder().encode("cloak_utxo_priv_v1");
-    NATIVE_SOL_MINT = new import_web33.PublicKey("So11111111111111111111111111111111111111112");
+    NATIVE_SOL_MINT = new import_web34.PublicKey("So11111111111111111111111111111111111111112");
     poseidonInstance = null;
   }
 });
@@ -542,8 +542,10 @@ var init_utxo = __esm({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BRIDGE_ESCROW_LABEL: () => BRIDGE_ESCROW_LABEL,
   BUILD_ALLOWS_LOCAL_ENDPOINTS: () => BUILD_ALLOWS_LOCAL_ENDPOINTS,
   CHAIN_NOTE_SALT_BITS: () => CHAIN_NOTE_SALT_BITS,
+  CLEANUP_FEE_BUDGET: () => CLEANUP_FEE_BUDGET,
   CLOAK_PRODUCTION_RELAY_URL: () => CLOAK_PRODUCTION_RELAY_URL,
   CLOAK_PROGRAM_ID: () => CLOAK_PROGRAM_ID,
   CloakError: () => CloakError,
@@ -551,25 +553,38 @@ __export(index_exports, {
   DEFAULT_TRANSACTION_CIRCUITS_URL: () => DEFAULT_TRANSACTION_CIRCUITS_URL,
   DELIVERY_MEMO_TAG: () => DELIVERY_MEMO_TAG,
   DELIVERY_REGISTRY_SEED: () => DELIVERY_REGISTRY_SEED,
+  DepositError: () => DepositError,
+  DoNotRetry: () => DoNotRetry,
+  ECONOMIC_MINIMUM: () => ECONOMIC_MINIMUM,
   EXPECTED_CIRCUIT_HASHES: () => EXPECTED_CIRCUIT_HASHES,
+  FEE_BUDGET: () => FEE_BUDGET,
   FIXED_FEE_LAMPORTS: () => FIXED_FEE_LAMPORTS,
   InsecureRandomnessError: () => InsecureRandomnessError,
   LAMPORTS_PER_SOL: () => LAMPORTS_PER_SOL,
   LocalStorageAdapter: () => LocalStorageAdapter,
+  MAINNET_RENT_0: () => MAINNET_RENT_0,
+  MAINNET_RENT_1: () => MAINNET_RENT_1,
+  MAX_RECEIVER_INDEX: () => MAX_RECEIVER_INDEX,
   MERKLE_TREE_HEIGHT: () => MERKLE_TREE_HEIGHT2,
   MIN_DEPOSIT_LAMPORTS: () => MIN_DEPOSIT_LAMPORTS,
+  MIN_DEPOSIT_SPL_BASE_UNITS: () => MIN_DEPOSIT_SPL_BASE_UNITS,
   MemoryStorageAdapter: () => MemoryStorageAdapter,
   MerkleTree: () => MerkleTree,
   NATIVE_SOL_MINT: () => NATIVE_SOL_MINT,
+  ONECLICK_PUBKEY_B58: () => ONECLICK_PUBKEY_B58,
   RECIPIENT_DELIVERY_CIPHERTEXT_LEN: () => RECIPIENT_DELIVERY_CIPHERTEXT_LEN,
   RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN: () => RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN,
   RECIPIENT_DELIVERY_NONCE_LEN: () => RECIPIENT_DELIVERY_NONCE_LEN,
   RECIPIENT_DELIVERY_NOTE_BYTES: () => RECIPIENT_DELIVERY_NOTE_BYTES,
   RECIPIENT_DELIVERY_PLAINTEXT_LEN: () => RECIPIENT_DELIVERY_PLAINTEXT_LEN,
   RECIPIENT_DELIVERY_TAG_LEN: () => RECIPIENT_DELIVERY_TAG_LEN,
+  RELAY_BATCH_AUTH_MAX_ITEMS: () => RELAY_BATCH_AUTH_MAX_ITEMS,
   RELAY_ORIGIN_ALLOWLIST: () => RELAY_ORIGIN_ALLOWLIST,
+  REQUEST_AUTH_BATCH_DOMAIN: () => REQUEST_AUTH_BATCH_DOMAIN,
+  REQUEST_AUTH_BATCH_MAX_AGE_SECONDS: () => REQUEST_AUTH_BATCH_MAX_AGE_SECONDS,
   REQUEST_AUTH_MAX_AGE_SECONDS: () => REQUEST_AUTH_MAX_AGE_SECONDS,
   REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS: () => REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS,
+  RelayBatchAuthCoordinator: () => RelayBatchAuthCoordinator,
   RelayInternalError: () => RelayInternalError,
   RelayService: () => RelayService,
   RootNotFoundError: () => RootNotFoundError,
@@ -579,6 +594,7 @@ __export(index_exports, {
   SettlementVerificationError: () => SettlementVerificationError,
   ShieldPoolErrors: () => ShieldPoolErrors,
   SimpleWallet: () => SimpleWallet,
+  TERMINAL_FAILURE: () => TERMINAL_FAILURE,
   TRANSACTION_CIRCUITS_VERSION: () => TRANSACTION_CIRCUITS_VERSION,
   TRANSACT_AUTH_FIELDS: () => TRANSACT_AUTH_FIELDS,
   TRANSACT_SWAP_AUTH_FIELDS: () => TRANSACT_SWAP_AUTH_FIELDS,
@@ -588,15 +604,21 @@ __export(index_exports, {
   VARIABLE_FEE_NUMERATOR: () => VARIABLE_FEE_NUMERATOR,
   VARIABLE_FEE_RATE: () => VARIABLE_FEE_RATE,
   VERSION: () => VERSION,
+  WITHDRAW_FEE_BPS: () => WITHDRAW_FEE_BPS,
+  WITHDRAW_FIXED_FEE: () => WITHDRAW_FIXED_FEE,
   assertDirectSubmissionLanded: () => assertDirectSubmissionLanded,
+  assertInputMints: () => assertInputMints,
   assertTransactionCircuitIntegrity: () => assertTransactionCircuitIntegrity,
+  assessBridgeQuote: () => assessBridgeQuote,
   bigintToBytes32: () => bigintToBytes32,
   bigintToHex: () => bigintToHex,
+  buildAuthTransactionMessage: () => buildAuthTransactionMessage,
   buildMerkleTree: () => buildMerkleTree,
   buildMerkleTreeFromChain: () => buildMerkleTreeFromChain,
   buildMerkleTreeFromRelay: () => buildMerkleTreeFromRelay,
   buildRecipientDeliveryNotes: () => buildRecipientDeliveryNotes,
   buildRelayAuthPreimage: () => buildRelayAuthPreimage,
+  buildRelayBatchAuthMessage: () => buildRelayBatchAuthMessage,
   buildTransactRequestBody: () => buildTransactRequestBody,
   bytesToHex: () => bytesToHex,
   calculateFee: () => calculateFee,
@@ -604,12 +626,16 @@ __export(index_exports, {
   calculateRelayFee: () => calculateRelayFee,
   canRebuildMerkleTreeFromChain: () => canRebuildMerkleTreeFromChain,
   canonicalJson: () => canonicalJson,
+  canonicalPayloadString: () => canonicalPayloadString,
   chainNoteFromBase64: () => chainNoteFromBase64,
   chainNoteToBase64: () => chainNoteToBase64,
+  classifyPostFailure: () => classifyPostFailure,
   classifyRelayError: () => classifyRelayError,
+  cleanupReceivingAddress: () => cleanupReceivingAddress,
   cleanupStalePendingOperations: () => cleanupStalePendingOperations,
   clearPendingDeposits: () => clearPendingDeposits,
   clearPendingWithdrawals: () => clearPendingWithdrawals,
+  cloakBridgeRail: () => cloakBridgeRail,
   computeChainNoteHash: () => computeChainNoteHash,
   computeExtDataHash: () => computeExtDataHash,
   computeMerkleRoot: () => computeMerkleRoot,
@@ -626,15 +652,19 @@ __export(index_exports, {
   createLogger: () => createLogger,
   createRecoverableChangeUtxo: () => createRecoverableChangeUtxo,
   createRecoverableDepositUtxo: () => createRecoverableDepositUtxo,
+  createRelayBatchAuthCoordinator: () => createRelayBatchAuthCoordinator,
   createUtxo: () => createUtxo,
   createZeroUtxo: () => createZeroUtxo,
   decryptCompactChainNote: () => decryptCompactChainNote,
   decryptComplianceMetadataWithMasterKey: () => decryptComplianceMetadataWithMasterKey,
   decryptTransactionMetadata: () => decryptTransactionMetadata,
+  depositFromDerivedKey: () => depositFromDerivedKey,
+  deriveBridgeReceiver: () => deriveBridgeReceiver,
   deriveChangeNoteBlinding: () => deriveChangeNoteBlinding,
   deriveDepositNoteSecrets: () => deriveDepositNoteSecrets,
   deriveDiversifiedViewingKey: () => deriveDiversifiedViewingKey,
   deriveDiversifier: () => deriveDiversifier,
+  deriveFundingTargets: () => deriveFundingTargets,
   deriveInputNullifierPdas: () => deriveInputNullifierPdas,
   derivePublicKey: () => derivePublicKey,
   deriveSpendKey: () => deriveSpendKey,
@@ -673,6 +703,7 @@ __export(index_exports, {
   formatErrorForLogging: () => formatErrorForLogging,
   formatSol: () => formatSol,
   fullWithdraw: () => fullWithdraw,
+  fundReceiverViaPaymaster: () => fundReceiverViaPaymaster,
   generateCloakKeys: () => generateCloakKeys,
   generateCommitmentAsync: () => generateCommitmentAsync,
   generateMasterSeed: () => generateMasterSeed,
@@ -708,18 +739,21 @@ __export(index_exports, {
   isReactNative: () => isReactNative,
   isRootNotFoundError: () => isRootNotFoundError,
   isSubmissionOutcomeUnknownResponse: () => isSubmissionOutcomeUnknownResponse,
+  isTerminalFailure: () => isTerminalFailure,
   isValidHex: () => isValidHex,
   isValidRpcUrl: () => isValidRpcUrl,
   isValidSolanaAddress: () => isValidSolanaAddress,
   isWithdrawAmountSufficient: () => isWithdrawAmountSufficient,
   isWithdrawable: () => isWithdrawable,
   keypairToAdapter: () => keypairToAdapter,
+  listBridgeDeposits: () => listBridgeDeposits,
   loadPendingDeposits: () => loadPendingDeposits,
   loadPendingWithdrawals: () => loadPendingWithdrawals,
   loadVerifiedCircuitArtifacts: () => loadVerifiedCircuitArtifacts,
   matchChangeNote: () => matchChangeNote,
   matchDepositNote: () => matchDepositNote,
   matchSwapRefundLeaf: () => matchSwapRefundLeaf,
+  mayRetry: () => mayRetry,
   openRecipientDeliveryNote: () => openRecipientDeliveryNote,
   parseAmount: () => parseAmount,
   parseDeliveryCarrierMemo: () => parseDeliveryCarrierMemo,
@@ -742,11 +776,15 @@ __export(index_exports, {
   randomDepositNoteSalt: () => randomDepositNoteSalt,
   randomFieldElement: () => randomFieldElement,
   readMerkleTreeState: () => readMerkleTreeState,
+  readRent: () => readRent,
   recipientDeliveryNoteToBase64: () => recipientDeliveryNoteToBase64,
   registerViewingKey: () => registerViewingKey,
+  relayRequestDigestHex: () => relayRequestDigestHex,
   removePendingDeposit: () => removePendingDeposit,
   removePendingWithdrawal: () => removePendingWithdrawal,
+  renderAssessment: () => renderAssessment,
   resolveCircuitsBase: () => resolveCircuitsBase,
+  retryDelayMs: () => retryDelayMs,
   savePendingDeposit: () => savePendingDeposit,
   savePendingWithdrawal: () => savePendingWithdrawal,
   scanNotesForWallet: () => scanNotesForWallet,
@@ -755,10 +793,12 @@ __export(index_exports, {
   sdkLogger: () => sdkLogger,
   selectUtxos: () => selectUtxos,
   sendTransaction: () => sendTransaction,
+  serializeAuthTransactionMessage: () => serializeAuthTransactionMessage,
   serializeNote: () => serializeNote,
   serializeUtxo: () => serializeUtxo,
   setCircuitsPath: () => setCircuitsPath,
   setDebugMode: () => setDebugMode,
+  signRelayAuthPayload: () => signRelayAuthPayload,
   signTransaction: () => signTransaction,
   splitTo2Limbs: () => splitTo2Limbs,
   submitTransactToRelay: () => submitTransactToRelay,
@@ -767,6 +807,7 @@ __export(index_exports, {
   swapWithChange: () => swapWithChange,
   toComplianceReport: () => toComplianceReport,
   transact: () => transact,
+  transactBatch: () => transactBatch,
   transfer: () => transfer,
   truncate: () => truncate,
   tryDecryptNote: () => tryDecryptNote,
@@ -779,15 +820,19 @@ __export(index_exports, {
   validateDepositParams: () => validateDepositParams,
   validateNote: () => validateNote,
   validateOutputsSum: () => validateOutputsSum,
+  validatePaymasterTopUpTransaction: () => validatePaymasterTopUpTransaction,
   validateRoot: () => validateRoot,
   validateTransfers: () => validateTransfers,
   validateWalletConnected: () => validateWalletConnected,
   validateWithdrawableNote: () => validateWithdrawableNote,
   verifyAllCircuits: () => verifyAllCircuits,
   verifyCircuitIntegrity: () => verifyCircuitIntegrity,
+  verifyQuoteSignature: () => verifyQuoteSignature,
   verifyUtxos: () => verifyUtxos,
   waitForRoot: () => waitForRoot,
-  withTiming: () => withTiming
+  withShieldRetries: () => withShieldRetries,
+  withTiming: () => withTiming,
+  withdrawFeeFor: () => withdrawFeeFor
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1346,9 +1391,9 @@ var LocalStorageAdapter = class {
 };
 
 // src/scanning/compliance-keys.ts
-var import_tweetnacl2 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl3 = __toESM(require("tweetnacl"), 1);
 var import_blake32 = require("@noble/hashes/blake3");
-var import_sha2 = require("@noble/hashes/sha2");
+var import_sha22 = require("@noble/hashes/sha2");
 init_inputs();
 
 // src/relay/viewing-key.ts
@@ -1391,7 +1436,7 @@ function parseStrictViewingKeyChallenge(response, userPubkey, viewingKeyHex) {
 
 // src/config/relay.ts
 var CLOAK_PRODUCTION_RELAY_URL = "https://api.cloak.ag";
-var RELAY_ORIGIN_ALLOWLIST = [CLOAK_PRODUCTION_RELAY_URL];
+var RELAY_ORIGIN_ALLOWLIST = ["https://staging-api.cloak.ag"];
 var ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
 var LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
 var THIS_NETWORK_IPV4 = /^0\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
@@ -1536,6 +1581,276 @@ function connectionRpcEndpoint(connection) {
   return connection?._rpcEndpoint ?? connection?.rpcEndpoint;
 }
 
+// src/relay/payload.ts
+var import_sha2 = require("@noble/hashes/sha2");
+var import_utils = require("@noble/hashes/utils");
+var import_tweetnacl2 = __toESM(require("tweetnacl"), 1);
+var import_web33 = require("@solana/web3.js");
+init_inputs();
+var REQUEST_AUTH_DOMAIN = "CLOAK_RELAY_REQUEST_AUTH_V1";
+var REQUEST_AUTH_MAX_AGE_SECONDS = 300;
+var REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
+var RELAY_AUTH_APPROVAL_MARGIN_SECONDS = 15;
+function sha256Hex(text) {
+  return (0, import_utils.bytesToHex)((0, import_sha2.sha256)(new TextEncoder().encode(text)));
+}
+function randomNonceUuid() {
+  const webCrypto = globalThis?.crypto;
+  if (typeof webCrypto?.randomUUID === "function") return webCrypto.randomUUID();
+  const proc = globalThis?.process;
+  const nodeCrypto = typeof proc?.getBuiltinModule === "function" ? proc.getBuiltinModule("node:crypto") : void 0;
+  if (typeof nodeCrypto?.randomUUID === "function") return nodeCrypto.randomUUID();
+  const bytes = randomBytes(16);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = (0, import_utils.bytesToHex)(bytes);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+var TRANSACT_AUTH_FIELDS = [
+  "encrypted_notes",
+  "max_fee",
+  "mint",
+  "proof_bytes",
+  "public_inputs",
+  "recipient",
+  "recipient_delivery_notes",
+  "risk_quote",
+  "sender"
+];
+var TRANSACT_SWAP_AUTH_FIELDS = [
+  "close_timed_out",
+  "dexes",
+  "encrypted_notes",
+  "exclude_dexes",
+  "max_fee",
+  "min_output_amount",
+  "output_mint",
+  "proof_bytes",
+  "public_inputs",
+  "recipient",
+  "recipient_ata",
+  "refund_blinding",
+  "refund_pubkey",
+  "retry_request_id",
+  "risk_quote",
+  "route_retry_attempts",
+  "sender",
+  "slippage_bps",
+  "swap_max_retries"
+];
+var UTF8 = new TextEncoder();
+function compareKeysBytewise(a, b) {
+  if (a === b) return 0;
+  const ab = UTF8.encode(a);
+  const bb = UTF8.encode(b);
+  const shared = Math.min(ab.length, bb.length);
+  for (let i = 0; i < shared; i++) {
+    if (ab[i] !== bb[i]) return ab[i] - bb[i];
+  }
+  return ab.length - bb.length;
+}
+function canonicalJson(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || !Number.isInteger(value) || !Number.isSafeInteger(value)) {
+      throw new Error(
+        `canonicalJson: refusing to sign the number ${String(value)}. The relay renders numbers with serde_json, which spells non-integer, non-finite and very large values differently from JavaScript, so the two digests would differ and the request would be rejected with an unexplained 401. Send it as a decimal string instead, which is how every amount in this schema travels.`
+      );
+    }
+    return String(value);
+  }
+  if (typeof value === "bigint") return value.toString();
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort(compareKeysBytewise);
+    return "{" + keys.map((k) => {
+      const v = obj[k];
+      if (typeof v === "function" || typeof v === "symbol") {
+        throw new Error(
+          `canonicalJson: the key "${k}" holds a ${typeof v}, which has no JSON representation. JSON.stringify would drop it from the wire body while it stayed in the signed view, so the relay's digest could never match this one.`
+        );
+      }
+      return `${JSON.stringify(k)}:${canonicalJson(v)}`;
+    }).join(",") + "}";
+  }
+  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
+}
+var FIELDS_WITHOUT_NULL_ENCODING = {
+  slippage_bps: "500 (`default_slippage_bps` in api/transact_swap.rs)"
+};
+function buildAuthRequest(body, sender, fields) {
+  const out = {};
+  for (const k of fields) {
+    if (k === "sender") {
+      out[k] = sender;
+      continue;
+    }
+    const value = body[k];
+    if (value === void 0 || value === null) {
+      const relayDefault = FIELDS_WITHOUT_NULL_ENCODING[k];
+      if (relayDefault) {
+        throw new Error(
+          `Relay request auth: \`${k}\` must be present in the body. It is the one field in this schema that is not optional on the relay side: when it is missing the relay signs its default, ${relayDefault}, while this request would sign null. The two digests differ and the relay answers 401 "Relay request signature does not match the exact request", which points at nothing. Set \`${k}\` explicitly, to the same value the body will carry.`
+        );
+      }
+      out[k] = null;
+      continue;
+    }
+    out[k] = value;
+  }
+  return out;
+}
+function buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request) {
+  const digest = sha256Hex(canonicalJson(request));
+  return new TextEncoder().encode(
+    `${REQUEST_AUTH_DOMAIN}
+${endpoint}
+${programId.toBase58()}
+${nonce}
+${issuedAt}
+${digest}`
+  );
+}
+function buildRelayAuthPreimage(endpoint, programId, body, sender, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
+  const senderB58 = sender.toBase58();
+  const issuedAt = String(nowSeconds ?? Math.floor(Date.now() / 1e3));
+  const nonce = randomNonceUuid();
+  const request = buildAuthRequest({ ...body, sender: senderB58 }, senderB58, fields);
+  const message = buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request);
+  return { sender: senderB58, auth_issued_at: issuedAt, auth_nonce: nonce, message };
+}
+function signRelayRequest(endpoint, programId, body, signer, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
+  const preimage = buildRelayAuthPreimage(
+    endpoint,
+    programId,
+    body,
+    signer.publicKey,
+    nowSeconds,
+    fields
+  );
+  const signature = import_tweetnacl2.default.sign.detached(preimage.message, signer.secretKey);
+  return {
+    sender: preimage.sender,
+    auth_issued_at: preimage.auth_issued_at,
+    auth_nonce: preimage.auth_nonce,
+    auth_signature: Buffer.from(signature).toString("base64")
+  };
+}
+function buildAuthTransactionMessage(sender, digest) {
+  if (digest.length !== 32) throw new Error(`auth transaction digest must be 32 bytes (got ${digest.length})`);
+  const tx = new import_web33.Transaction();
+  tx.add(import_web33.SystemProgram.transfer({ fromPubkey: sender, toPubkey: sender, lamports: 0 }));
+  tx.feePayer = sender;
+  tx.recentBlockhash = new import_web33.PublicKey(digest).toBase58();
+  return tx;
+}
+function serializeAuthTransactionMessage(sender, digest) {
+  return Uint8Array.from(buildAuthTransactionMessage(sender, digest).compileMessage().serialize());
+}
+async function signRelayAuthPayload(signer, payload) {
+  if (signer instanceof import_web33.Keypair) {
+    return { signature: import_tweetnacl2.default.sign.detached(payload, signer.secretKey), mode: "message" };
+  }
+  if (signer.signMessage) {
+    const signature = await signer.signMessage(payload);
+    assertDetachedSignature(signature, "signMessage");
+    return { signature, mode: "message" };
+  }
+  if (signer.signAuthTransaction) {
+    const digest = (0, import_sha2.sha256)(payload);
+    const signed = await signer.signAuthTransaction(buildAuthTransactionMessage(signer.walletPublicKey, digest));
+    const own = signed.signatures.find((s) => s.publicKey.equals(signer.walletPublicKey))?.signature;
+    if (!own) {
+      throw new Error(
+        "The wallet returned no signature for the Cloak auth transaction. Nothing was submitted."
+      );
+    }
+    const signature = Uint8Array.from(own);
+    assertDetachedSignature(signature, "signTransaction");
+    return { signature, mode: "transaction" };
+  }
+  throw new Error("Relay auth signer has neither signMessage nor signAuthTransaction.");
+}
+function assertDetachedSignature(signature, method) {
+  if (!(signature instanceof Uint8Array) || signature.length !== 64) {
+    throw new Error(
+      `The wallet's ${method} did not return a 64-byte ed25519 detached signature (got ${signature instanceof Uint8Array ? `${signature.length} bytes` : typeof signature}). Cloak signs with a raw detached signature over the bytes it hands the wallet; adapters that wrap or re-encode the result cannot be used here.`
+    );
+  }
+}
+function assertApprovalWithinFreshnessWindow(elapsedMs, maxAgeSeconds = REQUEST_AUTH_MAX_AGE_SECONDS) {
+  const elapsedSeconds = elapsedMs / 1e3;
+  const budget = maxAgeSeconds - RELAY_AUTH_APPROVAL_MARGIN_SECONDS;
+  if (elapsedSeconds <= budget) return;
+  throw new Error(
+    `The wallet approval took ${Math.round(elapsedSeconds)} seconds, and Cloak requests stay valid for ${maxAgeSeconds} seconds from the moment they are signed (${RELAY_AUTH_APPROVAL_MARGIN_SECONDS} of those are held back for the request to reach the network). The timestamp is inside the signature, so it cannot be refreshed without your approval again. NOTHING WAS SUBMITTED and no funds moved. Start the same operation again and approve the prompt when it appears.`
+  );
+}
+function explainRelayAuthRejection(responseText) {
+  const text = String(responseText);
+  const has = (needle) => text.includes(needle);
+  if (has("issued too far in the future")) {
+    return `This computer's clock is more than ${REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS} seconds ahead of the network's, so the request looks like it was signed in the future and is refused before anything else happens. Turn on automatic date and time (or resynchronise the clock) and try again. Nothing was submitted.`;
+  }
+  if (has("signature expired")) {
+    return `The request was signed more than ${REQUEST_AUTH_MAX_AGE_SECONDS} seconds before it arrived, usually because a wallet approval was left waiting, or because this computer's clock is running behind. The signed timestamp cannot be refreshed on its own. Start the operation again. Nothing was submitted.`;
+  }
+  if (has("does not match the exact request")) {
+    return `The request body changed after it was signed, so the relay's digest and this one disagree. Sign the exact body that is POSTed, and re-POST a retry byte for byte rather than rebuilding it. If this is a hand-built swap call, check that every field in TRANSACT_SWAP_AUTH_FIELDS is present, including \`slippage_bps\`.`;
+  }
+  if (has("has no registered viewing key")) {
+    return `The signature was accepted, so this is not a signing problem: the wallet that signed has no viewing key registered with Cloak yet. Register one first, or let the SDK do it by leaving \`enforceViewingKeyRegistration\` on and supplying the viewing key.`;
+  }
+  if (has("Authenticated sender is required") || has("auth_issued_at is required") || has("auth_nonce is required") || has("auth_signature is required")) {
+    return `The request reached the relay without its authentication fields. Pass \`depositorKeypair\`, or \`signMessage\` together with \`walletPublicKey\`, so the request can be signed.`;
+  }
+  if (has("auth_nonce must be a canonical UUID")) {
+    return `\`auth_nonce\` must be a canonical lowercase UUID. Reuse the one from the preimage.`;
+  }
+  if (has("Relay request signature must be exactly 64 bytes") || has("Invalid relay request signature encoding")) {
+    return `\`auth_signature\` must be the raw 64-byte ed25519 detached signature, base64 encoded. Wallet adapters that wrap or re-encode what \`signMessage\` returns cannot be used here.`;
+  }
+  return null;
+}
+async function buildRelayAuthFields(endpoint, programId, body, signers, fields = TRANSACT_AUTH_FIELDS) {
+  if (signers.depositorKeypair) {
+    return signRelayRequest(endpoint, programId, body, signers.depositorKeypair, void 0, fields);
+  }
+  const wallet = signers.relayAuthSigner;
+  if (!wallet) return null;
+  const preimage = buildRelayAuthPreimage(
+    endpoint,
+    programId,
+    body,
+    wallet.walletPublicKey,
+    void 0,
+    fields
+  );
+  const approvalStartedMs = Date.now();
+  const { signature, mode } = await signRelayAuthPayload(wallet, preimage.message);
+  assertApprovalWithinFreshnessWindow(Date.now() - approvalStartedMs);
+  return {
+    sender: preimage.sender,
+    auth_issued_at: preimage.auth_issued_at,
+    auth_nonce: preimage.auth_nonce,
+    auth_signature: Buffer.from(signature).toString("base64"),
+    ...mode === "transaction" ? { auth_mode: mode } : {}
+  };
+}
+var REQUEST_AUTH_BATCH_DOMAIN = "CLOAK_RELAY_BATCH_AUTH_V1";
+var REQUEST_AUTH_BATCH_MAX_AGE_SECONDS = 600;
+var RELAY_BATCH_AUTH_MAX_ITEMS = 64;
+function relayRequestDigestHex(preimage) {
+  return (0, import_utils.bytesToHex)((0, import_sha2.sha256)(preimage.message));
+}
+function buildRelayBatchAuthMessage(programId, issuedAt, digests) {
+  const lines = [REQUEST_AUTH_BATCH_DOMAIN, programId.toBase58(), issuedAt, String(digests.length)];
+  return new TextEncoder().encode([...lines, ...digests].join("\n"));
+}
+
 // src/scanning/compliance-keys.ts
 var X25519_KEY_LENGTH = 32;
 var DIVERSIFIER_LENGTH = 11;
@@ -1573,7 +1888,7 @@ function deriveViewingKeyFromNk(nk) {
   preimage.set(nk, CHAIN_NOTE_VK_DOMAIN.length);
   const derived = (0, import_blake32.blake3)(preimage);
   const privateKey = clampX25519Secret(derived);
-  const publicKey = import_tweetnacl2.default.scalarMult.base(privateKey);
+  const publicKey = import_tweetnacl3.default.scalarMult.base(privateKey);
   return { privateKey, publicKey };
 }
 function deriveDiversifier(nk, commitmentHex, outputIndex) {
@@ -1608,7 +1923,7 @@ function deriveDiversifiedViewingKey(nk, diversifier) {
   preimage.set(diversifier, SK_D_DOMAIN.length + nk.length);
   const derived = (0, import_blake32.blake3)(preimage);
   const privateKey = clampX25519Secret(derived);
-  const publicKey = import_tweetnacl2.default.scalarMult.base(privateKey);
+  const publicKey = import_tweetnacl3.default.scalarMult.base(privateKey);
   return { privateKey, publicKey };
 }
 function deriveViewingKeyFromSpendKey(skSpend) {
@@ -1671,19 +1986,19 @@ async function deriveUserCompliancePublicKey(masterCompliancePublicKey, userPubl
     masterCompliancePublicKey,
     userPublicKey
   );
-  return import_tweetnacl2.default.scalarMult(factor, masterCompliancePublicKey);
+  return import_tweetnacl3.default.scalarMult(factor, masterCompliancePublicKey);
 }
-function bytesToHex2(bytes) {
+function bytesToHex3(bytes) {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function computeViewingKeyIdentifier(userPubkey, nkHex) {
   const preimage = new TextEncoder().encode(`${userPubkey.toBase58()}${nkHex}`);
-  return bytesToHex2((0, import_sha2.sha256)(preimage));
+  return bytesToHex3((0, import_sha22.sha256)(preimage));
 }
 var SIGN_IN_MESSAGE = "Cloak: Sign in\n\nSign this message to securely access your Cloak account.\nThis does NOT authorize any transaction or spend any funds.";
 async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
   assert32Bytes(nk, "nk");
-  const nkHex = bytesToHex2(nk);
+  const nkHex = bytesToHex3(nk);
   const keyId = computeViewingKeyIdentifier(userPubkey, nkHex);
   const challengeResponse = await relayFetch(`${relayUrl}/viewing-key/challenge`, {
     method: "POST",
@@ -1704,8 +2019,11 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
     nkHex
   );
   const messageBytes = new TextEncoder().encode(challenge.message);
-  const signatureBytes = await signMessage(messageBytes);
-  const signature = Buffer.from(signatureBytes).toString("base64");
+  const signed = await signRelayAuthPayload(
+    typeof signMessage === "function" ? { walletPublicKey: userPubkey, signMessage } : signMessage,
+    messageBytes
+  );
+  const signature = Buffer.from(signed.signature).toString("base64");
   const response = await relayFetch(`${relayUrl}/viewing-key/register`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -1714,7 +2032,8 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
       viewing_key: nkHex,
       nonce: challenge.nonce,
       identifier: keyId,
-      signature
+      signature,
+      ...signed.mode === "transaction" ? { auth_mode: signed.mode } : {}
     })
   });
   if (!response.ok) {
@@ -1723,7 +2042,7 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
 }
 
 // src/scanning/metadata-encryption.ts
-var import_tweetnacl3 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl4 = __toESM(require("tweetnacl"), 1);
 init_inputs();
 var AES_GCM_NONCE_LENGTH = 12;
 var AES_GCM_TAG_LENGTH = 16;
@@ -1821,8 +2140,8 @@ async function aesGcmDecrypt(ciphertext, keyBytes, nonce) {
 }
 async function encryptForRecipient(plaintext, recipientPublicKey) {
   assert32Bytes2(recipientPublicKey, "recipientPublicKey");
-  const ephemeral = import_tweetnacl3.default.box.keyPair();
-  const sharedSecret = import_tweetnacl3.default.scalarMult(ephemeral.secretKey, recipientPublicKey);
+  const ephemeral = import_tweetnacl4.default.box.keyPair();
+  const sharedSecret = import_tweetnacl4.default.scalarMult(ephemeral.secretKey, recipientPublicKey);
   const nonce = randomBytes(AES_GCM_NONCE_LENGTH);
   const ciphertext = await aesGcmEncrypt(plaintext, sharedSecret, nonce);
   return {
@@ -1881,7 +2200,7 @@ async function encryptTransactionMetadataBundle(metadata, viewingKeyPrivate, use
   const plaintext = new TextEncoder().encode(JSON.stringify(metadata));
   const basePoint = new Uint8Array(32);
   basePoint[0] = 9;
-  const viewingKeyPublic = import_tweetnacl3.default.scalarMult(viewingKeyPrivate, basePoint);
+  const viewingKeyPublic = import_tweetnacl4.default.scalarMult(viewingKeyPrivate, basePoint);
   const [userPayload, compliancePayload] = await Promise.all([
     encryptForRecipient(plaintext, viewingKeyPublic),
     encryptForRecipient(plaintext, viewingKeyPublic)
@@ -1900,7 +2219,7 @@ async function decryptTransactionMetadata(encrypted, viewKeySecret) {
   const payload = decodePayload(encrypted);
   const ephemeralPk = hexToBytes(payload.ephemeral_pk);
   assert32Bytes2(ephemeralPk, "ephemeral public key");
-  const sharedSecret = import_tweetnacl3.default.scalarMult(viewKeySecret, ephemeralPk);
+  const sharedSecret = import_tweetnacl4.default.scalarMult(viewKeySecret, ephemeralPk);
   return decryptWithSharedSecret(payload, sharedSecret);
 }
 async function decryptComplianceMetadataWithMasterKey(encrypted, masterCompliancePrivateKey, masterCompliancePublicKey, userPublicKey) {
@@ -1913,8 +2232,8 @@ async function decryptComplianceMetadataWithMasterKey(encrypted, masterComplianc
     masterCompliancePublicKey,
     userPublicKey
   );
-  const scaledEphemeral = import_tweetnacl3.default.scalarMult(userFactor, ephemeralPk);
-  const sharedSecret = import_tweetnacl3.default.scalarMult(masterCompliancePrivateKey, scaledEphemeral);
+  const scaledEphemeral = import_tweetnacl4.default.scalarMult(userFactor, ephemeralPk);
+  const sharedSecret = import_tweetnacl4.default.scalarMult(masterCompliancePrivateKey, scaledEphemeral);
   return decryptWithSharedSecret(payload, sharedSecret);
 }
 
@@ -2851,23 +3170,23 @@ function formatErrorForLogging(error) {
 init_utxo();
 
 // src/program/pda.ts
-var import_web34 = require("@solana/web3.js");
+var import_web35 = require("@solana/web3.js");
 init_utxo();
 function getShieldPoolPDAs(programId, mint = NATIVE_SOL_MINT) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  const [pool] = import_web34.PublicKey.findProgramAddressSync(
+  const [pool] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("pool"), mint.toBuffer()],
     pid
   );
-  const [merkleTree] = import_web34.PublicKey.findProgramAddressSync(
+  const [merkleTree] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("merkle_tree"), mint.toBuffer()],
     pid
   );
-  const [treasury] = import_web34.PublicKey.findProgramAddressSync(
+  const [treasury] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("treasury"), mint.toBuffer()],
     pid
   );
-  const [vaultAuthority] = import_web34.PublicKey.findProgramAddressSync(
+  const [vaultAuthority] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("vault_authority"), mint.toBuffer()],
     pid
   );
@@ -2883,7 +3202,7 @@ function getNullifierPDA(poolPubkey, nullifier, programId) {
   if (nullifier.length !== 32) {
     throw new Error(`Nullifier must be 32 bytes, got ${nullifier.length}`);
   }
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("nullifier"), poolPubkey.toBuffer(), Buffer.from(nullifier)],
     pid
   );
@@ -2893,25 +3212,25 @@ function getSwapStatePDA(poolPubkey, nullifier, programId) {
   if (nullifier.length !== 32) {
     throw new Error(`Nullifier must be 32 bytes, got ${nullifier.length}`);
   }
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("swap_state"), poolPubkey.toBuffer(), Buffer.from(nullifier)],
     pid
   );
 }
 function getPoolAuthorityConfigPDA(mint = NATIVE_SOL_MINT, programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("pool_authority"), mint.toBuffer()],
     pid
   );
 }
 function getDeliveryRegistryPDA(programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync([Buffer.from("cloak_delivery_registry")], pid)[0];
+  return import_web35.PublicKey.findProgramAddressSync([Buffer.from("cloak_delivery_registry")], pid)[0];
 }
 function getChainNoteRegistryPDA(programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync([Buffer.from("cloak_chain_note_registry")], pid)[0];
+  return import_web35.PublicKey.findProgramAddressSync([Buffer.from("cloak_chain_note_registry")], pid)[0];
 }
 
 // src/flows/verify-utxos.ts
@@ -2929,8 +3248,8 @@ async function verifyUtxos(utxos, connection, programId, commitment = "confirmed
       const nullifierHex = nullifierBig.toString(16).padStart(64, "0");
       const nullifierBytes = Buffer.from(nullifierHex, "hex");
       const { pool } = getShieldPoolPDAs(programId, utxo.mintAddress);
-      const [pda] = getNullifierPDA(pool, nullifierBytes, programId);
-      checkable.push({ utxo, pda });
+      const [pda2] = getNullifierPDA(pool, nullifierBytes, programId);
+      checkable.push({ utxo, pda: pda2 });
     } catch {
       skipped.push(utxo);
     }
@@ -3000,8 +3319,8 @@ function deriveInputNullifierPdas(programId, mint, inputNullifiers) {
   const pdas = [];
   for (const nullifier of inputNullifiers) {
     if (nullifier === BigInt(0)) continue;
-    const [pda] = getNullifierPDA(pool, bigintToBytes324(nullifier), programId);
-    pdas.push(pda);
+    const [pda2] = getNullifierPDA(pool, bigintToBytes324(nullifier), programId);
+    pdas.push(pda2);
   }
   return pdas;
 }
@@ -3242,8 +3561,9 @@ function truncate(str, len = 20) {
 var sdkLogger = createLogger("cloak::sdk");
 
 // src/relay/relay-service.ts
-var import_sha22 = require("@noble/hashes/sha2");
+var import_sha23 = require("@noble/hashes/sha2");
 init_inputs();
+var import_web36 = require("@solana/web3.js");
 var RelayService = class {
   /**
    * Create a new Relay Service client
@@ -3559,8 +3879,11 @@ var RelayService = class {
       userPubkey,
       viewingKey
     );
-    const signatureBytes = await signMessage(new TextEncoder().encode(challenge.message));
-    const signature = this.bytesToBase64(signatureBytes);
+    const signed = await signRelayAuthPayload(
+      typeof signMessage === "function" ? { walletPublicKey: new import_web36.PublicKey(userPubkey), signMessage } : signMessage,
+      new TextEncoder().encode(challenge.message)
+    );
+    const signature = this.bytesToBase64(signed.signature);
     const response = await relayFetch(`${this.baseUrl}/viewing-key/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -3569,7 +3892,8 @@ var RelayService = class {
         viewing_key: viewingKey,
         nonce: challenge.nonce,
         identifier,
-        signature
+        signature,
+        ...signed.mode === "transaction" ? { auth_mode: signed.mode } : {}
       })
     });
     if (!response.ok) {
@@ -3607,7 +3931,7 @@ var RelayService = class {
   }
   computeViewingKeyIdentifier(userPubkey, viewingKeyHex) {
     const preimage = new TextEncoder().encode(`${userPubkey}${viewingKeyHex}`);
-    const hash = (0, import_sha22.sha256)(preimage);
+    const hash = (0, import_sha23.sha256)(preimage);
     return Array.from(hash).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
 };
@@ -3725,10 +4049,10 @@ function encodeNoteSimple(note) {
 }
 
 // src/wallet/adapter.ts
-var import_web35 = require("@solana/web3.js");
+var import_web37 = require("@solana/web3.js");
 init_types();
 function validateWalletConnected(wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return;
   }
   if (!wallet.publicKey) {
@@ -3740,7 +4064,7 @@ function validateWalletConnected(wallet) {
   }
 }
 function getPublicKey(wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return wallet.publicKey;
   }
   if (!wallet.publicKey) {
@@ -3754,7 +4078,7 @@ function getPublicKey(wallet) {
 }
 async function sendTransaction(transaction, wallet, connection, options) {
   assertAllowedRpcConnection(connection);
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return await connection.sendTransaction(transaction, [wallet], options);
   }
   if (wallet.sendTransaction) {
@@ -3771,7 +4095,7 @@ async function sendTransaction(transaction, wallet, connection, options) {
   }
 }
 async function signTransaction(transaction, wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     transaction.sign(wallet);
     return transaction;
   }
@@ -3799,7 +4123,7 @@ function keypairToAdapter(keypair) {
 }
 
 // src/program/instructions.ts
-var import_web36 = require("@solana/web3.js");
+var import_web38 = require("@solana/web3.js");
 function createDepositInstruction(params) {
   if (params.commitment.length !== 32) {
     throw new Error(
@@ -3821,7 +4145,7 @@ function createDepositInstruction(params) {
   data.set(discriminant, 0);
   data.set(amountBytes, 1);
   data.set(params.commitment, 9);
-  return new import_web36.TransactionInstruction({
+  return new import_web38.TransactionInstruction({
     programId: params.programId,
     keys: [
       // Account 0: Payer (signer, writable) - pays for transaction
@@ -3829,7 +4153,7 @@ function createDepositInstruction(params) {
       // Account 1: Pool (writable) - receives SOL
       { pubkey: params.pool, isSigner: false, isWritable: true },
       // Account 2: System Program (readonly) - for transfers
-      { pubkey: import_web36.SystemProgram.programId, isSigner: false, isWritable: false },
+      { pubkey: import_web38.SystemProgram.programId, isSigner: false, isWritable: false },
       // Account 3: Merkle Tree (writable) - stores on-chain Merkle tree
       { pubkey: params.merkleTree, isSigner: false, isWritable: true }
     ],
@@ -3837,16 +4161,16 @@ function createDepositInstruction(params) {
   });
 }
 function validateDepositParams(params) {
-  if (!(params.programId instanceof import_web36.PublicKey)) {
+  if (!(params.programId instanceof import_web38.PublicKey)) {
     throw new Error("programId must be a PublicKey");
   }
-  if (!(params.payer instanceof import_web36.PublicKey)) {
+  if (!(params.payer instanceof import_web38.PublicKey)) {
     throw new Error("payer must be a PublicKey");
   }
-  if (!(params.pool instanceof import_web36.PublicKey)) {
+  if (!(params.pool instanceof import_web38.PublicKey)) {
     throw new Error("pool must be a PublicKey");
   }
-  if (!(params.merkleTree instanceof import_web36.PublicKey)) {
+  if (!(params.merkleTree instanceof import_web38.PublicKey)) {
     throw new Error("merkleTree must be a PublicKey");
   }
   if (typeof params.amount !== "number" || params.amount <= 0) {
@@ -4187,7 +4511,7 @@ async function buildMerkleTree(commitments, height = MERKLE_TREE_HEIGHT2) {
 }
 
 // src/relay/client.ts
-var import_web37 = require("@solana/web3.js");
+var import_web39 = require("@solana/web3.js");
 var import_bs58 = __toESM(require("bs58"), 1);
 
 // src/notes/refund-leaf.ts
@@ -4304,7 +4628,7 @@ var CLOSE_SWAP_STATE_TAG = 13;
 var CLOSE_SWAP_STATE_PHASE1_PAYLOAD_LEN = 40;
 var CLOSE_SWAP_STATE_PHASE1_WIRE_LEN = 1 + CLOSE_SWAP_STATE_PHASE1_PAYLOAD_LEN;
 var CLOSE_SWAP_STATE_COMMITMENT_END = 1 + 32;
-var NATIVE_SOL_MINT2 = new import_web37.PublicKey("So11111111111111111111111111111111111111112");
+var NATIVE_SOL_MINT2 = new import_web39.PublicKey("So11111111111111111111111111111111111111112");
 var PROOF_LEN = 256;
 var PUBLIC_INPUTS_LEN = 264;
 var COMMITMENTS_OFFSET = 168;
@@ -4320,7 +4644,7 @@ async function fetchWithRetry(url, options = {}) {
   const {
     timeoutMs = DEFAULT_TIMEOUT_MS,
     maxRetries = DEFAULT_MAX_RETRIES,
-    retryDelayMs = 1e3
+    retryDelayMs: retryDelayMs2 = 1e3
   } = options;
   assertAllowedRelayOrigin(url);
   let lastError = null;
@@ -4344,7 +4668,7 @@ async function fetchWithRetry(url, options = {}) {
           `Relay request failed after ${attempt + 1} attempts: ${lastError.message}`
         );
       }
-      const delay = retryDelayMs * Math.pow(2, attempt) + Math.random() * 500;
+      const delay = retryDelayMs2 * Math.pow(2, attempt) + Math.random() * 500;
       await new Promise((resolve) => setTimeout(resolve, delay));
     }
   }
@@ -4593,7 +4917,7 @@ async function preflightCheck(relayUrl, rootHex) {
 }
 
 // src/flows/transact.ts
-var import_web39 = require("@solana/web3.js");
+var import_web311 = require("@solana/web3.js");
 var import_spl_token = require("@solana/spl-token");
 var snarkjs = __toESM(require("snarkjs"), 1);
 init_utxo();
@@ -4821,7 +5145,7 @@ function chainNoteFromBase64(base64) {
 }
 
 // src/notes/delivery-note.ts
-var import_tweetnacl4 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl5 = __toESM(require("tweetnacl"), 1);
 var RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN = 32;
 var RECIPIENT_DELIVERY_NONCE_LEN = 24;
 var RECIPIENT_DELIVERY_PLAINTEXT_LEN = 40;
@@ -4872,10 +5196,10 @@ function encodeRecipientDeliveryNote(note, recipientViewingPublicKey) {
   const plaintext = new Uint8Array(RECIPIENT_DELIVERY_PLAINTEXT_LEN);
   writeU64LE2(plaintext, 0, note.amount);
   writeU256BE2(plaintext, 8, note.blinding);
-  const ephemeral = import_tweetnacl4.default.box.keyPair();
-  const shared = import_tweetnacl4.default.box.before(recipientViewingPublicKey, ephemeral.secretKey);
-  const nonce = import_tweetnacl4.default.randomBytes(import_tweetnacl4.default.secretbox.nonceLength);
-  const ciphertext = import_tweetnacl4.default.secretbox(plaintext, nonce, shared);
+  const ephemeral = import_tweetnacl5.default.box.keyPair();
+  const shared = import_tweetnacl5.default.box.before(recipientViewingPublicKey, ephemeral.secretKey);
+  const nonce = import_tweetnacl5.default.randomBytes(import_tweetnacl5.default.secretbox.nonceLength);
+  const ciphertext = import_tweetnacl5.default.secretbox(plaintext, nonce, shared);
   if (ciphertext.length !== RECIPIENT_DELIVERY_CIPHERTEXT_LEN) {
     throw new Error(
       `delivery ciphertext must be ${RECIPIENT_DELIVERY_CIPHERTEXT_LEN} bytes, got ${ciphertext.length}`
@@ -4901,8 +5225,8 @@ function openRecipientDeliveryNote(envelope, viewingSecretKey) {
     const ciphertext = envelope.slice(
       RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN + RECIPIENT_DELIVERY_NONCE_LEN
     );
-    const shared = import_tweetnacl4.default.box.before(ephemeralPk, viewingSecretKey);
-    const plaintext = import_tweetnacl4.default.secretbox.open(ciphertext, nonce, shared);
+    const shared = import_tweetnacl5.default.box.before(ephemeralPk, viewingSecretKey);
+    const plaintext = import_tweetnacl5.default.secretbox.open(ciphertext, nonce, shared);
     if (!plaintext || plaintext.length !== RECIPIENT_DELIVERY_PLAINTEXT_LEN) return null;
     return { amount: readU64LE2(plaintext, 0), blinding: readU256BE2(plaintext, 8) };
   } catch {
@@ -4960,7 +5284,7 @@ function parseDeliveryCarrierMemo(data) {
 
 // src/notes/swap-refund.ts
 var import_blake34 = require("@noble/hashes/blake3");
-var import_web38 = require("@solana/web3.js");
+var import_web310 = require("@solana/web3.js");
 var import_bs582 = __toESM(require("bs58"), 1);
 init_utxo();
 init_inputs();
@@ -5107,7 +5431,7 @@ async function discoverSwapRefunds(connection, programId, viewingKeyNk, options
   const { limit = 0, untilSignature, batchSize = 50, onStatus } = options;
   const poolMint = options.poolMint ?? NATIVE_SOL_MINT;
   const programIdBase58 = programId.toBase58();
-  const [pool] = import_web38.PublicKey.findProgramAddressSync(
+  const [pool] = import_web310.PublicKey.findProgramAddressSync(
     [Buffer.from("pool"), poolMint.toBuffer()],
     programId
   );
@@ -5158,7 +5482,7 @@ async function discoverSwapRefunds(connection, programId, viewingKeyNk, options
         if (data[0] !== TRANSACT_SWAP_TAG2 || data.length < MIN_TRANSACT_SWAP_LEN) continue;
         const nullifier = data.slice(NULLIFIER_0_OFFSET, NULLIFIER_0_OFFSET + 32);
         if (nullifier.length !== 32) continue;
-        const [swapState] = import_web38.PublicKey.findProgramAddressSync(
+        const [swapState] = import_web310.PublicKey.findProgramAddressSync(
           [Buffer.from("swap_state"), pool.toBuffer(), Buffer.from(nullifier)],
           programId
         );
@@ -5388,229 +5712,6 @@ async function matchChangeNote(params) {
 // src/flows/transact.ts
 var import_circomlibjs4 = require("circomlibjs");
 var import_tweetnacl6 = __toESM(require("tweetnacl"), 1);
-
-// src/relay/payload.ts
-var import_sha23 = require("@noble/hashes/sha2");
-var import_utils = require("@noble/hashes/utils");
-var import_tweetnacl5 = __toESM(require("tweetnacl"), 1);
-init_inputs();
-var REQUEST_AUTH_DOMAIN = "CLOAK_RELAY_REQUEST_AUTH_V1";
-var REQUEST_AUTH_MAX_AGE_SECONDS = 300;
-var REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
-var RELAY_AUTH_APPROVAL_MARGIN_SECONDS = 15;
-function sha256Hex(text) {
-  return (0, import_utils.bytesToHex)((0, import_sha23.sha256)(new TextEncoder().encode(text)));
-}
-function randomNonceUuid() {
-  const webCrypto = globalThis?.crypto;
-  if (typeof webCrypto?.randomUUID === "function") return webCrypto.randomUUID();
-  const proc = globalThis?.process;
-  const nodeCrypto = typeof proc?.getBuiltinModule === "function" ? proc.getBuiltinModule("node:crypto") : void 0;
-  if (typeof nodeCrypto?.randomUUID === "function") return nodeCrypto.randomUUID();
-  const bytes = randomBytes(16);
-  bytes[6] = bytes[6] & 15 | 64;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = (0, import_utils.bytesToHex)(bytes);
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-var TRANSACT_AUTH_FIELDS = [
-  "encrypted_notes",
-  "max_fee",
-  "mint",
-  "proof_bytes",
-  "public_inputs",
-  "recipient",
-  "recipient_delivery_notes",
-  "risk_quote",
-  "sender"
-];
-var TRANSACT_SWAP_AUTH_FIELDS = [
-  "close_timed_out",
-  "dexes",
-  "encrypted_notes",
-  "exclude_dexes",
-  "max_fee",
-  "min_output_amount",
-  "output_mint",
-  "proof_bytes",
-  "public_inputs",
-  "recipient",
-  "recipient_ata",
-  "refund_blinding",
-  "refund_pubkey",
-  "retry_request_id",
-  "risk_quote",
-  "route_retry_attempts",
-  "sender",
-  "slippage_bps",
-  "swap_max_retries"
-];
-var UTF8 = new TextEncoder();
-function compareKeysBytewise(a, b) {
-  if (a === b) return 0;
-  const ab = UTF8.encode(a);
-  const bb = UTF8.encode(b);
-  const shared = Math.min(ab.length, bb.length);
-  for (let i = 0; i < shared; i++) {
-    if (ab[i] !== bb[i]) return ab[i] - bb[i];
-  }
-  return ab.length - bb.length;
-}
-function canonicalJson(value) {
-  if (value === null || value === void 0) return "null";
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || !Number.isSafeInteger(value)) {
-      throw new Error(
-        `canonicalJson: refusing to sign the number ${String(value)}. The relay renders numbers with serde_json, which spells non-integer, non-finite and very large values differently from JavaScript, so the two digests would differ and the request would be rejected with an unexplained 401. Send it as a decimal string instead, which is how every amount in this schema travels.`
-      );
-    }
-    return String(value);
-  }
-  if (typeof value === "bigint") return value.toString();
-  if (typeof value === "string") return JSON.stringify(value);
-  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort(compareKeysBytewise);
-    return "{" + keys.map((k) => {
-      const v = obj[k];
-      if (typeof v === "function" || typeof v === "symbol") {
-        throw new Error(
-          `canonicalJson: the key "${k}" holds a ${typeof v}, which has no JSON representation. JSON.stringify would drop it from the wire body while it stayed in the signed view, so the relay's digest could never match this one.`
-        );
-      }
-      return `${JSON.stringify(k)}:${canonicalJson(v)}`;
-    }).join(",") + "}";
-  }
-  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
-}
-var FIELDS_WITHOUT_NULL_ENCODING = {
-  slippage_bps: "500 (`default_slippage_bps` in api/transact_swap.rs)"
-};
-function buildAuthRequest(body, sender, fields) {
-  const out = {};
-  for (const k of fields) {
-    if (k === "sender") {
-      out[k] = sender;
-      continue;
-    }
-    const value = body[k];
-    if (value === void 0 || value === null) {
-      const relayDefault = FIELDS_WITHOUT_NULL_ENCODING[k];
-      if (relayDefault) {
-        throw new Error(
-          `Relay request auth: \`${k}\` must be present in the body. It is the one field in this schema that is not optional on the relay side: when it is missing the relay signs its default, ${relayDefault}, while this request would sign null. The two digests differ and the relay answers 401 "Relay request signature does not match the exact request", which points at nothing. Set \`${k}\` explicitly, to the same value the body will carry.`
-        );
-      }
-      out[k] = null;
-      continue;
-    }
-    out[k] = value;
-  }
-  return out;
-}
-function buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request) {
-  const digest = sha256Hex(canonicalJson(request));
-  return new TextEncoder().encode(
-    `${REQUEST_AUTH_DOMAIN}
-${endpoint}
-${programId.toBase58()}
-${nonce}
-${issuedAt}
-${digest}`
-  );
-}
-function buildRelayAuthPreimage(endpoint, programId, body, sender, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
-  const senderB58 = sender.toBase58();
-  const issuedAt = String(nowSeconds ?? Math.floor(Date.now() / 1e3));
-  const nonce = randomNonceUuid();
-  const request = buildAuthRequest({ ...body, sender: senderB58 }, senderB58, fields);
-  const message = buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request);
-  return { sender: senderB58, auth_issued_at: issuedAt, auth_nonce: nonce, message };
-}
-function signRelayRequest(endpoint, programId, body, signer, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
-  const preimage = buildRelayAuthPreimage(
-    endpoint,
-    programId,
-    body,
-    signer.publicKey,
-    nowSeconds,
-    fields
-  );
-  const signature = import_tweetnacl5.default.sign.detached(preimage.message, signer.secretKey);
-  return {
-    sender: preimage.sender,
-    auth_issued_at: preimage.auth_issued_at,
-    auth_nonce: preimage.auth_nonce,
-    auth_signature: Buffer.from(signature).toString("base64")
-  };
-}
-function assertApprovalWithinFreshnessWindow(elapsedMs) {
-  const elapsedSeconds = elapsedMs / 1e3;
-  const budget = REQUEST_AUTH_MAX_AGE_SECONDS - RELAY_AUTH_APPROVAL_MARGIN_SECONDS;
-  if (elapsedSeconds <= budget) return;
-  throw new Error(
-    `The wallet approval took ${Math.round(elapsedSeconds)} seconds, and Cloak requests stay valid for ${REQUEST_AUTH_MAX_AGE_SECONDS} seconds from the moment they are signed (${RELAY_AUTH_APPROVAL_MARGIN_SECONDS} of those are held back for the request to reach the network). The timestamp is inside the signature, so it cannot be refreshed without your approval again. NOTHING WAS SUBMITTED and no funds moved. Start the same operation again and approve the prompt when it appears.`
-  );
-}
-function explainRelayAuthRejection(responseText) {
-  const text = String(responseText);
-  const has = (needle) => text.includes(needle);
-  if (has("issued too far in the future")) {
-    return `This computer's clock is more than ${REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS} seconds ahead of the network's, so the request looks like it was signed in the future and is refused before anything else happens. Turn on automatic date and time (or resynchronise the clock) and try again. Nothing was submitted.`;
-  }
-  if (has("signature expired")) {
-    return `The request was signed more than ${REQUEST_AUTH_MAX_AGE_SECONDS} seconds before it arrived, usually because a wallet approval was left waiting, or because this computer's clock is running behind. The signed timestamp cannot be refreshed on its own. Start the operation again. Nothing was submitted.`;
-  }
-  if (has("does not match the exact request")) {
-    return `The request body changed after it was signed, so the relay's digest and this one disagree. Sign the exact body that is POSTed, and re-POST a retry byte for byte rather than rebuilding it. If this is a hand-built swap call, check that every field in TRANSACT_SWAP_AUTH_FIELDS is present, including \`slippage_bps\`.`;
-  }
-  if (has("has no registered viewing key")) {
-    return `The signature was accepted, so this is not a signing problem: the wallet that signed has no viewing key registered with Cloak yet. Register one first, or let the SDK do it by leaving \`enforceViewingKeyRegistration\` on and supplying the viewing key.`;
-  }
-  if (has("Authenticated sender is required") || has("auth_issued_at is required") || has("auth_nonce is required") || has("auth_signature is required")) {
-    return `The request reached the relay without its authentication fields. Pass \`depositorKeypair\`, or \`signMessage\` together with \`walletPublicKey\`, so the request can be signed.`;
-  }
-  if (has("auth_nonce must be a canonical UUID")) {
-    return `\`auth_nonce\` must be a canonical lowercase UUID. Reuse the one from the preimage.`;
-  }
-  if (has("Relay request signature must be exactly 64 bytes") || has("Invalid relay request signature encoding")) {
-    return `\`auth_signature\` must be the raw 64-byte ed25519 detached signature, base64 encoded. Wallet adapters that wrap or re-encode what \`signMessage\` returns cannot be used here.`;
-  }
-  return null;
-}
-async function buildRelayAuthFields(endpoint, programId, body, signers, fields = TRANSACT_AUTH_FIELDS) {
-  if (signers.depositorKeypair) {
-    return signRelayRequest(endpoint, programId, body, signers.depositorKeypair, void 0, fields);
-  }
-  const wallet = signers.relayAuthSigner;
-  if (!wallet) return null;
-  const preimage = buildRelayAuthPreimage(
-    endpoint,
-    programId,
-    body,
-    wallet.walletPublicKey,
-    void 0,
-    fields
-  );
-  const approvalStartedMs = Date.now();
-  const signature = await wallet.signMessage(preimage.message);
-  assertApprovalWithinFreshnessWindow(Date.now() - approvalStartedMs);
-  if (!(signature instanceof Uint8Array) || signature.length !== 64) {
-    throw new Error(
-      `The wallet's signMessage did not return a 64-byte ed25519 detached signature (got ${signature instanceof Uint8Array ? `${signature.length} bytes` : typeof signature}). Cloak signs with a raw detached signature over the bytes it hands the wallet; adapters that wrap or re-encode the result cannot be used here. Pass depositorKeypair instead, or use an adapter whose signMessage returns the raw signature.`
-    );
-  }
-  return {
-    sender: preimage.sender,
-    auth_issued_at: preimage.auth_issued_at,
-    auth_nonce: preimage.auth_nonce,
-    auth_signature: Buffer.from(signature).toString("base64")
-  };
-}
-
-// src/flows/transact.ts
 init_inputs();
 
 // src/proving/artifacts.ts
@@ -5888,6 +5989,7 @@ async function resolveTransactionCircuitFiles() {
 }
 var _transactPaddingSaltCounter = 0;
 var _registeredViewingKeys = /* @__PURE__ */ new Set();
+var _viewingKeyRegistrationsInFlight = /* @__PURE__ */ new Map();
 var _resolvedAltAccountsCache = /* @__PURE__ */ new Map();
 var _relayMerkleDisabledMints = /* @__PURE__ */ new Set();
 var _relayMerkleFallbackNotifiedMints = /* @__PURE__ */ new Set();
@@ -6012,7 +6114,7 @@ async function fetchSupplementalAltFromRelay(relayUrl, params) {
     throw new Error("Supplemental ALT response is missing a 'table' address");
   }
   try {
-    return new import_web39.PublicKey(table);
+    return new import_web311.PublicKey(table);
   } catch {
     throw new Error(`Supplemental ALT response 'table' is not a valid public key: ${table}`);
   }
@@ -6080,7 +6182,7 @@ async function resolveAddressLookupTableAccounts(connection, relayUrl, altAddres
   const fetched = await Promise.all(
     altAddresses.map(async (addr) => {
       try {
-        const pubkey = new import_web39.PublicKey(addr);
+        const pubkey = new import_web311.PublicKey(addr);
         const result = await connection.getAddressLookupTable(pubkey);
         return result.value ?? null;
       } catch {
@@ -6170,7 +6272,7 @@ function calculateConfiguredProtocolFee(amount, config) {
   return total;
 }
 async function readLiveProtocolFee(connection, programId, mint, amount, requireSwapOpen = false) {
-  const [poolConfigPda] = import_web39.PublicKey.findProgramAddressSync(
+  const [poolConfigPda] = import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("pool_config"), mint.toBuffer()],
     programId
   );
@@ -6220,6 +6322,23 @@ async function computeSwapExtDataHash(outputMint, recipientAta, minOutputAmount,
   ]);
   return poseidonHasher.F.toObject(hash);
 }
+function assertInputMints(inputUtxos, expectedMint) {
+  const funded = inputUtxos.filter((u) => u.amount > BigInt(0));
+  if (funded.length === 0) return;
+  const first = funded[0].mintAddress;
+  for (const utxo of funded) {
+    if (!utxo.mintAddress.equals(first)) {
+      throw new Error(
+        `Input notes span more than one mint (${first.toBase58()} and ${utxo.mintAddress.toBase58()}). Every pool holds a single mint, so this cannot be a valid spend of either. Select notes of one mint.`
+      );
+    }
+  }
+  if (expectedMint && !first.equals(expectedMint)) {
+    throw new Error(
+      `Input notes are ${first.toBase58()} but this transaction expects ${expectedMint.toBase58()}. The notes decide which pool is spent, so proceeding would move the wrong asset \u2014 refusing. This usually means note selection ignored the mint.`
+    );
+  }
+}
 function parseNkInput(input) {
   if (typeof input !== "string") {
     if (input.length !== 32) {
@@ -6275,6 +6394,26 @@ async function ensureViewingKeyRegistered(options, onProgress, fallbackNk) {
   if (_registeredViewingKeys.has(cacheKey)) {
     return;
   }
+  const inFlight = _viewingKeyRegistrationsInFlight.get(cacheKey);
+  if (inFlight) {
+    return inFlight;
+  }
+  const registration = registerViewingKeyOnce(
+    relayUrl,
+    userPubkey,
+    viewingKeyHex,
+    cacheKey,
+    options,
+    onProgress
+  );
+  _viewingKeyRegistrationsInFlight.set(cacheKey, registration);
+  try {
+    await registration;
+  } finally {
+    _viewingKeyRegistrationsInFlight.delete(cacheKey);
+  }
+}
+async function registerViewingKeyOnce(relayUrl, userPubkey, viewingKeyHex, cacheKey, options, onProgress) {
   const challengeResponse = await relayFetch(`${relayUrl}/viewing-key/challenge`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -6295,17 +6434,27 @@ async function ensureViewingKeyRegistered(options, onProgress, fallbackNk) {
     viewingKeyHex
   );
   let signatureBase64;
+  let authMode = "message";
+  const messageBytes = new TextEncoder().encode(challenge.message);
   if (options.signMessage) {
-    const messageBytes = new TextEncoder().encode(challenge.message);
     const sig = await options.signMessage(messageBytes);
     signatureBase64 = Buffer.from(sig).toString("base64");
   } else if (options.depositorKeypair) {
-    const messageBytes = new TextEncoder().encode(challenge.message);
     const sig = import_tweetnacl6.default.sign.detached(messageBytes, options.depositorKeypair.secretKey);
     signatureBase64 = Buffer.from(sig).toString("base64");
+  } else if (options.signAuthTransaction) {
+    onProgress?.(
+      "Approve the viewing-key registration in your wallet. It shows as a 0 SOL transfer to yourself and is never sent to the network."
+    );
+    const signed = await signRelayAuthPayload(
+      { walletPublicKey: userPubkey, signAuthTransaction: options.signAuthTransaction },
+      messageBytes
+    );
+    signatureBase64 = Buffer.from(signed.signature).toString("base64");
+    authMode = signed.mode;
   } else {
     throw new Error(
-      "Viewing key registration is mandatory: signMessage (wallet) or depositorKeypair is required."
+      "Viewing key registration is mandatory: signMessage or signAuthTransaction (wallet) or depositorKeypair is required."
     );
   }
   onProgress?.("Registering viewing key...");
@@ -6316,7 +6465,8 @@ async function ensureViewingKeyRegistered(options, onProgress, fallbackNk) {
       user_pubkey: userPubkey.toBase58(),
       viewing_key: viewingKeyHex,
       nonce: challenge.nonce,
-      signature: signatureBase64
+      signature: signatureBase64,
+      ...authMode === "transaction" ? { auth_mode: authMode } : {}
     })
   });
   if (!response.ok) {
@@ -6410,7 +6560,7 @@ function buildPublicInputsBytesFromSignals(publicSignals) {
 var TRANSACT_DISCRIMINATOR = 0;
 var RANGE_QUOTE_TAG_DEPOSIT = 1;
 function deriveRiskNoncePDA(programId, nonce) {
-  return import_web39.PublicKey.findProgramAddressSync(
+  return import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("risk_nonce"), Buffer.from(nonce)],
     programId
   );
@@ -6429,7 +6579,7 @@ function extractDepositNonceFromEd25519Ix(ix) {
   }
 }
 function deriveNullifierPDA(programId, poolPDA, nullifier) {
-  return import_web39.PublicKey.findProgramAddressSync(
+  return import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("nullifier"), poolPDA.toBuffer(), Buffer.from(nullifier)],
     programId
   );
@@ -6462,7 +6612,7 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
   }
   if (!isDepositData) {
     data[offset++] = 3;
-    data.set((relayer ?? import_web39.PublicKey.default).toBytes(), offset);
+    data.set((relayer ?? import_web311.PublicKey.default).toBytes(), offset);
     offset += 32;
     writeBigUInt64LE(data, relayerFee ?? BigInt(0), offset);
     offset += 8;
@@ -6492,7 +6642,7 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
     // 4. nullifier PDA 0 (writable)
     { pubkey: nullifierPDA1, isSigner: false, isWritable: true },
     // 5. nullifier PDA 1 (writable)
-    { pubkey: import_web39.SystemProgram.programId, isSigner: false, isWritable: false }
+    { pubkey: import_web311.SystemProgram.programId, isSigner: false, isWritable: false }
     // 6. system_program
   ];
   if (splAccounts) {
@@ -6501,34 +6651,34 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
     accounts.push({ pubkey: splAccounts.tokenProgram, isSigner: false, isWritable: false });
     if (splAccounts.payerAta) {
       if (enableRiskCheck) {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       }
       accounts.push({ pubkey: splAccounts.payerAta, isSigner: false, isWritable: true });
       if (riskNonce) {
         accounts.push({ pubkey: riskNonce, isSigner: false, isWritable: true });
       }
     } else if (enableRiskCheck && !recipient) {
-      accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+      accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
     }
   } else {
     if (recipient) {
       accounts.push({ pubkey: recipient, isSigner: false, isWritable: true });
       if (enableRiskCheck) {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       }
     } else if (enableRiskCheck) {
       if (publicAmountForAccounts === BigInt(0)) {
         accounts.push({ pubkey: payer, isSigner: true, isWritable: false });
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       } else {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
         if (riskNonce) {
           accounts.push({ pubkey: riskNonce, isSigner: false, isWritable: true });
         }
       }
     }
   }
-  return new import_web39.TransactionInstruction({
+  return new import_web311.TransactionInstruction({
     programId,
     keys: accounts,
     data
@@ -6537,10 +6687,10 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
 var PACKET_LIMIT_BYTES = 1232;
 function getCommonALTAddresses() {
   return [
-    import_web39.SystemProgram.programId,
-    import_web39.SYSVAR_SLOT_HASHES_PUBKEY,
-    import_web39.SYSVAR_INSTRUCTIONS_PUBKEY,
-    import_web39.ComputeBudgetProgram.programId
+    import_web311.SystemProgram.programId,
+    import_web311.SYSVAR_SLOT_HASHES_PUBKEY,
+    import_web311.SYSVAR_INSTRUCTIONS_PUBKEY,
+    import_web311.ComputeBudgetProgram.programId
   ];
 }
 function dedupePubkeys(addresses) {
@@ -6591,12 +6741,12 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
     try {
       const slot = await connection.getSlot("finalized");
       const altPayerPubkey = externalFeePayer ? await externalFeePayer.getPayerPubkey() : depositor.publicKey;
-      const [createIx, altAddress] = import_web39.AddressLookupTableProgram.createLookupTable({
+      const [createIx, altAddress] = import_web311.AddressLookupTableProgram.createLookupTable({
         authority: depositor.publicKey,
         payer: altPayerPubkey,
         recentSlot: slot
       });
-      const extendIx = import_web39.AddressLookupTableProgram.extendLookupTable({
+      const extendIx = import_web311.AddressLookupTableProgram.extendLookupTable({
         payer: altPayerPubkey,
         authority: depositor.publicKey,
         lookupTable: altAddress,
@@ -6615,12 +6765,12 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
           allowSupplementalAlt
         );
       } else {
-        const tx = new import_web39.Transaction().add(createIx).add(extendIx);
+        const tx = new import_web311.Transaction().add(createIx).add(extendIx);
         const { blockhash } = await connection.getLatestBlockhash();
         tx.recentBlockhash = blockhash;
         tx.feePayer = depositor.publicKey;
         if (depositor.keypair) {
-          await (0, import_web39.sendAndConfirmTransaction)(connection, tx, [depositor.keypair], { commitment: "confirmed" });
+          await (0, import_web311.sendAndConfirmTransaction)(connection, tx, [depositor.keypair], { commitment: "confirmed" });
         } else if (depositor.signTransaction) {
           const signedTx = await depositor.signTransaction(tx);
           const sig = await connection.sendRawTransaction(signedTx.serialize());
@@ -6659,7 +6809,7 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
 var SOLANA_PACKET_DATA_SIZE = 1232;
 function estimateV0TransactionSize(payerKey, recentBlockhash, instructions, addressLookupTableAccounts) {
   try {
-    const messageV0 = new import_web39.TransactionMessage({
+    const messageV0 = new import_web311.TransactionMessage({
       payerKey,
       recentBlockhash,
       instructions
@@ -6728,7 +6878,7 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
   const { blockhash: quoteBlockhash } = await connection.getLatestBlockhash();
   const measure = (instrs, alts) => {
     try {
-      const message = new import_web39.TransactionMessage({
+      const message = new import_web311.TransactionMessage({
         payerKey: externalFeePayerPubkey,
         recentBlockhash: quoteBlockhash,
         instructions: instrs
@@ -6786,12 +6936,12 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
     pre = measure(instructions, addressLookupTableAccounts);
   }
   failIfOverLimit(pre.size, pre.error);
-  const quoteMessage = new import_web39.TransactionMessage({
+  const quoteMessage = new import_web311.TransactionMessage({
     payerKey: externalFeePayerPubkey,
     recentBlockhash: quoteBlockhash,
     instructions
   }).compileToV0Message(addressLookupTableAccounts ?? []);
-  const quoteTxBase64 = Buffer.from(new import_web39.VersionedTransaction(quoteMessage).serialize()).toString("base64");
+  const quoteTxBase64 = Buffer.from(new import_web311.VersionedTransaction(quoteMessage).serialize()).toString("base64");
   const paymentInstruction = await externalFeePayer.getPaymentInstruction(quoteTxBase64);
   const finalInstructions = [...instructions, paymentInstruction];
   let post = measure(finalInstructions, addressLookupTableAccounts);
@@ -6802,12 +6952,12 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
   failIfOverLimit(post.size, post.error);
   onProgress?.("Building final transaction...");
   const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash();
-  const finalMessage = new import_web39.TransactionMessage({
+  const finalMessage = new import_web311.TransactionMessage({
     payerKey: externalFeePayerPubkey,
     recentBlockhash: blockhash,
     instructions: finalInstructions
   }).compileToV0Message(addressLookupTableAccounts ?? []);
-  const finalTx = new import_web39.VersionedTransaction(finalMessage);
+  const finalTx = new import_web311.VersionedTransaction(finalMessage);
   onProgress?.("Waiting for wallet signature...");
   const partiallySignedTx = await depositor.signTransaction(finalTx);
   const partiallySignedBase64 = Buffer.from(partiallySignedTx.serialize()).toString("base64");
@@ -7028,8 +7178,8 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
       baseInstructions.splice(riskQuoteIx ? 1 : 0, 0, ...topUpInstructions);
     }
   }
-  const cuLimitIx = import_web39.ComputeBudgetProgram.setComputeUnitLimit({ units: 12e5 });
-  const cuPriceIx = import_web39.ComputeBudgetProgram.setComputeUnitPrice({ microLamports: 1e5 });
+  const cuLimitIx = import_web311.ComputeBudgetProgram.setComputeUnitLimit({ units: 12e5 });
+  const cuPriceIx = import_web311.ComputeBudgetProgram.setComputeUnitPrice({ microLamports: 1e5 });
   const fullInstructions = [...baseInstructions, cuLimitIx, cuPriceIx, transactIx];
   const compactInstructions = [...baseInstructions, cuLimitIx, transactIx];
   const minimalInstructions = [...baseInstructions, cuLimitIx, transactIx];
@@ -7141,12 +7291,12 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
         }
         let transportAttempt = 0;
         while (true) {
-          const messageV0 = new import_web39.TransactionMessage({
+          const messageV0 = new import_web311.TransactionMessage({
             payerKey: depositor.publicKey,
             recentBlockhash: blockhash,
             instructions: ixs
           }).compileToV0Message(addressLookupTableAccounts);
-          const versionedTx = new import_web39.VersionedTransaction(messageV0);
+          const versionedTx = new import_web311.VersionedTransaction(messageV0);
           if (onTransactProofBuilt) {
             await onTransactProofBuilt();
           }
@@ -7276,7 +7426,7 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
     let legacyTransportAttempt = 0;
     while (true) {
       try {
-        const tx = new import_web39.Transaction();
+        const tx = new import_web311.Transaction();
         for (const ix of instructions) {
           tx.add(ix);
         }
@@ -7284,7 +7434,7 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
         tx.feePayer = depositor.publicKey;
         if (depositor.keypair) {
           onProgress?.("Signing and sending transaction...");
-          signature = await (0, import_web39.sendAndConfirmTransaction)(
+          signature = await (0, import_web311.sendAndConfirmTransaction)(
             connection,
             tx,
             [depositor.keypair],
@@ -7500,7 +7650,7 @@ async function fetchRiskQuote(riskQuoteUrl, wallet, options) {
     const messageArr = hexToBytes2(messageHex);
     let signerPubkey;
     try {
-      signerPubkey = new import_web39.PublicKey(signerB58);
+      signerPubkey = new import_web311.PublicKey(signerB58);
     } catch {
       throw new Error("Invalid risk quote response: signer_pubkey is not a public key");
     }
@@ -7524,7 +7674,7 @@ async function fetchRiskQuote(riskQuoteUrl, wallet, options) {
     const signature = new Uint8Array(signatureBuf);
     const message = new Uint8Array(messageArr);
     const publicKey = new Uint8Array(publicKeyBytes);
-    const instruction = import_web39.Ed25519Program.createInstructionWithPublicKey({
+    const instruction = import_web311.Ed25519Program.createInstructionWithPublicKey({
       publicKey,
       message,
       signature
@@ -7601,18 +7751,22 @@ function planRelayAuth(options) {
   const walletPublicKey = resolveUserWallet(options);
   if (options.depositorKeypair) return { kind: "keypair" };
   const signMessage = options.signMessage;
+  const signAuthTransaction = options.signAuthTransaction;
   if (walletPublicKey && signMessage) return { kind: "wallet", signer: { walletPublicKey, signMessage } };
-  if (!walletPublicKey && !signMessage) return { kind: "none" };
+  if (walletPublicKey && signAuthTransaction) {
+    return { kind: "wallet", signer: { walletPublicKey, signAuthTransaction } };
+  }
+  if (!walletPublicKey && !signMessage && !signAuthTransaction) return { kind: "none" };
   return {
     kind: "incomplete",
-    detail: signMessage ? "`signMessage` was provided but no wallet public key, so the request has no sender to authenticate as. Add `walletPublicKey` (or `depositorPublicKey`)." : "a wallet public key was provided but no `signMessage`, so nothing can sign. Add `signMessage` from the same wallet adapter."
+    detail: signMessage || signAuthTransaction ? "a signer was provided but no wallet public key, so the request has no sender to authenticate as. Add `walletPublicKey` (or `depositorPublicKey`)." : "a wallet public key was provided but no `signMessage` and no `signAuthTransaction`, so nothing can sign. Add `signMessage` from the wallet adapter, or `signAuthTransaction` (its `signTransaction`) for a wallet that cannot sign messages."
   };
 }
 function assertRelayAuthAvailable(plan, flow) {
   if (plan.kind === "keypair" || plan.kind === "wallet") return;
   const cause = plan.kind === "none" ? "no signer was provided." : `the signer provided cannot produce one: ${plan.detail}`;
   throw new Error(
-    `Cloak ${flow} requires an authenticated sender, and ${cause} Pass either \`depositorKeypair\` (a local Keypair) or \`signMessage\` together with \`walletPublicKey\` (a browser wallet adapter). The sender must be the end user's own wallet. Checked before proof generation, so nothing has been computed or submitted yet.`
+    `Cloak ${flow} requires an authenticated sender, and ${cause} Pass either \`depositorKeypair\` (a local Keypair), or \`signMessage\` (a browser wallet adapter) or \`signAuthTransaction\` (a hardware wallet that cannot sign messages) together with \`walletPublicKey\`. The sender must be the end user's own wallet. Checked up front, so nothing has been computed or submitted yet.`
   );
 }
 async function submitTransactToRelay(args) {
@@ -7630,12 +7784,12 @@ async function submitTransactToRelay(args) {
   const doFetch = args.fetchImpl ?? fetch;
   const maxNetworkRetries = args.maxNetworkRetries ?? relayNetworkRetries();
   const requestTimeoutMs = args.requestTimeoutMs ?? relayRequestTimeoutMs();
-  if (!depositorKeypair && args.relayAuthSigner) {
+  if (!depositorKeypair && args.relayAuthSigner && !args.relayAuthBatch) {
     onProgress?.(
       "Approve the request in your wallet. This signs the request for the relay, not a transaction, and it must be approved within a few minutes to stay valid."
     );
   }
-  const authFields = await buildRelayAuthFields("/transact", programId, requestBody, {
+  const authFields = args.relayAuthBatch ? await args.relayAuthBatch.authorize("/transact", programId, requestBody, TRANSACT_AUTH_FIELDS) : await buildRelayAuthFields("/transact", programId, requestBody, {
     depositorKeypair,
     relayAuthSigner: args.relayAuthSigner
   });
@@ -7831,7 +7985,7 @@ async function transact(params, options) {
     // names is refused.
     maxRootRetries = 40,
     // Increased to handle prolonged relay sync recovery under high concurrency
-    retryDelayMs = 500,
+    retryDelayMs: retryDelayMs2 = 500,
     // Start with short delay, will exponentially back off
     riskOracleQueue,
     riskQuoteUrl: riskQuoteUrlOption,
@@ -7886,6 +8040,7 @@ async function transact(params, options) {
     }
   }
   assertAllowedRpcConnection(connection);
+  assertInputMints(inputUtxos, options.expectedMint);
   await ensureViewingKeyRegistered(options, onProgress, fallbackNk);
   const resolvedChainNoteNk = explicitChainNoteNk ?? fallbackNk ?? null;
   if (inputUtxos.length > 2) {
@@ -8252,7 +8407,7 @@ async function transact(params, options) {
   while (submissionAttempts <= maxRootRetries) {
     const isRetry = submissionAttempts > 0;
     if (isRetry) {
-      const exponentialDelay = Math.min(retryDelayMs * Math.pow(1.5, submissionAttempts - 1), 5e3);
+      const exponentialDelay = Math.min(retryDelayMs2 * Math.pow(1.5, submissionAttempts - 1), 5e3);
       const jitter = Math.random() * 500;
       const totalDelay = Math.floor(exponentialDelay + jitter);
       await sleep2(totalDelay);
@@ -8391,11 +8546,14 @@ async function transact(params, options) {
     }
     let proof;
     let publicSignals;
+    const releaseProofSlot = options.relayAuthBatch ? await options.relayAuthBatch.proofSlot() : void 0;
     try {
       const result = await generateTransactionProof(circuitInputs, onProofProgress);
       proof = result.proof;
       publicSignals = result.publicSignals;
+      releaseProofSlot?.();
     } catch (proofError) {
+      releaseProofSlot?.();
       const errorMsg = proofError?.message || String(proofError);
       if ((errorMsg.includes("ForceEqual") || errorMsg.includes("Assert Failed")) && submissionAttempts < maxRootRetries) {
         onProgress?.(`Merkle proof error (stale sibling data), will regenerate with fresh tree...`);
@@ -8415,7 +8573,7 @@ async function transact(params, options) {
         }
         treeState = null;
         useSiblingInfo = false;
-        const waitMs = Math.min(retryDelayMs * Math.pow(2, Math.min(submissionAttempts, 4)), 5e3);
+        const waitMs = Math.min(retryDelayMs2 * Math.pow(2, Math.min(submissionAttempts, 4)), 5e3);
         if (waitMs > 0) {
           onProgress?.(`Waiting ${waitMs}ms for relay sync before retry...`);
           await new Promise((r) => setTimeout(r, waitMs));
@@ -8708,6 +8866,7 @@ async function transact(params, options) {
       // point where they reach the relay submission instead of stopping at viewing-key
       // registration. The keypair still wins when both are present.
       relayAuthSigner: relayAuthPlan.kind === "wallet" ? relayAuthPlan.signer : void 0,
+      relayAuthBatch: options.relayAuthBatch,
       settlement: {
         connection,
         programId,
@@ -8753,7 +8912,7 @@ async function transact(params, options) {
         "All relay-tree attempts failed. Rebuilding merkle tree from chain as last resort..."
       );
       try {
-        const [merkleTreePda] = import_web39.PublicKey.findProgramAddressSync(
+        const [merkleTreePda] = import_web311.PublicKey.findProgramAddressSync(
           [Buffer.from("merkle_tree"), mint.toBuffer()],
           programId
         );
@@ -9109,7 +9268,7 @@ async function swapUtxo(params, options) {
     riskQuoteUrl: riskQuoteUrlOption,
     maxRootRetries = 40,
     // Increased to handle prolonged relay sync recovery under high concurrency
-    retryDelayMs = 500,
+    retryDelayMs: retryDelayMs2 = 500,
     // Start with short delay, will exponentially back off
     useUniqueNullifiers,
     useChainRootForProof = true
@@ -9128,6 +9287,12 @@ async function swapUtxo(params, options) {
   if (inputUtxos.length > 2) {
     throw new Error("Maximum 2 input UTXOs allowed");
   }
+  assertInputMints(inputUtxos, NATIVE_SOL_MINT);
+  if (options.expectedMint && !options.expectedMint.equals(NATIVE_SOL_MINT)) {
+    throw new Error(
+      `swapUtxo expects ${NATIVE_SOL_MINT.toBase58()} input notes (a swap always spends from the wSOL pool), but expectedMint was ${options.expectedMint.toBase58()}. Drop expectedMint, or spend the other mint with transact/transfer instead.`
+    );
+  }
   await preflightNullifiers(inputUtxos, connection, programId);
   const outputMintAccount = await connection.getAccountInfo(outputMint, {
     commitment: "confirmed"
@@ -9514,7 +9679,7 @@ async function swapUtxo(params, options) {
   let walletApprovals = 0;
   for (let attempt = 0; attempt <= maxRootRetries; attempt++) {
     if (attempt > 0) {
-      const exponentialDelay = Math.min(retryDelayMs * Math.pow(1.5, attempt - 1), 5e3);
+      const exponentialDelay = Math.min(retryDelayMs2 * Math.pow(1.5, attempt - 1), 5e3);
       const jitter = Math.random() * 500;
       const totalDelay = Math.floor(exponentialDelay + jitter);
       await sleep2(totalDelay);
@@ -9652,7 +9817,7 @@ async function swapUtxo(params, options) {
         }
         merkleState = null;
         useSiblingInfo = false;
-        const waitMs = Math.min(retryDelayMs * Math.pow(2, Math.min(attempt, 4)), 5e3);
+        const waitMs = Math.min(retryDelayMs2 * Math.pow(2, Math.min(attempt, 4)), 5e3);
         if (waitMs > 0) {
           onProgress?.(`Waiting ${waitMs}ms for relay sync before retry...`);
           await new Promise((r) => setTimeout(r, waitMs));
@@ -9735,7 +9900,7 @@ async function swapUtxo(params, options) {
     }
     if (options.onSwapStatePredicted && inputNullifiers.length > 0) {
       const nBytes = bigintToBytes323(inputNullifiers[0]);
-      const [ssp] = import_web39.PublicKey.findProgramAddressSync(
+      const [ssp] = import_web311.PublicKey.findProgramAddressSync(
         [Buffer.from("swap_state"), pdas.pool.toBuffer(), Buffer.from(nBytes)],
         programId
       );
@@ -10157,28 +10322,294 @@ function cleanupStalePendingOperations(maxAgeMs = 24 * 60 * 60 * 1e3) {
 // src/index.ts
 init_utxo();
 
-// src/scanning/scan.ts
-var import_bs583 = __toESM(require("bs58"), 1);
-var import_web310 = require("@solana/web3.js");
-var import_spl_token2 = require("@solana/spl-token");
-init_inputs();
-init_utxo();
-var bs583 = import_bs583.default.default || import_bs583.default;
-var TRANSACT_TAG2 = 0;
-var TRANSACT_SWAP_TAG3 = 1;
-var PROOF_LEN3 = 256;
-var PUBLIC_INPUTS_LEN3 = 264;
-var SWAP_PARAMS_LEN = 72;
-var CHAIN_NOTES_OFFSET_TRANSACT = 1 + PROOF_LEN3 + PUBLIC_INPUTS_LEN3;
-var CHAIN_NOTES_OFFSET_TRANSACT_SWAP = 1 + PROOF_LEN3 + PUBLIC_INPUTS_LEN3 + SWAP_PARAMS_LEN;
-var PUBLIC_INPUTS_OFFSET = 1 + PROOF_LEN3;
-var SWAP_OUTPUT_MINT_OFFSET = CHAIN_NOTES_OFFSET_TRANSACT;
-var TOKEN_PROGRAM_ID2 = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-var SOL_MINT = "So11111111111111111111111111111111111111112";
-var USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
-var USDT_MINT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
-var PUBLIC_AMOUNT_OFFSET = 32;
-var EXT_DATA_HASH_OFFSET = 40;
+// src/relay/batch-auth.ts
+var import_web312 = require("@solana/web3.js");
+var RelayBatchAuthCoordinator = class {
+  constructor(options) {
+    this.proofSlotsInUse = 0;
+    this.proofQueue = [];
+    this.items = [];
+    this.signing = false;
+    this.slotsInUse = 0;
+    this.ready = [];
+    this.waves = 0;
+    if (!Number.isInteger(options.items) || options.items < 1) {
+      throw new Error(`A batch needs at least one item (got ${options.items}).`);
+    }
+    if (options.items > RELAY_BATCH_AUTH_MAX_ITEMS) {
+      throw new Error(
+        `A batch may cover at most ${RELAY_BATCH_AUTH_MAX_ITEMS} requests (got ${options.items}); the relay refuses longer digest lists. Chunk the payout. The practical bound is lower still: each spend appends two roots to the on-chain ring of 100, so a batch proved against one root evicts it by itself before 50 items.`
+      );
+    }
+    const concurrency = options.submitConcurrency ?? 3;
+    if (!Number.isInteger(concurrency) || concurrency < 1) {
+      throw new Error(`submitConcurrency must be a positive integer (got ${concurrency}).`);
+    }
+    this.signer = options.signer;
+    this.sender = options.signer instanceof import_web312.Keypair ? options.signer.publicKey : options.signer.walletPublicKey;
+    this.expectedItems = options.items;
+    this.submitConcurrency = concurrency;
+    const proofConcurrency = options.proofConcurrency ?? 2;
+    if (!Number.isInteger(proofConcurrency) || proofConcurrency < 1) {
+      throw new Error(`proofConcurrency must be a positive integer (got ${proofConcurrency}).`);
+    }
+    this.proofConcurrency = proofConcurrency;
+    this.onProgress = options.onProgress;
+  }
+  /** The wallet that signs and is every item's authenticated `sender`. */
+  get walletPublicKey() {
+    return this.sender;
+  }
+  /** How many times the signer has been asked so far: one per wave. */
+  get approvals() {
+    return this.waves;
+  }
+  /** Where every item is right now. For progress UIs and for diagnosing a batch that never signs. */
+  snapshot() {
+    const count = (state) => this.items.filter((i) => i.state === state).length;
+    return {
+      building: count("building"),
+      waiting: count("waiting"),
+      submitting: count("submitting"),
+      done: count("done"),
+      proving: this.proofSlotsInUse,
+      proofQueue: this.proofQueue.length,
+      registered: this.items.length,
+      expected: this.expectedItems
+    };
+  }
+  /** Register one item. Throws past `items`: the wave condition would never be reachable. */
+  item() {
+    if (this.items.length >= this.expectedItems) {
+      throw new Error(
+        `This batch was created for ${this.expectedItems} item(s) and all of them are registered.`
+      );
+    }
+    const item = { state: "building", waiting: null, holdsSlot: false };
+    this.items.push(item);
+    return {
+      proofSlot: () => this.acquireProofSlot(),
+      authorize: (endpoint, programId, body, fields) => this.authorize(item, endpoint, programId, body, fields),
+      finish: () => this.finish(item)
+    };
+  }
+  acquireProofSlot() {
+    return new Promise((resolve) => {
+      const grant = () => {
+        this.proofSlotsInUse += 1;
+        let released = false;
+        resolve(() => {
+          if (released) return;
+          released = true;
+          this.proofSlotsInUse -= 1;
+          const next = this.proofQueue.shift();
+          if (next) next();
+        });
+      };
+      if (this.proofSlotsInUse < this.proofConcurrency) grant();
+      else this.proofQueue.push(grant);
+    });
+  }
+  authorize(item, endpoint, programId, body, fields) {
+    if (item.state === "done") {
+      return Promise.reject(new Error("This batch item already finished; it cannot authorize."));
+    }
+    if (item.state === "waiting") {
+      return Promise.reject(new Error("This batch item is already waiting for a signature."));
+    }
+    this.releaseSlot(item);
+    return new Promise((resolve, reject) => {
+      item.state = "waiting";
+      item.waiting = { endpoint, programId, body, fields, resolve, reject };
+      this.maybeSign();
+    });
+  }
+  finish(item) {
+    if (item.state === "done") return;
+    if (item.state === "waiting" && item.waiting) {
+      item.waiting.reject(new Error("Batch item finished before it was signed."));
+      item.waiting = null;
+    }
+    this.releaseSlot(item);
+    item.state = "done";
+    this.maybeSign();
+    this.pump();
+  }
+  releaseSlot(item) {
+    if (!item.holdsSlot) return;
+    item.holdsSlot = false;
+    this.slotsInUse -= 1;
+  }
+  /** Sign when every registered item is either waiting here or finished, and nothing is building. */
+  maybeSign() {
+    if (this.signing) return;
+    if (this.items.length < this.expectedItems) return;
+    if (this.items.some((item) => item.state === "building" || item.state === "submitting")) return;
+    const wave = this.items.filter((item) => item.state === "waiting");
+    if (wave.length === 0) return;
+    this.signing = true;
+    void this.signWave(wave).finally(() => {
+      this.signing = false;
+      this.maybeSign();
+    });
+  }
+  async signWave(wave) {
+    const waiting = wave.map((item) => item.waiting);
+    try {
+      const programId = waiting[0].programId;
+      for (const w of waiting) {
+        if (!w.programId.equals(programId)) {
+          throw new Error("Every item of a batch must target the same program id.");
+        }
+      }
+      const nowSeconds = Math.floor(Date.now() / 1e3);
+      const preimages = waiting.map(
+        (w) => buildRelayAuthPreimage(w.endpoint, programId, w.body, this.sender, nowSeconds, w.fields)
+      );
+      const digests = preimages.map(relayRequestDigestHex);
+      const issuedAt = preimages[0].auth_issued_at;
+      const message = buildRelayBatchAuthMessage(programId, issuedAt, digests);
+      this.waves += 1;
+      if (!(this.signer instanceof import_web312.Keypair)) {
+        const asTransaction = !this.signer.signMessage;
+        this.onProgress?.(
+          `Approve ${waiting.length} request(s) in your wallet` + (this.waves > 1 ? ` (approval ${this.waves}, for the rows that had to re-prove)` : "") + (asTransaction ? `. Your wallet shows this as a 0 SOL transfer to yourself: it is how a wallet that cannot sign messages authorizes the requests for the relay, and it is never sent to the network. Approve it on the device within a few minutes.` : `. This signs the requests for the relay, not a transaction, and must be approved within a few minutes to stay valid.`)
+        );
+      }
+      const approvalStartedMs = Date.now();
+      const { signature, mode } = await signRelayAuthPayload(this.signer, message);
+      if (!(this.signer instanceof import_web312.Keypair)) {
+        assertApprovalWithinFreshnessWindow(
+          Date.now() - approvalStartedMs,
+          REQUEST_AUTH_BATCH_MAX_AGE_SECONDS
+        );
+      }
+      const signatureB64 = Buffer.from(signature).toString("base64");
+      wave.forEach((item, i) => {
+        const preimage = preimages[i];
+        this.ready.push({
+          item,
+          fields: {
+            sender: preimage.sender,
+            auth_issued_at: preimage.auth_issued_at,
+            auth_nonce: preimage.auth_nonce,
+            auth_signature: signatureB64,
+            ...mode === "transaction" ? { auth_mode: mode } : {},
+            // A fresh array per item: `Object.assign` puts this on the wire body, and the body is
+            // serialized again on every network retry.
+            auth_batch: { digests: [...digests] }
+          }
+        });
+      });
+      this.pump();
+    } catch (error) {
+      for (const item of wave) {
+        const w = item.waiting;
+        item.waiting = null;
+        item.state = "done";
+        w?.reject(error);
+      }
+    }
+  }
+  /** Release signed items to submit, `submitConcurrency` at a time, in signing order. */
+  pump() {
+    while (this.ready.length > 0 && this.slotsInUse < this.submitConcurrency) {
+      const next = this.ready.shift();
+      const w = next.item.waiting;
+      next.item.waiting = null;
+      if (next.item.state !== "waiting" || !w) continue;
+      next.item.state = "submitting";
+      next.item.holdsSlot = true;
+      this.slotsInUse += 1;
+      w.resolve(next.fields);
+    }
+  }
+};
+function createRelayBatchAuthCoordinator(options) {
+  return new RelayBatchAuthCoordinator(options);
+}
+
+// src/flows/transact-batch.ts
+async function transactBatch(items, options) {
+  if (items.length === 0) {
+    return { results: [], approvals: 0 };
+  }
+  if (items.length > RELAY_BATCH_AUTH_MAX_ITEMS) {
+    throw new Error(
+      `transactBatch accepts at most ${RELAY_BATCH_AUTH_MAX_ITEMS} items per call (got ${items.length}). Chunk the payout; see RELAY_BATCH_AUTH_MAX_ITEMS for why the practical bound is lower.`
+    );
+  }
+  if (!options.relayUrl) {
+    throw new Error("transactBatch requires relayUrl: batch approval is a relay authentication scheme.");
+  }
+  const { proofConcurrency, submitConcurrency, ...shared } = options;
+  const signer = shared.depositorKeypair ? shared.depositorKeypair : (() => {
+    const wallet = shared.walletPublicKey ?? shared.depositorPublicKey;
+    if (!wallet) return null;
+    if (shared.signMessage) return { walletPublicKey: wallet, signMessage: shared.signMessage };
+    if (shared.signAuthTransaction) {
+      return { walletPublicKey: wallet, signAuthTransaction: shared.signAuthTransaction };
+    }
+    return null;
+  })();
+  if (!signer) {
+    throw new Error(
+      "transactBatch requires an authenticated sender: pass `depositorKeypair` (a local Keypair), or `walletPublicKey` with `signMessage` (a browser wallet adapter) or `signAuthTransaction` (a hardware wallet). Checked up front, so nothing has been computed or submitted yet."
+    );
+  }
+  const coordinator = createRelayBatchAuthCoordinator({
+    signer,
+    items: items.length,
+    proofConcurrency,
+    submitConcurrency,
+    onProgress: shared.onProgress
+  });
+  const handles = items.map(() => coordinator.item());
+  const results = new Array(items.length);
+  const runOne = async (index) => {
+    const item = items[index];
+    const handle = handles[index];
+    const label = `[batch ${index + 1}/${items.length}]`;
+    try {
+      const value = await transact(item.params, {
+        ...shared,
+        ...item.options,
+        relayAuthBatch: handle,
+        onProgress: shared.onProgress ? (status) => shared.onProgress?.(`${label} ${status}`) : void 0
+      });
+      results[index] = { status: "fulfilled", value };
+    } catch (reason) {
+      results[index] = { status: "rejected", reason };
+    } finally {
+      handle.finish();
+    }
+  };
+  await Promise.all(items.map((_, index) => runOne(index)));
+  return { results, approvals: coordinator.approvals };
+}
+
+// src/scanning/scan.ts
+var import_bs583 = __toESM(require("bs58"), 1);
+var import_web313 = require("@solana/web3.js");
+var import_spl_token2 = require("@solana/spl-token");
+init_inputs();
+init_utxo();
+var bs583 = import_bs583.default.default || import_bs583.default;
+var TRANSACT_TAG2 = 0;
+var TRANSACT_SWAP_TAG3 = 1;
+var PROOF_LEN3 = 256;
+var PUBLIC_INPUTS_LEN3 = 264;
+var SWAP_PARAMS_LEN = 72;
+var CHAIN_NOTES_OFFSET_TRANSACT = 1 + PROOF_LEN3 + PUBLIC_INPUTS_LEN3;
+var CHAIN_NOTES_OFFSET_TRANSACT_SWAP = 1 + PROOF_LEN3 + PUBLIC_INPUTS_LEN3 + SWAP_PARAMS_LEN;
+var PUBLIC_INPUTS_OFFSET = 1 + PROOF_LEN3;
+var SWAP_OUTPUT_MINT_OFFSET = CHAIN_NOTES_OFFSET_TRANSACT;
+var TOKEN_PROGRAM_ID2 = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var SOL_MINT = "So11111111111111111111111111111111111111112";
+var USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+var USDT_MINT = "Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB";
+var PUBLIC_AMOUNT_OFFSET = 32;
+var EXT_DATA_HASH_OFFSET = 40;
 var OUTPUT_COMMITMENT_0_OFFSET = 168;
 var OUTPUT_COMMITMENT_1_OFFSET = 200;
 var CHAIN_NOTE_HASH_OFFSET = 232;
@@ -10248,7 +10679,7 @@ function parseSwapOutputMint(data) {
   const mintBytes = data.slice(SWAP_OUTPUT_MINT_OFFSET, end);
   if (mintBytes.every((byte) => byte === 0)) return void 0;
   try {
-    return new import_web310.PublicKey(mintBytes).toBase58();
+    return new import_web313.PublicKey(mintBytes).toBase58();
   } catch {
     return void 0;
   }
@@ -10338,7 +10769,7 @@ function parseSwapRecipientAta(data) {
   const recipientAtaBytes = data.slice(recipientAtaStart, recipientAtaEnd);
   if (recipientAtaBytes.every((byte) => byte === 0)) return void 0;
   try {
-    return new import_web310.PublicKey(recipientAtaBytes).toBase58();
+    return new import_web313.PublicKey(recipientAtaBytes).toBase58();
   } catch {
     return void 0;
   }
@@ -10500,7 +10931,7 @@ async function scanSwapNoteCarriers(connection, programId, viewingKeyNk, swapCtx
   let rpcCalls = 0;
   const candidates = Array.from(swapCtxByCommitment.keys());
   if (candidates.length === 0) return { records, rpcCalls };
-  const [registry] = import_web310.PublicKey.findProgramAddressSync(
+  const [registry] = import_web313.PublicKey.findProgramAddressSync(
     [Buffer.from("cloak_chain_note_registry")],
     programId
   );
@@ -10903,8 +11334,8 @@ async function scanTransactions(opts) {
                   if (onChainAta) {
                     try {
                       const expectedAta = (0, import_spl_token2.getAssociatedTokenAddressSync)(
-                        new import_web310.PublicKey(asset.mint),
-                        new import_web310.PublicKey(walletPublicKey)
+                        new import_web313.PublicKey(asset.mint),
+                        new import_web313.PublicKey(walletPublicKey)
                       ).toBase58();
                       if (onChainAta === expectedAta) {
                         isOurs = true;
@@ -11118,7 +11549,7 @@ async function scanTransactions(opts) {
                   // deposit — that is the public deposit amount. A deposit that also merged inputs
                   // carries a larger output 0 and is not recoverable from public data alone.
                   amount: grossAmount,
-                  mintAddress: new import_web310.PublicKey(asset.mint),
+                  mintAddress: new import_web313.PublicKey(asset.mint),
                   outputCommitments: ixCtx.outputCommitments ?? []
                 });
                 if (recoveredDeposit) {
@@ -11144,7 +11575,7 @@ async function scanTransactions(opts) {
                   noteSalt: compactNote.noteSalt,
                   amount: compactNote.outAmount0,
                   keypair: { privateKey: 0n, publicKey: compactNote.outPubkey0 },
-                  mintAddress: new import_web310.PublicKey(asset.mint),
+                  mintAddress: new import_web313.PublicKey(asset.mint),
                   outputIndex: 0,
                   // v4 describes output 0, which is where change lands
                   outputCommitments: ixCtx.outputCommitments ?? []
@@ -11337,7 +11768,7 @@ function formatComplianceCsv(report) {
 }
 
 // src/wallet/utxo-wallet.ts
-var import_web311 = require("@solana/web3.js");
+var import_web314 = require("@solana/web3.js");
 init_utxo();
 var UtxoWallet = class _UtxoWallet {
   constructor(viewingKey) {
@@ -11550,7 +11981,7 @@ var UtxoWallet = class _UtxoWallet {
       data.viewingKey ? new Uint8Array(data.viewingKey) : void 0
     );
     for (const w of data.wallets) {
-      const mint = new import_web311.PublicKey(w.mint);
+      const mint = new import_web314.PublicKey(w.mint);
       for (const u of w.utxos) {
         wallet.addUtxo({
           amount: BigInt(u.amount),
@@ -11632,13 +12063,781 @@ var SimpleWallet = class {
   }
 };
 
+// src/bridge/rail-verify.ts
+var import_tweetnacl7 = __toESM(require("tweetnacl"), 1);
+var import_sha256 = require("@noble/hashes/sha256");
+var ONECLICK_PUBKEY_B58 = "reYaWhvwu8Jzo3WUM3zhn6VrhuMEF4eADL17qtRVifc";
+var b58 = /* @__PURE__ */ (() => {
+  const A = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+  return {
+    decode(s) {
+      let n = 0n;
+      for (const c of s) {
+        const i = A.indexOf(c);
+        if (i < 0) throw new Error("bad base58");
+        n = n * 58n + BigInt(i);
+      }
+      const bytes = [];
+      while (n > 0n) {
+        bytes.unshift(Number(n & 255n));
+        n >>= 8n;
+      }
+      for (const c of s) {
+        if (c === "1") bytes.unshift(0);
+        else break;
+      }
+      return Uint8Array.from(bytes);
+    },
+    encode(b) {
+      let n = 0n;
+      for (const x of b) n = n * 256n + BigInt(x);
+      let s = "";
+      while (n > 0n) {
+        s = A[Number(n % 58n)] + s;
+        n /= 58n;
+      }
+      for (const x of b) {
+        if (x === 0) s = "1" + s;
+        else break;
+      }
+      return s;
+    }
+  };
+})();
+function stable(v) {
+  if (v === null || typeof v !== "object") return JSON.stringify(v) ?? "null";
+  if (Array.isArray(v)) return `[${v.map(stable).join(",")}]`;
+  const o = v;
+  const parts = Object.keys(o).sort().filter((k) => o[k] !== void 0).map((k) => `${JSON.stringify(k)}:${stable(o[k])}`);
+  return `{${parts.join(",")}}`;
+}
+function signedRequest(r) {
+  const q = r.quoteRequest ?? {};
+  return {
+    dry: q.dry,
+    swapType: q.swapType,
+    slippageTolerance: q.slippageTolerance,
+    originAsset: q.originAsset,
+    depositType: q.depositType,
+    destinationAsset: q.destinationAsset,
+    amount: q.amount,
+    refundTo: q.refundTo,
+    refundType: q.refundType,
+    recipient: q.recipient,
+    recipientType: q.recipientType,
+    deadline: q.deadline,
+    quoteWaitingTimeMs: q.quoteWaitingTimeMs || void 0,
+    referral: q.referral || void 0,
+    virtualChainRecipient: q.virtualChainRecipient || void 0,
+    virtualChainRefundRecipient: q.virtualChainRefundRecipient || void 0,
+    customRecipientMsg: q.customRecipientMsg || void 0
+    // Deliberately unsigned by the rail: sessionId, connectedWallets, correlationId, appFees,
+    // partnerId, userAccountId, depositMode. APP FEES ARE NOT AUTHENTICATED — never display a fee
+    // caption as if the signature vouched for it.
+  };
+}
+function signedQuote(r) {
+  const q = r.quote ?? {};
+  const base = {
+    amountIn: q.amountIn,
+    amountInFormatted: q.amountInFormatted,
+    amountInUsd: q.amountInUsd,
+    minAmountIn: q.minAmountIn,
+    amountOut: q.amountOut,
+    amountOutFormatted: q.amountOutFormatted,
+    amountOutUsd: q.amountOutUsd,
+    minAmountOut: q.minAmountOut
+  };
+  if (r.quoteRequest?.dry) return base;
+  return {
+    ...base,
+    depositAddress: q.depositAddress || void 0,
+    // <- the field that makes substitution detectable
+    depositMemo: q.depositMemo || void 0,
+    deadline: q.deadline || void 0,
+    // <- a real, SIGNED expiry
+    timeWhenInactive: q.timeWhenInactive || void 0,
+    timeEstimate: q.timeEstimate || void 0,
+    virtualChainRecipient: q.virtualChainRecipient || void 0,
+    virtualChainRefundRecipient: q.virtualChainRefundRecipient || void 0,
+    customRecipientMsg: q.customRecipientMsg || void 0,
+    refundFee: q.refundFee || void 0,
+    withdrawFee: q.withdrawFee || void 0
+  };
+}
+function canonicalPayloadString(resp) {
+  return stable({ ...signedRequest(resp), ...signedQuote(resp), timestamp: resp.timestamp });
+}
+function verifyQuoteSignature(resp) {
+  if (!resp?.signature) return { valid: false, reason: "no signature on the response" };
+  const payload = { ...signedRequest(resp), ...signedQuote(resp), timestamp: resp.timestamp };
+  const digest = (0, import_sha256.sha256)(new TextEncoder().encode(stable(payload)));
+  const message = new TextEncoder().encode(b58.encode(new Uint8Array(digest)));
+  const sig = resp.signature.replace(/^ed25519:/, "");
+  try {
+    return { valid: import_tweetnacl7.default.sign.detached.verify(message, b58.decode(sig), b58.decode(ONECLICK_PUBKEY_B58)) };
+  } catch (e) {
+    return { valid: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+
+// src/bridge/rails.ts
+async function parseBridgeResponse(res, what) {
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new Error(`${what} failed: ${res.status} ${res.statusText} (response body was not JSON)`);
+  }
+  if (!res.ok) {
+    const b = body ?? {};
+    throw new Error(
+      `${what} failed: ${b.message ?? res.statusText} (${b.code ?? res.status}${b.retryable ? ", retryable" : ""})`
+    );
+  }
+  return body;
+}
+function toAttestation(raw) {
+  if (raw.kind === "ed25519") {
+    return { kind: "ed25519", verified: raw.verified ?? false, signer: raw.signer ?? "" };
+  }
+  return { kind: "none", checks: raw.checks ?? [], note: raw.note ?? "" };
+}
+async function fetchBridgeQuote(relayUrl, req) {
+  const body = {
+    recipient: req.recipient,
+    origin_chain: req.originChain,
+    amount_base_units: req.amountBaseUnits.toString(),
+    allocate: req.allocate ?? false
+  };
+  if (req.refundTo !== void 0) body.refund_to = req.refundTo;
+  if (req.rails !== void 0) body.rails = req.rails;
+  const res = await relayFetch(`${relayUrl}/bridge/quote`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const raw = await parseBridgeResponse(res, "bridge quote");
+  const options = [];
+  const unavailable = (raw.unavailable ?? []).map((p) => ({
+    rail: p.rail,
+    reason: p.reason
+  }));
+  for (const opt of raw.options) {
+    const attestation = toAttestation(opt.attestation);
+    if (attestation.kind === "ed25519") {
+      const verdict = opt.rail_response ? verifyQuoteSignature(opt.rail_response) : { valid: false, reason: "no rail_response to verify against" };
+      if (!verdict.valid) {
+        unavailable.push({
+          rail: opt.rail,
+          reason: `deposit address failed independent signature verification, refusing to display it (${verdict.reason ?? "signature did not verify"})`
+        });
+        continue;
+      }
+    }
+    options.push({
+      rail: opt.rail,
+      refunds: opt.refunds,
+      addressLifetime: opt.address_lifetime,
+      amountOut: BigInt(opt.amount_out),
+      minAmountOut: BigInt(opt.min_amount_out),
+      timeEstimateSeconds: opt.time_estimate_s,
+      expiresAt: opt.expires_at,
+      depositAddress: opt.deposit_address,
+      attestation
+    });
+  }
+  return { options, unavailable };
+}
+var STATUS_STATES = [
+  "pending",
+  "delivered",
+  "refunded",
+  "expired",
+  "unknown"
+];
+async function fetchBridgeStatus(relayUrl, depositAddress, rail) {
+  const qs = new URLSearchParams({ deposit_address: depositAddress, rail });
+  const res = await relayFetch(`${relayUrl}/bridge/status?${qs.toString()}`);
+  const raw = await parseBridgeResponse(res, "bridge status");
+  const state = STATUS_STATES.includes(raw.state ?? "") ? raw.state : "unknown";
+  return { rail: raw.rail ?? rail, state, detail: raw.detail ?? "" };
+}
+function cloakBridgeRail(relayUrl) {
+  assertAllowedRelayOrigin(relayUrl);
+  return {
+    id: "cloak-bridge",
+    quote: (req) => fetchBridgeQuote(relayUrl, req),
+    status: (depositAddress, rail) => fetchBridgeStatus(relayUrl, depositAddress, rail)
+  };
+}
+
+// src/bridge/paymaster-client.ts
+var import_web315 = require("@solana/web3.js");
+var import_spl_token3 = require("@solana/spl-token");
+function validatePaymasterTopUpTransaction(tx, expect) {
+  const ixs = tx.instructions;
+  if (ixs.length !== 1 && ixs.length !== 2) {
+    throw new Error(
+      `paymaster top-up must be exactly 1 or 2 instructions, got ${ixs.length} \u2014 refusing to sign a transaction whose shape does not match the documented top-up contract`
+    );
+  }
+  const ix0 = ixs[0];
+  if (!ix0.programId.equals(import_web315.SystemProgram.programId)) {
+    throw new Error(
+      `paymaster top-up instruction 0 is owned by ${ix0.programId.toBase58()}, not the System Program \u2014 refusing to sign an unrecognised first instruction`
+    );
+  }
+  const transfer2 = import_web315.SystemInstruction.decodeTransfer(ix0);
+  if (!transfer2.toPubkey.equals(expect.recipient)) {
+    throw new Error(
+      `paymaster top-up sends SOL to ${transfer2.toPubkey.toBase58()}, which is not our recipient ${expect.recipient.toBase58()} \u2014 refusing to sign a transaction that funds a key we do not control`
+    );
+  }
+  if (BigInt(transfer2.lamports) > expect.maxGrantLamports) {
+    throw new Error(
+      `paymaster top-up grants ${transfer2.lamports} lamports, more than the ${expect.maxGrantLamports} we asked for \u2014 refusing a transaction that funds beyond our own request`
+    );
+  }
+  if (ixs.length === 1) return;
+  const ix1 = ixs[1];
+  if (!ix1.programId.equals(import_spl_token3.TOKEN_PROGRAM_ID)) {
+    throw new Error(
+      `paymaster top-up instruction 1 is owned by ${ix1.programId.toBase58()}, not the SPL Token program \u2014 refusing to sign an unrecognised second instruction`
+    );
+  }
+  const spl = (0, import_spl_token3.decodeTransferInstruction)(ix1, import_spl_token3.TOKEN_PROGRAM_ID);
+  const authority = spl.keys.owner.pubkey;
+  if (!authority.equals(expect.recipient)) {
+    throw new Error(
+      `paymaster top-up's fee transfer is authorised by ${authority.toBase58()}, not our recipient ${expect.recipient.toBase58()} \u2014 refusing to sign away tokens from an account we do not control`
+    );
+  }
+  const expectedDestination = (0, import_spl_token3.getAssociatedTokenAddressSync)(
+    expect.feeMint,
+    expect.paymentAddress,
+    false
+  );
+  const destination = spl.keys.destination.pubkey;
+  if (!destination.equals(expectedDestination)) {
+    throw new Error(
+      `paymaster top-up's fee transfer is addressed to ${destination.toBase58()}, not the paymaster's own payment ATA ${expectedDestination.toBase58()} \u2014 refusing to sign a payment to an unverified destination`
+    );
+  }
+  const paidAmount = BigInt(spl.data.amount);
+  if (paidAmount !== expect.feeTokenAmount) {
+    throw new Error(
+      `paymaster top-up's fee amount is ${paidAmount}, not the ${expect.feeTokenAmount} Kora quoted at prepare time \u2014 refusing to sign a payment that does not match the quote`
+    );
+  }
+}
+async function parseBridgeResponse2(res, what) {
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new Error(`${what} failed: ${res.status} ${res.statusText} (response body was not JSON)`);
+  }
+  if (!res.ok) {
+    const b = body ?? {};
+    throw new Error(
+      `${what} failed: ${b.message ?? res.statusText} (${b.code ?? res.status}${b.retryable ? ", retryable" : ""})`
+    );
+  }
+  return body;
+}
+async function fundReceiverViaPaymaster(relayUrl, receiver, grantLamports) {
+  assertAllowedRelayOrigin(relayUrl);
+  if (grantLamports <= 0n || grantLamports > BigInt(Number.MAX_SAFE_INTEGER)) {
+    throw new Error(
+      `grantLamports must be a positive value representable as a JS number, got ${grantLamports}`
+    );
+  }
+  const prepareRes = await relayFetch(`${relayUrl}/bridge/paymaster/prepare`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      recipient: receiver.publicKey.toBase58(),
+      grant_lamports: Number(grantLamports)
+    })
+  });
+  const prepared = await parseBridgeResponse2(prepareRes, "paymaster prepare");
+  if (Math.floor(Date.now() / 1e3) >= prepared.expires_at_unix) {
+    throw new Error(
+      "paymaster prepare returned a voucher that is already expired \u2014 refusing to sign a stale top-up rather than fail confusingly at cosign"
+    );
+  }
+  const feeMint = new import_web315.PublicKey(prepared.fee_mint);
+  const paymentAddress = new import_web315.PublicKey(prepared.payment_address);
+  const feeTokenAmount = BigInt(prepared.fee_token_amount);
+  const tx = import_web315.Transaction.from(Buffer.from(prepared.transaction, "base64"));
+  validatePaymasterTopUpTransaction(tx, {
+    recipient: receiver.publicKey,
+    maxGrantLamports: grantLamports,
+    feeMint,
+    feeTokenAmount,
+    paymentAddress
+  });
+  tx.partialSign(receiver);
+  const cosignRes = await relayFetch(`${relayUrl}/bridge/paymaster/cosign`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      transaction: tx.serialize({ requireAllSignatures: false, verifySignatures: false }).toString("base64"),
+      voucher: prepared.voucher
+    })
+  });
+  const cosigned = await parseBridgeResponse2(cosignRes, "paymaster cosign");
+  return {
+    transaction: import_web315.Transaction.from(Buffer.from(cosigned.transaction, "base64")),
+    feeTokenAmount,
+    feeMint: prepared.fee_mint,
+    paymentAddress: prepared.payment_address
+  };
+}
+
+// src/bridge/derive.ts
+var import_web316 = require("@solana/web3.js");
+var import_hmac = require("@noble/hashes/hmac");
+var import_sha512 = require("@noble/hashes/sha512");
+var BRIDGE_ESCROW_LABEL = "cloak_bridge_escrow";
+var MAX_RECEIVER_INDEX = 1e4;
+function deriveBridgeReceiver(nk, index) {
+  if (!Number.isInteger(index) || index < 0) {
+    throw new Error(`index must be a non-negative integer, got ${index}`);
+  }
+  if (index > MAX_RECEIVER_INDEX) {
+    throw new Error(
+      `index ${index} exceeds MAX_RECEIVER_INDEX (${MAX_RECEIVER_INDEX}). Indices must be a small sequential counter \u2014 discovery derives 0\u2026N and reads each on chain, so a timestamp index is unreachable by any scan and the deposit would be invisible to every device but this one.`
+    );
+  }
+  const h = (0, import_hmac.hmac)(import_sha512.sha512, new Uint8Array(nk), new TextEncoder().encode(`${BRIDGE_ESCROW_LABEL}:${index}`));
+  return import_web316.Keypair.fromSeed(h.slice(0, 32));
+}
+
+// src/bridge/discover.ts
+var import_web317 = require("@solana/web3.js");
+var import_spl_token4 = require("@solana/spl-token");
+function describeError(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function listBridgeDeposits(conn, nk, opts) {
+  const scanDepth = Math.min(opts.scanDepth ?? 20, MAX_RECEIVER_INDEX + 1);
+  const stopAfterUnused = opts.stopAfterUnused ?? 5;
+  const out = [];
+  let consecutiveUnused = 0;
+  for (let index = 0; index < scanDepth; index++) {
+    const kp = deriveBridgeReceiver(nk, index);
+    const receiver = kp.publicKey;
+    const tokenAccount = (0, import_spl_token4.getAssociatedTokenAddressSync)(opts.mint, receiver, false);
+    try {
+      const [recvInfo, ataInfo] = await conn.getMultipleAccountsInfo([receiver, tokenAccount]);
+      const lamports = recvInfo?.lamports ?? 0;
+      let tokenBalance = 0n;
+      if (ataInfo) {
+        try {
+          tokenBalance = BigInt((await conn.getTokenAccountBalance(tokenAccount)).value.amount);
+        } catch (err) {
+          if (!(err instanceof import_web317.SolanaJSONRPCError && /could not find account/i.test(err.message))) {
+            throw err;
+          }
+        }
+      }
+      if (lamports === 0 && !ataInfo) {
+        consecutiveUnused++;
+        if (consecutiveUnused >= stopAfterUnused) break;
+        continue;
+      }
+      consecutiveUnused = 0;
+      const shieldSignatures = [];
+      const sigs = await conn.getSignaturesForAddress(receiver, { limit: 20 });
+      for (const s of sigs) {
+        if (s.err) continue;
+        const tx = await conn.getTransaction(s.signature, { maxSupportedTransactionVersion: 0 });
+        const keys = tx?.transaction.message.getAccountKeys({
+          accountKeysFromLookups: tx.meta?.loadedAddresses
+        });
+        if (keys && [...Array(keys.length).keys()].some((i) => keys.get(i)?.equals(opts.programId))) {
+          shieldSignatures.push(s.signature);
+        }
+      }
+      const shieldSignature = shieldSignatures[0];
+      const indexReused = shieldSignatures.length > 1;
+      let state;
+      if (tokenBalance > 0n) state = shieldSignature ? "needs-cleanup" : "arrived";
+      else if (shieldSignature) state = ataInfo ? "needs-cleanup" : "complete";
+      else state = "awaiting";
+      out.push({
+        index,
+        receiver,
+        tokenAccount,
+        state,
+        tokenBalance,
+        lamports,
+        shieldSignature,
+        ...indexReused ? { indexReused, shieldSignatures } : {}
+      });
+    } catch (err) {
+      out.push({
+        index,
+        receiver,
+        tokenAccount,
+        state: "unknown",
+        tokenBalance: 0n,
+        lamports: 0,
+        error: describeError(err)
+      });
+    }
+  }
+  return out;
+}
+
+// src/bridge/deposit-core.ts
+var import_web319 = require("@solana/web3.js");
+var import_tweetnacl8 = __toESM(require("tweetnacl"), 1);
+init_utxo();
+
+// src/bridge/funder.ts
+var import_web318 = require("@solana/web3.js");
+var import_spl_token5 = require("@solana/spl-token");
+var MAINNET_RENT_0 = 890880;
+var MAINNET_RENT_1 = 897840;
+var FEE_BUDGET = 13e4;
+var CLEANUP_FEE_BUDGET = 5e3;
+var pda = (seeds, programId) => import_web318.PublicKey.findProgramAddressSync(seeds.map((s) => Buffer.from(s)), programId)[0];
+function deriveFundingTargets(d) {
+  const pool = pda([Buffer.from("pool"), d.mint.toBuffer()], d.programId);
+  return {
+    pool,
+    // program: NullifierAccount::derive_pda_with_pool -> [b"nullifier", pool, nullifier]
+    nullifier0: pda([Buffer.from("nullifier"), pool.toBuffer(), d.nullifiers[0]], d.programId),
+    nullifier1: pda([Buffer.from("nullifier"), pool.toBuffer(), d.nullifiers[1]], d.programId),
+    // relay: derive_risk_nonce_pda -> [b"risk_nonce", bind0]
+    riskNonce: pda([Buffer.from("risk_nonce"), d.bind0], d.programId),
+    depositorAta: (0, import_spl_token5.getAssociatedTokenAddressSync)(d.mint, d.depositor, false)
+  };
+}
+async function readRent(conn) {
+  const [zero, one] = await Promise.all([
+    conn.getMinimumBalanceForRentExemption(0),
+    conn.getMinimumBalanceForRentExemption(1)
+  ]);
+  return { zero, one };
+}
+
+// src/bridge/deposit-core.ts
+var DepositError = class extends Error {
+  constructor(message, fundedAccounts, measuredTxSize) {
+    super(message);
+    this.fundedAccounts = fundedAccounts;
+    this.measuredTxSize = measuredTxSize;
+    this.name = "DepositError";
+  }
+};
+async function depositFromDerivedKey(conn, R, funder, amount, log = console.log, grantOverride, opts) {
+  if (!opts.noteSpendKey || opts.noteSpendKey.length !== 32) {
+    throw new Error(
+      "opts.noteSpendKey (32 bytes) is required. It derives the note's spending key, and a note whose key is not derived from something you can reproduce is unspendable forever. Pass the same Cloak seed you derived the receiving address from."
+    );
+  }
+  if (!opts.relayUrl) {
+    throw new Error(
+      "opts.relayUrl is required. There is no default: a missing relay used to resolve silently to the local stack, which is how a live run built a deposit against infrastructure that only existed on someone's laptop. Say which relay, every call."
+    );
+  }
+  if (!opts.programId) {
+    throw new Error(
+      "opts.programId is required. There is no default: this is the exact field a live mainnet run once inherited from this module's local-stack constant, built a deposit against a program that does not exist on mainnet, and failed hunting a merkle tree that was never there."
+    );
+  }
+  if (!opts.mint) {
+    throw new Error(
+      "opts.mint is required. There is no default: a deposit built for the wrong mint produces a note for an asset that never arrived at R, and there is nothing to silently fall back to."
+    );
+  }
+  assertAllowedRpcConnection(conn);
+  const relayUrl = opts.relayUrl;
+  const programId = opts.programId;
+  const mint = opts.mint;
+  setCircuitsPath(resolveCircuitsBase());
+  const grantR = grantOverride ?? MAINNET_RENT_0 + FEE_BUDGET + CLEANUP_FEE_BUDGET;
+  const heldByR = await conn.getBalance(R.publicKey);
+  if (heldByR >= grantR) {
+    log(`   R already holds ${heldByR} (>= ${grantR}) \u2014 no top-up needed`);
+  } else {
+    await (0, import_web319.sendAndConfirmTransaction)(conn, new import_web319.Transaction().add(
+      import_web319.SystemProgram.transfer({ fromPubkey: funder.publicKey, toPubkey: R.publicKey, lamports: grantR - heldByR })
+    ), [funder]);
+    log(`   funder topped R up by ${grantR - heldByR} to ${grantR}${grantOverride !== void 0 ? " (OVERRIDDEN for a deliberate test)" : " \u2014 floor + deposit fee + cleanup fee, no rent"}`);
+  }
+  let measuredSize = -1;
+  let fundedAccounts = [];
+  const signTransaction2 = async (tx) => {
+    if (tx instanceof import_web319.VersionedTransaction) {
+      measuredSize = tx.serialize().length;
+      const alts = await Promise.all(
+        tx.message.addressTableLookups.map(async (l) => (await conn.getAddressLookupTable(l.accountKey)).value)
+      );
+      const keys = tx.message.getAccountKeys({ addressLookupTableAccounts: alts });
+      const ix = tx.message.compiledInstructions.find((i) => keys.get(i.programIdIndex).equals(programId));
+      const at = (n) => keys.get(ix.accountKeyIndexes[n]);
+      const targets = [
+        { a: at(12), need: MAINNET_RENT_0, name: "risk_nonce" },
+        { a: at(4), need: MAINNET_RENT_1, name: "nullifier_0" },
+        { a: at(5), need: MAINNET_RENT_1, name: "nullifier_1" }
+      ];
+      const infos = await conn.getMultipleAccountsInfo(targets.map((t) => t.a));
+      fundedAccounts = targets.map((t, i) => ({
+        name: t.name,
+        address: t.a.toBase58(),
+        lamportsSent: Math.max(0, t.need - (infos[i]?.lamports ?? 0))
+      }));
+      const ixs = targets.flatMap((t, i) => (infos[i]?.lamports ?? 0) >= t.need ? [] : [import_web319.SystemProgram.transfer({
+        fromPubkey: funder.publicKey,
+        toPubkey: t.a,
+        lamports: t.need - (infos[i]?.lamports ?? 0)
+      })]);
+      if (ixs.length) {
+        const sig = await (0, import_web319.sendAndConfirmTransaction)(conn, new import_web319.Transaction().add(...ixs), [funder]);
+        log(`   seam: funded ${ixs.length} program accounts read off the built tx \u2014 ${sig.slice(0, 16)}\u2026`);
+      }
+      tx.sign([R]);
+      return tx;
+    }
+    tx.partialSign(R);
+    return tx;
+  };
+  const signMessage = async (m) => import_tweetnacl8.default.sign.detached(m, R.secretKey);
+  const utxoKeypair = await deriveUtxoKeypairFromSpendKey(opts.noteSpendKey);
+  const nk = getNkFromUtxoPrivateKey(utxoKeypair.privateKey);
+  const { utxo, noteSalt } = await createRecoverableDepositUtxo(amount, nk, mint);
+  const zeroInput = await createZeroUtxo(mint);
+  const rBefore = await conn.getBalance(R.publicKey);
+  let result;
+  try {
+    result = await transact(
+      { inputUtxos: [zeroInput], outputUtxos: [utxo], externalAmount: amount, depositor: R.publicKey },
+      {
+        connection: conn,
+        programId,
+        relayUrl,
+        // NO depositorKeypair: the SDK branches `if (keypair) … else if (signTransaction)`
+        // (transact.ts:2786, :2936), so passing one silently skips the funding seam.
+        depositorPublicKey: R.publicKey,
+        walletPublicKey: R.publicKey,
+        signTransaction: signTransaction2,
+        signMessage,
+        chainNoteViewingKeyNk: nk,
+        chainNoteSalt: noteSalt,
+        relaySupplementalAlt: true,
+        onProgress: (s) => log(`   \xB7 ${s}`)
+      }
+    );
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new DepositError(msg, fundedAccounts, measuredSize);
+  }
+  const rAfter = await conn.getBalance(R.publicKey);
+  const noteIndex = result.outputUtxos[0].index;
+  if (noteIndex === void 0) throw new Error("deposit landed but the note has no index \u2014 it cannot be discovered later");
+  return {
+    signature: result.signature,
+    noteIndex,
+    amount: result.outputUtxos[0].amount,
+    txSize: measuredSize,
+    rBefore,
+    rAfter,
+    rentExempt: rAfter >= MAINNET_RENT_0,
+    inputNullifiers: result.inputNullifiers,
+    fundedAccounts
+  };
+}
+
+// src/bridge/cleanup.ts
+var import_web320 = require("@solana/web3.js");
+var import_spl_token6 = require("@solana/spl-token");
+var DEFAULT_MINT = new import_web320.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
+async function cleanupReceivingAddress(conn, R, dustDestination, mint = DEFAULT_MINT) {
+  assertAllowedRpcConnection(conn);
+  const rAta = (0, import_spl_token6.getAssociatedTokenAddressSync)(mint, R.publicKey);
+  const info = await conn.getAccountInfo(rAta);
+  if (!info) {
+    return {
+      closed: false,
+      dustSwept: 0n,
+      rentReturned: 0,
+      destination: null,
+      signature: null,
+      note: "no token account \u2014 nothing to recover"
+    };
+  }
+  const bal = BigInt((await conn.getTokenAccountBalance(rAta)).value.amount);
+  const rentHeld = info.lamports;
+  const before = await conn.getBalance(R.publicKey);
+  const ixs = [];
+  let destination = null;
+  if (bal > 0n && !dustDestination) {
+    return {
+      closed: false,
+      dustSwept: 0n,
+      rentReturned: 0,
+      destination: null,
+      signature: null,
+      note: `dusted with ${bal} base units after the deposit; leaving the account open and ${rentHeld.toLocaleString()} lamports of rent unrecovered, because sweeping it would publish a link from this deposit to whoever receives it`
+    };
+  }
+  if (bal > 0n && dustDestination) {
+    const destAta = (0, import_spl_token6.getAssociatedTokenAddressSync)(mint, dustDestination);
+    const destInfo = await conn.getAccountInfo(destAta);
+    if (!destInfo) {
+      const ataRent = await (0, import_spl_token6.getMinimumBalanceForRentExemptAccount)(conn);
+      if (before < ataRent + CLEANUP_FEE_BUDGET) {
+        throw new Error(
+          `dustDestination ${dustDestination.toBase58()} has no token account for mint ${mint.toBase58()}, and creating one costs ${ataRent} lamports of rent that R does not have: R holds ${before}, which deposit-core.ts reserved only for this transaction's own fee (CLEANUP_FEE_BUDGET = ${CLEANUP_FEE_BUDGET} in funder.ts), not for a fresh account's rent. Fund R with at least ${ataRent + CLEANUP_FEE_BUDGET - before} more lamports first, or choose a destination that already has a token account for this mint.`
+        );
+      }
+      ixs.push((0, import_spl_token6.createAssociatedTokenAccountIdempotentInstruction)(R.publicKey, destAta, dustDestination, mint));
+    }
+    ixs.push((0, import_spl_token6.createTransferInstruction)(rAta, destAta, R.publicKey, bal));
+    destination = destAta.toBase58();
+  }
+  ixs.push((0, import_spl_token6.createCloseAccountInstruction)(rAta, R.publicKey, R.publicKey));
+  const signature = await (0, import_web320.sendAndConfirmTransaction)(conn, new import_web320.Transaction().add(...ixs), [R], {
+    commitment: "confirmed"
+  });
+  const after = await conn.getBalance(R.publicKey);
+  const gone = await conn.getAccountInfo(rAta) === null;
+  return {
+    closed: gone,
+    dustSwept: bal,
+    rentReturned: after - before,
+    destination,
+    signature,
+    note: bal > 0n ? `swept ${bal} base units of dust to the caller-chosen destination and closed, in one transaction \u2014 note this publishes a link from the deposit to that destination` : `closed cleanly, nothing to sweep`
+  };
+}
+
+// src/bridge/quote.ts
+var MIN_DEPOSIT_SPL_BASE_UNITS = 1000000n;
+var WITHDRAW_FIXED_FEE = 450000n;
+var WITHDRAW_FEE_BPS = 30n;
+function withdrawFeeAt(amount, fixedFee, feeBps) {
+  return fixedFee + amount * feeBps / 10000n;
+}
+var MAX_FEE_FRACTION = 0.063;
+var FIXED_ROUND_TRIP = 903000n;
+var ECONOMIC_MINIMUM = FIXED_ROUND_TRIP * 1000000n / BigInt(Math.round((MAX_FEE_FRACTION - 3e-3) * 1e6));
+function withdrawFeeFor(amount) {
+  return withdrawFeeAt(amount, WITHDRAW_FIXED_FEE, WITHDRAW_FEE_BPS);
+}
+function assessBridgeQuote(q) {
+  if (q.sent < 0n) {
+    throw new Error(`assessBridgeQuote: sent must not be negative (got ${q.sent}).`);
+  }
+  if (q.arrivesMin > q.sent) {
+    throw new Error(
+      `assessBridgeQuote: arrivesMin (${q.arrivesMin}) exceeds sent (${q.sent}) \u2014 no rail returns more than it was given, so this input did not come from a real quote.`
+    );
+  }
+  const shieldedMinRaw = q.arrivesMin - q.paymasterFee;
+  const shieldedTargetRaw = q.arrivesTarget - q.paymasterFee;
+  const shieldedMin = shieldedMinRaw > 0n ? shieldedMinRaw : 0n;
+  const shieldedTarget = shieldedTargetRaw > 0n ? shieldedTargetRaw : 0n;
+  const viable = shieldedMinRaw >= MIN_DEPOSIT_SPL_BASE_UNITS;
+  const economic = q.sent >= ECONOMIC_MINIMUM;
+  const withdrawFee = shieldedMin > 0n ? withdrawFeeAt(shieldedMin, q.liveWithdrawFixedFee ?? WITHDRAW_FIXED_FEE, q.liveWithdrawFeeBps ?? WITHDRAW_FEE_BPS) : 0n;
+  const roundTripCost = q.sent - (shieldedMin > withdrawFee ? shieldedMin - withdrawFee : 0n);
+  const roundTripFraction = q.sent > 0n ? Number(roundTripCost) / Number(q.sent) : 0;
+  const reasons = [];
+  if (!viable) {
+    const short = MIN_DEPOSIT_SPL_BASE_UNITS - shieldedMinRaw;
+    reasons.push(
+      (shieldedMinRaw <= 0n ? `The ${fmt(q.paymasterFee)} paymaster fee alone is ${shieldedMinRaw < 0n ? `${fmt(-shieldedMinRaw)} more than` : "all of"} the ${fmt(q.arrivesMin)} the rail guarantees, so nothing would be left to shield.` : `Only ${fmt(shieldedMinRaw)} would be left to shield after the ${fmt(q.paymasterFee)} paymaster fee.`) + ` The program's minimum deposit is ${fmt(MIN_DEPOSIT_SPL_BASE_UNITS)}. Send at least ${fmt(q.sent + short)} to clear it.`
+    );
+  }
+  if (viable && !economic) {
+    reasons.push(
+      `This works, but ${fmt(roundTripCost)} of ${fmt(q.sent)} goes to fees (${(roundTripFraction * 100).toFixed(0)}%). The costs are almost all fixed, so bridging ${fmt(ECONOMIC_MINIMUM)} or more spreads them much further.`
+    );
+  }
+  return {
+    ...q,
+    shieldedMin,
+    shieldedTarget,
+    viable,
+    economic,
+    withdrawFee,
+    roundTripCost,
+    roundTripFraction,
+    reasons
+  };
+}
+var fmt = (v) => `${(Number(v) / 1e6).toFixed(6)} USDC`;
+function renderAssessment(a) {
+  const L = [];
+  L.push(`  you send            ${fmt(a.sent)}`);
+  L.push(`  arrives at least    ${fmt(a.arrivesMin)}        (target ${fmt(a.arrivesTarget)}, not a promise)`);
+  L.push(`  paymaster fee       ${fmt(a.paymasterFee)}        buys the receiver its SOL, so your wallet stays off chain`);
+  L.push(`  SHIELDED            ${fmt(a.shieldedMin)}        at least \u2014 this is what you end up with`);
+  L.push(`  to withdraw later   ${fmt(a.withdrawFee)}        the program's fee, whenever you take it out`);
+  for (const r of a.reasons) L.push(`
+  ${a.viable ? "NOTE" : "REFUSED"}: ${r}`);
+  return L.join("\n");
+}
+
+// src/bridge/retry.ts
+var TERMINAL_FAILURE = /DepositTooSmall|minimum is 1\.000000|insufficient|holds only|below the program|kora wants|over the .* ceiling/i;
+function isTerminalFailure(message) {
+  return TERMINAL_FAILURE.test(message);
+}
+function classifyPostFailure(attempted, after) {
+  if (after === null) return "unknown";
+  if (after === 0n) return "landed";
+  if (after >= attempted) return "did-not-land";
+  return "unknown";
+}
+function mayRetry(verdict, message) {
+  return verdict === "did-not-land" && !isTerminalFailure(message);
+}
+function retryDelayMs(attempt) {
+  return 15e3 * Math.max(0, attempt - 1);
+}
+var DoNotRetry = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DoNotRetry";
+  }
+};
+async function withShieldRetries(attempt, hooks = {}) {
+  const attempts = hooks.attempts ?? 3;
+  const sleep4 = hooks.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  let last = "";
+  for (let n = 1; n <= attempts; n++) {
+    if (n > 1) {
+      const delay = retryDelayMs(n);
+      hooks.onRetry?.(n, delay, last);
+      await sleep4(delay);
+    }
+    try {
+      return await attempt(n);
+    } catch (e) {
+      if (e instanceof DoNotRetry) throw e;
+      last = e instanceof Error ? e.message : String(e);
+      if (isTerminalFailure(last) || n === attempts) throw e;
+    }
+  }
+  throw new Error("unreachable");
+}
+
 // src/index.ts
-var VERSION = "0.2.1";
+var VERSION = "0.2.3";
 var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BRIDGE_ESCROW_LABEL,
   BUILD_ALLOWS_LOCAL_ENDPOINTS,
   CHAIN_NOTE_SALT_BITS,
+  CLEANUP_FEE_BUDGET,
   CLOAK_PRODUCTION_RELAY_URL,
   CLOAK_PROGRAM_ID,
   CloakError,
@@ -11646,25 +12845,38 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   DEFAULT_TRANSACTION_CIRCUITS_URL,
   DELIVERY_MEMO_TAG,
   DELIVERY_REGISTRY_SEED,
+  DepositError,
+  DoNotRetry,
+  ECONOMIC_MINIMUM,
   EXPECTED_CIRCUIT_HASHES,
+  FEE_BUDGET,
   FIXED_FEE_LAMPORTS,
   InsecureRandomnessError,
   LAMPORTS_PER_SOL,
   LocalStorageAdapter,
+  MAINNET_RENT_0,
+  MAINNET_RENT_1,
+  MAX_RECEIVER_INDEX,
   MERKLE_TREE_HEIGHT,
   MIN_DEPOSIT_LAMPORTS,
+  MIN_DEPOSIT_SPL_BASE_UNITS,
   MemoryStorageAdapter,
   MerkleTree,
   NATIVE_SOL_MINT,
+  ONECLICK_PUBKEY_B58,
   RECIPIENT_DELIVERY_CIPHERTEXT_LEN,
   RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN,
   RECIPIENT_DELIVERY_NONCE_LEN,
   RECIPIENT_DELIVERY_NOTE_BYTES,
   RECIPIENT_DELIVERY_PLAINTEXT_LEN,
   RECIPIENT_DELIVERY_TAG_LEN,
+  RELAY_BATCH_AUTH_MAX_ITEMS,
   RELAY_ORIGIN_ALLOWLIST,
+  REQUEST_AUTH_BATCH_DOMAIN,
+  REQUEST_AUTH_BATCH_MAX_AGE_SECONDS,
   REQUEST_AUTH_MAX_AGE_SECONDS,
   REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS,
+  RelayBatchAuthCoordinator,
   RelayInternalError,
   RelayService,
   RootNotFoundError,
@@ -11674,6 +12886,7 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   SettlementVerificationError,
   ShieldPoolErrors,
   SimpleWallet,
+  TERMINAL_FAILURE,
   TRANSACTION_CIRCUITS_VERSION,
   TRANSACT_AUTH_FIELDS,
   TRANSACT_SWAP_AUTH_FIELDS,
@@ -11683,15 +12896,21 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   VARIABLE_FEE_NUMERATOR,
   VARIABLE_FEE_RATE,
   VERSION,
+  WITHDRAW_FEE_BPS,
+  WITHDRAW_FIXED_FEE,
   assertDirectSubmissionLanded,
+  assertInputMints,
   assertTransactionCircuitIntegrity,
+  assessBridgeQuote,
   bigintToBytes32,
   bigintToHex,
+  buildAuthTransactionMessage,
   buildMerkleTree,
   buildMerkleTreeFromChain,
   buildMerkleTreeFromRelay,
   buildRecipientDeliveryNotes,
   buildRelayAuthPreimage,
+  buildRelayBatchAuthMessage,
   buildTransactRequestBody,
   bytesToHex,
   calculateFee,
@@ -11699,12 +12918,16 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   calculateRelayFee,
   canRebuildMerkleTreeFromChain,
   canonicalJson,
+  canonicalPayloadString,
   chainNoteFromBase64,
   chainNoteToBase64,
+  classifyPostFailure,
   classifyRelayError,
+  cleanupReceivingAddress,
   cleanupStalePendingOperations,
   clearPendingDeposits,
   clearPendingWithdrawals,
+  cloakBridgeRail,
   computeChainNoteHash,
   computeExtDataHash,
   computeMerkleRoot,
@@ -11721,15 +12944,19 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   createLogger,
   createRecoverableChangeUtxo,
   createRecoverableDepositUtxo,
+  createRelayBatchAuthCoordinator,
   createUtxo,
   createZeroUtxo,
   decryptCompactChainNote,
   decryptComplianceMetadataWithMasterKey,
   decryptTransactionMetadata,
+  depositFromDerivedKey,
+  deriveBridgeReceiver,
   deriveChangeNoteBlinding,
   deriveDepositNoteSecrets,
   deriveDiversifiedViewingKey,
   deriveDiversifier,
+  deriveFundingTargets,
   deriveInputNullifierPdas,
   derivePublicKey,
   deriveSpendKey,
@@ -11768,6 +12995,7 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   formatErrorForLogging,
   formatSol,
   fullWithdraw,
+  fundReceiverViaPaymaster,
   generateCloakKeys,
   generateCommitmentAsync,
   generateMasterSeed,
@@ -11803,18 +13031,21 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   isReactNative,
   isRootNotFoundError,
   isSubmissionOutcomeUnknownResponse,
+  isTerminalFailure,
   isValidHex,
   isValidRpcUrl,
   isValidSolanaAddress,
   isWithdrawAmountSufficient,
   isWithdrawable,
   keypairToAdapter,
+  listBridgeDeposits,
   loadPendingDeposits,
   loadPendingWithdrawals,
   loadVerifiedCircuitArtifacts,
   matchChangeNote,
   matchDepositNote,
   matchSwapRefundLeaf,
+  mayRetry,
   openRecipientDeliveryNote,
   parseAmount,
   parseDeliveryCarrierMemo,
@@ -11837,11 +13068,15 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   randomDepositNoteSalt,
   randomFieldElement,
   readMerkleTreeState,
+  readRent,
   recipientDeliveryNoteToBase64,
   registerViewingKey,
+  relayRequestDigestHex,
   removePendingDeposit,
   removePendingWithdrawal,
+  renderAssessment,
   resolveCircuitsBase,
+  retryDelayMs,
   savePendingDeposit,
   savePendingWithdrawal,
   scanNotesForWallet,
@@ -11850,10 +13085,12 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   sdkLogger,
   selectUtxos,
   sendTransaction,
+  serializeAuthTransactionMessage,
   serializeNote,
   serializeUtxo,
   setCircuitsPath,
   setDebugMode,
+  signRelayAuthPayload,
   signTransaction,
   splitTo2Limbs,
   submitTransactToRelay,
@@ -11862,6 +13099,7 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   swapWithChange,
   toComplianceReport,
   transact,
+  transactBatch,
   transfer,
   truncate,
   tryDecryptNote,
@@ -11874,13 +13112,17 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   validateDepositParams,
   validateNote,
   validateOutputsSum,
+  validatePaymasterTopUpTransaction,
   validateRoot,
   validateTransfers,
   validateWalletConnected,
   validateWithdrawableNote,
   verifyAllCircuits,
   verifyCircuitIntegrity,
+  verifyQuoteSignature,
   verifyUtxos,
   waitForRoot,
-  withTiming
+  withShieldRetries,
+  withTiming,
+  withdrawFeeFor
 });