@invisi-labs/primitives 0.0.0-stage → 1.2.0

package/dist/index.js

@@ -0,0 +1,1311 @@
+import {
+  computeNoteNullifier
+} from "./chunk-TJYV6KTQ.js";
+import {
+  CREDIT_POLICY_FIELDS,
+  CREDIT_USAGE_FIELDS,
+  D_CNULL,
+  D_CREDIT,
+  D_CREDIT_KEY_HASH,
+  D_CREDIT_RECOVERY,
+  D_CREDIT_STATE_NONCE,
+  D_IDENT,
+  D_NOTE,
+  D_NULL,
+  FIELD_MODULUS,
+  MAX_CIPHERTEXT_BYTES,
+  TREE_DEPTH,
+  applyCreditDrawUsage,
+  computeCreditCommitment,
+  computeCreditNullifier,
+  computeCreditRecoveryPad,
+  computeCreditSharedKeyHash,
+  computeNoteCommitment,
+  computeNoteIdentity,
+  creditCommitment,
+  creditPeriods,
+  decodeDeliveryHeader,
+  decryptCreditPayload,
+  decryptCreditState,
+  decryptNotePayload,
+  decryptPrivateTransferNote,
+  deliveryCodec,
+  deliveryHeader,
+  deriveCreditState,
+  deriveCreditStateNonce,
+  deriveCreditUpdate,
+  encryptCreditState,
+  encryptPrivateTransferNote,
+  exportPayloadKey,
+  generateCreditSharedKey,
+  generateNonce,
+  normalizeCreditDeliveryState,
+  normalizeCreditPolicy,
+  normalizeCreditState,
+  normalizeCreditUsage,
+  noteCommitment,
+  poseidonHash,
+  recoverCreditState,
+  validateContext,
+  validateDeliveryCiphertext,
+  viewingPublicKey
+} from "./chunk-PRUUPDVD.js";
+import {
+  MissingCapabilityError,
+  ReceivingAddress,
+  decodeAddress
+} from "./chunk-3SEC7POH.js";
+import {
+  createClue,
+  createClueFromSeed,
+  deriveClueKey,
+  validateClueKey
+} from "./chunk-Q3NNEKKR.js";
+
+// src/disclosure/disclosure.ts
+import { bytesToHex } from "@noble/hashes/utils";
+var NOTE_FIELDS = ["ownerAddress", "amount", "nonce"];
+var CREDIT_FIELDS = [
+  "spenderWalletIdentity",
+  "ownerWalletIdentity",
+  "revocationShard",
+  "revocationSlot",
+  "nonce",
+  "expiry",
+  "creditSharedKeyHash",
+  "singleLimit",
+  "dailyLimit",
+  "monthlyLimit",
+  "availableCredit",
+  "unlimited",
+  "lastDay",
+  "dailySpent",
+  "lastMonth",
+  "monthlySpent",
+  "totalSpent"
+];
+function record(value, fields) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("invalid disclosure object");
+  const keys = Object.keys(value);
+  if (keys.length !== fields.length || keys.some((key) => !fields.includes(key)))
+    throw new Error("unexpected disclosure fields");
+  return value;
+}
+function number(value, bits, label) {
+  if (typeof value !== "bigint" || value < 0n || value >= 1n << BigInt(bits))
+    throw new Error(`invalid disclosure ${label}`);
+  return value;
+}
+function decimal(value, bits, label) {
+  if (typeof value !== "string" || !/^(0|[1-9][0-9]*)$/.test(value) || value.length > 78)
+    throw new Error(`invalid disclosure ${label}`);
+  return number(BigInt(value), bits, label);
+}
+function hash(value, label, field = true) {
+  if (typeof value !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(value))
+    throw new Error(`invalid disclosure ${label}`);
+  if (field && BigInt(value) >= FIELD_MODULUS) throw new Error(`invalid disclosure ${label}`);
+  return value.toLowerCase();
+}
+function owner(value, label) {
+  if (typeof value !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(value) || BigInt(value) === 0n)
+    throw new Error(`invalid disclosure ${label}`);
+  return value.toLowerCase();
+}
+function nonce(value) {
+  if (value < 0n || value >= FIELD_MODULUS) throw new Error("invalid disclosure nonce");
+  return value;
+}
+function context(value) {
+  const result = {
+    chainId: number(value.chainId, 64, "chainId"),
+    protocolAddress: number(value.protocolAddress, 160, "protocolAddress"),
+    tokenAddress: number(value.tokenAddress, 160, "tokenAddress")
+  };
+  if (result.protocolAddress === 0n || result.tokenAddress === 0n)
+    throw new Error("disclosure addresses must be nonzero");
+  return result;
+}
+function encode(values) {
+  return Object.fromEntries(
+    Object.entries(values).map(([key, value]) => [key, value.toString()])
+  );
+}
+async function creditOpening(note) {
+  const copied = { ...note };
+  return {
+    ...context(copied),
+    ...normalizeCreditPolicy(copied),
+    ...normalizeCreditUsage(copied),
+    availableCredit: number(copied.availableCredit, 128, "availableCredit"),
+    unlimited: copied.unlimited,
+    spenderWalletIdentity: owner(copied.spenderWalletIdentity, "spender identity"),
+    ownerWalletIdentity: owner(copied.ownerWalletIdentity, "owner identity"),
+    revocationShard: number(copied.revocationShard, 64, "revocation shard"),
+    revocationSlot: number(copied.revocationSlot, 16, "revocation slot"),
+    nonce: nonce(copied.nonce),
+    expiry: number(copied.expiry, 64, "expiry"),
+    creditSharedKeyHash: await computeCreditSharedKeyHash(copied.creditSharedKey)
+  };
+}
+async function commitment(note) {
+  if ("creditSharedKeyHash" in note) {
+    return computeCreditCommitment({ ...note, creditSharedKey: 0n }, note.creditSharedKeyHash);
+  }
+  return computeNoteCommitment(
+    note.chainId,
+    BigInt(note.protocolAddress),
+    await computeNoteIdentity(BigInt(note.ownerAddress), note.nonce),
+    note.tokenAddress,
+    note.amount
+  );
+}
+var Disclosure = class _Disclosure {
+  #material;
+  constructor(material) {
+    this.#material = {
+      ...material,
+      context: Object.freeze({ ...material.context }),
+      data: Object.freeze({ ...material.data })
+    };
+    Object.freeze(this.#material);
+    Object.freeze(this);
+  }
+  static async fromNote(value) {
+    const copied = { ...value };
+    const note = {
+      ...context(copied),
+      ownerAddress: owner(copied.ownerAddress, "owner address"),
+      amount: number(copied.amount, 128, "amount"),
+      nonce: nonce(copied.nonce)
+    };
+    return new _Disclosure({
+      version: 1,
+      kind: "note",
+      method: "opening",
+      context: {
+        ...encode(context(note)),
+        outputCommitment: await commitment(note)
+      },
+      data: encode({
+        ownerAddress: note.ownerAddress,
+        amount: note.amount,
+        nonce: note.nonce
+      })
+    });
+  }
+  static async fromCredit(value) {
+    const note = await creditOpening(value);
+    const data = Object.fromEntries(
+      CREDIT_FIELDS.map((key) => [
+        key,
+        key === "unlimited" ? note.unlimited ? "1" : "0" : note[key].toString()
+      ])
+    );
+    return new _Disclosure({
+      version: 1,
+      kind: "credit",
+      method: "opening",
+      context: {
+        ...encode(context(note)),
+        outputCommitment: await commitment(note)
+      },
+      data
+    });
+  }
+  /** Low-level factory; normally use wallet.getViewer().discloseNote(). */
+  static async fromEncryptedNote(key, envelope, value) {
+    const scoped = { ...value };
+    const copied = typeof envelope === "string" ? envelope : Uint8Array.from(envelope);
+    const localKey = typeof key === "string" ? key : Uint8Array.from(key);
+    try {
+      await decryptPrivateTransferNote(localKey, copied, scoped);
+      return await _Disclosure.fromEnvelope(localKey, copied, scoped, "funds");
+    } finally {
+      if (localKey instanceof Uint8Array) localKey.fill(0);
+    }
+  }
+  /** Exposes the full selected Credit envelope, including its shared key and receiving snapshots. */
+  static async fromEncryptedCredit(key, envelope, value) {
+    const scoped = { ...value };
+    const copied = typeof envelope === "string" ? envelope : Uint8Array.from(envelope);
+    const localKey = typeof key === "string" ? key : Uint8Array.from(key);
+    try {
+      await decryptCreditState(localKey, copied, scoped);
+      return await _Disclosure.fromEnvelope(localKey, copied, scoped, scoped.role);
+    } finally {
+      if (localKey instanceof Uint8Array) localKey.fill(0);
+    }
+  }
+  static async fromEnvelope(key, envelope, scoped, role) {
+    const payloadKey = await exportPayloadKey(key, envelope, role !== "funds");
+    try {
+      return new _Disclosure({
+        version: 1,
+        kind: role === "funds" ? "note" : "credit",
+        method: "payload-key",
+        context: {
+          ...encode(context(scoped)),
+          outputCommitment: hash(scoped.outputCommitment, "commitment")
+        },
+        data: {
+          payloadKey: `0x${bytesToHex(payloadKey)}`,
+          ownerAddress: owner(scoped.ownerAddress, "owner address"),
+          role
+        }
+      });
+    } finally {
+      payloadKey.fill(0);
+    }
+  }
+  /** Parse untrusted JSON material; verification against an independent output is still required. */
+  static async fromExport(value) {
+    const root = record(value, ["version", "kind", "method", "context", "data"]);
+    if (root.version !== 1 || root.kind !== "note" && root.kind !== "credit" || root.method !== "opening" && root.method !== "payload-key")
+      throw new Error("unsupported disclosure format");
+    const rawContext = record(root.context, [
+      "chainId",
+      "protocolAddress",
+      "tokenAddress",
+      "outputCommitment"
+    ]);
+    const scoped = context({
+      chainId: decimal(rawContext.chainId, 64, "chainId"),
+      protocolAddress: decimal(rawContext.protocolAddress, 160, "protocolAddress"),
+      tokenAddress: decimal(rawContext.tokenAddress, 160, "tokenAddress")
+    });
+    const outputCommitment = hash(rawContext.outputCommitment, "commitment");
+    const fields = root.method === "payload-key" ? ["payloadKey", "ownerAddress", "role"] : root.kind === "note" ? NOTE_FIELDS : CREDIT_FIELDS;
+    const raw = record(root.data, fields);
+    const data = {};
+    for (const key of fields) {
+      if (key === "role") {
+        if (root.kind === "note" ? raw[key] !== "funds" : raw[key] !== "owner" && raw[key] !== "spender")
+          throw new Error("invalid disclosure role");
+        data[key] = raw[key];
+      } else if (key === "payloadKey" || key.endsWith("Identity") || key === "ownerAddress" || key === "creditSharedKeyHash") {
+        data[key] = key.endsWith("Identity") || key === "ownerAddress" ? owner(raw[key], key) : hash(raw[key], key, key !== "payloadKey");
+      } else if (key === "unlimited") {
+        if (raw[key] !== "0" && raw[key] !== "1")
+          throw Error("invalid disclosure unlimited");
+        data[key] = raw[key];
+      } else {
+        const bits = key === "availableCredit" ? 128 : key.endsWith("Payout") ? 160 : key === "expiry" ? 64 : key === "amount" ? root.kind === "note" ? 128 : 126 : 254;
+        const parsed = decimal(raw[key], bits, key);
+        if (key === "nonce") nonce(parsed);
+        data[key] = parsed.toString();
+      }
+    }
+    const material = {
+      version: 1,
+      kind: root.kind,
+      method: root.method,
+      context: { ...encode(scoped), outputCommitment },
+      data
+    };
+    const result = new _Disclosure(material);
+    if (material.method === "opening")
+      await result.verify({
+        ...scoped,
+        outputCommitment,
+        role: material.kind === "note" ? "funds" : "owner"
+      });
+    return result;
+  }
+  getScope() {
+    const { version, kind, method } = this.#material;
+    return {
+      version,
+      kind,
+      method,
+      permitsOwnerSweep: kind === "note",
+      revealsNoteConsumption: kind === "note",
+      revealsCreditSharedKey: kind === "credit" && method === "payload-key",
+      revealsReceivingKeys: kind === "credit" && method === "payload-key",
+      revealsMemo: method === "payload-key",
+      revealsPayload: method === "payload-key"
+    };
+  }
+  /** Explicitly export sensitive, JSON-compatible material for a chosen recipient. */
+  export() {
+    return {
+      ...this.#material,
+      context: { ...this.#material.context },
+      data: { ...this.#material.data }
+    };
+  }
+  async verify(value) {
+    const output = {
+      ...value,
+      ciphertext: value.ciphertext instanceof Uint8Array ? Uint8Array.from(value.ciphertext) : value.ciphertext
+    };
+    const scoped = context(output);
+    const material = this.#material;
+    for (const field of ["chainId", "protocolAddress", "tokenAddress"]) {
+      if (scoped[field].toString() !== material.context[field])
+        throw new Error("disclosure deployment context mismatch");
+    }
+    if (hash(output.outputCommitment, "commitment") !== material.context.outputCommitment)
+      throw new Error("disclosure output commitment mismatch");
+    if (material.kind === "note" ? output.role !== "funds" : output.role !== "owner" && output.role !== "spender")
+      throw new Error("disclosure output role mismatch");
+    const data = material.data;
+    if (material.method === "payload-key") {
+      if (output.role !== data.role || output.ciphertext === void 0)
+        throw new Error("disclosure requires the selected role envelope");
+      const decryption = {
+        ...scoped,
+        outputCommitment: output.outputCommitment,
+        ownerAddress: data.ownerAddress
+      };
+      if (material.kind === "note")
+        return {
+          kind: "note",
+          note: Object.freeze(
+            await decryptNotePayload(
+              data.payloadKey,
+              output.ciphertext,
+              decryption
+            )
+          )
+        };
+      const state = await decryptCreditPayload(
+        data.payloadKey,
+        output.ciphertext,
+        { ...decryption, role: output.role }
+      );
+      return {
+        kind: "credit",
+        note: Object.freeze({
+          ...await creditOpening(state.note),
+          ...state.note.payload === void 0 ? {} : { payload: structuredClone(state.note.payload) }
+        })
+      };
+    }
+    if (material.kind === "note") {
+      const note2 = {
+        ...scoped,
+        ownerAddress: data.ownerAddress,
+        amount: BigInt(data.amount),
+        nonce: BigInt(data.nonce)
+      };
+      if (await commitment(note2) !== material.context.outputCommitment)
+        throw new Error("disclosure opening commitment mismatch");
+      return { kind: "note", note: Object.freeze(note2) };
+    }
+    const note = {
+      ...scoped,
+      spenderWalletIdentity: data.spenderWalletIdentity,
+      ownerWalletIdentity: data.ownerWalletIdentity,
+      revocationShard: BigInt(data.revocationShard),
+      revocationSlot: BigInt(data.revocationSlot),
+      nonce: BigInt(data.nonce),
+      expiry: BigInt(data.expiry),
+      ...normalizeCreditPolicy(
+        Object.fromEntries(
+          ["singleLimit", "dailyLimit", "monthlyLimit"].map((k) => [k, BigInt(data[k])])
+        )
+      ),
+      ...normalizeCreditUsage(
+        Object.fromEntries(
+          ["lastDay", "dailySpent", "lastMonth", "monthlySpent", "totalSpent"].map(
+            (k) => [k, BigInt(data[k])]
+          )
+        )
+      ),
+      availableCredit: BigInt(data.availableCredit),
+      unlimited: data.unlimited === "1",
+      creditSharedKeyHash: data.creditSharedKeyHash
+    };
+    if (await commitment(note) !== material.context.outputCommitment)
+      throw new Error("disclosure opening commitment mismatch");
+    return { kind: "credit", note: Object.freeze(note) };
+  }
+  toJSON() {
+    return { capability: "disclosure", ...this.getScope() };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toJSON();
+  }
+};
+
+// src/wallet/capabilities.ts
+import { secp256k1 as secp256k12 } from "@noble/curves/secp256k1";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes2 } from "@noble/hashes/utils";
+
+// src/wallet/wallet.ts
+import { secp256k1 } from "@noble/curves/secp256k1";
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 } from "@noble/hashes/sha256";
+import { keccak_256 } from "@noble/hashes/sha3";
+import { bytesToHex as bytesToHex2, concatBytes, hexToBytes, utf8ToBytes } from "@noble/hashes/utils";
+var OPERATIONS = {
+  transact: "Transact",
+  "create-credit": "CreateCredit",
+  "credit-draw": "CreditDraw",
+  "update-credit": "UpdateCredit"
+};
+var WALLET_AUTHORIZATION_TYPES = {
+  WalletAuthorization: [
+    { name: "operation", type: "bytes32" },
+    { name: "statementHash", type: "bytes32" }
+  ]
+};
+var hex = (value) => `0x${bytesToHex2(value)}`;
+function bytes(value, length) {
+  if (typeof value === "string" && !/^0x(?:[0-9a-fA-F]{2})*$/.test(value))
+    throw new Error("invalid hexadecimal bytes");
+  if (typeof value !== "string" && !(value instanceof Uint8Array))
+    throw new TypeError("expected bytes");
+  const result = typeof value === "string" ? hexToBytes(value.slice(2)) : Uint8Array.from(value);
+  if (length !== void 0 && result.length !== length)
+    throw new Error(`expected ${length} bytes`);
+  return result;
+}
+function word(value) {
+  if (value < 0n || value >= 1n << 256n) throw new RangeError("value exceeds uint256");
+  return hexToBytes(value.toString(16).padStart(64, "0"));
+}
+async function computeOwnerAddress(publicKey) {
+  const point = secp256k1.ProjectivePoint.fromHex(bytes(publicKey));
+  point.assertValidity();
+  return hex(keccak_256(point.toRawBytes(false).slice(1)).slice(12));
+}
+function walletAuthorizationTypedData(request) {
+  const { context: context2, operation, capacity, words } = request;
+  if (!Object.hasOwn(OPERATIONS, operation)) throw new Error("unsupported wallet operation");
+  const allowed = operation === "transact" ? [
+    1,
+    2,
+    3,
+    4,
+    5,
+    6,
+    7,
+    8,
+    9,
+    10,
+    20,
+    30,
+    40,
+    50,
+    60,
+    70,
+    80,
+    90,
+    100,
+    110,
+    120,
+    130,
+    140,
+    150,
+    160,
+    170,
+    180,
+    190
+  ] : operation === "credit-draw" ? [1, 2, 3, 4, 5, 10, 20, 30, 40, 50, 60, 70, 80] : [1];
+  if (!allowed.includes(capacity)) throw new Error("invalid operation capacity");
+  if (!Array.isArray(words) || words.length < 2) throw new Error("public words required");
+  for (const value of words)
+    if (typeof value !== "bigint" || value < 0n || value >= FIELD_MODULUS)
+      throw new RangeError("noncanonical public field");
+  const { chainId, protocolAddress } = context2;
+  if (typeof chainId !== "bigint" || chainId < 0n || chainId >= 1n << 64n)
+    throw new RangeError("invalid chain id");
+  if (typeof protocolAddress !== "bigint" || protocolAddress <= 0n || protocolAddress >= 1n << 160n)
+    throw new RangeError("invalid protocol address");
+  if (words[0] !== chainId) throw new Error("statement chain mismatch");
+  if (words[1] !== protocolAddress) throw new Error("statement instance mismatch");
+  const statement = concatBytes(
+    word(BigInt(capacity)),
+    word(64n),
+    word(BigInt(words.length)),
+    ...words.map(word)
+  );
+  return {
+    domain: {
+      name: "InvisibleProtocol",
+      version: "1",
+      chainId,
+      verifyingContract: `0x${protocolAddress.toString(16).padStart(40, "0")}`
+    },
+    types: WALLET_AUTHORIZATION_TYPES,
+    primaryType: "WalletAuthorization",
+    message: {
+      operation: hex(
+        keccak_256(
+          utf8ToBytes(
+            `Invisi.${OPERATIONS[operation]}.${operation === "transact" ? "v1" : "v4"}`
+          )
+        )
+      ),
+      statementHash: hex(keccak_256(statement))
+    }
+  };
+}
+function computeWalletAuthorizationDigest(request) {
+  const data = walletAuthorizationTypedData(request), hashText = (text) => keccak_256(utf8ToBytes(text));
+  const domain = keccak_256(
+    concatBytes(
+      hashText(
+        "EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"
+      ),
+      hashText(data.domain.name),
+      hashText(data.domain.version),
+      word(data.domain.chainId),
+      word(BigInt(data.domain.verifyingContract))
+    )
+  );
+  const structure = keccak_256(
+    concatBytes(
+      hashText("WalletAuthorization(bytes32 operation,bytes32 statementHash)"),
+      bytes(data.message.operation),
+      bytes(data.message.statementHash)
+    )
+  );
+  return hex(keccak_256(concatBytes(new Uint8Array([25, 1]), domain, structure)));
+}
+function signWalletAuthorization(privateKey, request) {
+  return hex(
+    secp256k1.sign(bytes(computeWalletAuthorizationDigest(request)), bytes(privateKey, 32), {
+      lowS: true
+    }).toCompactRawBytes()
+  );
+}
+async function verifyWalletAuthorization(expectedIdentity, publicKey, signature, request) {
+  const raw = bytes(signature, 64), digest = bytes(computeWalletAuthorizationDigest(request));
+  if (await computeOwnerAddress(publicKey) !== expectedIdentity) return false;
+  return secp256k1.verify(raw, digest, bytes(publicKey), { lowS: true });
+}
+async function buildWalletAuthorizationWitness(wallet, request) {
+  const publicKey = secp256k1.ProjectivePoint.fromHex(bytes(wallet.spendingPublicKey)).toRawBytes(
+    false
+  );
+  const privateKey = bytes(wallet.spendingPrivateKey, 32), identity2 = wallet.ownerAddress;
+  const statement = { ...request, context: { ...request.context }, words: [...request.words] };
+  try {
+    const derived = secp256k1.getPublicKey(privateKey, false);
+    if (!derived.every((value, i) => value === publicKey[i]))
+      throw new Error("spending key pair mismatch");
+    if (BigInt(await computeOwnerAddress(publicKey)) !== BigInt(identity2))
+      throw new Error("owner address mismatch");
+    return {
+      public_key_x: Array.from(publicKey.slice(1, 33)),
+      public_key_y: Array.from(publicKey.slice(33)),
+      signature: Array.from(bytes(signWalletAuthorization(privateKey, statement), 64))
+    };
+  } finally {
+    privateKey.fill(0);
+  }
+}
+
+// src/wallet/capabilities.ts
+var copyWitness = (witness) => ({
+  public_key_x: [...witness.public_key_x],
+  public_key_y: [...witness.public_key_y],
+  signature: [...witness.signature]
+});
+var inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+function copyBytes(value) {
+  if (typeof value === "string" && !/^0x(?:[0-9a-fA-F]{2})+$/.test(value)) {
+    throw new Error("invalid hexadecimal bytes");
+  }
+  return typeof value === "string" ? hexToBytes2(value.slice(2)) : Uint8Array.from(value);
+}
+function identity(value) {
+  return ReceivingAddress.fromIdentity(value).ownerAddress;
+}
+var ViewingCapability = class {
+  #key;
+  ownerAddress;
+  constructor(ownerAddress, privateKey, expectedPublicKey) {
+    this.ownerAddress = identity(ownerAddress);
+    this.#key = copyBytes(privateKey);
+    const publicKey = viewingPublicKey(this.#key);
+    if (expectedPublicKey && bytesToHex3(publicKey) !== bytesToHex3(expectedPublicKey)) {
+      throw new Error("viewing key pair mismatch");
+    }
+    Object.freeze(this);
+  }
+  decryptNote(envelope, context2) {
+    return decryptPrivateTransferNote(this.#key, envelope, {
+      ...context2,
+      ownerAddress: this.ownerAddress
+    });
+  }
+  decryptCredit(envelope, context2) {
+    return decryptCreditState(this.#key, envelope, {
+      ...context2,
+      ownerAddress: this.ownerAddress
+    });
+  }
+  getPublicKey() {
+    return viewingPublicKey(this.#key);
+  }
+  /** Disclose this authenticated output's payload key, without exporting the wallet viewing key. */
+  discloseNote(envelope, context2) {
+    return Disclosure.fromEncryptedNote(this.#key, envelope, {
+      ...context2,
+      ownerAddress: this.ownerAddress
+    });
+  }
+  /** Exposes the entire Credit envelope; prefer Disclosure.fromCredit() for hash-only opening. */
+  discloseCredit(envelope, context2) {
+    return Disclosure.fromEncryptedCredit(this.#key, envelope, {
+      ...context2,
+      ownerAddress: this.ownerAddress
+    });
+  }
+  /** Explicit sensitive export for delegating viewing. It grants note recovery and owner-only sweep permission. */
+  exportKey() {
+    return Uint8Array.from(this.#key);
+  }
+  toJSON() {
+    return { capability: "viewing", ownerAddress: this.ownerAddress };
+  }
+  [inspect]() {
+    return this.toJSON();
+  }
+};
+var Detector = class {
+  #key;
+  #clueKey;
+  constructor(key) {
+    this.#key = Uint8Array.from(key);
+    this.#clueKey = deriveClueKey(this.#key);
+    Object.freeze(this);
+  }
+  getClueKey() {
+    return Uint8Array.from(this.#clueKey);
+  }
+  /** Full detection delegation; the receiver chooses the checked prefix length. */
+  exportKey() {
+    return Uint8Array.from(this.#key);
+  }
+  toJSON() {
+    return { capability: "detection" };
+  }
+  [inspect]() {
+    return this.toJSON();
+  }
+};
+var NullifierCapability = class _NullifierCapability {
+  ownerAddress;
+  constructor(ownerAddress) {
+    this.ownerAddress = identity(ownerAddress);
+    Object.freeze(this);
+  }
+  static fromIdentity(ownerAddress) {
+    return new _NullifierCapability(ownerAddress);
+  }
+  compute(chainId, protocolAddress, commitment2, nonce2) {
+    return computeNoteNullifier(chainId, protocolAddress, nonce2, commitment2);
+  }
+  toJSON() {
+    return { capability: "nullifier", ownerAddress: this.ownerAddress };
+  }
+  [inspect]() {
+    return this.toJSON();
+  }
+};
+var AuthorizedStatement = class {
+  #witness;
+  digest;
+  ownerAddress;
+  constructor(ownerAddress, digest, witness) {
+    this.ownerAddress = ownerAddress;
+    this.digest = digest;
+    this.#witness = copyWitness(witness);
+    Object.freeze(this);
+  }
+  withWitness(assemble) {
+    return assemble(copyWitness(this.#witness));
+  }
+  toJSON() {
+    return { ownerAddress: this.ownerAddress, digest: this.digest };
+  }
+  [inspect]() {
+    return this.toJSON();
+  }
+};
+var WalletAuthorization = class _WalletAuthorization {
+  #privateKey;
+  #publicKey;
+  ownerAddress;
+  constructor(ownerAddress, privateKey, publicKey) {
+    this.ownerAddress = ownerAddress;
+    this.#privateKey = privateKey;
+    this.#publicKey = publicKey;
+    Object.freeze(this);
+  }
+  static async fromMaterial(ownerAddress, privateKey) {
+    const privateBytes = copyBytes(privateKey);
+    const publicBytes = secp256k12.getPublicKey(privateBytes, false);
+    if (await computeOwnerAddress(publicBytes) !== identity(ownerAddress)) {
+      throw new Error("owner address mismatch");
+    }
+    return new _WalletAuthorization(identity(ownerAddress), privateBytes, publicBytes);
+  }
+  getPublicKey() {
+    return Uint8Array.from(this.#publicKey);
+  }
+  async authorize(request) {
+    const frozen = { ...request, context: { ...request.context }, words: [...request.words] };
+    const digest = computeWalletAuthorizationDigest(frozen);
+    const witness = await buildWalletAuthorizationWitness(
+      {
+        ownerAddress: this.ownerAddress,
+        spendingPrivateKey: this.#privateKey,
+        spendingPublicKey: this.#publicKey
+      },
+      frozen
+    );
+    return new AuthorizedStatement(this.ownerAddress, digest, witness);
+  }
+  toJSON() {
+    return { capability: "wallet-authorization", ownerAddress: this.ownerAddress };
+  }
+  [inspect]() {
+    return this.toJSON();
+  }
+};
+
+// src/wallet/wallet-object.ts
+var WalletAddress = class {
+  #address;
+  constructor(address) {
+    this.#address = address;
+  }
+  get ownerAddress() {
+    return this.#address.ownerAddress;
+  }
+  get viewingPublicKey() {
+    return this.#address.viewingPublicKey;
+  }
+  get clueKey() {
+    return this.#address.clueKey;
+  }
+  /** Complete 0i receiving address. Owner-only wallets must first resolve their receiving keys. */
+  getAddress() {
+    if (this.#address.kind !== "long") {
+      throw new MissingCapabilityError("resolved receiving keys");
+    }
+    return this.#address.toString();
+  }
+  getReceivingAddress() {
+    return this.#address;
+  }
+  /** Nullifiers derive from public identity and do not grant spending authority. */
+  exportNullifier() {
+    return NullifierCapability.fromIdentity(this.ownerAddress);
+  }
+  toJSON() {
+    return { ownerAddress: this.ownerAddress, address: this.#address.toString() };
+  }
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
+    return this.toJSON();
+  }
+};
+var Wallet = class _Wallet extends WalletAddress {
+  constructor(address) {
+    super(address);
+    Object.freeze(this);
+  }
+  /** Parse a complete 0i address or an EVM owner address without network access. */
+  static fromAddress(address) {
+    if (typeof address !== "string" && !(address instanceof ReceivingAddress)) {
+      throw new TypeError("expected a validated receiving address");
+    }
+    return new _Wallet(typeof address === "string" ? ReceivingAddress.parse(address) : address);
+  }
+};
+
+// src/delivery/memo.ts
+var MAX_MEMO_BYTES = 256;
+function encodeMemo(memo) {
+  if (memo === void 0) return new Uint8Array();
+  let encoded;
+  if (typeof memo === "string") {
+    for (let i = 0; i < memo.length; i++) {
+      const unit = memo.charCodeAt(i);
+      if (unit >= 55296 && unit <= 56319) {
+        const next = memo.charCodeAt(++i);
+        if (!(next >= 56320 && next <= 57343))
+          throw new Error("memo contains an invalid surrogate");
+      } else if (unit >= 56320 && unit <= 57343)
+        throw new Error("memo contains an invalid surrogate");
+    }
+    encoded = new TextEncoder().encode(memo);
+  } else if (memo instanceof Uint8Array) encoded = Uint8Array.from(memo);
+  else throw new TypeError("memo must be text or Uint8Array");
+  if (encoded.length > MAX_MEMO_BYTES) throw new RangeError("memo exceeds 256 bytes");
+  return encoded;
+}
+function decodeMemoText(memo) {
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(memo);
+}
+
+// src/wallet/signing-request.ts
+import { TypedDataEncoder } from "ethers";
+function createSigningRequest(data) {
+  const types = Object.fromEntries(
+    Object.entries(data.types).map(([name, fields]) => [name, [...fields]])
+  );
+  const payload = TypedDataEncoder.getPayload(data.domain, types, data.message);
+  if (payload.primaryType !== data.primaryType) {
+    throw new Error("signing request primary type mismatch");
+  }
+  delete payload.types.EIP712Domain;
+  return structuredClone(payload);
+}
+
+// src/delivery/payload.ts
+function encodeData(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    throw new TypeError("v1 payload data must be an object");
+  }
+  for (const key of Object.keys(data)) {
+    if (key !== "memo") throw new Error(`unsupported v1 payload field ${key}`);
+  }
+  const memo = encodeMemo(data.memo);
+  return new Uint8Array([1, ...memo]);
+}
+function readData(value) {
+  if (!(value instanceof Uint8Array) || value.length < 1) {
+    throw new Error("payload version required");
+  }
+  if (value[0] !== 1) throw new Error("unsupported payload version");
+  const memo = Uint8Array.from(value.subarray(1));
+  if (memo.length > 256) throw new Error("invalid memo length");
+  return memo.length === 0 ? {} : { memo };
+}
+var fundsV1 = Object.freeze({
+  encode(data = {}) {
+    return encodeData(data);
+  },
+  decode(value) {
+    return readData(value);
+  }
+});
+var creditV1 = Object.freeze({
+  encode(data = {}) {
+    return encodeData(data);
+  },
+  decode(value) {
+    return readData(value);
+  }
+});
+
+// src/delivery/decryptor.ts
+import { bytesToHex as bytesToHex4 } from "@noble/hashes/utils";
+var DeliveryDecryptionError = class extends Error {
+  constructor(cause) {
+    super(cause instanceof Error ? cause.message : "delivery decryption failed", { cause });
+    this.name = "DeliveryDecryptionError";
+  }
+};
+function checkedPlaintext(plaintext, codec) {
+  if (!(plaintext instanceof Uint8Array)) throw new Error("invalid decrypted plaintext");
+  if (plaintext.length + 78 < codec.minimum || plaintext.length + 78 > codec.maximum)
+    throw new Error("invalid plaintext length");
+  return plaintext.slice();
+}
+function authenticatedDecryptor(wallet, decryptor) {
+  const ownerAddress = wallet.ownerAddress;
+  return {
+    ownerAddress,
+    async decryptNote(envelope, context2) {
+      context2 = { ...context2 };
+      try {
+        const bytes2 = validateDeliveryCiphertext(envelope, "funds");
+        const full = { ...context2, ownerAddress };
+        const plaintext = await decryptor.decryptNote(bytes2.slice(), { ...full });
+        if (plaintext === null) return null;
+        const codec = deliveryCodec(bytes2[0]);
+        if (codec.kind !== "funds") throw new Error("unexpected envelope kind");
+        const note = codec.decode(checkedPlaintext(plaintext, codec), full);
+        if (BigInt(note.ownerAddress) !== BigInt(ownerAddress) || note.tokenAddress !== context2.tokenAddress)
+          throw new Error("decrypted note context mismatch");
+        await noteCommitment(full, note);
+        return note;
+      } catch (cause) {
+        throw new DeliveryDecryptionError(cause);
+      }
+    },
+    async decryptCredit(envelope, context2) {
+      context2 = { ...context2 };
+      try {
+        const bytes2 = validateDeliveryCiphertext(envelope, "credit");
+        const full = { ...context2, ownerAddress };
+        const plaintext = await decryptor.decryptCredit(bytes2.slice(), { ...full });
+        if (plaintext === null) return null;
+        const codec = deliveryCodec(bytes2[0]);
+        if (codec.kind !== "credit") throw new Error("unexpected envelope kind");
+        const state = codec.decode(checkedPlaintext(plaintext, codec), full);
+        const identity2 = context2.role === "owner" ? state.note.ownerWalletIdentity : state.note.spenderWalletIdentity;
+        if (BigInt(identity2) !== BigInt(ownerAddress) || state.note.tokenAddress !== context2.tokenAddress)
+          throw new Error("decrypted credit context mismatch");
+        if (wallet.getReceivingAddress().kind === "long") {
+          const keys = context2.role === "owner" ? state.ownerReceivingKeys : state.spenderReceivingKeys;
+          if (bytesToHex4(keys.viewingPublicKey) !== bytesToHex4(wallet.viewingPublicKey))
+            throw new Error("decrypted credit receiving key mismatch");
+        }
+        await creditCommitment(full, state.note);
+        return state;
+      } catch (cause) {
+        throw new DeliveryDecryptionError(cause);
+      }
+    }
+  };
+}
+
+// src/wallet/wallet-wire.ts
+import { bytesToHex as bytesToHex5, hexToBytes as hexToBytes3 } from "@noble/hashes/utils";
+var walletHex = (bytes2) => `0x${bytesToHex5(bytes2)}`;
+function walletBytes(value, length) {
+  if (typeof value !== "string" || !/^0x(?:[0-9a-f]{2})*$/.test(value))
+    throw new Error("invalid canonical hex bytes");
+  const bytes2 = hexToBytes3(value.slice(2));
+  if (length !== void 0 && bytes2.length !== length) throw new Error("invalid byte length");
+  return bytes2;
+}
+function walletInteger(value) {
+  if (typeof value !== "string" || !/^(0|[1-9][0-9]*)$/.test(value) || value.length > 78)
+    throw new Error("invalid canonical integer");
+  return BigInt(value);
+}
+function walletAuthorizationParams(params) {
+  return {
+    ...params,
+    words: params.words.map(walletInteger),
+    context: {
+      chainId: walletInteger(params.context.chainId),
+      protocolAddress: walletInteger(params.context.protocolAddress)
+    }
+  };
+}
+function walletDecryptionContext(request) {
+  const context2 = request.params.context;
+  return {
+    chainId: walletInteger(context2.chainId),
+    protocolAddress: walletInteger(context2.protocolAddress),
+    tokenAddress: walletInteger(context2.tokenAddress),
+    outputCommitment: context2.outputCommitment,
+    ownerAddress: request.ownerAddress,
+    ...context2.role ? { role: context2.role } : {}
+  };
+}
+function freeze(value) {
+  if (value && typeof value === "object") {
+    Object.values(value).forEach(freeze);
+    Object.freeze(value);
+  }
+  return value;
+}
+function exactKeys(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !Object.hasOwn(value, key)))
+    throw new Error("unexpected wallet fields");
+}
+function validateWalletRequest(request) {
+  exactKeys(request, ["version", "id", "ownerAddress", "method", "params"]);
+  if (request.version !== 1 || typeof request.id !== "string" || !/^[\x21-\x7e]{1,128}$/.test(request.id))
+    throw new Error("invalid wallet request envelope");
+  walletBytes(request.ownerAddress, 20);
+  ReceivingAddress.fromIdentity(request.ownerAddress);
+  switch (request.method) {
+    case "wallet.public":
+      exactKeys(request.params, []);
+      break;
+    case "wallet.detect": {
+      exactKeys(request.params, ["clues"]);
+      const { clues } = request.params;
+      if (!Array.isArray(clues) || clues.length > 1024) throw new Error("invalid clues");
+      clues.forEach((clue) => walletBytes(clue, 68));
+      break;
+    }
+    case "wallet.authorize": {
+      exactKeys(request.params, ["operation", "capacity", "words", "context"]);
+      const params = request.params;
+      exactKeys(params.context, ["chainId", "protocolAddress"]);
+      if (!Array.isArray(params.words) || params.words.length > 8192)
+        throw new Error("invalid authorization words");
+      computeWalletAuthorizationDigest(walletAuthorizationParams(params));
+      break;
+    }
+    case "wallet.decryptNote":
+    case "wallet.decryptCredit": {
+      const typed = request;
+      exactKeys(typed.params, ["envelope", "context"]);
+      exactKeys(typed.params.context, [
+        "chainId",
+        "protocolAddress",
+        "tokenAddress",
+        "outputCommitment",
+        ...request.method === "wallet.decryptCredit" ? ["role"] : []
+      ]);
+      const context2 = walletDecryptionContext(typed);
+      walletBytes(context2.outputCommitment, 32);
+      validateContext(context2, context2.tokenAddress);
+      if (request.method === "wallet.decryptCredit" && context2.role !== "owner" && context2.role !== "spender")
+        throw new Error("invalid credit role");
+      if (request.method === "wallet.decryptNote" && context2.role !== void 0)
+        throw new Error("unexpected note role");
+      walletBytes(typed.params.envelope);
+      validateDeliveryCiphertext(
+        typed.params.envelope,
+        request.method === "wallet.decryptCredit" ? "credit" : "funds"
+      );
+      break;
+    }
+    default:
+      throw new Error("unsupported wallet method");
+  }
+}
+var retainedWallets = /* @__PURE__ */ new WeakMap();
+function prepareWalletRequest(wallet, id, method, params) {
+  if (!(wallet instanceof Wallet)) throw new TypeError("public Wallet required");
+  const request = structuredClone({
+    version: 1,
+    id,
+    ownerAddress: wallet.ownerAddress.toLowerCase(),
+    method,
+    params
+  });
+  validateWalletRequest(request);
+  const prepared = freeze({ request });
+  retainedWallets.set(prepared, wallet);
+  return prepared;
+}
+async function acceptWalletResponse(prepared, response) {
+  return acceptResponse(prepared, response);
+}
+async function acceptResponse(prepared, response) {
+  const wallet = retainedWallets.get(prepared);
+  if (!wallet) throw new Error("wallet request was not prepared by this SDK instance");
+  const request = prepared.request;
+  validateWalletRequest(request);
+  const safe = structuredClone(response);
+  if (safe.version !== request.version || safe.id !== request.id || safe.ownerAddress !== request.ownerAddress || safe.method !== request.method)
+    throw new Error("wallet response envelope mismatch");
+  validateWalletResponses([request], [safe]);
+  if ("error" in safe) throw new NativeWalletError(safe.error.code);
+  const result = safe.result;
+  exactKeys(
+    result,
+    request.method === "wallet.public" ? ["viewingPublicKey", "spendingPublicKey", "clueKey"] : request.method === "wallet.authorize" ? ["spendingPublicKey", "signature", "digest"] : request.method === "wallet.detect" ? ["matches"] : ["plaintext"]
+  );
+  if (request.method === "wallet.public") {
+    walletBytes(result.spendingPublicKey, 65);
+    walletBytes(result.viewingPublicKey, 33);
+    walletBytes(result.clueKey, 32);
+    if (await computeOwnerAddress(result.spendingPublicKey) !== request.ownerAddress)
+      throw new Error("wallet public identity mismatch");
+    if (wallet.getReceivingAddress().kind === "long" && (walletHex(wallet.viewingPublicKey) !== result.viewingPublicKey || walletHex(wallet.clueKey) !== result.clueKey))
+      throw new Error("wallet receiving key mismatch");
+    ReceivingAddress.from({
+      ownerAddress: request.ownerAddress,
+      viewingPublicKey: walletBytes(result.viewingPublicKey),
+      clueKey: walletBytes(result.clueKey)
+    });
+  } else if (request.method === "wallet.authorize") {
+    const auth = walletAuthorizationParams(request.params);
+    if (result.digest !== computeWalletAuthorizationDigest(auth) || !await verifyWalletAuthorization(
+      request.ownerAddress,
+      result.spendingPublicKey,
+      result.signature,
+      auth
+    ))
+      throw new Error("invalid wallet authorization response");
+    const publicKey = walletBytes(result.spendingPublicKey, 65);
+    return new AuthorizedStatement(request.ownerAddress, result.digest, {
+      public_key_x: Array.from(publicKey.slice(1, 33)),
+      public_key_y: Array.from(publicKey.slice(33)),
+      signature: Array.from(walletBytes(result.signature, 64))
+    });
+  } else if (request.method === "wallet.detect") {
+    if (!Array.isArray(result.matches) || result.matches.length !== request.params.clues.length || result.matches.some((v) => typeof v !== "boolean"))
+      throw new Error("invalid detection response");
+  } else {
+    const typed = request;
+    const context2 = walletDecryptionContext(typed);
+    const plaintext = walletBytes(result.plaintext);
+    const viewing = authenticatedDecryptor(wallet, {
+      decryptNote: async () => plaintext,
+      decryptCredit: async () => plaintext
+    });
+    return typed.method === "wallet.decryptNote" ? viewing.decryptNote(typed.params.envelope, context2) : viewing.decryptCredit(typed.params.envelope, context2);
+  }
+  return result;
+}
+var NativeWalletError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "NativeWalletError";
+  }
+};
+var MAX_WALLET_BATCH_BYTES = 16 * 1024 * 1024;
+function boundedJson(value) {
+  const json = JSON.stringify(value);
+  if (typeof json !== "string" || new TextEncoder().encode(json).length > MAX_WALLET_BATCH_BYTES)
+    throw new Error("wallet batch exceeds encoded size limit");
+}
+function validateWalletBatch(requests) {
+  if (!Array.isArray(requests) || requests.length > 1024) throw new Error("invalid wallet batch");
+  boundedJson(requests);
+  const ids = /* @__PURE__ */ new Set();
+  for (const request of requests) {
+    validateWalletRequest(request);
+    if (ids.has(request.id)) throw new Error("duplicate wallet request id");
+    if (request.ownerAddress !== requests[0].ownerAddress)
+      throw new Error("mixed wallet batch owners");
+    ids.add(request.id);
+  }
+}
+function validateWalletResponses(requests, responses) {
+  validateWalletBatch(requests);
+  if (!Array.isArray(responses) || responses.length !== requests.length)
+    throw new Error("wallet response batch length mismatch");
+  boundedJson(responses);
+  const expected = new Map(requests.map((request) => [request.id, request]));
+  const found = /* @__PURE__ */ new Map();
+  for (const response of responses) {
+    if (!response || typeof response !== "object") throw new Error("invalid wallet response");
+    const request = expected.get(response.id);
+    if (!request || found.has(response.id) || response.version !== 1 || response.method !== request.method || response.ownerAddress !== request.ownerAddress)
+      throw new Error("wallet response envelope mismatch");
+    if (Object.hasOwn(response, "error")) {
+      exactKeys(response, ["version", "id", "ownerAddress", "method", "error"]);
+      exactKeys(response.error, ["code"]);
+      if (typeof response.error?.code !== "string" || !/^[A-Z][A-Z0-9_]{0,127}$/.test(response.error.code))
+        throw new Error("invalid native wallet error");
+    } else {
+      exactKeys(response, ["version", "id", "ownerAddress", "method", "result"]);
+      if (!response.result || typeof response.result !== "object" || Array.isArray(response.result))
+        throw new Error("invalid wallet result");
+      const result = response.result;
+      exactKeys(
+        result,
+        request.method === "wallet.public" ? ["viewingPublicKey", "spendingPublicKey", "clueKey"] : request.method === "wallet.authorize" ? ["spendingPublicKey", "signature", "digest"] : request.method === "wallet.detect" ? ["matches"] : ["plaintext"]
+      );
+      if (request.method === "wallet.public") {
+        walletBytes(result.viewingPublicKey, 33);
+        walletBytes(result.spendingPublicKey, 65);
+        walletBytes(result.clueKey, 32);
+      } else if (request.method === "wallet.authorize") {
+        walletBytes(result.spendingPublicKey, 65);
+        walletBytes(result.signature, 64);
+        walletBytes(result.digest, 32);
+      } else if (request.method === "wallet.detect") {
+        if (!Array.isArray(result.matches) || result.matches.length !== request.params.clues.length || result.matches.some((value) => typeof value !== "boolean"))
+          throw new Error("invalid detection response");
+      } else {
+        walletBytes(result.plaintext);
+      }
+    }
+    found.set(response.id, response);
+  }
+  return requests.map((request) => found.get(request.id));
+}
+async function acceptWalletResponses(prepared, responses) {
+  for (const item of prepared) {
+    if (!retainedWallets.has(item))
+      throw new Error("wallet request was not prepared by this SDK instance");
+  }
+  const ordered = validateWalletResponses(
+    prepared.map((item) => item.request),
+    structuredClone(responses)
+  );
+  return Promise.all(prepared.map((item, index) => acceptWalletResponse(item, ordered[index])));
+}
+
+// src/provenance/intent-hash.ts
+import { AbiCoder, keccak256, toBeHex } from "ethers";
+function provenanceIntentHash(originalRequestHash) {
+  return keccak256(
+    AbiCoder.defaultAbiCoder().encode(
+      ["string", "bytes32"],
+      ["InvisiBroadcasterProvenanceIntentV1", toBeHex(BigInt(originalRequestHash), 32)]
+    )
+  );
+}
+export {
+  AuthorizedStatement,
+  CREDIT_POLICY_FIELDS,
+  CREDIT_USAGE_FIELDS,
+  D_CNULL,
+  D_CREDIT,
+  D_CREDIT_KEY_HASH,
+  D_CREDIT_RECOVERY,
+  D_CREDIT_STATE_NONCE,
+  D_IDENT,
+  D_NOTE,
+  D_NULL,
+  DeliveryDecryptionError,
+  Detector,
+  Disclosure,
+  FIELD_MODULUS,
+  MAX_CIPHERTEXT_BYTES,
+  MAX_MEMO_BYTES,
+  MAX_WALLET_BATCH_BYTES,
+  MissingCapabilityError,
+  NativeWalletError,
+  NullifierCapability,
+  ReceivingAddress,
+  TREE_DEPTH,
+  ViewingCapability,
+  WALLET_AUTHORIZATION_TYPES,
+  Wallet,
+  acceptWalletResponse,
+  acceptWalletResponses,
+  applyCreditDrawUsage,
+  authenticatedDecryptor,
+  computeCreditCommitment,
+  computeCreditNullifier,
+  computeCreditRecoveryPad,
+  computeCreditSharedKeyHash,
+  computeNoteCommitment,
+  computeNoteIdentity,
+  computeNoteNullifier,
+  computeOwnerAddress,
+  computeWalletAuthorizationDigest,
+  createClue,
+  createClueFromSeed,
+  createSigningRequest,
+  creditPeriods,
+  creditV1,
+  decodeAddress,
+  decodeDeliveryHeader,
+  decodeMemoText,
+  decryptCreditState,
+  decryptPrivateTransferNote,
+  deliveryCodec,
+  deliveryHeader,
+  deriveClueKey,
+  deriveCreditState,
+  deriveCreditStateNonce,
+  deriveCreditUpdate,
+  encodeMemo,
+  encryptCreditState,
+  encryptPrivateTransferNote,
+  fundsV1,
+  generateCreditSharedKey,
+  generateNonce,
+  normalizeCreditDeliveryState,
+  normalizeCreditPolicy,
+  normalizeCreditState,
+  normalizeCreditUsage,
+  poseidonHash,
+  prepareWalletRequest,
+  provenanceIntentHash,
+  recoverCreditState,
+  validateClueKey,
+  validateDeliveryCiphertext,
+  validateWalletBatch,
+  validateWalletResponses,
+  verifyWalletAuthorization,
+  viewingPublicKey,
+  walletAuthorizationTypedData
+};
+//# sourceMappingURL=index.js.map