@invisi-labs/sdk 1.1.5 → 1.1.7

package/dist/index.js

@@ -1,694 +1,613 @@
 import {
-  DisclosureVerifier,
-  InvisiError,
-  Operation,
-  TransactionPreparation,
-  WalletSession,
-  acceptFundingSignature,
-  acceptWalletSignature,
-  copyGasBenchmarks,
+  AddressRegistry,
+  BroadcasterClient,
+  BroadcasterRpcError,
+  Invisi,
+  PreparedTransaction,
+  TransactionOutput,
+  broadcasterQuoteDomain,
+  broadcasterQuoteTypes,
+  broadcasterRequestHash,
+  broadcasterTransactInterface,
+  decodeBroadcasterIntent,
   decryptCandidates,
   defineGasBenchmarks,
-  deserializeState,
-  encodeOperation,
-  estimateGasReference,
-  fundingSigningRequest,
-  operationPreview,
-  positiveAmount,
-  prepareWithErrors,
-  proveOperation,
-  publicProof,
+  extractDeliveryCandidates,
   readProtocolLogs,
-  requiresAuthorization,
-  sameStatement,
-  serializeState,
-  statement,
-  walletBalance,
-  walletSigningRequest
-} from "./chunk-BE52B32Z.js";
+  verifyBroadcasterQuote
+} from "./chunk-EHP5TBC6.js";
 import {
-  EthersAddressResolver,
-  EthersChainReader,
-  EthersFundingVerifier
-} from "./chunk-4HMM7ZKY.js";
+  InvisiError,
+  NoteOutput,
+  decodePaymentNote,
+  decodePaymentRequest,
+  encodePaymentNote,
+  encodePaymentRequest
+} from "./chunk-ITTGBIG2.js";
+import {
+  EthersChainReader
+} from "./chunk-XHKQ2BO2.js";
 
-// src/explicit-preparation.ts
-import { getAddress } from "ethers";
+// src/index.ts
+import {
+  Detector,
+  Disclosure,
+  MAX_MEMO_BYTES,
+  MissingCapabilityError,
+  NullifierCapability,
+  PublicWallet,
+  ViewingCapability,
+  Wallet as Wallet2,
+  WalletAuthorization,
+  computeCreditNullifier,
+  creditPeriods,
+  creditV1,
+  decodeDeliveryHeader,
+  decodeMemoText,
+  encodeMemo,
+  fundsV1
+} from "@invisi-labs/core";
+import { RegistrationOperation } from "@invisi-labs/protocol";
 
-// src/PreparedTransaction.ts
-import { MissingCapabilityError } from "@invisi-labs/core";
-import { normalizeFunding } from "@invisi-labs/protocol";
-function check(ok, message) {
-  if (!ok) throw new Error(message);
+// src/disclosure/DisclosureVerifier.ts
+function check(value, message) {
+  if (!value) throw new Error(message);
 }
-var PreparedTransaction = class _PreparedTransaction {
-  #runtime;
-  #saved;
-  #authorization;
-  #lifecycle;
-  status;
-  constructor(runtime, saved, status, lifecycle, authorization) {
-    this.#runtime = runtime;
-    this.#saved = structuredClone(saved);
-    this.#lifecycle = lifecycle;
-    this.#authorization = authorization;
-    this.status = status;
-    Object.freeze(this);
-  }
-  static prepare(runtime, plan) {
-    return new _PreparedTransaction(
-      runtime,
-      { plan: structuredClone(plan), generation: 0 },
-      "prepared",
-      { generation: 0, busy: false }
-    );
-  }
-  get id() {
-    return this.#saved.plan.id;
-  }
-  get kind() {
-    return this.#saved.plan.kind;
-  }
-  estimateGas() {
-    return estimateGasReference(
-      this.#saved.plan,
-      this.#runtime.options.protocol,
-      this.#runtime.options.gasBenchmarks
-    );
-  }
-  preview() {
-    return operationPreview(this.#saved.plan, this.status);
-  }
-  current() {
+function reference(value) {
+  check(/^0x[0-9a-fA-F]{64}$/.test(value.transactionHash), "invalid disclosure transaction hash");
+  check(
+    typeof value.treeId === "bigint" && value.treeId > 0n && value.treeId < 1n << 64n,
+    "invalid disclosure tree ID"
+  );
+  check(
+    Number.isSafeInteger(value.leafIndex) && value.leafIndex >= 0 && value.leafIndex < 65536,
+    "invalid disclosure leaf index"
+  );
+  check(["funds", "owner", "spender"].includes(value.role), "invalid disclosure reference role");
+  return {
+    transactionHash: value.transactionHash.toLowerCase(),
+    treeId: value.treeId,
+    leafIndex: value.leafIndex,
+    role: value.role
+  };
+}
+var DisclosureVerifier = class {
+  #protocol;
+  #reader;
+  #confirmations;
+  constructor(options) {
+    const confirmations = options.confirmations ?? 1;
     check(
-      !this.#lifecycle.busy && this.#lifecycle.generation === this.#saved.generation,
-      "stale transaction handle or active worker"
+      Number.isSafeInteger(confirmations) && confirmations >= 1,
+      "invalid disclosure confirmations"
     );
+    this.#protocol = options.protocol;
+    this.#reader = "provider" in options ? new EthersChainReader(options.provider) : options.reader;
+    this.#confirmations = BigInt(confirmations);
+    Object.freeze(this);
   }
-  async stage(stage, allowed, work, signal) {
-    signal?.throwIfAborted();
-    this.current();
-    check(allowed.includes(this.status), `invalid transaction stage for ${stage}`);
-    this.#lifecycle.busy = true;
-    const saved = structuredClone(this.#saved);
-    try {
-      const next = await work(saved);
-      signal?.throwIfAborted();
-      saved.generation++;
-      this.#lifecycle.generation = saved.generation;
-      return new _PreparedTransaction(
-        this.#runtime,
-        saved,
-        next.status,
-        this.#lifecycle,
-        next.authorization ?? this.#authorization
-      );
-    } finally {
-      this.#lifecycle.busy = false;
-    }
-  }
-  /** Public EIP-712 request; signing transport and key custody belong to the caller. */
-  async exportWalletAuthorization(options = {}) {
-    options.signal?.throwIfAborted();
-    this.current();
+  async barrier(block) {
+    await this.#protocol.validateDeployment(this.#reader);
+    const canonical = await this.#reader.getBlock(block.number);
     check(
-      requiresAuthorization(this.#saved.plan),
-      "operation does not require wallet authorization"
+      canonical.number === block.number && canonical.hash.toLowerCase() === block.hash.toLowerCase(),
+      "disclosure canonical block changed; reorg verification required"
     );
+    const head = await this.#reader.getLatestBlockNumber();
     check(
-      ["prepared", "authorized"].includes(this.status),
-      "operation is not awaiting wallet authorization"
+      head >= block.number && head - block.number + 1n >= this.#confirmations,
+      "insufficient disclosure confirmations"
     );
-    return walletSigningRequest(this.#saved.plan);
-  }
-  /** Attach an external EOA signature, retaining its witness only at the private proving boundary. */
-  async withWalletSignature(signature, options = {}) {
-    options.signal?.throwIfAborted();
-    this.current();
     check(
-      requiresAuthorization(this.#saved.plan),
-      "operation does not require wallet authorization"
+      await this.#reader.getChainId() === this.#protocol.context.chainId,
+      "disclosure chain changed during verification"
     );
+    return head - block.number + 1n;
+  }
+  /** Resolve the exact inserted output and its delivery from a successful canonical receipt. */
+  async readOutput(value) {
+    const selected = reference(value);
+    await this.#protocol.validateDeployment(this.#reader);
+    const received = await this.#reader.getReceipt(selected.transactionHash);
+    check(received, "disclosure transaction receipt is unavailable");
+    const receipt = structuredClone(received);
+    check(receipt.status === "success", "disclosure requires a successful transaction receipt");
     check(
-      ["prepared", "authorized"].includes(this.status),
-      "operation is not awaiting wallet authorization"
+      receipt.transactionHash.toLowerCase() === selected.transactionHash,
+      "disclosure receipt transaction mismatch"
     );
-    const authorization = await acceptWalletSignature(this.#saved.plan, signature);
-    return this.stage(
-      "wallet authorization",
-      ["prepared", "authorized"],
-      async () => ({ status: "authorized", authorization }),
-      options.signal
-    );
-  }
-  /** Export only after proving when the funding authorization binds an actual proof hash. */
-  async exportFundingAuthorization(options = {}) {
-    options.signal?.throwIfAborted();
-    this.current();
-    check(
-      this.status === (this.kind === "shield" ? "prepared" : "proved"),
-      "operation is not awaiting funding authorization or proof"
-    );
-    const request = await fundingSigningRequest(this.#saved, this.#runtime);
-    options.signal?.throwIfAborted();
-    this.current();
-    return request;
-  }
-  /** Verify an external signature against this handle's own frozen operation. */
-  async withFundingSignature(signature, options = {}) {
-    options.signal?.throwIfAborted();
-    this.current();
     check(
-      this.status === (this.kind === "shield" ? "prepared" : "proved"),
-      "operation is not awaiting funding authorization or proof"
+      typeof receipt.block.number === "bigint" && receipt.block.number >= 0n && /^0x[0-9a-fA-F]{64}$/.test(receipt.block.hash),
+      "invalid disclosure receipt block"
     );
-    const verified = await acceptFundingSignature(this.#saved, signature, this.#runtime);
-    return this.stage(
-      "funding authorization",
-      this.kind === "shield" ? ["prepared"] : ["proved"],
-      async (saved) => {
-        saved.plan.funding.signature = verified;
-        if (saved.plan.statement?.target !== "noir-recursive") {
-          saved.call = await this.encode(saved);
-        }
-        return { status: "ready" };
-      },
-      options.signal
-    );
-  }
-  async prove(backendOrOptions = {}, suppliedOptions = {}) {
-    const options = { ..."prove" in backendOrOptions ? suppliedOptions : backendOrOptions };
-    const plan = this.#saved.plan;
-    check(plan.kind !== "shield", "shield requires no proof");
-    if (requiresAuthorization(plan)) {
-      check(
-        this.#authorization,
-        "local wallet authorization required; authorize again after recovery"
-      );
-    }
-    const prover = "prove" in backendOrOptions ? backendOrOptions : this.#runtime.options.prover;
-    if (!prover) {
-      throw new MissingCapabilityError("prover");
-    }
-    return this.stage(
-      "proof",
-      requiresAuthorization(plan) ? ["authorized"] : ["prepared"],
-      async (saved) => {
-        const p = saved.plan;
-        saved.proof = await proveOperation(
-          this.#runtime.options.protocol,
-          p,
-          this.#authorization,
-          prover,
-          options
-        );
-        if (p.fundingMode === "signature") {
-          return { status: "proved" };
-        }
-        if (p.statement?.target !== "noir-recursive") {
-          saved.call = await this.encode(saved);
-        }
-        return { status: "ready" };
-      },
-      options.signal
+    const { context } = this.#protocol;
+    const logs = readProtocolLogs(receipt, context.protocolAddress);
+    const candidates = extractDeliveryCandidates(logs, context, receipt.block.number).filter(
+      (candidate2) => candidate2.treeId === selected.treeId && candidate2.leafIndex === selected.leafIndex && candidate2.role === selected.role && candidate2.tokenAddress.toLowerCase() === context.tokenAddress.toLowerCase()
     );
-  }
-  encode(saved) {
-    return encodeOperation(saved);
-  }
-  /** Shield caller funding needs no wallet signing or proof; this step only encodes its frozen request. */
-  async ready() {
     check(
-      this.kind === "shield" && this.#saved.plan.fundingMode === "caller",
-      "operation needs authorization or proof first"
+      candidates.length === 1,
+      "disclosure output has no unique canonical insertion and delivery"
     );
-    return this.stage("encoding", ["prepared"], async (saved) => {
-      saved.call = await this.encode(saved);
-      return { status: "ready" };
+    const candidate = candidates[0];
+    const confirmations = await this.barrier(receipt.block);
+    return Object.freeze({
+      reference: Object.freeze(selected),
+      block: Object.freeze({ ...receipt.block }),
+      confirmations,
+      output: Object.freeze({
+        chainId: context.chainId,
+        protocolAddress: BigInt(context.protocolAddress),
+        tokenAddress: BigInt(context.tokenAddress),
+        outputCommitment: candidate.commitment,
+        role: selected.role,
+        ciphertext: candidate.delivery.ciphertext
+      })
     });
   }
-  async exportTransaction() {
-    this.current();
-    check(
-      this.#saved.plan.statement?.target !== "noir-recursive",
-      "recursive operations must be exported as aggregate members"
-    );
-    check(this.status === "ready" && this.#saved.call, "transaction is not ready");
-    return structuredClone(this.#saved.call);
-  }
-  exportProof() {
-    this.current();
-    check(this.#saved.proof, "transaction has no proof");
-    return publicProof(this.#saved.proof);
-  }
-  exportAggregateMember() {
-    this.current();
-    const saved = this.#saved, plan = saved.plan;
-    check(
-      this.status === "ready" && plan.params && saved.proof && plan.statement?.target === "noir-recursive" && plan.statement.circuitName === "transact_user_slots14",
-      "ready recursive slots14 transaction required"
-    );
-    sameStatement(saved.proof, statement(plan));
-    check(
-      saved.proof.proofHex.length === 2 + 458 * 64,
-      "recursive member proof must have 458 fields"
-    );
-    return {
-      bundle: publicProof(saved.proof),
-      statement: structuredClone(plan.statement),
-      context: { ...plan.context },
-      request: {
-        params: structuredClone(plan.params),
-        deliveries: plan.outputs.map((output) => structuredClone(output.delivery)),
-        funding: normalizeFunding(plan.funding)
-      }
-    };
+  async verify(disclosure, value) {
+    const evidence = await this.readOutput(value);
+    const result = await disclosure.verify(evidence.output);
+    const confirmations = await this.barrier(evidence.block);
+    return Object.freeze({
+      result: Object.freeze(result),
+      block: evidence.block,
+      confirmations,
+      output: Object.freeze({
+        ...evidence.reference,
+        commitment: evidence.output.outputCommitment
+      })
+    });
   }
   toJSON() {
-    return { transaction: true, id: this.id, kind: this.kind, status: this.status };
+    return { disclosureVerifier: true, confirmations: this.#confirmations.toString() };
   }
   [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
     return this.toJSON();
   }
 };
 
-// src/explicit-preparation.ts
-function explicitPreparation(options, data, tokenAddress) {
-  if (!options.chainReader) throw new Error("chain reader required");
-  const inputs = structuredClone(data.inputs ?? []);
-  const credits = structuredClone(data.creditInputs ?? []);
-  const inventory = { notes: {}, credits: {}, reservations: {} };
-  const context = options.protocol.context;
-  function position(input) {
-    if (typeof input.treeId !== "bigint" || input.treeId < 0n || input.treeId >= 1n << 256n || !Number.isInteger(input.leafIndex) || input.leafIndex < 0 || input.leafIndex >= 65536)
-      throw new Error("invalid explicit input position");
-  }
-  for (const input of inputs) {
-    position(input);
-    positiveAmount(input.note.amount);
-    if (inventory.notes[input.commitment]) throw new Error("duplicate explicit note input");
-    if (input.note.chainId !== context.chainId || input.note.protocolAddress !== BigInt(context.protocolAddress) || input.note.walletIdentity !== options.wallet.walletIdentity)
-      throw new Error("explicit note identity or deployment mismatch");
-    inventory.notes[input.commitment] = { ...input, spent: "unspent" };
-  }
-  for (const input of credits) {
-    position(input);
-    if (input.role !== "owner" && input.role !== "spender")
-      throw new Error("invalid explicit Credit role");
-    const key = input.commitment + ":" + input.role;
-    if (inventory.credits[key]) throw new Error("duplicate explicit Credit input");
-    inventory.credits[key] = { ...input, spent: "unspent" };
-  }
-  const scope = {
-    ...context,
-    namespace: "explicit",
-    walletIdentity: options.wallet.walletIdentity
-  };
-  const {
-    store: _store,
-    coinSelector: _selector,
-    authorization: _authorization,
-    viewing: _viewing,
-    signer: _signer,
-    fundingSigner: _fundingSigner,
-    ...capabilities
-  } = options;
-  if (inputs.some((input) => input.note.tokenAddress !== BigInt(getAddress(tokenAddress))))
-    throw new Error("explicit note token mismatch");
-  const runtime = {
-    options: { ...capabilities, protocol: options.protocol.forToken(tokenAddress) },
-    reader: options.chainReader,
-    scope
-  };
-  return new TransactionPreparation({
-    ...runtime,
-    explicitInputs: true,
-    ...data.changeAddress ? { changeAddress: data.changeAddress } : {},
-    readInventory: async () => structuredClone(inventory),
-    complete: async (plan) => PreparedTransaction.prepare(runtime, plan)
-  });
+// src/protocol/connections.ts
+var connections = /* @__PURE__ */ new WeakMap();
+function rememberProtocolConnection(protocol, provider, protocolRpc) {
+  connections.set(protocol, { provider, protocolRpc });
+}
+function protocolConnection(protocol) {
+  return connections.get(protocol);
 }
 
-// src/Invisi.ts
-import { ProtocolRpcClient } from "@invisi-labs/rpc";
-import { MissingCapabilityError as MissingCapabilityError2, PublicWallet, ReceivingAddress } from "@invisi-labs/core";
-
-// src/AddressRegistry.ts
-import { AddressRegistry as Registry } from "@invisi-labs/protocol";
-var AddressRegistry = class extends Registry {
-  prepareRegistration(options) {
-    return prepareWithErrors("prepareRegistration", async () => {
-      if ("provider" in options) {
-        const { provider, ...preparation } = options;
-        return super.prepareRegistration({
-          ...preparation,
-          reader: new EthersChainReader(provider)
-        });
-      }
-      return super.prepareRegistration(options);
-    });
+// src/protocol/Protocol.ts
+import { Protocol as BaseProtocol } from "@invisi-labs/protocol";
+import { getAddress } from "ethers";
+var sources = /* @__PURE__ */ new WeakMap();
+var Protocol = class _Protocol extends BaseProtocol {
+  static async fromRpc(rpc, provider, options = {}) {
+    const verified = await BaseProtocol.fromRpc(rpc, provider, options);
+    const protocol = new _Protocol({ deployment: verified.deployment });
+    if (rpc.getBroadcasters)
+      sources.set(protocol, rpc);
+    if (rpc.withReader)
+      rememberProtocolConnection(
+        protocol,
+        provider,
+        rpc
+      );
+    return protocol;
+  }
+  /** Returns enabled services that answer a token fee probe; final quotes are checked by prepared. */
+  async getBroadcasters(options) {
+    const token = getAddress(options.tokenAddress);
+    if (!this.deployment.broadcasterRegistry)
+      throw new Error("broadcaster registry is not configured");
+    const rpc = sources.get(this);
+    if (!rpc) throw new Error("broadcaster discovery requires Protocol.fromRpc");
+    const clients = [];
+    let after;
+    let block;
+    const seen = /* @__PURE__ */ new Set();
+    do {
+      const page = await rpc.getBroadcasters({
+        enabled: true,
+        limit: 100,
+        ...after ? { after } : {},
+        ...block ? { block } : {}
+      });
+      block ??= page.block;
+      const compatible = await Promise.all(
+        page.broadcasters.map(async (entry) => {
+          if (!entry.enabled) return void 0;
+          try {
+            const client = new BroadcasterClient(entry);
+            await client.fee(token);
+            return client;
+          } catch {
+            return void 0;
+          }
+        })
+      );
+      clients.push(
+        ...compatible.filter((client) => client !== void 0)
+      );
+      after = page.next;
+      if (after && seen.has(after)) throw new Error("repeated broadcaster pagination cursor");
+      if (after) seen.add(after);
+    } while (after);
+    return clients;
   }
 };
 
-// src/Invisi.ts
-var Invisi = class {
+// src/index.ts
+import { MAX_UPDATE_BLOCKS, ProtocolRpcError } from "@invisi-labs/rpc";
+
+// src/protocol/BroadcasterRegistry.ts
+import { broadcasterRegistryAbi } from "@invisi-labs/protocol/contracts";
+import { getAddress as getAddress2, Interface, keccak256 } from "ethers";
+var abi = new Interface(broadcasterRegistryAbi);
+function address(value) {
+  const normalized = getAddress2(value);
+  if (BigInt(normalized) === 0n) throw new Error("zero broadcaster address");
+  return normalized;
+}
+var BroadcasterRegistry = class {
+  address;
   #options;
-  constructor(options = {}) {
-    if ("ciphertextCodecs" in options || "envelopeVersion" in options) {
-      throw new Error(
-        "SDK envelope versions are fixed; encode application payload bytes externally"
-      );
+  constructor(options) {
+    this.address = address(options.address);
+    const blockRange = options.blockRange ?? 2e3;
+    if (options.chainId <= 0n || !Number.isSafeInteger(options.fromBlock) || options.fromBlock < 0 || !Number.isSafeInteger(blockRange) || blockRange < 1 || blockRange > 1e5 || !/^0x[0-9a-fA-F]{64}$/.test(options.runtimeCodeHash))
+      throw new Error("invalid broadcaster registry configuration");
+    this.#options = Object.freeze({ ...options, blockRange });
+  }
+  prepareRegistration(registration) {
+    const { endpoint, metadataURI = "" } = registration;
+    if (!endpoint.startsWith("https://") || endpoint.length <= 8 || endpoint.length > 2048 || /[^\x21-\x7e]/.test(endpoint))
+      throw new Error("broadcaster endpoint must be a printable HTTPS URI");
+    const url = new URL(endpoint);
+    if (!url.hostname || url.username || url.password) {
+      throw new Error("broadcaster HTTPS endpoint must not include credentials");
     }
-    if ("signer" in options || "fundingSigner" in options) {
-      throw new Error(
-        "Invisi does not accept signer defaults; export a signing request and attach the external signature"
-      );
+    if (metadataURI.length > 2048 || /[^\x21-\x7e]/.test(metadataURI)) {
+      throw new Error("invalid broadcaster metadata URI");
     }
-    this.#options = {
-      ...options,
-      ...options.gasBenchmarks ? { gasBenchmarks: copyGasBenchmarks(options.gasBenchmarks) } : {}
-    };
-    Object.freeze(this);
-  }
-  async connect(options) {
-    return new WalletSession(await this.resolve(options));
-  }
-  async resolve(options) {
-    const allowed = [
-      "wallet",
-      "protocol",
-      "namespace",
-      "viewing",
-      "authorization",
-      "signer",
-      "fundingSigner"
-    ];
-    for (const key of Object.keys(options)) {
-      if (!allowed.includes(key))
-        throw new Error(
-          `Unknown connection option: ${key}; configure infrastructure on Invisi`
-        );
+    return this.call("setBroadcaster", [
+      endpoint,
+      metadataURI,
+      address(registration.quoteSigner),
+      address(registration.feeRecipient)
+    ]);
+  }
+  prepareAvailability(enabled) {
+    return this.call("setEnabled", [enabled]);
+  }
+  call(name, args) {
+    return { to: this.address, data: abi.encodeFunctionData(name, args), value: 0n };
+  }
+  async validate() {
+    const { provider, chainId, runtimeCodeHash } = this.#options;
+    if ((await provider.getNetwork()).chainId !== chainId) {
+      throw new Error("broadcaster registry chain mismatch");
     }
-    const selected = { ...options };
-    const combined = { ...this.#options, ...selected };
-    const { provider, addressLookup = "protocol-rpc", ...runtime } = combined;
-    if (addressLookup !== void 0 && addressLookup !== "chain" && addressLookup !== "protocol-rpc") {
-      throw new Error("Invalid recipient address lookup source");
-    }
-    const reader = combined.chainReader ?? (provider ? new EthersChainReader(provider) : void 0);
-    if (!reader) throw new MissingCapabilityError2("chain reader");
-    if (provider && (await provider.getNetwork()).chainId !== selected.protocol.context.chainId)
-      throw new Error("provider deployment chain mismatch");
-    await selected.protocol.validateDeployment(reader);
-    if (runtime.protocolRpc instanceof ProtocolRpcClient) {
-      runtime.protocolRpc = runtime.protocolRpc.withReader(reader);
-    }
-    const registry = selected.protocol.deployment.registry;
-    const fundingVerifier = combined.fundingVerifier ?? (provider ? new EthersFundingVerifier(provider, selected.protocol.context.chainId) : void 0);
-    let addressResolver = combined.addressResolver;
-    if (!addressResolver && registry) {
-      if (addressLookup === "protocol-rpc") {
-        const rpc = runtime.protocolRpc;
-        addressResolver = async (identity) => {
-          if (!(rpc instanceof ProtocolRpcClient)) {
-            throw new MissingCapabilityError2("Protocol RPC recipient discovery");
-          }
-          const discovered = await rpc.getDeployment(selected.protocol.context.chainId);
-          const expected = selected.protocol.deployment;
-          if (discovered.protocol.address !== expected.protocol.address || discovered.protocol.runtimeCodeHash !== expected.protocol.runtimeCodeHash || discovered.protocol.fromBlock !== expected.protocol.fromBlock || discovered.registry?.address !== registry.address || discovered.registry.runtimeCodeHash !== registry.runtimeCodeHash || discovered.registry.fromBlock !== registry.fromBlock)
-            throw new Error("Recipient registry deployment pins mismatch");
-          const registration = await rpc.getReceivingAddress(identity);
-          return registration ? ReceivingAddress.parse(registration.receivingAddress).getReceivingKeys() : null;
-        };
-      } else if (provider) {
-        addressResolver = new EthersAddressResolver(
-          provider,
-          {
-            chainId: selected.protocol.context.chainId,
-            registryAddress: registry.address
-          },
-          registry.runtimeCodeHash
-        ).lookup;
-      }
+    if (keccak256(await provider.getCode(this.address)).toLowerCase() !== runtimeCodeHash.toLowerCase()) {
+      throw new Error("broadcaster registry runtime code mismatch");
     }
+  }
+  async get(operator) {
+    await this.validate();
+    return this.read(address(operator));
+  }
+  async read(operator) {
+    const result = await this.#options.provider.call(this.call("broadcasterOf", [operator]));
+    const [entry] = abi.decodeFunctionResult("broadcasterOf", result);
     return {
-      ...runtime,
-      chainReader: reader,
-      ...fundingVerifier ? { fundingVerifier } : {},
-      ...addressResolver ? { addressResolver } : {},
-      protocol: selected.protocol
+      operator,
+      endpoint: entry.endpoint,
+      metadataURI: entry.metadataURI,
+      quoteSigner: address(entry.quoteSigner),
+      feeRecipient: address(entry.feeRecipient),
+      enabled: entry.enabled
     };
   }
-  /** Discover the selected chain's registry and prepare an independent signing request. */
-  async prepareRegistration(options) {
-    return prepareWithErrors("prepareRegistration", async () => {
-      for (const key of Object.keys(options)) {
-        if (!["wallet", "update", "deadline"].includes(key)) {
-          throw new Error(`Unknown registration option: ${key}`);
-        }
-      }
-      this.assertPublicIdentity(options);
-      const selected = { ...options };
-      const { provider, protocolRpc } = this.#options;
-      if (!provider) throw new MissingCapabilityError2("ethers provider");
-      if (!(protocolRpc instanceof ProtocolRpcClient)) {
-        throw new MissingCapabilityError2("Protocol RPC deployment discovery");
-      }
-      const chainId = (await provider.getNetwork()).chainId;
-      const deployment = await protocolRpc.getDeployment(chainId);
-      if (!deployment.registry) {
-        throw new MissingCapabilityError2("receiving-key registry deployment");
+  /** Discover event operators, then read their latest entry; disabled services remain explicit. */
+  async discover(options = {}) {
+    const { provider, fromBlock, blockRange } = this.#options;
+    options.signal?.throwIfAborted();
+    await this.validate();
+    const toBlock = options.toBlock ?? await provider.getBlockNumber();
+    if (!Number.isSafeInteger(toBlock) || toBlock < fromBlock) {
+      throw new Error("invalid broadcaster discovery block range");
+    }
+    const operators = /* @__PURE__ */ new Set();
+    for (let start = fromBlock; start <= toBlock; ) {
+      options.signal?.throwIfAborted();
+      const end = Math.min(start + blockRange - 1, toBlock);
+      const logs = await provider.getLogs({
+        address: this.address,
+        topics: [abi.getEvent("BroadcasterSet").topicHash],
+        fromBlock: start,
+        toBlock: end
+      });
+      for (const log of logs) {
+        if (getAddress2(log.address) !== this.address)
+          throw new Error("registry event address mismatch");
+        const event = abi.parseLog(log);
+        if (!event || event.name !== "BroadcasterSet")
+          throw new Error("invalid registry event");
+        operators.add(address(event.args.operator));
       }
-      const registry = new AddressRegistry(
-        { chainId, registryAddress: deployment.registry.address },
-        { expectedRuntimeCodeHash: deployment.registry.runtimeCodeHash }
-      );
-      return registry.prepareRegistration({ ...selected, provider });
-    });
-  }
-  assertPublicIdentity(options) {
-    const { wallet } = options;
-    if (!(wallet instanceof PublicWallet) || ["getViewer", "getDetector", "exportAuthorization"].some((key) => key in wallet)) {
-      throw new Error(
-        "Independent preparation requires a PublicWallet without private capabilities"
-      );
+      start = end + 1;
     }
-    for (const key of ["authorization", "signer", "fundingSigner", "viewing"]) {
-      if (key in options)
-        throw new Error(`Independent preparation does not accept capability: ${key}`);
+    const entries = [];
+    for (const operator of operators) {
+      options.signal?.throwIfAborted();
+      entries.push(await this.read(operator));
     }
-  }
-  resolveExplicit(options) {
-    this.assertPublicIdentity(options);
-    return this.resolve({ wallet: options.wallet, protocol: options.protocol });
-  }
-  async prepareTransfer(options) {
-    return prepareWithErrors("prepareTransfer", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-      return preparation.prepareTransfer(request);
-    });
-  }
-  async prepareShield(options) {
-    return prepareWithErrors("prepareShield", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, {}, request.tokenAddress);
-      return preparation.prepareShield(request);
-    });
-  }
-  async prepareCreateCredit(options) {
-    return prepareWithErrors("prepareCreateCredit", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-      return preparation.prepareCreateCredit(request);
-    });
-  }
-  async prepareDrawCredit(options) {
-    return prepareWithErrors("prepareDrawCredit", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-      return preparation.prepareDrawCredit(request);
-    });
-  }
-  async prepareTopUpCredit(options) {
-    return prepareWithErrors("prepareTopUpCredit", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-      return preparation.prepareTopUpCredit(request);
-    });
-  }
-  async prepareCancelCredit(options) {
-    return prepareWithErrors("prepareCancelCredit", async () => {
-      const { wallet, protocol, ...input } = options;
-      const request = structuredClone(input);
-      const runtime = await this.resolveExplicit(options);
-      const preparation = explicitPreparation(runtime, request, request.tokenAddress);
-      return preparation.prepareCancelCredit(request);
-    });
-  }
-  toJSON() {
-    return { invisi: true };
-  }
-  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
-    return this.toJSON();
+    return entries;
   }
 };
 
-// src/index.ts
-import {
-  fundsV1,
-  creditV1,
-  decodeDeliveryHeader,
-  Wallet,
-  PublicWallet as PublicWallet2,
-  ViewingCapability,
-  Detector,
-  NullifierCapability,
-  WalletAuthorization,
-  MissingCapabilityError as MissingCapabilityError3,
-  Disclosure,
-  encodeMemo,
-  decodeMemoText,
-  MAX_MEMO_BYTES,
-  computeCreditNullifier,
-  creditPeriods
-} from "@invisi-labs/core";
-import { Protocol, RegistrationOperation } from "@invisi-labs/protocol";
-import { ProtocolRpcError } from "@invisi-labs/rpc";
-
-// src/ProtocolRpcClient.ts
+// src/protocol/ProtocolRpcClient.ts
 import { ProtocolRpcClient as RpcClient } from "@invisi-labs/rpc";
-var ProtocolRpcClient2 = class extends RpcClient {
+var ProtocolRpcClient = class extends RpcClient {
   withProvider(provider) {
     return this.withReader(new EthersChainReader(provider));
   }
 };
 
-// src/integrations/encrypted-codec.ts
-var EncryptedWalletCodec = class _EncryptedWalletCodec {
-  #key;
-  constructor(key) {
-    this.#key = key;
+// src/payment-note/PaymentNote.ts
+import { computeNoteIdentity, computeNoteCommitment, Wallet } from "@invisi-labs/core";
+
+// src/payment-note/verification.ts
+import {
+  poseidonHash,
+  TREE_DEPTH,
+  computeNoteNullifier
+} from "@invisi-labs/core";
+import { getAddress as getAddress3 } from "ethers";
+function verificationOptions(protocol, options = {}) {
+  const connected = protocolConnection(protocol);
+  const resolved = { ...connected, ...options };
+  if (!("protocolRpc" in resolved) || !resolved.protocolRpc || !("chainReader" in resolved) && !("provider" in resolved))
+    throw new Error(
+      "Payment note verification requires Protocol.fromRpc or explicit chain and Protocol RPC connections"
+    );
+  return resolved;
+}
+function sameBlock(a, b) {
+  return a.number === b.number && a.hash === b.hash && a.parentHash === b.parentHash && a.timestamp === b.timestamp;
+}
+function asNote(data) {
+  return {
+    chainId: data.chainId,
+    protocolAddress: BigInt(data.protocolAddress),
+    tokenAddress: BigInt(data.tokenAddress),
+    amount: data.amount,
+    ownerAddress: data.ownerAddress,
+    nonce: data.nonce
+  };
+}
+async function verifyPaymentNote(data, protocol, options, wallet) {
+  if (data.chainId !== protocol.context.chainId || getAddress3(data.protocolAddress) !== getAddress3(protocol.context.protocolAddress))
+    throw new Error("Payment note protocol context mismatch");
+  const confirmations = options.confirmations ?? 1;
+  if (!Number.isSafeInteger(confirmations) || confirmations < 1)
+    throw new RangeError("confirmations must be positive");
+  const reader = options.chainReader ?? new EthersChainReader(options.provider);
+  await protocol.validateDeployment(reader);
+  if (wallet && getAddress3(wallet.ownerAddress) !== getAddress3(data.ownerAddress))
+    throw new Error("Payment note owner mismatch");
+  if (wallet) {
+    if (typeof wallet.exportAuthorization !== "function")
+      throw new Error("Wallet spending authorization capability required");
+    const authorization = wallet.exportAuthorization();
+    if (getAddress3(authorization.ownerAddress) !== getAddress3(data.ownerAddress))
+      throw new Error("Wallet authorization owner mismatch");
+  }
+  const latest = await reader.getLatestBlockNumber();
+  const number = latest - BigInt(confirmations - 1);
+  if (number < protocol.deployment.protocol.fromBlock)
+    throw new Error("Insufficient confirmed blocks");
+  const rpc = options.protocolRpc.withReader(reader);
+  const status = await rpc.getStatus(protocol.context);
+  if (!status.indexedHead) throw new Error("Protocol RPC has no indexed blocks");
+  const indexedNumber = status.indexedHead.number < number ? status.indexedHead.number : number;
+  if (indexedNumber < protocol.deployment.protocol.fromBlock)
+    throw new Error("Protocol RPC has not reached the deployment");
+  const checkedAt = await reader.getBlock(indexedNumber);
+  if (checkedAt.number !== indexedNumber)
+    throw new Error("Payment note confirmation block mismatch");
+  const result = await rpc.getNote(protocol.context, data.commitment, checkedAt);
+  if (!result) throw new Error("Payment note is not indexed at the requested confirmed block");
+  const { output, membership } = result;
+  if (output.commitment !== data.commitment || getAddress3(output.tokenAddress) !== getAddress3(data.tokenAddress) || membership.leaf !== data.commitment || membership.treeId !== output.treeId || membership.leafIndex !== output.leafIndex || membership.block.number > checkedAt.number || output.block.number > checkedAt.number || membership.path.length !== TREE_DEPTH || !Number.isSafeInteger(output.leafIndex) || output.leafIndex < 0 || output.leafIndex >= 2 ** TREE_DEPTH)
+    throw new Error("Payment note membership metadata mismatch");
+  let root = BigInt(data.commitment);
+  for (let level = 0; level < membership.path.length; level++) {
+    const sibling = membership.path[level];
+    root = BigInt(
+      await poseidonHash(output.leafIndex >> level & 1 ? [sibling, root] : [root, sibling])
+    );
   }
-  static fromKey(key) {
-    if (key.type !== "secret" || key.algorithm.name !== "AES-GCM" || key.algorithm.length !== 256 || !key.usages.includes("encrypt") || !key.usages.includes("decrypt"))
-      throw new Error("wallet record key must support AES-256-GCM encryption and decryption");
-    return new _EncryptedWalletCodec(key);
+  if (root !== BigInt(membership.root) || !await reader.isKnownRoot(protocol.context, membership.treeId, membership.root, checkedAt))
+    throw new Error("Payment note membership root is not accepted on chain");
+  if (!sameBlock(output.block, await reader.getBlock(output.block.number)) || !sameBlock(membership.block, await reader.getBlock(membership.block.number)))
+    throw new Error("Payment note block is no longer canonical");
+  let spendabilityCheckedAt;
+  if (wallet) {
+    const current = await reader.getBlock(await reader.getLatestBlockNumber());
+    const nullifier = await computeNoteNullifier(data.chainId, data.nonce, data.commitment);
+    const spent = await reader.isSpent(protocol.context, [nullifier], current);
+    if (spent.length !== 1 || spent[0] !== false)
+      throw new Error("Payment note is already spent");
+    if (!await reader.isKnownRoot(
+      protocol.context,
+      membership.treeId,
+      membership.root,
+      current
+    ))
+      throw new Error("Payment note membership root is no longer spendable");
+    if (!sameBlock(current, await reader.getBlock(current.number)))
+      throw new Error("Spendability block reorganized");
+    spendabilityCheckedAt = current;
+  }
+  if (!sameBlock(checkedAt, await reader.getBlock(checkedAt.number)))
+    throw new Error("Payment note verification block reorganized");
+  return {
+    input: {
+      note: asNote(data),
+      commitment: data.commitment,
+      treeId: output.treeId,
+      leafIndex: output.leafIndex
+    },
+    membership,
+    checkedAt,
+    ...spendabilityCheckedAt ? { spendabilityCheckedAt } : {}
+  };
+}
+
+// src/payment-note/PaymentNote.ts
+var verification = /* @__PURE__ */ Symbol("PaymentNote verification");
+var VerifiedPaymentNote = class {
+  #membership;
+  #checkedAt;
+  constructor(token, membership, checkedAt) {
+    if (token !== verification) throw new Error("Payment note verification required");
+    this.#membership = structuredClone(membership);
+    this.#checkedAt = structuredClone(checkedAt);
+  }
+  get membership() {
+    return structuredClone(this.#membership);
+  }
+  get checkedAt() {
+    return structuredClone(this.#checkedAt);
   }
-  static async fromBytes(key) {
-    if (key.length !== 32) throw new Error("wallet record encryption requires 32 key bytes");
-    const copy = Uint8Array.from(key);
-    try {
-      return _EncryptedWalletCodec.fromKey(
-        await crypto.subtle.importKey("raw", copy, { name: "AES-GCM" }, false, [
-          "encrypt",
-          "decrypt"
-        ])
-      );
-    } finally {
-      copy.fill(0);
-    }
+};
+var SpendablePaymentNote = class extends VerifiedPaymentNote {
+  #input;
+  #spendabilityCheckedAt;
+  constructor(token, input, membership, checkedAt, spendabilityCheckedAt) {
+    super(token, membership, checkedAt);
+    this.#input = structuredClone(input);
+    this.#spendabilityCheckedAt = structuredClone(spendabilityCheckedAt);
+    Object.freeze(this);
   }
-  aad(context) {
-    if (!Number.isSafeInteger(context.revision) || context.revision < 1)
-      throw new Error("invalid encrypted record revision");
-    return new TextEncoder().encode(
-      `Invisi.WalletRecord.v1\0${context.revision}\0${context.key}`
-    );
+  get spendabilityCheckedAt() {
+    return structuredClone(this.#spendabilityCheckedAt);
   }
-  async encode(state, context) {
-    const iv = crypto.getRandomValues(new Uint8Array(12)), plain = Uint8Array.from(serializeState(state));
-    try {
-      const encrypted = new Uint8Array(
-        await crypto.subtle.encrypt(
-          { name: "AES-GCM", iv, additionalData: this.aad(context) },
-          this.#key,
-          plain
-        )
-      );
-      const out = new Uint8Array(13 + encrypted.length);
-      out[0] = 1;
-      out.set(iv, 1);
-      out.set(encrypted, 13);
-      return out;
-    } finally {
-      plain.fill(0);
-    }
+  toInput() {
+    return structuredClone(this.#input);
   }
-  async decode(data, context) {
-    if (data.length < 29 || data[0] !== 1)
-      throw new Error("wallet record authentication failed");
-    let plain;
-    try {
-      plain = new Uint8Array(
-        await crypto.subtle.decrypt(
-          {
-            name: "AES-GCM",
-            iv: Uint8Array.from(data.subarray(1, 13)),
-            additionalData: this.aad(context)
-          },
-          this.#key,
-          Uint8Array.from(data.subarray(13))
-        )
-      );
-    } catch {
-      throw new Error("wallet record authentication failed");
-    }
-    try {
-      return deserializeState(plain);
-    } finally {
-      plain.fill(0);
-    }
+};
+var PaymentNote = class _PaymentNote {
+  chainId;
+  protocolAddress;
+  tokenAddress;
+  amount;
+  ownerAddress;
+  nonce;
+  commitment;
+  ipn;
+  constructor(data, ipn) {
+    this.chainId = data.chainId;
+    this.protocolAddress = data.protocolAddress;
+    this.tokenAddress = data.tokenAddress;
+    this.amount = data.amount;
+    this.ownerAddress = data.ownerAddress;
+    this.nonce = data.nonce;
+    this.commitment = data.commitment;
+    this.ipn = ipn;
+    Object.freeze(this);
   }
-  toJSON() {
-    return { walletRecordCodec: "AES-256-GCM" };
+  static async from(ipn) {
+    const data = decodePaymentNote(ipn);
+    const identity = await computeNoteIdentity(BigInt(data.ownerAddress), data.nonce);
+    const commitment = await computeNoteCommitment(
+      data.chainId,
+      identity,
+      BigInt(data.tokenAddress),
+      data.amount
+    );
+    if (commitment !== data.commitment) throw new Error("Payment note commitment mismatch");
+    return new _PaymentNote(data, encodePaymentNote(data));
+  }
+  async verify(protocol, options = {}) {
+    const result = await verifyPaymentNote(
+      this.data(),
+      protocol,
+      verificationOptions(protocol, options)
+    );
+    const verified = new VerifiedPaymentNote(verification, result.membership, result.checkedAt);
+    Object.freeze(verified);
+    return verified;
+  }
+  async verifySpendable(protocol, wallet, options = {}) {
+    if (!(wallet instanceof Wallet))
+      throw new Error("Wallet spending authorization capability required");
+    const result = await verifyPaymentNote(
+      this.data(),
+      protocol,
+      verificationOptions(protocol, options),
+      wallet
+    );
+    return new SpendablePaymentNote(
+      verification,
+      result.input,
+      result.membership,
+      result.checkedAt,
+      result.spendabilityCheckedAt
+    );
   }
-  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
-    return this.toJSON();
+  data() {
+    const { chainId, protocolAddress, tokenAddress, amount, ownerAddress, nonce, commitment } = this;
+    return { chainId, protocolAddress, tokenAddress, amount, ownerAddress, nonce, commitment };
   }
 };
 export {
   AddressRegistry,
+  BroadcasterClient,
+  BroadcasterRegistry,
+  BroadcasterRpcError,
   Detector,
   Disclosure,
   DisclosureVerifier,
-  EncryptedWalletCodec,
   Invisi,
   InvisiError,
   MAX_MEMO_BYTES,
-  MissingCapabilityError3 as MissingCapabilityError,
+  MAX_UPDATE_BLOCKS,
+  MissingCapabilityError,
+  NoteOutput,
   NullifierCapability,
-  Operation,
+  PaymentNote,
   PreparedTransaction,
   Protocol,
-  ProtocolRpcClient2 as ProtocolRpcClient,
+  ProtocolRpcClient,
   ProtocolRpcError,
-  PublicWallet2 as PublicWallet,
+  PublicWallet,
   RegistrationOperation,
+  SpendablePaymentNote,
+  TransactionOutput,
+  VerifiedPaymentNote,
   ViewingCapability,
-  Wallet,
+  Wallet2 as Wallet,
   WalletAuthorization,
-  WalletSession,
+  broadcasterQuoteDomain,
+  broadcasterQuoteTypes,
+  broadcasterRequestHash,
+  broadcasterTransactInterface,
   computeCreditNullifier,
   creditPeriods,
   creditV1,
+  decodeBroadcasterIntent,
   decodeDeliveryHeader,
   decodeMemoText,
+  decodePaymentNote,
+  decodePaymentRequest,
   decryptCandidates,
   defineGasBenchmarks,
   encodeMemo,
+  encodePaymentNote,
+  encodePaymentRequest,
   fundsV1,
   readProtocolLogs,
-  walletBalance
+  verifyBroadcasterQuote
 };
 //# sourceMappingURL=index.js.map