@cloak.dev/sdk 0.2.3-staging.16d1078 → 0.2.3-staging.4f641ea

package/dist/index.cjs

@@ -455,7 +455,7 @@ async function deserializeUtxo(bytes) {
   const blindingBytes = bytes.slice(40, 72);
   const blinding = bytesToBigint2(blindingBytes);
   const mintBytes = bytes.slice(72, 104);
-  const mintAddress = new import_web33.PublicKey(mintBytes);
+  const mintAddress = new import_web34.PublicKey(mintBytes);
   const index = view.getUint32(104, true);
   const utxo = {
     amount,
@@ -523,18 +523,18 @@ function selectUtxos(available, targetAmount) {
   }
   return selected;
 }
-var import_web33, import_circomlibjs2, import_blake33, FIELD_MODULUS, KEYPAIR_DOMAIN_TAG, UTXO_KEY_DOMAIN, NATIVE_SOL_MINT, poseidonInstance;
+var import_web34, import_circomlibjs2, import_blake33, FIELD_MODULUS, KEYPAIR_DOMAIN_TAG, UTXO_KEY_DOMAIN, NATIVE_SOL_MINT, poseidonInstance;
 var init_utxo = __esm({
   "src/notes/utxo.ts"() {
     "use strict";
-    import_web33 = require("@solana/web3.js");
+    import_web34 = require("@solana/web3.js");
     import_circomlibjs2 = require("circomlibjs");
     import_blake33 = require("@noble/hashes/blake3");
     init_inputs();
     FIELD_MODULUS = BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
     KEYPAIR_DOMAIN_TAG = BigInt("5423839527465210463");
     UTXO_KEY_DOMAIN = new TextEncoder().encode("cloak_utxo_priv_v1");
-    NATIVE_SOL_MINT = new import_web33.PublicKey("So11111111111111111111111111111111111111112");
+    NATIVE_SOL_MINT = new import_web34.PublicKey("So11111111111111111111111111111111111111112");
     poseidonInstance = null;
   }
 });
@@ -612,6 +612,7 @@ __export(index_exports, {
   assessBridgeQuote: () => assessBridgeQuote,
   bigintToBytes32: () => bigintToBytes32,
   bigintToHex: () => bigintToHex,
+  buildAuthTransactionMessage: () => buildAuthTransactionMessage,
   buildMerkleTree: () => buildMerkleTree,
   buildMerkleTreeFromChain: () => buildMerkleTreeFromChain,
   buildMerkleTreeFromRelay: () => buildMerkleTreeFromRelay,
@@ -792,10 +793,12 @@ __export(index_exports, {
   sdkLogger: () => sdkLogger,
   selectUtxos: () => selectUtxos,
   sendTransaction: () => sendTransaction,
+  serializeAuthTransactionMessage: () => serializeAuthTransactionMessage,
   serializeNote: () => serializeNote,
   serializeUtxo: () => serializeUtxo,
   setCircuitsPath: () => setCircuitsPath,
   setDebugMode: () => setDebugMode,
+  signRelayAuthPayload: () => signRelayAuthPayload,
   signTransaction: () => signTransaction,
   splitTo2Limbs: () => splitTo2Limbs,
   submitTransactToRelay: () => submitTransactToRelay,
@@ -1388,9 +1391,9 @@ var LocalStorageAdapter = class {
 };
 
 // src/scanning/compliance-keys.ts
-var import_tweetnacl2 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl3 = __toESM(require("tweetnacl"), 1);
 var import_blake32 = require("@noble/hashes/blake3");
-var import_sha2 = require("@noble/hashes/sha2");
+var import_sha22 = require("@noble/hashes/sha2");
 init_inputs();
 
 // src/relay/viewing-key.ts
@@ -1578,6 +1581,276 @@ function connectionRpcEndpoint(connection) {
   return connection?._rpcEndpoint ?? connection?.rpcEndpoint;
 }
 
+// src/relay/payload.ts
+var import_sha2 = require("@noble/hashes/sha2");
+var import_utils = require("@noble/hashes/utils");
+var import_tweetnacl2 = __toESM(require("tweetnacl"), 1);
+var import_web33 = require("@solana/web3.js");
+init_inputs();
+var REQUEST_AUTH_DOMAIN = "CLOAK_RELAY_REQUEST_AUTH_V1";
+var REQUEST_AUTH_MAX_AGE_SECONDS = 300;
+var REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
+var RELAY_AUTH_APPROVAL_MARGIN_SECONDS = 15;
+function sha256Hex(text) {
+  return (0, import_utils.bytesToHex)((0, import_sha2.sha256)(new TextEncoder().encode(text)));
+}
+function randomNonceUuid() {
+  const webCrypto = globalThis?.crypto;
+  if (typeof webCrypto?.randomUUID === "function") return webCrypto.randomUUID();
+  const proc = globalThis?.process;
+  const nodeCrypto = typeof proc?.getBuiltinModule === "function" ? proc.getBuiltinModule("node:crypto") : void 0;
+  if (typeof nodeCrypto?.randomUUID === "function") return nodeCrypto.randomUUID();
+  const bytes = randomBytes(16);
+  bytes[6] = bytes[6] & 15 | 64;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = (0, import_utils.bytesToHex)(bytes);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+var TRANSACT_AUTH_FIELDS = [
+  "encrypted_notes",
+  "max_fee",
+  "mint",
+  "proof_bytes",
+  "public_inputs",
+  "recipient",
+  "recipient_delivery_notes",
+  "risk_quote",
+  "sender"
+];
+var TRANSACT_SWAP_AUTH_FIELDS = [
+  "close_timed_out",
+  "dexes",
+  "encrypted_notes",
+  "exclude_dexes",
+  "max_fee",
+  "min_output_amount",
+  "output_mint",
+  "proof_bytes",
+  "public_inputs",
+  "recipient",
+  "recipient_ata",
+  "refund_blinding",
+  "refund_pubkey",
+  "retry_request_id",
+  "risk_quote",
+  "route_retry_attempts",
+  "sender",
+  "slippage_bps",
+  "swap_max_retries"
+];
+var UTF8 = new TextEncoder();
+function compareKeysBytewise(a, b) {
+  if (a === b) return 0;
+  const ab = UTF8.encode(a);
+  const bb = UTF8.encode(b);
+  const shared = Math.min(ab.length, bb.length);
+  for (let i = 0; i < shared; i++) {
+    if (ab[i] !== bb[i]) return ab[i] - bb[i];
+  }
+  return ab.length - bb.length;
+}
+function canonicalJson(value) {
+  if (value === null || value === void 0) return "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || !Number.isInteger(value) || !Number.isSafeInteger(value)) {
+      throw new Error(
+        `canonicalJson: refusing to sign the number ${String(value)}. The relay renders numbers with serde_json, which spells non-integer, non-finite and very large values differently from JavaScript, so the two digests would differ and the request would be rejected with an unexplained 401. Send it as a decimal string instead, which is how every amount in this schema travels.`
+      );
+    }
+    return String(value);
+  }
+  if (typeof value === "bigint") return value.toString();
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort(compareKeysBytewise);
+    return "{" + keys.map((k) => {
+      const v = obj[k];
+      if (typeof v === "function" || typeof v === "symbol") {
+        throw new Error(
+          `canonicalJson: the key "${k}" holds a ${typeof v}, which has no JSON representation. JSON.stringify would drop it from the wire body while it stayed in the signed view, so the relay's digest could never match this one.`
+        );
+      }
+      return `${JSON.stringify(k)}:${canonicalJson(v)}`;
+    }).join(",") + "}";
+  }
+  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
+}
+var FIELDS_WITHOUT_NULL_ENCODING = {
+  slippage_bps: "500 (`default_slippage_bps` in api/transact_swap.rs)"
+};
+function buildAuthRequest(body, sender, fields) {
+  const out = {};
+  for (const k of fields) {
+    if (k === "sender") {
+      out[k] = sender;
+      continue;
+    }
+    const value = body[k];
+    if (value === void 0 || value === null) {
+      const relayDefault = FIELDS_WITHOUT_NULL_ENCODING[k];
+      if (relayDefault) {
+        throw new Error(
+          `Relay request auth: \`${k}\` must be present in the body. It is the one field in this schema that is not optional on the relay side: when it is missing the relay signs its default, ${relayDefault}, while this request would sign null. The two digests differ and the relay answers 401 "Relay request signature does not match the exact request", which points at nothing. Set \`${k}\` explicitly, to the same value the body will carry.`
+        );
+      }
+      out[k] = null;
+      continue;
+    }
+    out[k] = value;
+  }
+  return out;
+}
+function buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request) {
+  const digest = sha256Hex(canonicalJson(request));
+  return new TextEncoder().encode(
+    `${REQUEST_AUTH_DOMAIN}
+${endpoint}
+${programId.toBase58()}
+${nonce}
+${issuedAt}
+${digest}`
+  );
+}
+function buildRelayAuthPreimage(endpoint, programId, body, sender, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
+  const senderB58 = sender.toBase58();
+  const issuedAt = String(nowSeconds ?? Math.floor(Date.now() / 1e3));
+  const nonce = randomNonceUuid();
+  const request = buildAuthRequest({ ...body, sender: senderB58 }, senderB58, fields);
+  const message = buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request);
+  return { sender: senderB58, auth_issued_at: issuedAt, auth_nonce: nonce, message };
+}
+function signRelayRequest(endpoint, programId, body, signer, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
+  const preimage = buildRelayAuthPreimage(
+    endpoint,
+    programId,
+    body,
+    signer.publicKey,
+    nowSeconds,
+    fields
+  );
+  const signature = import_tweetnacl2.default.sign.detached(preimage.message, signer.secretKey);
+  return {
+    sender: preimage.sender,
+    auth_issued_at: preimage.auth_issued_at,
+    auth_nonce: preimage.auth_nonce,
+    auth_signature: Buffer.from(signature).toString("base64")
+  };
+}
+function buildAuthTransactionMessage(sender, digest) {
+  if (digest.length !== 32) throw new Error(`auth transaction digest must be 32 bytes (got ${digest.length})`);
+  const tx = new import_web33.Transaction();
+  tx.add(import_web33.SystemProgram.transfer({ fromPubkey: sender, toPubkey: sender, lamports: 0 }));
+  tx.feePayer = sender;
+  tx.recentBlockhash = new import_web33.PublicKey(digest).toBase58();
+  return tx;
+}
+function serializeAuthTransactionMessage(sender, digest) {
+  return Uint8Array.from(buildAuthTransactionMessage(sender, digest).compileMessage().serialize());
+}
+async function signRelayAuthPayload(signer, payload) {
+  if (signer instanceof import_web33.Keypair) {
+    return { signature: import_tweetnacl2.default.sign.detached(payload, signer.secretKey), mode: "message" };
+  }
+  if (signer.signMessage) {
+    const signature = await signer.signMessage(payload);
+    assertDetachedSignature(signature, "signMessage");
+    return { signature, mode: "message" };
+  }
+  if (signer.signAuthTransaction) {
+    const digest = (0, import_sha2.sha256)(payload);
+    const signed = await signer.signAuthTransaction(buildAuthTransactionMessage(signer.walletPublicKey, digest));
+    const own = signed.signatures.find((s) => s.publicKey.equals(signer.walletPublicKey))?.signature;
+    if (!own) {
+      throw new Error(
+        "The wallet returned no signature for the Cloak auth transaction. Nothing was submitted."
+      );
+    }
+    const signature = Uint8Array.from(own);
+    assertDetachedSignature(signature, "signTransaction");
+    return { signature, mode: "transaction" };
+  }
+  throw new Error("Relay auth signer has neither signMessage nor signAuthTransaction.");
+}
+function assertDetachedSignature(signature, method) {
+  if (!(signature instanceof Uint8Array) || signature.length !== 64) {
+    throw new Error(
+      `The wallet's ${method} did not return a 64-byte ed25519 detached signature (got ${signature instanceof Uint8Array ? `${signature.length} bytes` : typeof signature}). Cloak signs with a raw detached signature over the bytes it hands the wallet; adapters that wrap or re-encode the result cannot be used here.`
+    );
+  }
+}
+function assertApprovalWithinFreshnessWindow(elapsedMs, maxAgeSeconds = REQUEST_AUTH_MAX_AGE_SECONDS) {
+  const elapsedSeconds = elapsedMs / 1e3;
+  const budget = maxAgeSeconds - RELAY_AUTH_APPROVAL_MARGIN_SECONDS;
+  if (elapsedSeconds <= budget) return;
+  throw new Error(
+    `The wallet approval took ${Math.round(elapsedSeconds)} seconds, and Cloak requests stay valid for ${maxAgeSeconds} seconds from the moment they are signed (${RELAY_AUTH_APPROVAL_MARGIN_SECONDS} of those are held back for the request to reach the network). The timestamp is inside the signature, so it cannot be refreshed without your approval again. NOTHING WAS SUBMITTED and no funds moved. Start the same operation again and approve the prompt when it appears.`
+  );
+}
+function explainRelayAuthRejection(responseText) {
+  const text = String(responseText);
+  const has = (needle) => text.includes(needle);
+  if (has("issued too far in the future")) {
+    return `This computer's clock is more than ${REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS} seconds ahead of the network's, so the request looks like it was signed in the future and is refused before anything else happens. Turn on automatic date and time (or resynchronise the clock) and try again. Nothing was submitted.`;
+  }
+  if (has("signature expired")) {
+    return `The request was signed more than ${REQUEST_AUTH_MAX_AGE_SECONDS} seconds before it arrived, usually because a wallet approval was left waiting, or because this computer's clock is running behind. The signed timestamp cannot be refreshed on its own. Start the operation again. Nothing was submitted.`;
+  }
+  if (has("does not match the exact request")) {
+    return `The request body changed after it was signed, so the relay's digest and this one disagree. Sign the exact body that is POSTed, and re-POST a retry byte for byte rather than rebuilding it. If this is a hand-built swap call, check that every field in TRANSACT_SWAP_AUTH_FIELDS is present, including \`slippage_bps\`.`;
+  }
+  if (has("has no registered viewing key")) {
+    return `The signature was accepted, so this is not a signing problem: the wallet that signed has no viewing key registered with Cloak yet. Register one first, or let the SDK do it by leaving \`enforceViewingKeyRegistration\` on and supplying the viewing key.`;
+  }
+  if (has("Authenticated sender is required") || has("auth_issued_at is required") || has("auth_nonce is required") || has("auth_signature is required")) {
+    return `The request reached the relay without its authentication fields. Pass \`depositorKeypair\`, or \`signMessage\` together with \`walletPublicKey\`, so the request can be signed.`;
+  }
+  if (has("auth_nonce must be a canonical UUID")) {
+    return `\`auth_nonce\` must be a canonical lowercase UUID. Reuse the one from the preimage.`;
+  }
+  if (has("Relay request signature must be exactly 64 bytes") || has("Invalid relay request signature encoding")) {
+    return `\`auth_signature\` must be the raw 64-byte ed25519 detached signature, base64 encoded. Wallet adapters that wrap or re-encode what \`signMessage\` returns cannot be used here.`;
+  }
+  return null;
+}
+async function buildRelayAuthFields(endpoint, programId, body, signers, fields = TRANSACT_AUTH_FIELDS) {
+  if (signers.depositorKeypair) {
+    return signRelayRequest(endpoint, programId, body, signers.depositorKeypair, void 0, fields);
+  }
+  const wallet = signers.relayAuthSigner;
+  if (!wallet) return null;
+  const preimage = buildRelayAuthPreimage(
+    endpoint,
+    programId,
+    body,
+    wallet.walletPublicKey,
+    void 0,
+    fields
+  );
+  const approvalStartedMs = Date.now();
+  const { signature, mode } = await signRelayAuthPayload(wallet, preimage.message);
+  assertApprovalWithinFreshnessWindow(Date.now() - approvalStartedMs);
+  return {
+    sender: preimage.sender,
+    auth_issued_at: preimage.auth_issued_at,
+    auth_nonce: preimage.auth_nonce,
+    auth_signature: Buffer.from(signature).toString("base64"),
+    ...mode === "transaction" ? { auth_mode: mode } : {}
+  };
+}
+var REQUEST_AUTH_BATCH_DOMAIN = "CLOAK_RELAY_BATCH_AUTH_V1";
+var REQUEST_AUTH_BATCH_MAX_AGE_SECONDS = 600;
+var RELAY_BATCH_AUTH_MAX_ITEMS = 64;
+function relayRequestDigestHex(preimage) {
+  return (0, import_utils.bytesToHex)((0, import_sha2.sha256)(preimage.message));
+}
+function buildRelayBatchAuthMessage(programId, issuedAt, digests) {
+  const lines = [REQUEST_AUTH_BATCH_DOMAIN, programId.toBase58(), issuedAt, String(digests.length)];
+  return new TextEncoder().encode([...lines, ...digests].join("\n"));
+}
+
 // src/scanning/compliance-keys.ts
 var X25519_KEY_LENGTH = 32;
 var DIVERSIFIER_LENGTH = 11;
@@ -1615,7 +1888,7 @@ function deriveViewingKeyFromNk(nk) {
   preimage.set(nk, CHAIN_NOTE_VK_DOMAIN.length);
   const derived = (0, import_blake32.blake3)(preimage);
   const privateKey = clampX25519Secret(derived);
-  const publicKey = import_tweetnacl2.default.scalarMult.base(privateKey);
+  const publicKey = import_tweetnacl3.default.scalarMult.base(privateKey);
   return { privateKey, publicKey };
 }
 function deriveDiversifier(nk, commitmentHex, outputIndex) {
@@ -1650,7 +1923,7 @@ function deriveDiversifiedViewingKey(nk, diversifier) {
   preimage.set(diversifier, SK_D_DOMAIN.length + nk.length);
   const derived = (0, import_blake32.blake3)(preimage);
   const privateKey = clampX25519Secret(derived);
-  const publicKey = import_tweetnacl2.default.scalarMult.base(privateKey);
+  const publicKey = import_tweetnacl3.default.scalarMult.base(privateKey);
   return { privateKey, publicKey };
 }
 function deriveViewingKeyFromSpendKey(skSpend) {
@@ -1713,19 +1986,19 @@ async function deriveUserCompliancePublicKey(masterCompliancePublicKey, userPubl
     masterCompliancePublicKey,
     userPublicKey
   );
-  return import_tweetnacl2.default.scalarMult(factor, masterCompliancePublicKey);
+  return import_tweetnacl3.default.scalarMult(factor, masterCompliancePublicKey);
 }
-function bytesToHex2(bytes) {
+function bytesToHex3(bytes) {
   return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 function computeViewingKeyIdentifier(userPubkey, nkHex) {
   const preimage = new TextEncoder().encode(`${userPubkey.toBase58()}${nkHex}`);
-  return bytesToHex2((0, import_sha2.sha256)(preimage));
+  return bytesToHex3((0, import_sha22.sha256)(preimage));
 }
 var SIGN_IN_MESSAGE = "Cloak: Sign in\n\nSign this message to securely access your Cloak account.\nThis does NOT authorize any transaction or spend any funds.";
 async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
   assert32Bytes(nk, "nk");
-  const nkHex = bytesToHex2(nk);
+  const nkHex = bytesToHex3(nk);
   const keyId = computeViewingKeyIdentifier(userPubkey, nkHex);
   const challengeResponse = await relayFetch(`${relayUrl}/viewing-key/challenge`, {
     method: "POST",
@@ -1746,8 +2019,11 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
     nkHex
   );
   const messageBytes = new TextEncoder().encode(challenge.message);
-  const signatureBytes = await signMessage(messageBytes);
-  const signature = Buffer.from(signatureBytes).toString("base64");
+  const signed = await signRelayAuthPayload(
+    typeof signMessage === "function" ? { walletPublicKey: userPubkey, signMessage } : signMessage,
+    messageBytes
+  );
+  const signature = Buffer.from(signed.signature).toString("base64");
   const response = await relayFetch(`${relayUrl}/viewing-key/register`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -1756,7 +2032,8 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
       viewing_key: nkHex,
       nonce: challenge.nonce,
       identifier: keyId,
-      signature
+      signature,
+      ...signed.mode === "transaction" ? { auth_mode: signed.mode } : {}
     })
   });
   if (!response.ok) {
@@ -1765,7 +2042,7 @@ async function registerViewingKey(relayUrl, userPubkey, nk, signMessage) {
 }
 
 // src/scanning/metadata-encryption.ts
-var import_tweetnacl3 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl4 = __toESM(require("tweetnacl"), 1);
 init_inputs();
 var AES_GCM_NONCE_LENGTH = 12;
 var AES_GCM_TAG_LENGTH = 16;
@@ -1863,8 +2140,8 @@ async function aesGcmDecrypt(ciphertext, keyBytes, nonce) {
 }
 async function encryptForRecipient(plaintext, recipientPublicKey) {
   assert32Bytes2(recipientPublicKey, "recipientPublicKey");
-  const ephemeral = import_tweetnacl3.default.box.keyPair();
-  const sharedSecret = import_tweetnacl3.default.scalarMult(ephemeral.secretKey, recipientPublicKey);
+  const ephemeral = import_tweetnacl4.default.box.keyPair();
+  const sharedSecret = import_tweetnacl4.default.scalarMult(ephemeral.secretKey, recipientPublicKey);
   const nonce = randomBytes(AES_GCM_NONCE_LENGTH);
   const ciphertext = await aesGcmEncrypt(plaintext, sharedSecret, nonce);
   return {
@@ -1923,7 +2200,7 @@ async function encryptTransactionMetadataBundle(metadata, viewingKeyPrivate, use
   const plaintext = new TextEncoder().encode(JSON.stringify(metadata));
   const basePoint = new Uint8Array(32);
   basePoint[0] = 9;
-  const viewingKeyPublic = import_tweetnacl3.default.scalarMult(viewingKeyPrivate, basePoint);
+  const viewingKeyPublic = import_tweetnacl4.default.scalarMult(viewingKeyPrivate, basePoint);
   const [userPayload, compliancePayload] = await Promise.all([
     encryptForRecipient(plaintext, viewingKeyPublic),
     encryptForRecipient(plaintext, viewingKeyPublic)
@@ -1942,7 +2219,7 @@ async function decryptTransactionMetadata(encrypted, viewKeySecret) {
   const payload = decodePayload(encrypted);
   const ephemeralPk = hexToBytes(payload.ephemeral_pk);
   assert32Bytes2(ephemeralPk, "ephemeral public key");
-  const sharedSecret = import_tweetnacl3.default.scalarMult(viewKeySecret, ephemeralPk);
+  const sharedSecret = import_tweetnacl4.default.scalarMult(viewKeySecret, ephemeralPk);
   return decryptWithSharedSecret(payload, sharedSecret);
 }
 async function decryptComplianceMetadataWithMasterKey(encrypted, masterCompliancePrivateKey, masterCompliancePublicKey, userPublicKey) {
@@ -1955,8 +2232,8 @@ async function decryptComplianceMetadataWithMasterKey(encrypted, masterComplianc
     masterCompliancePublicKey,
     userPublicKey
   );
-  const scaledEphemeral = import_tweetnacl3.default.scalarMult(userFactor, ephemeralPk);
-  const sharedSecret = import_tweetnacl3.default.scalarMult(masterCompliancePrivateKey, scaledEphemeral);
+  const scaledEphemeral = import_tweetnacl4.default.scalarMult(userFactor, ephemeralPk);
+  const sharedSecret = import_tweetnacl4.default.scalarMult(masterCompliancePrivateKey, scaledEphemeral);
   return decryptWithSharedSecret(payload, sharedSecret);
 }
 
@@ -2893,23 +3170,23 @@ function formatErrorForLogging(error) {
 init_utxo();
 
 // src/program/pda.ts
-var import_web34 = require("@solana/web3.js");
+var import_web35 = require("@solana/web3.js");
 init_utxo();
 function getShieldPoolPDAs(programId, mint = NATIVE_SOL_MINT) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  const [pool] = import_web34.PublicKey.findProgramAddressSync(
+  const [pool] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("pool"), mint.toBuffer()],
     pid
   );
-  const [merkleTree] = import_web34.PublicKey.findProgramAddressSync(
+  const [merkleTree] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("merkle_tree"), mint.toBuffer()],
     pid
   );
-  const [treasury] = import_web34.PublicKey.findProgramAddressSync(
+  const [treasury] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("treasury"), mint.toBuffer()],
     pid
   );
-  const [vaultAuthority] = import_web34.PublicKey.findProgramAddressSync(
+  const [vaultAuthority] = import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("vault_authority"), mint.toBuffer()],
     pid
   );
@@ -2925,7 +3202,7 @@ function getNullifierPDA(poolPubkey, nullifier, programId) {
   if (nullifier.length !== 32) {
     throw new Error(`Nullifier must be 32 bytes, got ${nullifier.length}`);
   }
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("nullifier"), poolPubkey.toBuffer(), Buffer.from(nullifier)],
     pid
   );
@@ -2935,25 +3212,25 @@ function getSwapStatePDA(poolPubkey, nullifier, programId) {
   if (nullifier.length !== 32) {
     throw new Error(`Nullifier must be 32 bytes, got ${nullifier.length}`);
   }
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("swap_state"), poolPubkey.toBuffer(), Buffer.from(nullifier)],
     pid
   );
 }
 function getPoolAuthorityConfigPDA(mint = NATIVE_SOL_MINT, programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync(
+  return import_web35.PublicKey.findProgramAddressSync(
     [Buffer.from("pool_authority"), mint.toBuffer()],
     pid
   );
 }
 function getDeliveryRegistryPDA(programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync([Buffer.from("cloak_delivery_registry")], pid)[0];
+  return import_web35.PublicKey.findProgramAddressSync([Buffer.from("cloak_delivery_registry")], pid)[0];
 }
 function getChainNoteRegistryPDA(programId) {
   const pid = programId || CLOAK_PROGRAM_ID;
-  return import_web34.PublicKey.findProgramAddressSync([Buffer.from("cloak_chain_note_registry")], pid)[0];
+  return import_web35.PublicKey.findProgramAddressSync([Buffer.from("cloak_chain_note_registry")], pid)[0];
 }
 
 // src/flows/verify-utxos.ts
@@ -3284,8 +3561,9 @@ function truncate(str, len = 20) {
 var sdkLogger = createLogger("cloak::sdk");
 
 // src/relay/relay-service.ts
-var import_sha22 = require("@noble/hashes/sha2");
+var import_sha23 = require("@noble/hashes/sha2");
 init_inputs();
+var import_web36 = require("@solana/web3.js");
 var RelayService = class {
   /**
    * Create a new Relay Service client
@@ -3601,8 +3879,11 @@ var RelayService = class {
       userPubkey,
       viewingKey
     );
-    const signatureBytes = await signMessage(new TextEncoder().encode(challenge.message));
-    const signature = this.bytesToBase64(signatureBytes);
+    const signed = await signRelayAuthPayload(
+      typeof signMessage === "function" ? { walletPublicKey: new import_web36.PublicKey(userPubkey), signMessage } : signMessage,
+      new TextEncoder().encode(challenge.message)
+    );
+    const signature = this.bytesToBase64(signed.signature);
     const response = await relayFetch(`${this.baseUrl}/viewing-key/register`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -3611,7 +3892,8 @@ var RelayService = class {
         viewing_key: viewingKey,
         nonce: challenge.nonce,
         identifier,
-        signature
+        signature,
+        ...signed.mode === "transaction" ? { auth_mode: signed.mode } : {}
       })
     });
     if (!response.ok) {
@@ -3649,7 +3931,7 @@ var RelayService = class {
   }
   computeViewingKeyIdentifier(userPubkey, viewingKeyHex) {
     const preimage = new TextEncoder().encode(`${userPubkey}${viewingKeyHex}`);
-    const hash = (0, import_sha22.sha256)(preimage);
+    const hash = (0, import_sha23.sha256)(preimage);
     return Array.from(hash).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
 };
@@ -3767,10 +4049,10 @@ function encodeNoteSimple(note) {
 }
 
 // src/wallet/adapter.ts
-var import_web35 = require("@solana/web3.js");
+var import_web37 = require("@solana/web3.js");
 init_types();
 function validateWalletConnected(wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return;
   }
   if (!wallet.publicKey) {
@@ -3782,7 +4064,7 @@ function validateWalletConnected(wallet) {
   }
 }
 function getPublicKey(wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return wallet.publicKey;
   }
   if (!wallet.publicKey) {
@@ -3796,7 +4078,7 @@ function getPublicKey(wallet) {
 }
 async function sendTransaction(transaction, wallet, connection, options) {
   assertAllowedRpcConnection(connection);
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     return await connection.sendTransaction(transaction, [wallet], options);
   }
   if (wallet.sendTransaction) {
@@ -3813,7 +4095,7 @@ async function sendTransaction(transaction, wallet, connection, options) {
   }
 }
 async function signTransaction(transaction, wallet) {
-  if (wallet instanceof import_web35.Keypair) {
+  if (wallet instanceof import_web37.Keypair) {
     transaction.sign(wallet);
     return transaction;
   }
@@ -3841,7 +4123,7 @@ function keypairToAdapter(keypair) {
 }
 
 // src/program/instructions.ts
-var import_web36 = require("@solana/web3.js");
+var import_web38 = require("@solana/web3.js");
 function createDepositInstruction(params) {
   if (params.commitment.length !== 32) {
     throw new Error(
@@ -3863,7 +4145,7 @@ function createDepositInstruction(params) {
   data.set(discriminant, 0);
   data.set(amountBytes, 1);
   data.set(params.commitment, 9);
-  return new import_web36.TransactionInstruction({
+  return new import_web38.TransactionInstruction({
     programId: params.programId,
     keys: [
       // Account 0: Payer (signer, writable) - pays for transaction
@@ -3871,7 +4153,7 @@ function createDepositInstruction(params) {
       // Account 1: Pool (writable) - receives SOL
       { pubkey: params.pool, isSigner: false, isWritable: true },
       // Account 2: System Program (readonly) - for transfers
-      { pubkey: import_web36.SystemProgram.programId, isSigner: false, isWritable: false },
+      { pubkey: import_web38.SystemProgram.programId, isSigner: false, isWritable: false },
       // Account 3: Merkle Tree (writable) - stores on-chain Merkle tree
       { pubkey: params.merkleTree, isSigner: false, isWritable: true }
     ],
@@ -3879,16 +4161,16 @@ function createDepositInstruction(params) {
   });
 }
 function validateDepositParams(params) {
-  if (!(params.programId instanceof import_web36.PublicKey)) {
+  if (!(params.programId instanceof import_web38.PublicKey)) {
     throw new Error("programId must be a PublicKey");
   }
-  if (!(params.payer instanceof import_web36.PublicKey)) {
+  if (!(params.payer instanceof import_web38.PublicKey)) {
     throw new Error("payer must be a PublicKey");
   }
-  if (!(params.pool instanceof import_web36.PublicKey)) {
+  if (!(params.pool instanceof import_web38.PublicKey)) {
     throw new Error("pool must be a PublicKey");
   }
-  if (!(params.merkleTree instanceof import_web36.PublicKey)) {
+  if (!(params.merkleTree instanceof import_web38.PublicKey)) {
     throw new Error("merkleTree must be a PublicKey");
   }
   if (typeof params.amount !== "number" || params.amount <= 0) {
@@ -4229,7 +4511,7 @@ async function buildMerkleTree(commitments, height = MERKLE_TREE_HEIGHT2) {
 }
 
 // src/relay/client.ts
-var import_web37 = require("@solana/web3.js");
+var import_web39 = require("@solana/web3.js");
 var import_bs58 = __toESM(require("bs58"), 1);
 
 // src/notes/refund-leaf.ts
@@ -4346,7 +4628,7 @@ var CLOSE_SWAP_STATE_TAG = 13;
 var CLOSE_SWAP_STATE_PHASE1_PAYLOAD_LEN = 40;
 var CLOSE_SWAP_STATE_PHASE1_WIRE_LEN = 1 + CLOSE_SWAP_STATE_PHASE1_PAYLOAD_LEN;
 var CLOSE_SWAP_STATE_COMMITMENT_END = 1 + 32;
-var NATIVE_SOL_MINT2 = new import_web37.PublicKey("So11111111111111111111111111111111111111112");
+var NATIVE_SOL_MINT2 = new import_web39.PublicKey("So11111111111111111111111111111111111111112");
 var PROOF_LEN = 256;
 var PUBLIC_INPUTS_LEN = 264;
 var COMMITMENTS_OFFSET = 168;
@@ -4635,7 +4917,7 @@ async function preflightCheck(relayUrl, rootHex) {
 }
 
 // src/flows/transact.ts
-var import_web39 = require("@solana/web3.js");
+var import_web311 = require("@solana/web3.js");
 var import_spl_token = require("@solana/spl-token");
 var snarkjs = __toESM(require("snarkjs"), 1);
 init_utxo();
@@ -4863,7 +5145,7 @@ function chainNoteFromBase64(base64) {
 }
 
 // src/notes/delivery-note.ts
-var import_tweetnacl4 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl5 = __toESM(require("tweetnacl"), 1);
 var RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN = 32;
 var RECIPIENT_DELIVERY_NONCE_LEN = 24;
 var RECIPIENT_DELIVERY_PLAINTEXT_LEN = 40;
@@ -4914,10 +5196,10 @@ function encodeRecipientDeliveryNote(note, recipientViewingPublicKey) {
   const plaintext = new Uint8Array(RECIPIENT_DELIVERY_PLAINTEXT_LEN);
   writeU64LE2(plaintext, 0, note.amount);
   writeU256BE2(plaintext, 8, note.blinding);
-  const ephemeral = import_tweetnacl4.default.box.keyPair();
-  const shared = import_tweetnacl4.default.box.before(recipientViewingPublicKey, ephemeral.secretKey);
-  const nonce = import_tweetnacl4.default.randomBytes(import_tweetnacl4.default.secretbox.nonceLength);
-  const ciphertext = import_tweetnacl4.default.secretbox(plaintext, nonce, shared);
+  const ephemeral = import_tweetnacl5.default.box.keyPair();
+  const shared = import_tweetnacl5.default.box.before(recipientViewingPublicKey, ephemeral.secretKey);
+  const nonce = import_tweetnacl5.default.randomBytes(import_tweetnacl5.default.secretbox.nonceLength);
+  const ciphertext = import_tweetnacl5.default.secretbox(plaintext, nonce, shared);
   if (ciphertext.length !== RECIPIENT_DELIVERY_CIPHERTEXT_LEN) {
     throw new Error(
       `delivery ciphertext must be ${RECIPIENT_DELIVERY_CIPHERTEXT_LEN} bytes, got ${ciphertext.length}`
@@ -4943,8 +5225,8 @@ function openRecipientDeliveryNote(envelope, viewingSecretKey) {
     const ciphertext = envelope.slice(
       RECIPIENT_DELIVERY_EPHEMERAL_PK_LEN + RECIPIENT_DELIVERY_NONCE_LEN
     );
-    const shared = import_tweetnacl4.default.box.before(ephemeralPk, viewingSecretKey);
-    const plaintext = import_tweetnacl4.default.secretbox.open(ciphertext, nonce, shared);
+    const shared = import_tweetnacl5.default.box.before(ephemeralPk, viewingSecretKey);
+    const plaintext = import_tweetnacl5.default.secretbox.open(ciphertext, nonce, shared);
     if (!plaintext || plaintext.length !== RECIPIENT_DELIVERY_PLAINTEXT_LEN) return null;
     return { amount: readU64LE2(plaintext, 0), blinding: readU256BE2(plaintext, 8) };
   } catch {
@@ -5002,7 +5284,7 @@ function parseDeliveryCarrierMemo(data) {
 
 // src/notes/swap-refund.ts
 var import_blake34 = require("@noble/hashes/blake3");
-var import_web38 = require("@solana/web3.js");
+var import_web310 = require("@solana/web3.js");
 var import_bs582 = __toESM(require("bs58"), 1);
 init_utxo();
 init_inputs();
@@ -5149,7 +5431,7 @@ async function discoverSwapRefunds(connection, programId, viewingKeyNk, options
   const { limit = 0, untilSignature, batchSize = 50, onStatus } = options;
   const poolMint = options.poolMint ?? NATIVE_SOL_MINT;
   const programIdBase58 = programId.toBase58();
-  const [pool] = import_web38.PublicKey.findProgramAddressSync(
+  const [pool] = import_web310.PublicKey.findProgramAddressSync(
     [Buffer.from("pool"), poolMint.toBuffer()],
     programId
   );
@@ -5200,7 +5482,7 @@ async function discoverSwapRefunds(connection, programId, viewingKeyNk, options
         if (data[0] !== TRANSACT_SWAP_TAG2 || data.length < MIN_TRANSACT_SWAP_LEN) continue;
         const nullifier = data.slice(NULLIFIER_0_OFFSET, NULLIFIER_0_OFFSET + 32);
         if (nullifier.length !== 32) continue;
-        const [swapState] = import_web38.PublicKey.findProgramAddressSync(
+        const [swapState] = import_web310.PublicKey.findProgramAddressSync(
           [Buffer.from("swap_state"), pool.toBuffer(), Buffer.from(nullifier)],
           programId
         );
@@ -5263,406 +5545,173 @@ function saltToBytes(noteSalt) {
     out[i] = Number(v & 0xffn);
     v >>= 8n;
   }
-  return out;
-}
-function toFieldSecret2(bytes) {
-  let value = 0n;
-  for (let i = 0; i < 32; i++) value = value << 8n | BigInt(bytes[i]);
-  const reduced = value % (BN254_MODULUS >> 4n);
-  return reduced === 0n ? 1n : reduced;
-}
-function derive2(nk, salt, info) {
-  const preimage = new Uint8Array(
-    DEPOSIT_NOTE_DOMAIN.length + nk.length + salt.length + info.length
-  );
-  let off = 0;
-  preimage.set(DEPOSIT_NOTE_DOMAIN, off);
-  off += DEPOSIT_NOTE_DOMAIN.length;
-  preimage.set(nk, off);
-  off += nk.length;
-  preimage.set(salt, off);
-  off += salt.length;
-  preimage.set(info, off);
-  return (0, import_blake35.blake3)(preimage);
-}
-function randomDepositNoteSalt() {
-  const bytes = randomBytes(12);
-  let v = 0n;
-  for (const b of bytes) v = v << 8n | BigInt(b);
-  return v === 0n ? 1n : v;
-}
-async function deriveDepositNoteSecrets(viewingKeyNk, noteSalt) {
-  if (!viewingKeyNk || !(viewingKeyNk instanceof Uint8Array) || viewingKeyNk.length !== 32) {
-    throw new Error("viewingKeyNk must be 32 bytes");
-  }
-  const salt = saltToBytes(noteSalt);
-  const privateKey = toFieldSecret2(derive2(viewingKeyNk, salt, DEPOSIT_PRIVATE_KEY_INFO));
-  const blinding = toFieldSecret2(derive2(viewingKeyNk, salt, DEPOSIT_BLINDING_INFO));
-  const publicKey = await derivePublicKey(privateKey);
-  if (publicKey === 0n || blinding === 0n) {
-    throw new Error("derived deposit note secrets are degenerate");
-  }
-  return { keypair: { privateKey, publicKey }, blinding };
-}
-async function createRecoverableDepositUtxo(amount, viewingKeyNk, mintAddress = NATIVE_SOL_MINT, noteSalt = randomDepositNoteSalt()) {
-  if (typeof amount !== "bigint" || amount <= 0n) {
-    throw new Error("amount must be a positive bigint");
-  }
-  const { keypair, blinding } = await deriveDepositNoteSecrets(viewingKeyNk, noteSalt);
-  const utxo = { amount, keypair, blinding, mintAddress };
-  utxo.commitment = await computeCommitment2(utxo);
-  return { utxo, noteSalt };
-}
-function normalizeCommitment(value) {
-  if (typeof value === "bigint") return value;
-  if (typeof value !== "string") return null;
-  const clean = value.startsWith("0x") ? value.slice(2) : value;
-  if (!/^[0-9a-fA-F]{1,64}$/.test(clean)) return null;
-  return BigInt("0x" + clean);
-}
-async function matchDepositNote(params) {
-  const { viewingKeyNk, noteSalt, amount, mintAddress, outputCommitments } = params;
-  if (typeof amount !== "bigint" || amount <= 0n) return null;
-  let secrets;
-  try {
-    secrets = await deriveDepositNoteSecrets(viewingKeyNk, noteSalt);
-  } catch {
-    return null;
-  }
-  const candidate = await computeCommitment2({
-    amount,
-    keypair: secrets.keypair,
-    blinding: secrets.blinding,
-    mintAddress
-  });
-  const published = (outputCommitments ?? []).map(normalizeCommitment).filter((value) => value !== null);
-  if (!published.some((value) => value === candidate)) return null;
-  return { ...secrets, amount, mintAddress, commitment: candidate, noteSalt };
-}
-
-// src/notes/change-note.ts
-var import_blake36 = require("@noble/hashes/blake3");
-init_utxo();
-init_inputs();
-var CHANGE_NOTE_DOMAIN = new TextEncoder().encode("cloak_change_note_v1");
-var CHANGE_BLINDING_INFO = new TextEncoder().encode("blinding");
-var MAX_OUTPUT_INDEX = 1;
-var MAX_CHAIN_NOTE_SALT2 = (1n << BigInt(CHAIN_NOTE_SALT_BITS)) - 1n;
-function saltToBytes2(noteSalt) {
-  if (typeof noteSalt !== "bigint" || noteSalt <= 0n || noteSalt > MAX_CHAIN_NOTE_SALT2) {
-    throw new Error(`noteSalt must be a positive ${CHAIN_NOTE_SALT_BITS}-bit value`);
-  }
-  const out = new Uint8Array(32);
-  let v = noteSalt;
-  for (let i = 31; i >= 0; i--) {
-    out[i] = Number(v & 0xffn);
-    v >>= 8n;
-  }
-  return out;
-}
-function toFieldSecret3(bytes) {
-  let value = 0n;
-  for (let i = 0; i < 32; i++) value = value << 8n | BigInt(bytes[i]);
-  const reduced = value % (BN254_MODULUS >> 4n);
-  return reduced === 0n ? 1n : reduced;
-}
-function randomChangeNoteSalt() {
-  const bytes = randomBytes(12);
-  let v = 0n;
-  for (const b of bytes) v = v << 8n | BigInt(b);
-  return v === 0n ? 1n : v;
-}
-function deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex) {
-  if (!viewingKeyNk || !(viewingKeyNk instanceof Uint8Array) || viewingKeyNk.length !== 32) {
-    throw new Error("viewingKeyNk must be 32 bytes");
-  }
-  if (!Number.isInteger(outputIndex) || outputIndex < 0 || outputIndex > MAX_OUTPUT_INDEX) {
-    throw new Error(`outputIndex must be 0..${MAX_OUTPUT_INDEX}`);
-  }
-  const salt = saltToBytes2(noteSalt);
-  const preimage = new Uint8Array(
-    CHANGE_NOTE_DOMAIN.length + viewingKeyNk.length + salt.length + 1 + CHANGE_BLINDING_INFO.length
-  );
-  let off = 0;
-  preimage.set(CHANGE_NOTE_DOMAIN, off);
-  off += CHANGE_NOTE_DOMAIN.length;
-  preimage.set(viewingKeyNk, off);
-  off += viewingKeyNk.length;
-  preimage.set(salt, off);
-  off += salt.length;
-  preimage[off] = outputIndex;
-  off += 1;
-  preimage.set(CHANGE_BLINDING_INFO, off);
-  return toFieldSecret3((0, import_blake36.blake3)(preimage));
-}
-async function createRecoverableChangeUtxo(amount, keypair, viewingKeyNk, mintAddress = NATIVE_SOL_MINT, noteSalt = randomChangeNoteSalt(), outputIndex = 0) {
-  if (typeof amount !== "bigint" || amount <= 0n) {
-    throw new Error("amount must be a positive bigint");
-  }
-  const blinding = deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex);
-  const utxo = { amount, keypair, blinding, mintAddress };
-  utxo.commitment = await computeCommitment2(utxo);
-  return { utxo, noteSalt };
-}
-function normalizeCommitment2(value) {
-  if (typeof value === "bigint") return value;
-  if (typeof value !== "string") return null;
-  const clean = value.startsWith("0x") ? value.slice(2) : value;
-  if (!/^[0-9a-fA-F]{1,64}$/.test(clean)) return null;
-  return BigInt("0x" + clean);
-}
-async function matchChangeNote(params) {
-  const { viewingKeyNk, noteSalt, amount, keypair, mintAddress, outputIndex, outputCommitments } = params;
-  if (typeof amount !== "bigint" || amount <= 0n) return null;
-  if (!keypair || typeof keypair.publicKey !== "bigint" || keypair.publicKey === 0n) return null;
-  let blinding;
-  try {
-    blinding = deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex);
-  } catch {
-    return null;
-  }
-  const candidate = await computeCommitment2({ amount, keypair, blinding, mintAddress });
-  const published = (outputCommitments ?? []).map(normalizeCommitment2).filter((value) => value !== null);
-  if (!published.some((value) => value === candidate)) return null;
-  return { keypair, blinding, amount, mintAddress, commitment: candidate, noteSalt };
-}
-
-// src/flows/transact.ts
-var import_circomlibjs4 = require("circomlibjs");
-var import_tweetnacl6 = __toESM(require("tweetnacl"), 1);
-
-// src/relay/payload.ts
-var import_sha23 = require("@noble/hashes/sha2");
-var import_utils = require("@noble/hashes/utils");
-var import_tweetnacl5 = __toESM(require("tweetnacl"), 1);
-init_inputs();
-var REQUEST_AUTH_DOMAIN = "CLOAK_RELAY_REQUEST_AUTH_V1";
-var REQUEST_AUTH_MAX_AGE_SECONDS = 300;
-var REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS = 30;
-var RELAY_AUTH_APPROVAL_MARGIN_SECONDS = 15;
-function sha256Hex(text) {
-  return (0, import_utils.bytesToHex)((0, import_sha23.sha256)(new TextEncoder().encode(text)));
-}
-function randomNonceUuid() {
-  const webCrypto = globalThis?.crypto;
-  if (typeof webCrypto?.randomUUID === "function") return webCrypto.randomUUID();
-  const proc = globalThis?.process;
-  const nodeCrypto = typeof proc?.getBuiltinModule === "function" ? proc.getBuiltinModule("node:crypto") : void 0;
-  if (typeof nodeCrypto?.randomUUID === "function") return nodeCrypto.randomUUID();
-  const bytes = randomBytes(16);
-  bytes[6] = bytes[6] & 15 | 64;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = (0, import_utils.bytesToHex)(bytes);
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
-}
-var TRANSACT_AUTH_FIELDS = [
-  "encrypted_notes",
-  "max_fee",
-  "mint",
-  "proof_bytes",
-  "public_inputs",
-  "recipient",
-  "recipient_delivery_notes",
-  "risk_quote",
-  "sender"
-];
-var TRANSACT_SWAP_AUTH_FIELDS = [
-  "close_timed_out",
-  "dexes",
-  "encrypted_notes",
-  "exclude_dexes",
-  "max_fee",
-  "min_output_amount",
-  "output_mint",
-  "proof_bytes",
-  "public_inputs",
-  "recipient",
-  "recipient_ata",
-  "refund_blinding",
-  "refund_pubkey",
-  "retry_request_id",
-  "risk_quote",
-  "route_retry_attempts",
-  "sender",
-  "slippage_bps",
-  "swap_max_retries"
-];
-var UTF8 = new TextEncoder();
-function compareKeysBytewise(a, b) {
-  if (a === b) return 0;
-  const ab = UTF8.encode(a);
-  const bb = UTF8.encode(b);
-  const shared = Math.min(ab.length, bb.length);
-  for (let i = 0; i < shared; i++) {
-    if (ab[i] !== bb[i]) return ab[i] - bb[i];
-  }
-  return ab.length - bb.length;
-}
-function canonicalJson(value) {
-  if (value === null || value === void 0) return "null";
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number") {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || !Number.isSafeInteger(value)) {
-      throw new Error(
-        `canonicalJson: refusing to sign the number ${String(value)}. The relay renders numbers with serde_json, which spells non-integer, non-finite and very large values differently from JavaScript, so the two digests would differ and the request would be rejected with an unexplained 401. Send it as a decimal string instead, which is how every amount in this schema travels.`
-      );
-    }
-    return String(value);
-  }
-  if (typeof value === "bigint") return value.toString();
-  if (typeof value === "string") return JSON.stringify(value);
-  if (Array.isArray(value)) return "[" + value.map(canonicalJson).join(",") + "]";
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).sort(compareKeysBytewise);
-    return "{" + keys.map((k) => {
-      const v = obj[k];
-      if (typeof v === "function" || typeof v === "symbol") {
-        throw new Error(
-          `canonicalJson: the key "${k}" holds a ${typeof v}, which has no JSON representation. JSON.stringify would drop it from the wire body while it stayed in the signed view, so the relay's digest could never match this one.`
-        );
-      }
-      return `${JSON.stringify(k)}:${canonicalJson(v)}`;
-    }).join(",") + "}";
-  }
-  throw new Error(`canonicalJson: unsupported value of type ${typeof value}`);
-}
-var FIELDS_WITHOUT_NULL_ENCODING = {
-  slippage_bps: "500 (`default_slippage_bps` in api/transact_swap.rs)"
-};
-function buildAuthRequest(body, sender, fields) {
-  const out = {};
-  for (const k of fields) {
-    if (k === "sender") {
-      out[k] = sender;
-      continue;
-    }
-    const value = body[k];
-    if (value === void 0 || value === null) {
-      const relayDefault = FIELDS_WITHOUT_NULL_ENCODING[k];
-      if (relayDefault) {
-        throw new Error(
-          `Relay request auth: \`${k}\` must be present in the body. It is the one field in this schema that is not optional on the relay side: when it is missing the relay signs its default, ${relayDefault}, while this request would sign null. The two digests differ and the relay answers 401 "Relay request signature does not match the exact request", which points at nothing. Set \`${k}\` explicitly, to the same value the body will carry.`
-        );
-      }
-      out[k] = null;
-      continue;
-    }
-    out[k] = value;
-  }
-  return out;
-}
-function buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request) {
-  const digest = sha256Hex(canonicalJson(request));
-  return new TextEncoder().encode(
-    `${REQUEST_AUTH_DOMAIN}
-${endpoint}
-${programId.toBase58()}
-${nonce}
-${issuedAt}
-${digest}`
-  );
+  return out;
 }
-function buildRelayAuthPreimage(endpoint, programId, body, sender, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
-  const senderB58 = sender.toBase58();
-  const issuedAt = String(nowSeconds ?? Math.floor(Date.now() / 1e3));
-  const nonce = randomNonceUuid();
-  const request = buildAuthRequest({ ...body, sender: senderB58 }, senderB58, fields);
-  const message = buildRequestAuthMessage(endpoint, programId, issuedAt, nonce, request);
-  return { sender: senderB58, auth_issued_at: issuedAt, auth_nonce: nonce, message };
+function toFieldSecret2(bytes) {
+  let value = 0n;
+  for (let i = 0; i < 32; i++) value = value << 8n | BigInt(bytes[i]);
+  const reduced = value % (BN254_MODULUS >> 4n);
+  return reduced === 0n ? 1n : reduced;
 }
-function signRelayRequest(endpoint, programId, body, signer, nowSeconds, fields = TRANSACT_AUTH_FIELDS) {
-  const preimage = buildRelayAuthPreimage(
-    endpoint,
-    programId,
-    body,
-    signer.publicKey,
-    nowSeconds,
-    fields
+function derive2(nk, salt, info) {
+  const preimage = new Uint8Array(
+    DEPOSIT_NOTE_DOMAIN.length + nk.length + salt.length + info.length
   );
-  const signature = import_tweetnacl5.default.sign.detached(preimage.message, signer.secretKey);
-  return {
-    sender: preimage.sender,
-    auth_issued_at: preimage.auth_issued_at,
-    auth_nonce: preimage.auth_nonce,
-    auth_signature: Buffer.from(signature).toString("base64")
-  };
+  let off = 0;
+  preimage.set(DEPOSIT_NOTE_DOMAIN, off);
+  off += DEPOSIT_NOTE_DOMAIN.length;
+  preimage.set(nk, off);
+  off += nk.length;
+  preimage.set(salt, off);
+  off += salt.length;
+  preimage.set(info, off);
+  return (0, import_blake35.blake3)(preimage);
 }
-function assertApprovalWithinFreshnessWindow(elapsedMs, maxAgeSeconds = REQUEST_AUTH_MAX_AGE_SECONDS) {
-  const elapsedSeconds = elapsedMs / 1e3;
-  const budget = maxAgeSeconds - RELAY_AUTH_APPROVAL_MARGIN_SECONDS;
-  if (elapsedSeconds <= budget) return;
-  throw new Error(
-    `The wallet approval took ${Math.round(elapsedSeconds)} seconds, and Cloak requests stay valid for ${maxAgeSeconds} seconds from the moment they are signed (${RELAY_AUTH_APPROVAL_MARGIN_SECONDS} of those are held back for the request to reach the network). The timestamp is inside the signature, so it cannot be refreshed without your approval again. NOTHING WAS SUBMITTED and no funds moved. Start the same operation again and approve the prompt when it appears.`
-  );
+function randomDepositNoteSalt() {
+  const bytes = randomBytes(12);
+  let v = 0n;
+  for (const b of bytes) v = v << 8n | BigInt(b);
+  return v === 0n ? 1n : v;
 }
-function explainRelayAuthRejection(responseText) {
-  const text = String(responseText);
-  const has = (needle) => text.includes(needle);
-  if (has("issued too far in the future")) {
-    return `This computer's clock is more than ${REQUEST_AUTH_MAX_FUTURE_SKEW_SECONDS} seconds ahead of the network's, so the request looks like it was signed in the future and is refused before anything else happens. Turn on automatic date and time (or resynchronise the clock) and try again. Nothing was submitted.`;
-  }
-  if (has("signature expired")) {
-    return `The request was signed more than ${REQUEST_AUTH_MAX_AGE_SECONDS} seconds before it arrived, usually because a wallet approval was left waiting, or because this computer's clock is running behind. The signed timestamp cannot be refreshed on its own. Start the operation again. Nothing was submitted.`;
+async function deriveDepositNoteSecrets(viewingKeyNk, noteSalt) {
+  if (!viewingKeyNk || !(viewingKeyNk instanceof Uint8Array) || viewingKeyNk.length !== 32) {
+    throw new Error("viewingKeyNk must be 32 bytes");
   }
-  if (has("does not match the exact request")) {
-    return `The request body changed after it was signed, so the relay's digest and this one disagree. Sign the exact body that is POSTed, and re-POST a retry byte for byte rather than rebuilding it. If this is a hand-built swap call, check that every field in TRANSACT_SWAP_AUTH_FIELDS is present, including \`slippage_bps\`.`;
+  const salt = saltToBytes(noteSalt);
+  const privateKey = toFieldSecret2(derive2(viewingKeyNk, salt, DEPOSIT_PRIVATE_KEY_INFO));
+  const blinding = toFieldSecret2(derive2(viewingKeyNk, salt, DEPOSIT_BLINDING_INFO));
+  const publicKey = await derivePublicKey(privateKey);
+  if (publicKey === 0n || blinding === 0n) {
+    throw new Error("derived deposit note secrets are degenerate");
   }
-  if (has("has no registered viewing key")) {
-    return `The signature was accepted, so this is not a signing problem: the wallet that signed has no viewing key registered with Cloak yet. Register one first, or let the SDK do it by leaving \`enforceViewingKeyRegistration\` on and supplying the viewing key.`;
+  return { keypair: { privateKey, publicKey }, blinding };
+}
+async function createRecoverableDepositUtxo(amount, viewingKeyNk, mintAddress = NATIVE_SOL_MINT, noteSalt = randomDepositNoteSalt()) {
+  if (typeof amount !== "bigint" || amount <= 0n) {
+    throw new Error("amount must be a positive bigint");
   }
-  if (has("Authenticated sender is required") || has("auth_issued_at is required") || has("auth_nonce is required") || has("auth_signature is required")) {
-    return `The request reached the relay without its authentication fields. Pass \`depositorKeypair\`, or \`signMessage\` together with \`walletPublicKey\`, so the request can be signed.`;
+  const { keypair, blinding } = await deriveDepositNoteSecrets(viewingKeyNk, noteSalt);
+  const utxo = { amount, keypair, blinding, mintAddress };
+  utxo.commitment = await computeCommitment2(utxo);
+  return { utxo, noteSalt };
+}
+function normalizeCommitment(value) {
+  if (typeof value === "bigint") return value;
+  if (typeof value !== "string") return null;
+  const clean = value.startsWith("0x") ? value.slice(2) : value;
+  if (!/^[0-9a-fA-F]{1,64}$/.test(clean)) return null;
+  return BigInt("0x" + clean);
+}
+async function matchDepositNote(params) {
+  const { viewingKeyNk, noteSalt, amount, mintAddress, outputCommitments } = params;
+  if (typeof amount !== "bigint" || amount <= 0n) return null;
+  let secrets;
+  try {
+    secrets = await deriveDepositNoteSecrets(viewingKeyNk, noteSalt);
+  } catch {
+    return null;
   }
-  if (has("auth_nonce must be a canonical UUID")) {
-    return `\`auth_nonce\` must be a canonical lowercase UUID. Reuse the one from the preimage.`;
+  const candidate = await computeCommitment2({
+    amount,
+    keypair: secrets.keypair,
+    blinding: secrets.blinding,
+    mintAddress
+  });
+  const published = (outputCommitments ?? []).map(normalizeCommitment).filter((value) => value !== null);
+  if (!published.some((value) => value === candidate)) return null;
+  return { ...secrets, amount, mintAddress, commitment: candidate, noteSalt };
+}
+
+// src/notes/change-note.ts
+var import_blake36 = require("@noble/hashes/blake3");
+init_utxo();
+init_inputs();
+var CHANGE_NOTE_DOMAIN = new TextEncoder().encode("cloak_change_note_v1");
+var CHANGE_BLINDING_INFO = new TextEncoder().encode("blinding");
+var MAX_OUTPUT_INDEX = 1;
+var MAX_CHAIN_NOTE_SALT2 = (1n << BigInt(CHAIN_NOTE_SALT_BITS)) - 1n;
+function saltToBytes2(noteSalt) {
+  if (typeof noteSalt !== "bigint" || noteSalt <= 0n || noteSalt > MAX_CHAIN_NOTE_SALT2) {
+    throw new Error(`noteSalt must be a positive ${CHAIN_NOTE_SALT_BITS}-bit value`);
   }
-  if (has("Relay request signature must be exactly 64 bytes") || has("Invalid relay request signature encoding")) {
-    return `\`auth_signature\` must be the raw 64-byte ed25519 detached signature, base64 encoded. Wallet adapters that wrap or re-encode what \`signMessage\` returns cannot be used here.`;
+  const out = new Uint8Array(32);
+  let v = noteSalt;
+  for (let i = 31; i >= 0; i--) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
   }
-  return null;
+  return out;
 }
-async function buildRelayAuthFields(endpoint, programId, body, signers, fields = TRANSACT_AUTH_FIELDS) {
-  if (signers.depositorKeypair) {
-    return signRelayRequest(endpoint, programId, body, signers.depositorKeypair, void 0, fields);
+function toFieldSecret3(bytes) {
+  let value = 0n;
+  for (let i = 0; i < 32; i++) value = value << 8n | BigInt(bytes[i]);
+  const reduced = value % (BN254_MODULUS >> 4n);
+  return reduced === 0n ? 1n : reduced;
+}
+function randomChangeNoteSalt() {
+  const bytes = randomBytes(12);
+  let v = 0n;
+  for (const b of bytes) v = v << 8n | BigInt(b);
+  return v === 0n ? 1n : v;
+}
+function deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex) {
+  if (!viewingKeyNk || !(viewingKeyNk instanceof Uint8Array) || viewingKeyNk.length !== 32) {
+    throw new Error("viewingKeyNk must be 32 bytes");
   }
-  const wallet = signers.relayAuthSigner;
-  if (!wallet) return null;
-  const preimage = buildRelayAuthPreimage(
-    endpoint,
-    programId,
-    body,
-    wallet.walletPublicKey,
-    void 0,
-    fields
+  if (!Number.isInteger(outputIndex) || outputIndex < 0 || outputIndex > MAX_OUTPUT_INDEX) {
+    throw new Error(`outputIndex must be 0..${MAX_OUTPUT_INDEX}`);
+  }
+  const salt = saltToBytes2(noteSalt);
+  const preimage = new Uint8Array(
+    CHANGE_NOTE_DOMAIN.length + viewingKeyNk.length + salt.length + 1 + CHANGE_BLINDING_INFO.length
   );
-  const approvalStartedMs = Date.now();
-  const signature = await wallet.signMessage(preimage.message);
-  assertApprovalWithinFreshnessWindow(Date.now() - approvalStartedMs);
-  if (!(signature instanceof Uint8Array) || signature.length !== 64) {
-    throw new Error(
-      `The wallet's signMessage did not return a 64-byte ed25519 detached signature (got ${signature instanceof Uint8Array ? `${signature.length} bytes` : typeof signature}). Cloak signs with a raw detached signature over the bytes it hands the wallet; adapters that wrap or re-encode the result cannot be used here. Pass depositorKeypair instead, or use an adapter whose signMessage returns the raw signature.`
-    );
+  let off = 0;
+  preimage.set(CHANGE_NOTE_DOMAIN, off);
+  off += CHANGE_NOTE_DOMAIN.length;
+  preimage.set(viewingKeyNk, off);
+  off += viewingKeyNk.length;
+  preimage.set(salt, off);
+  off += salt.length;
+  preimage[off] = outputIndex;
+  off += 1;
+  preimage.set(CHANGE_BLINDING_INFO, off);
+  return toFieldSecret3((0, import_blake36.blake3)(preimage));
+}
+async function createRecoverableChangeUtxo(amount, keypair, viewingKeyNk, mintAddress = NATIVE_SOL_MINT, noteSalt = randomChangeNoteSalt(), outputIndex = 0) {
+  if (typeof amount !== "bigint" || amount <= 0n) {
+    throw new Error("amount must be a positive bigint");
   }
-  return {
-    sender: preimage.sender,
-    auth_issued_at: preimage.auth_issued_at,
-    auth_nonce: preimage.auth_nonce,
-    auth_signature: Buffer.from(signature).toString("base64")
-  };
+  const blinding = deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex);
+  const utxo = { amount, keypair, blinding, mintAddress };
+  utxo.commitment = await computeCommitment2(utxo);
+  return { utxo, noteSalt };
 }
-var REQUEST_AUTH_BATCH_DOMAIN = "CLOAK_RELAY_BATCH_AUTH_V1";
-var REQUEST_AUTH_BATCH_MAX_AGE_SECONDS = 600;
-var RELAY_BATCH_AUTH_MAX_ITEMS = 64;
-function relayRequestDigestHex(preimage) {
-  return (0, import_utils.bytesToHex)((0, import_sha23.sha256)(preimage.message));
+function normalizeCommitment2(value) {
+  if (typeof value === "bigint") return value;
+  if (typeof value !== "string") return null;
+  const clean = value.startsWith("0x") ? value.slice(2) : value;
+  if (!/^[0-9a-fA-F]{1,64}$/.test(clean)) return null;
+  return BigInt("0x" + clean);
 }
-function buildRelayBatchAuthMessage(programId, issuedAt, digests) {
-  const lines = [REQUEST_AUTH_BATCH_DOMAIN, programId.toBase58(), issuedAt, String(digests.length)];
-  return new TextEncoder().encode([...lines, ...digests].join("\n"));
+async function matchChangeNote(params) {
+  const { viewingKeyNk, noteSalt, amount, keypair, mintAddress, outputIndex, outputCommitments } = params;
+  if (typeof amount !== "bigint" || amount <= 0n) return null;
+  if (!keypair || typeof keypair.publicKey !== "bigint" || keypair.publicKey === 0n) return null;
+  let blinding;
+  try {
+    blinding = deriveChangeNoteBlinding(viewingKeyNk, noteSalt, outputIndex);
+  } catch {
+    return null;
+  }
+  const candidate = await computeCommitment2({ amount, keypair, blinding, mintAddress });
+  const published = (outputCommitments ?? []).map(normalizeCommitment2).filter((value) => value !== null);
+  if (!published.some((value) => value === candidate)) return null;
+  return { keypair, blinding, amount, mintAddress, commitment: candidate, noteSalt };
 }
 
 // src/flows/transact.ts
+var import_circomlibjs4 = require("circomlibjs");
+var import_tweetnacl6 = __toESM(require("tweetnacl"), 1);
 init_inputs();
 
 // src/proving/artifacts.ts
@@ -6065,7 +6114,7 @@ async function fetchSupplementalAltFromRelay(relayUrl, params) {
     throw new Error("Supplemental ALT response is missing a 'table' address");
   }
   try {
-    return new import_web39.PublicKey(table);
+    return new import_web311.PublicKey(table);
   } catch {
     throw new Error(`Supplemental ALT response 'table' is not a valid public key: ${table}`);
   }
@@ -6133,7 +6182,7 @@ async function resolveAddressLookupTableAccounts(connection, relayUrl, altAddres
   const fetched = await Promise.all(
     altAddresses.map(async (addr) => {
       try {
-        const pubkey = new import_web39.PublicKey(addr);
+        const pubkey = new import_web311.PublicKey(addr);
         const result = await connection.getAddressLookupTable(pubkey);
         return result.value ?? null;
       } catch {
@@ -6223,7 +6272,7 @@ function calculateConfiguredProtocolFee(amount, config) {
   return total;
 }
 async function readLiveProtocolFee(connection, programId, mint, amount, requireSwapOpen = false) {
-  const [poolConfigPda] = import_web39.PublicKey.findProgramAddressSync(
+  const [poolConfigPda] = import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("pool_config"), mint.toBuffer()],
     programId
   );
@@ -6385,17 +6434,27 @@ async function registerViewingKeyOnce(relayUrl, userPubkey, viewingKeyHex, cache
     viewingKeyHex
   );
   let signatureBase64;
+  let authMode = "message";
+  const messageBytes = new TextEncoder().encode(challenge.message);
   if (options.signMessage) {
-    const messageBytes = new TextEncoder().encode(challenge.message);
     const sig = await options.signMessage(messageBytes);
     signatureBase64 = Buffer.from(sig).toString("base64");
   } else if (options.depositorKeypair) {
-    const messageBytes = new TextEncoder().encode(challenge.message);
     const sig = import_tweetnacl6.default.sign.detached(messageBytes, options.depositorKeypair.secretKey);
     signatureBase64 = Buffer.from(sig).toString("base64");
+  } else if (options.signAuthTransaction) {
+    onProgress?.(
+      "Approve the viewing-key registration in your wallet. It shows as a 0 SOL transfer to yourself and is never sent to the network."
+    );
+    const signed = await signRelayAuthPayload(
+      { walletPublicKey: userPubkey, signAuthTransaction: options.signAuthTransaction },
+      messageBytes
+    );
+    signatureBase64 = Buffer.from(signed.signature).toString("base64");
+    authMode = signed.mode;
   } else {
     throw new Error(
-      "Viewing key registration is mandatory: signMessage (wallet) or depositorKeypair is required."
+      "Viewing key registration is mandatory: signMessage or signAuthTransaction (wallet) or depositorKeypair is required."
     );
   }
   onProgress?.("Registering viewing key...");
@@ -6406,7 +6465,8 @@ async function registerViewingKeyOnce(relayUrl, userPubkey, viewingKeyHex, cache
       user_pubkey: userPubkey.toBase58(),
       viewing_key: viewingKeyHex,
       nonce: challenge.nonce,
-      signature: signatureBase64
+      signature: signatureBase64,
+      ...authMode === "transaction" ? { auth_mode: authMode } : {}
     })
   });
   if (!response.ok) {
@@ -6500,7 +6560,7 @@ function buildPublicInputsBytesFromSignals(publicSignals) {
 var TRANSACT_DISCRIMINATOR = 0;
 var RANGE_QUOTE_TAG_DEPOSIT = 1;
 function deriveRiskNoncePDA(programId, nonce) {
-  return import_web39.PublicKey.findProgramAddressSync(
+  return import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("risk_nonce"), Buffer.from(nonce)],
     programId
   );
@@ -6519,7 +6579,7 @@ function extractDepositNonceFromEd25519Ix(ix) {
   }
 }
 function deriveNullifierPDA(programId, poolPDA, nullifier) {
-  return import_web39.PublicKey.findProgramAddressSync(
+  return import_web311.PublicKey.findProgramAddressSync(
     [Buffer.from("nullifier"), poolPDA.toBuffer(), Buffer.from(nullifier)],
     programId
   );
@@ -6552,7 +6612,7 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
   }
   if (!isDepositData) {
     data[offset++] = 3;
-    data.set((relayer ?? import_web39.PublicKey.default).toBytes(), offset);
+    data.set((relayer ?? import_web311.PublicKey.default).toBytes(), offset);
     offset += 32;
     writeBigUInt64LE(data, relayerFee ?? BigInt(0), offset);
     offset += 8;
@@ -6582,7 +6642,7 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
     // 4. nullifier PDA 0 (writable)
     { pubkey: nullifierPDA1, isSigner: false, isWritable: true },
     // 5. nullifier PDA 1 (writable)
-    { pubkey: import_web39.SystemProgram.programId, isSigner: false, isWritable: false }
+    { pubkey: import_web311.SystemProgram.programId, isSigner: false, isWritable: false }
     // 6. system_program
   ];
   if (splAccounts) {
@@ -6591,34 +6651,34 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
     accounts.push({ pubkey: splAccounts.tokenProgram, isSigner: false, isWritable: false });
     if (splAccounts.payerAta) {
       if (enableRiskCheck) {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       }
       accounts.push({ pubkey: splAccounts.payerAta, isSigner: false, isWritable: true });
       if (riskNonce) {
         accounts.push({ pubkey: riskNonce, isSigner: false, isWritable: true });
       }
     } else if (enableRiskCheck && !recipient) {
-      accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+      accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
     }
   } else {
     if (recipient) {
       accounts.push({ pubkey: recipient, isSigner: false, isWritable: true });
       if (enableRiskCheck) {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       }
     } else if (enableRiskCheck) {
       if (publicAmountForAccounts === BigInt(0)) {
         accounts.push({ pubkey: payer, isSigner: true, isWritable: false });
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
       } else {
-        accounts.push({ pubkey: import_web39.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
+        accounts.push({ pubkey: import_web311.SYSVAR_INSTRUCTIONS_PUBKEY, isSigner: false, isWritable: false });
         if (riskNonce) {
           accounts.push({ pubkey: riskNonce, isSigner: false, isWritable: true });
         }
       }
     }
   }
-  return new import_web39.TransactionInstruction({
+  return new import_web311.TransactionInstruction({
     programId,
     keys: accounts,
     data
@@ -6627,10 +6687,10 @@ function buildTransactInstruction(programId, payer, poolPDA, treasuryPDA, merkle
 var PACKET_LIMIT_BYTES = 1232;
 function getCommonALTAddresses() {
   return [
-    import_web39.SystemProgram.programId,
-    import_web39.SYSVAR_SLOT_HASHES_PUBKEY,
-    import_web39.SYSVAR_INSTRUCTIONS_PUBKEY,
-    import_web39.ComputeBudgetProgram.programId
+    import_web311.SystemProgram.programId,
+    import_web311.SYSVAR_SLOT_HASHES_PUBKEY,
+    import_web311.SYSVAR_INSTRUCTIONS_PUBKEY,
+    import_web311.ComputeBudgetProgram.programId
   ];
 }
 function dedupePubkeys(addresses) {
@@ -6681,12 +6741,12 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
     try {
       const slot = await connection.getSlot("finalized");
       const altPayerPubkey = externalFeePayer ? await externalFeePayer.getPayerPubkey() : depositor.publicKey;
-      const [createIx, altAddress] = import_web39.AddressLookupTableProgram.createLookupTable({
+      const [createIx, altAddress] = import_web311.AddressLookupTableProgram.createLookupTable({
         authority: depositor.publicKey,
         payer: altPayerPubkey,
         recentSlot: slot
       });
-      const extendIx = import_web39.AddressLookupTableProgram.extendLookupTable({
+      const extendIx = import_web311.AddressLookupTableProgram.extendLookupTable({
         payer: altPayerPubkey,
         authority: depositor.publicKey,
         lookupTable: altAddress,
@@ -6705,12 +6765,12 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
           allowSupplementalAlt
         );
       } else {
-        const tx = new import_web39.Transaction().add(createIx).add(extendIx);
+        const tx = new import_web311.Transaction().add(createIx).add(extendIx);
         const { blockhash } = await connection.getLatestBlockhash();
         tx.recentBlockhash = blockhash;
         tx.feePayer = depositor.publicKey;
         if (depositor.keypair) {
-          await (0, import_web39.sendAndConfirmTransaction)(connection, tx, [depositor.keypair], { commitment: "confirmed" });
+          await (0, import_web311.sendAndConfirmTransaction)(connection, tx, [depositor.keypair], { commitment: "confirmed" });
         } else if (depositor.signTransaction) {
           const signedTx = await depositor.signTransaction(tx);
           const sig = await connection.sendRawTransaction(signedTx.serialize());
@@ -6749,7 +6809,7 @@ async function createEphemeralALT(connection, depositor, onProgress, additionalA
 var SOLANA_PACKET_DATA_SIZE = 1232;
 function estimateV0TransactionSize(payerKey, recentBlockhash, instructions, addressLookupTableAccounts) {
   try {
-    const messageV0 = new import_web39.TransactionMessage({
+    const messageV0 = new import_web311.TransactionMessage({
       payerKey,
       recentBlockhash,
       instructions
@@ -6818,7 +6878,7 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
   const { blockhash: quoteBlockhash } = await connection.getLatestBlockhash();
   const measure = (instrs, alts) => {
     try {
-      const message = new import_web39.TransactionMessage({
+      const message = new import_web311.TransactionMessage({
         payerKey: externalFeePayerPubkey,
         recentBlockhash: quoteBlockhash,
         instructions: instrs
@@ -6876,12 +6936,12 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
     pre = measure(instructions, addressLookupTableAccounts);
   }
   failIfOverLimit(pre.size, pre.error);
-  const quoteMessage = new import_web39.TransactionMessage({
+  const quoteMessage = new import_web311.TransactionMessage({
     payerKey: externalFeePayerPubkey,
     recentBlockhash: quoteBlockhash,
     instructions
   }).compileToV0Message(addressLookupTableAccounts ?? []);
-  const quoteTxBase64 = Buffer.from(new import_web39.VersionedTransaction(quoteMessage).serialize()).toString("base64");
+  const quoteTxBase64 = Buffer.from(new import_web311.VersionedTransaction(quoteMessage).serialize()).toString("base64");
   const paymentInstruction = await externalFeePayer.getPaymentInstruction(quoteTxBase64);
   const finalInstructions = [...instructions, paymentInstruction];
   let post = measure(finalInstructions, addressLookupTableAccounts);
@@ -6892,12 +6952,12 @@ async function submitViaExternalFeePayer(connection, depositor, externalFeePayer
   failIfOverLimit(post.size, post.error);
   onProgress?.("Building final transaction...");
   const { blockhash, lastValidBlockHeight } = await connection.getLatestBlockhash();
-  const finalMessage = new import_web39.TransactionMessage({
+  const finalMessage = new import_web311.TransactionMessage({
     payerKey: externalFeePayerPubkey,
     recentBlockhash: blockhash,
     instructions: finalInstructions
   }).compileToV0Message(addressLookupTableAccounts ?? []);
-  const finalTx = new import_web39.VersionedTransaction(finalMessage);
+  const finalTx = new import_web311.VersionedTransaction(finalMessage);
   onProgress?.("Waiting for wallet signature...");
   const partiallySignedTx = await depositor.signTransaction(finalTx);
   const partiallySignedBase64 = Buffer.from(partiallySignedTx.serialize()).toString("base64");
@@ -7118,8 +7178,8 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
       baseInstructions.splice(riskQuoteIx ? 1 : 0, 0, ...topUpInstructions);
     }
   }
-  const cuLimitIx = import_web39.ComputeBudgetProgram.setComputeUnitLimit({ units: 12e5 });
-  const cuPriceIx = import_web39.ComputeBudgetProgram.setComputeUnitPrice({ microLamports: 1e5 });
+  const cuLimitIx = import_web311.ComputeBudgetProgram.setComputeUnitLimit({ units: 12e5 });
+  const cuPriceIx = import_web311.ComputeBudgetProgram.setComputeUnitPrice({ microLamports: 1e5 });
   const fullInstructions = [...baseInstructions, cuLimitIx, cuPriceIx, transactIx];
   const compactInstructions = [...baseInstructions, cuLimitIx, transactIx];
   const minimalInstructions = [...baseInstructions, cuLimitIx, transactIx];
@@ -7231,12 +7291,12 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
         }
         let transportAttempt = 0;
         while (true) {
-          const messageV0 = new import_web39.TransactionMessage({
+          const messageV0 = new import_web311.TransactionMessage({
             payerKey: depositor.publicKey,
             recentBlockhash: blockhash,
             instructions: ixs
           }).compileToV0Message(addressLookupTableAccounts);
-          const versionedTx = new import_web39.VersionedTransaction(messageV0);
+          const versionedTx = new import_web311.VersionedTransaction(messageV0);
           if (onTransactProofBuilt) {
             await onTransactProofBuilt();
           }
@@ -7366,7 +7426,7 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
     let legacyTransportAttempt = 0;
     while (true) {
       try {
-        const tx = new import_web39.Transaction();
+        const tx = new import_web311.Transaction();
         for (const ix of instructions) {
           tx.add(ix);
         }
@@ -7374,7 +7434,7 @@ async function submitTransactionDirect(connection, programId, depositor, proofBy
         tx.feePayer = depositor.publicKey;
         if (depositor.keypair) {
           onProgress?.("Signing and sending transaction...");
-          signature = await (0, import_web39.sendAndConfirmTransaction)(
+          signature = await (0, import_web311.sendAndConfirmTransaction)(
             connection,
             tx,
             [depositor.keypair],
@@ -7590,7 +7650,7 @@ async function fetchRiskQuote(riskQuoteUrl, wallet, options) {
     const messageArr = hexToBytes2(messageHex);
     let signerPubkey;
     try {
-      signerPubkey = new import_web39.PublicKey(signerB58);
+      signerPubkey = new import_web311.PublicKey(signerB58);
     } catch {
       throw new Error("Invalid risk quote response: signer_pubkey is not a public key");
     }
@@ -7614,7 +7674,7 @@ async function fetchRiskQuote(riskQuoteUrl, wallet, options) {
     const signature = new Uint8Array(signatureBuf);
     const message = new Uint8Array(messageArr);
     const publicKey = new Uint8Array(publicKeyBytes);
-    const instruction = import_web39.Ed25519Program.createInstructionWithPublicKey({
+    const instruction = import_web311.Ed25519Program.createInstructionWithPublicKey({
       publicKey,
       message,
       signature
@@ -7691,18 +7751,22 @@ function planRelayAuth(options) {
   const walletPublicKey = resolveUserWallet(options);
   if (options.depositorKeypair) return { kind: "keypair" };
   const signMessage = options.signMessage;
+  const signAuthTransaction = options.signAuthTransaction;
   if (walletPublicKey && signMessage) return { kind: "wallet", signer: { walletPublicKey, signMessage } };
-  if (!walletPublicKey && !signMessage) return { kind: "none" };
+  if (walletPublicKey && signAuthTransaction) {
+    return { kind: "wallet", signer: { walletPublicKey, signAuthTransaction } };
+  }
+  if (!walletPublicKey && !signMessage && !signAuthTransaction) return { kind: "none" };
   return {
     kind: "incomplete",
-    detail: signMessage ? "`signMessage` was provided but no wallet public key, so the request has no sender to authenticate as. Add `walletPublicKey` (or `depositorPublicKey`)." : "a wallet public key was provided but no `signMessage`, so nothing can sign. Add `signMessage` from the same wallet adapter."
+    detail: signMessage || signAuthTransaction ? "a signer was provided but no wallet public key, so the request has no sender to authenticate as. Add `walletPublicKey` (or `depositorPublicKey`)." : "a wallet public key was provided but no `signMessage` and no `signAuthTransaction`, so nothing can sign. Add `signMessage` from the wallet adapter, or `signAuthTransaction` (its `signTransaction`) for a wallet that cannot sign messages."
   };
 }
 function assertRelayAuthAvailable(plan, flow) {
   if (plan.kind === "keypair" || plan.kind === "wallet") return;
   const cause = plan.kind === "none" ? "no signer was provided." : `the signer provided cannot produce one: ${plan.detail}`;
   throw new Error(
-    `Cloak ${flow} requires an authenticated sender, and ${cause} Pass either \`depositorKeypair\` (a local Keypair) or \`signMessage\` together with \`walletPublicKey\` (a browser wallet adapter). The sender must be the end user's own wallet. Checked before proof generation, so nothing has been computed or submitted yet.`
+    `Cloak ${flow} requires an authenticated sender, and ${cause} Pass either \`depositorKeypair\` (a local Keypair), or \`signMessage\` (a browser wallet adapter) or \`signAuthTransaction\` (a hardware wallet that cannot sign messages) together with \`walletPublicKey\`. The sender must be the end user's own wallet. Checked up front, so nothing has been computed or submitted yet.`
   );
 }
 async function submitTransactToRelay(args) {
@@ -8848,7 +8912,7 @@ async function transact(params, options) {
         "All relay-tree attempts failed. Rebuilding merkle tree from chain as last resort..."
       );
       try {
-        const [merkleTreePda] = import_web39.PublicKey.findProgramAddressSync(
+        const [merkleTreePda] = import_web311.PublicKey.findProgramAddressSync(
           [Buffer.from("merkle_tree"), mint.toBuffer()],
           programId
         );
@@ -9836,7 +9900,7 @@ async function swapUtxo(params, options) {
     }
     if (options.onSwapStatePredicted && inputNullifiers.length > 0) {
       const nBytes = bigintToBytes323(inputNullifiers[0]);
-      const [ssp] = import_web39.PublicKey.findProgramAddressSync(
+      const [ssp] = import_web311.PublicKey.findProgramAddressSync(
         [Buffer.from("swap_state"), pdas.pool.toBuffer(), Buffer.from(nBytes)],
         programId
       );
@@ -10259,8 +10323,7 @@ function cleanupStalePendingOperations(maxAgeMs = 24 * 60 * 60 * 1e3) {
 init_utxo();
 
 // src/relay/batch-auth.ts
-var import_web310 = require("@solana/web3.js");
-var import_tweetnacl7 = __toESM(require("tweetnacl"), 1);
+var import_web312 = require("@solana/web3.js");
 var RelayBatchAuthCoordinator = class {
   constructor(options) {
     this.proofSlotsInUse = 0;
@@ -10283,7 +10346,7 @@ var RelayBatchAuthCoordinator = class {
       throw new Error(`submitConcurrency must be a positive integer (got ${concurrency}).`);
     }
     this.signer = options.signer;
-    this.sender = options.signer instanceof import_web310.Keypair ? options.signer.publicKey : options.signer.walletPublicKey;
+    this.sender = options.signer instanceof import_web312.Keypair ? options.signer.publicKey : options.signer.walletPublicKey;
     this.expectedItems = options.items;
     this.submitConcurrency = concurrency;
     const proofConcurrency = options.proofConcurrency ?? 2;
@@ -10407,24 +10470,19 @@ var RelayBatchAuthCoordinator = class {
       const issuedAt = preimages[0].auth_issued_at;
       const message = buildRelayBatchAuthMessage(programId, issuedAt, digests);
       this.waves += 1;
-      let signature;
-      if (this.signer instanceof import_web310.Keypair) {
-        signature = import_tweetnacl7.default.sign.detached(message, this.signer.secretKey);
-      } else {
+      if (!(this.signer instanceof import_web312.Keypair)) {
+        const asTransaction = !this.signer.signMessage;
         this.onProgress?.(
-          `Approve ${waiting.length} request(s) in your wallet` + (this.waves > 1 ? ` (approval ${this.waves}, for the rows that had to re-prove)` : "") + `. This signs the requests for the relay, not a transaction, and must be approved within a few minutes to stay valid.`
+          `Approve ${waiting.length} request(s) in your wallet` + (this.waves > 1 ? ` (approval ${this.waves}, for the rows that had to re-prove)` : "") + (asTransaction ? `. Your wallet shows this as a 0 SOL transfer to yourself: it is how a wallet that cannot sign messages authorizes the requests for the relay, and it is never sent to the network. Approve it on the device within a few minutes.` : `. This signs the requests for the relay, not a transaction, and must be approved within a few minutes to stay valid.`)
         );
-        const approvalStartedMs = Date.now();
-        signature = await this.signer.signMessage(message);
+      }
+      const approvalStartedMs = Date.now();
+      const { signature, mode } = await signRelayAuthPayload(this.signer, message);
+      if (!(this.signer instanceof import_web312.Keypair)) {
         assertApprovalWithinFreshnessWindow(
           Date.now() - approvalStartedMs,
           REQUEST_AUTH_BATCH_MAX_AGE_SECONDS
         );
-        if (!(signature instanceof Uint8Array) || signature.length !== 64) {
-          throw new Error(
-            `The wallet's signMessage did not return a 64-byte ed25519 detached signature (got ${signature instanceof Uint8Array ? `${signature.length} bytes` : typeof signature}).`
-          );
-        }
       }
       const signatureB64 = Buffer.from(signature).toString("base64");
       wave.forEach((item, i) => {
@@ -10436,6 +10494,7 @@ var RelayBatchAuthCoordinator = class {
             auth_issued_at: preimage.auth_issued_at,
             auth_nonce: preimage.auth_nonce,
             auth_signature: signatureB64,
+            ...mode === "transaction" ? { auth_mode: mode } : {},
             // A fresh array per item: `Object.assign` puts this on the wire body, and the body is
             // serialized again on every network retry.
             auth_batch: { digests: [...digests] }
@@ -10484,10 +10543,18 @@ async function transactBatch(items, options) {
     throw new Error("transactBatch requires relayUrl: batch approval is a relay authentication scheme.");
   }
   const { proofConcurrency, submitConcurrency, ...shared } = options;
-  const signer = shared.depositorKeypair ? shared.depositorKeypair : shared.walletPublicKey && shared.signMessage ? { walletPublicKey: shared.walletPublicKey, signMessage: shared.signMessage } : shared.depositorPublicKey && shared.signMessage ? { walletPublicKey: shared.depositorPublicKey, signMessage: shared.signMessage } : null;
+  const signer = shared.depositorKeypair ? shared.depositorKeypair : (() => {
+    const wallet = shared.walletPublicKey ?? shared.depositorPublicKey;
+    if (!wallet) return null;
+    if (shared.signMessage) return { walletPublicKey: wallet, signMessage: shared.signMessage };
+    if (shared.signAuthTransaction) {
+      return { walletPublicKey: wallet, signAuthTransaction: shared.signAuthTransaction };
+    }
+    return null;
+  })();
   if (!signer) {
     throw new Error(
-      "transactBatch requires an authenticated sender: pass `depositorKeypair` (a local Keypair) or `signMessage` together with `walletPublicKey` (a browser wallet adapter). Checked before proof generation, so nothing has been computed or submitted yet."
+      "transactBatch requires an authenticated sender: pass `depositorKeypair` (a local Keypair), or `walletPublicKey` with `signMessage` (a browser wallet adapter) or `signAuthTransaction` (a hardware wallet). Checked up front, so nothing has been computed or submitted yet."
     );
   }
   const coordinator = createRelayBatchAuthCoordinator({
@@ -10523,7 +10590,7 @@ async function transactBatch(items, options) {
 
 // src/scanning/scan.ts
 var import_bs583 = __toESM(require("bs58"), 1);
-var import_web311 = require("@solana/web3.js");
+var import_web313 = require("@solana/web3.js");
 var import_spl_token2 = require("@solana/spl-token");
 init_inputs();
 init_utxo();
@@ -10612,7 +10679,7 @@ function parseSwapOutputMint(data) {
   const mintBytes = data.slice(SWAP_OUTPUT_MINT_OFFSET, end);
   if (mintBytes.every((byte) => byte === 0)) return void 0;
   try {
-    return new import_web311.PublicKey(mintBytes).toBase58();
+    return new import_web313.PublicKey(mintBytes).toBase58();
   } catch {
     return void 0;
   }
@@ -10702,7 +10769,7 @@ function parseSwapRecipientAta(data) {
   const recipientAtaBytes = data.slice(recipientAtaStart, recipientAtaEnd);
   if (recipientAtaBytes.every((byte) => byte === 0)) return void 0;
   try {
-    return new import_web311.PublicKey(recipientAtaBytes).toBase58();
+    return new import_web313.PublicKey(recipientAtaBytes).toBase58();
   } catch {
     return void 0;
   }
@@ -10864,7 +10931,7 @@ async function scanSwapNoteCarriers(connection, programId, viewingKeyNk, swapCtx
   let rpcCalls = 0;
   const candidates = Array.from(swapCtxByCommitment.keys());
   if (candidates.length === 0) return { records, rpcCalls };
-  const [registry] = import_web311.PublicKey.findProgramAddressSync(
+  const [registry] = import_web313.PublicKey.findProgramAddressSync(
     [Buffer.from("cloak_chain_note_registry")],
     programId
   );
@@ -11267,8 +11334,8 @@ async function scanTransactions(opts) {
                   if (onChainAta) {
                     try {
                       const expectedAta = (0, import_spl_token2.getAssociatedTokenAddressSync)(
-                        new import_web311.PublicKey(asset.mint),
-                        new import_web311.PublicKey(walletPublicKey)
+                        new import_web313.PublicKey(asset.mint),
+                        new import_web313.PublicKey(walletPublicKey)
                       ).toBase58();
                       if (onChainAta === expectedAta) {
                         isOurs = true;
@@ -11482,7 +11549,7 @@ async function scanTransactions(opts) {
                   // deposit — that is the public deposit amount. A deposit that also merged inputs
                   // carries a larger output 0 and is not recoverable from public data alone.
                   amount: grossAmount,
-                  mintAddress: new import_web311.PublicKey(asset.mint),
+                  mintAddress: new import_web313.PublicKey(asset.mint),
                   outputCommitments: ixCtx.outputCommitments ?? []
                 });
                 if (recoveredDeposit) {
@@ -11508,7 +11575,7 @@ async function scanTransactions(opts) {
                   noteSalt: compactNote.noteSalt,
                   amount: compactNote.outAmount0,
                   keypair: { privateKey: 0n, publicKey: compactNote.outPubkey0 },
-                  mintAddress: new import_web311.PublicKey(asset.mint),
+                  mintAddress: new import_web313.PublicKey(asset.mint),
                   outputIndex: 0,
                   // v4 describes output 0, which is where change lands
                   outputCommitments: ixCtx.outputCommitments ?? []
@@ -11701,7 +11768,7 @@ function formatComplianceCsv(report) {
 }
 
 // src/wallet/utxo-wallet.ts
-var import_web312 = require("@solana/web3.js");
+var import_web314 = require("@solana/web3.js");
 init_utxo();
 var UtxoWallet = class _UtxoWallet {
   constructor(viewingKey) {
@@ -11914,7 +11981,7 @@ var UtxoWallet = class _UtxoWallet {
       data.viewingKey ? new Uint8Array(data.viewingKey) : void 0
     );
     for (const w of data.wallets) {
-      const mint = new import_web312.PublicKey(w.mint);
+      const mint = new import_web314.PublicKey(w.mint);
       for (const u of w.utxos) {
         wallet.addUtxo({
           amount: BigInt(u.amount),
@@ -11997,7 +12064,7 @@ var SimpleWallet = class {
 };
 
 // src/bridge/rail-verify.ts
-var import_tweetnacl8 = __toESM(require("tweetnacl"), 1);
+var import_tweetnacl7 = __toESM(require("tweetnacl"), 1);
 var import_sha256 = require("@noble/hashes/sha256");
 var ONECLICK_PUBKEY_B58 = "reYaWhvwu8Jzo3WUM3zhn6VrhuMEF4eADL17qtRVifc";
 var b58 = /* @__PURE__ */ (() => {
@@ -12108,7 +12175,7 @@ function verifyQuoteSignature(resp) {
   const message = new TextEncoder().encode(b58.encode(new Uint8Array(digest)));
   const sig = resp.signature.replace(/^ed25519:/, "");
   try {
-    return { valid: import_tweetnacl8.default.sign.detached.verify(message, b58.decode(sig), b58.decode(ONECLICK_PUBKEY_B58)) };
+    return { valid: import_tweetnacl7.default.sign.detached.verify(message, b58.decode(sig), b58.decode(ONECLICK_PUBKEY_B58)) };
   } catch (e) {
     return { valid: false, reason: e instanceof Error ? e.message : String(e) };
   }
@@ -12206,7 +12273,7 @@ function cloakBridgeRail(relayUrl) {
 }
 
 // src/bridge/paymaster-client.ts
-var import_web313 = require("@solana/web3.js");
+var import_web315 = require("@solana/web3.js");
 var import_spl_token3 = require("@solana/spl-token");
 function validatePaymasterTopUpTransaction(tx, expect) {
   const ixs = tx.instructions;
@@ -12216,12 +12283,12 @@ function validatePaymasterTopUpTransaction(tx, expect) {
     );
   }
   const ix0 = ixs[0];
-  if (!ix0.programId.equals(import_web313.SystemProgram.programId)) {
+  if (!ix0.programId.equals(import_web315.SystemProgram.programId)) {
     throw new Error(
       `paymaster top-up instruction 0 is owned by ${ix0.programId.toBase58()}, not the System Program \u2014 refusing to sign an unrecognised first instruction`
     );
   }
-  const transfer2 = import_web313.SystemInstruction.decodeTransfer(ix0);
+  const transfer2 = import_web315.SystemInstruction.decodeTransfer(ix0);
   if (!transfer2.toPubkey.equals(expect.recipient)) {
     throw new Error(
       `paymaster top-up sends SOL to ${transfer2.toPubkey.toBase58()}, which is not our recipient ${expect.recipient.toBase58()} \u2014 refusing to sign a transaction that funds a key we do not control`
@@ -12300,10 +12367,10 @@ async function fundReceiverViaPaymaster(relayUrl, receiver, grantLamports) {
       "paymaster prepare returned a voucher that is already expired \u2014 refusing to sign a stale top-up rather than fail confusingly at cosign"
     );
   }
-  const feeMint = new import_web313.PublicKey(prepared.fee_mint);
-  const paymentAddress = new import_web313.PublicKey(prepared.payment_address);
+  const feeMint = new import_web315.PublicKey(prepared.fee_mint);
+  const paymentAddress = new import_web315.PublicKey(prepared.payment_address);
   const feeTokenAmount = BigInt(prepared.fee_token_amount);
-  const tx = import_web313.Transaction.from(Buffer.from(prepared.transaction, "base64"));
+  const tx = import_web315.Transaction.from(Buffer.from(prepared.transaction, "base64"));
   validatePaymasterTopUpTransaction(tx, {
     recipient: receiver.publicKey,
     maxGrantLamports: grantLamports,
@@ -12322,7 +12389,7 @@ async function fundReceiverViaPaymaster(relayUrl, receiver, grantLamports) {
   });
   const cosigned = await parseBridgeResponse2(cosignRes, "paymaster cosign");
   return {
-    transaction: import_web313.Transaction.from(Buffer.from(cosigned.transaction, "base64")),
+    transaction: import_web315.Transaction.from(Buffer.from(cosigned.transaction, "base64")),
     feeTokenAmount,
     feeMint: prepared.fee_mint,
     paymentAddress: prepared.payment_address
@@ -12330,7 +12397,7 @@ async function fundReceiverViaPaymaster(relayUrl, receiver, grantLamports) {
 }
 
 // src/bridge/derive.ts
-var import_web314 = require("@solana/web3.js");
+var import_web316 = require("@solana/web3.js");
 var import_hmac = require("@noble/hashes/hmac");
 var import_sha512 = require("@noble/hashes/sha512");
 var BRIDGE_ESCROW_LABEL = "cloak_bridge_escrow";
@@ -12345,11 +12412,11 @@ function deriveBridgeReceiver(nk, index) {
     );
   }
   const h = (0, import_hmac.hmac)(import_sha512.sha512, new Uint8Array(nk), new TextEncoder().encode(`${BRIDGE_ESCROW_LABEL}:${index}`));
-  return import_web314.Keypair.fromSeed(h.slice(0, 32));
+  return import_web316.Keypair.fromSeed(h.slice(0, 32));
 }
 
 // src/bridge/discover.ts
-var import_web315 = require("@solana/web3.js");
+var import_web317 = require("@solana/web3.js");
 var import_spl_token4 = require("@solana/spl-token");
 function describeError(err) {
   return err instanceof Error ? err.message : String(err);
@@ -12371,7 +12438,7 @@ async function listBridgeDeposits(conn, nk, opts) {
         try {
           tokenBalance = BigInt((await conn.getTokenAccountBalance(tokenAccount)).value.amount);
         } catch (err) {
-          if (!(err instanceof import_web315.SolanaJSONRPCError && /could not find account/i.test(err.message))) {
+          if (!(err instanceof import_web317.SolanaJSONRPCError && /could not find account/i.test(err.message))) {
             throw err;
           }
         }
@@ -12426,18 +12493,18 @@ async function listBridgeDeposits(conn, nk, opts) {
 }
 
 // src/bridge/deposit-core.ts
-var import_web317 = require("@solana/web3.js");
-var import_tweetnacl9 = __toESM(require("tweetnacl"), 1);
+var import_web319 = require("@solana/web3.js");
+var import_tweetnacl8 = __toESM(require("tweetnacl"), 1);
 init_utxo();
 
 // src/bridge/funder.ts
-var import_web316 = require("@solana/web3.js");
+var import_web318 = require("@solana/web3.js");
 var import_spl_token5 = require("@solana/spl-token");
 var MAINNET_RENT_0 = 890880;
 var MAINNET_RENT_1 = 897840;
 var FEE_BUDGET = 13e4;
 var CLEANUP_FEE_BUDGET = 5e3;
-var pda = (seeds, programId) => import_web316.PublicKey.findProgramAddressSync(seeds.map((s) => Buffer.from(s)), programId)[0];
+var pda = (seeds, programId) => import_web318.PublicKey.findProgramAddressSync(seeds.map((s) => Buffer.from(s)), programId)[0];
 function deriveFundingTargets(d) {
   const pool = pda([Buffer.from("pool"), d.mint.toBuffer()], d.programId);
   return {
@@ -12498,15 +12565,15 @@ async function depositFromDerivedKey(conn, R, funder, amount, log = console.log,
   if (heldByR >= grantR) {
     log(`   R already holds ${heldByR} (>= ${grantR}) \u2014 no top-up needed`);
   } else {
-    await (0, import_web317.sendAndConfirmTransaction)(conn, new import_web317.Transaction().add(
-      import_web317.SystemProgram.transfer({ fromPubkey: funder.publicKey, toPubkey: R.publicKey, lamports: grantR - heldByR })
+    await (0, import_web319.sendAndConfirmTransaction)(conn, new import_web319.Transaction().add(
+      import_web319.SystemProgram.transfer({ fromPubkey: funder.publicKey, toPubkey: R.publicKey, lamports: grantR - heldByR })
     ), [funder]);
     log(`   funder topped R up by ${grantR - heldByR} to ${grantR}${grantOverride !== void 0 ? " (OVERRIDDEN for a deliberate test)" : " \u2014 floor + deposit fee + cleanup fee, no rent"}`);
   }
   let measuredSize = -1;
   let fundedAccounts = [];
   const signTransaction2 = async (tx) => {
-    if (tx instanceof import_web317.VersionedTransaction) {
+    if (tx instanceof import_web319.VersionedTransaction) {
       measuredSize = tx.serialize().length;
       const alts = await Promise.all(
         tx.message.addressTableLookups.map(async (l) => (await conn.getAddressLookupTable(l.accountKey)).value)
@@ -12525,13 +12592,13 @@ async function depositFromDerivedKey(conn, R, funder, amount, log = console.log,
         address: t.a.toBase58(),
         lamportsSent: Math.max(0, t.need - (infos[i]?.lamports ?? 0))
       }));
-      const ixs = targets.flatMap((t, i) => (infos[i]?.lamports ?? 0) >= t.need ? [] : [import_web317.SystemProgram.transfer({
+      const ixs = targets.flatMap((t, i) => (infos[i]?.lamports ?? 0) >= t.need ? [] : [import_web319.SystemProgram.transfer({
         fromPubkey: funder.publicKey,
         toPubkey: t.a,
         lamports: t.need - (infos[i]?.lamports ?? 0)
       })]);
       if (ixs.length) {
-        const sig = await (0, import_web317.sendAndConfirmTransaction)(conn, new import_web317.Transaction().add(...ixs), [funder]);
+        const sig = await (0, import_web319.sendAndConfirmTransaction)(conn, new import_web319.Transaction().add(...ixs), [funder]);
         log(`   seam: funded ${ixs.length} program accounts read off the built tx \u2014 ${sig.slice(0, 16)}\u2026`);
       }
       tx.sign([R]);
@@ -12540,7 +12607,7 @@ async function depositFromDerivedKey(conn, R, funder, amount, log = console.log,
     tx.partialSign(R);
     return tx;
   };
-  const signMessage = async (m) => import_tweetnacl9.default.sign.detached(m, R.secretKey);
+  const signMessage = async (m) => import_tweetnacl8.default.sign.detached(m, R.secretKey);
   const utxoKeypair = await deriveUtxoKeypairFromSpendKey(opts.noteSpendKey);
   const nk = getNkFromUtxoPrivateKey(utxoKeypair.privateKey);
   const { utxo, noteSalt } = await createRecoverableDepositUtxo(amount, nk, mint);
@@ -12587,9 +12654,9 @@ async function depositFromDerivedKey(conn, R, funder, amount, log = console.log,
 }
 
 // src/bridge/cleanup.ts
-var import_web318 = require("@solana/web3.js");
+var import_web320 = require("@solana/web3.js");
 var import_spl_token6 = require("@solana/spl-token");
-var DEFAULT_MINT = new import_web318.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
+var DEFAULT_MINT = new import_web320.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
 async function cleanupReceivingAddress(conn, R, dustDestination, mint = DEFAULT_MINT) {
   assertAllowedRpcConnection(conn);
   const rAta = (0, import_spl_token6.getAssociatedTokenAddressSync)(mint, R.publicKey);
@@ -12635,7 +12702,7 @@ async function cleanupReceivingAddress(conn, R, dustDestination, mint = DEFAULT_
     destination = destAta.toBase58();
   }
   ixs.push((0, import_spl_token6.createCloseAccountInstruction)(rAta, R.publicKey, R.publicKey));
-  const signature = await (0, import_web318.sendAndConfirmTransaction)(conn, new import_web318.Transaction().add(...ixs), [R], {
+  const signature = await (0, import_web320.sendAndConfirmTransaction)(conn, new import_web320.Transaction().add(...ixs), [R], {
     commitment: "confirmed"
   });
   const after = await conn.getBalance(R.publicKey);
@@ -12837,6 +12904,7 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   assessBridgeQuote,
   bigintToBytes32,
   bigintToHex,
+  buildAuthTransactionMessage,
   buildMerkleTree,
   buildMerkleTreeFromChain,
   buildMerkleTreeFromRelay,
@@ -13017,10 +13085,12 @@ var SCANNER_SUPPORTS_TRANSACT_SWAP = true;
   sdkLogger,
   selectUtxos,
   sendTransaction,
+  serializeAuthTransactionMessage,
   serializeNote,
   serializeUtxo,
   setCircuitsPath,
   setDebugMode,
+  signRelayAuthPayload,
   signTransaction,
   splitTo2Limbs,
   submitTransactToRelay,