@kohaku-eth/tornado-cash 0.0.2-alpha.8 → 0.1.0-alpha.26

package/README.md

@@ -0,0 +1,12 @@
+# @kohaku-eth/tornado-cash
+
+> [!IMPORTANT]
+> THIS PACKAGE IS NOT READY FOR PRODUCTION USE AND CONTAINS UNAUDITED CODE. USE WITH CAUTION AND ENTIRELY AT YOUR OWN RISK. POSSIBILITY OF BREAKING CHANGES IN SUBSEQUENT VERSIONS.
+
+Cross-platform Tornado Cash Typescript SDK with support for kohaku's standard interfaces.
+
+## Installation
+
+```sh
+pnpm add @kohaku-eth/tornado-cash
+```

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 import { Broadcaster } from '@kohaku-eth/plugins/broadcaster';
-import { Host, ChainId, Storage, PrivateOperation, PublicOperation, AssetAmount, ERC20AssetId, PluginInstance, AccountId } from '@kohaku-eth/plugins';
-import { combineReducers } from '@reduxjs/toolkit';
-import { ParseAbiItem, SignedAuthorization, Hash, Address as Address$2 } from 'viem';
+import { Host, ExternalRawEvent, ChainId, Storage, PrivateOperation, PublicOperation, AccountId, AssetAmount, ERC20AssetId, PluginInstance, UnshieldOptions, Keystore } from '@kohaku-eth/plugins';
 import { TxData } from '@kohaku-eth/provider';
+import { combineReducers } from '@reduxjs/toolkit';
+import { ParseAbiItem, SignedAuthorization, Hash, TypedDataDomain, Hex as Hex$1, Address as Address$2 } from 'viem';
 import { Address as Address$1 } from 'ox/Address';
+import { Hex } from 'ox/Hex';
 
 type Nullifier$1 = bigint & {};
 type NullifierHash = bigint & {};
@@ -29,50 +30,47 @@ type BaseDeriveSecretParams = {
 type DeriveDepositSecretParams = BaseDeriveSecretParams & {
     depositIndex: number;
 };
-interface ISecretManager {
-    getDepositSecrets: (params: DeriveDepositSecretParams) => Promise<Secret>;
+/** Global nonce plus the pool mixed in after the signature. */
+type SignatureDeriveParams = BaseDeriveSecretParams & {
+    nonce: number;
+};
+/** BIP-32 HD derivation. Still scanned so notes created before signature
+ * secrets remain spendable. New deposits use {@link SignatureDeriveParams}. */
+interface LegacySecretManager {
+    getLegacyDepositSecrets: (params: DeriveDepositSecretParams) => Promise<Secret>;
     deriveEphemeralSigner: (params: DeriveDepositSecretParams) => Promise<`0x${string}`>;
+    /**
+     * Derives a delegator key from a classical wallet BIP-32 `path`, WITHOUT the
+     * `coalesceSecret` privacy transform, so it resolves to a recoverable,
+     * classical Ethereum address. Used for the tail-call batch delegator when the
+     * integrator supplies a wallet path (see `paymasterWithdrawThunk`).
+     */
+    deriveDelegatorSigner: (params: {
+        path: string;
+    }) => Promise<`0x${string}`>;
+    /**
+     * Derives the ephemeral signer for an imported legacy note. Legacy secrets
+     * have no keystore-derived `depositIndex`, so this is a pure function of
+     * the note's own nullifier instead of a BIP-32 derivation.
+     */
+    deriveLegacyEphemeralSigner: (params: {
+        nullifier: Nullifier$1;
+    }) => Promise<`0x${string}`>;
+}
+interface ISecretManager extends LegacySecretManager {
+    getSignatureSecrets: (params: SignatureDeriveParams) => Promise<Secret>;
+    deriveSignatureEphemeralSigner: (params: SignatureDeriveParams) => Promise<`0x${string}`>;
 }
 interface SecretManagerParams {
     host: Pick<Host, 'keystore'>;
     accountIndex?: number;
 }
-declare function SecretManager({ host: { keystore }, accountIndex }: SecretManagerParams): Promise<ISecretManager>;
-
-interface IRelayerStatusResponse {
-    currentQueue: number;
-    netId: number;
-    rewardAccount: string;
-    version: string;
-    tornadoServiceFee: number;
-    ethPrices: Record<string, string>;
-}
-interface ITornadoWithdrawRequest {
-    proof: `0x${string}`;
-    args: [`0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`];
-    contract: `0x${string}`;
-}
-interface ITornadoWithdrawResponse {
-    id: string;
-}
-interface IRelayerClient {
-    getStatus(hostname: string): Promise<IRelayerStatusResponse>;
-    withdraw(relayerUrl: string, body: ITornadoWithdrawRequest): Promise<ITornadoWithdrawResponse>;
-}
-
-interface InstanceRegistryConfig extends IScrapeableContract {
-    lastDeployedOnBlock?: bigint;
-}
-interface ProtocolConfigState {
-    chainId: bigint;
-    ensSubdomainKey: string;
-    instanceRegistry: InstanceRegistryConfig;
-    relayerRegistry: IScrapeableContract;
-    aggregator: IContract;
-}
-
-type RootState = ReturnType<ReturnType<typeof combineReducers<typeof reducers>>>;
-type PublicRootState = Omit<RootState, 'userSecrets'>;
+/**
+ * @deprecated Legacy BIP-32 HD secret derivation. New deposits use
+ * {@link SignatureSecretManager}. Kept so notes created under this scheme are
+ * still discovered; the protocol default composes both.
+ */
+declare function SecretManager({ host: { keystore }, accountIndex }: SecretManagerParams): Promise<LegacySecretManager>;
 
 interface IBaseEvent {
     blockNumber: bigint;
@@ -86,6 +84,17 @@ interface IDepositEvent extends IPoolEvent {
     leafIndex: number;
     timestamp: bigint;
 }
+interface IIndexedDepositEvent extends IDepositEvent {
+    index: number;
+    /** Signature-scheme nonce. Set only for signature-derived notes. */
+    nonce?: number;
+}
+interface IDepositWithAsset extends IIndexedDepositEvent {
+    assetAddress: Address;
+}
+interface IDepositWithBalance extends IDepositWithAsset {
+    balance: bigint;
+}
 interface IWithdrawalEvent extends IPoolEvent {
     to: Address;
     nullifierHash: NullifierHash;
@@ -111,6 +120,42 @@ interface IAsset {
     symbol: string;
 }
 
+interface IRelayerStatusResponse {
+    currentQueue: number;
+    netId: number;
+    rewardAccount: string;
+    version: string;
+    tornadoServiceFee: number;
+    ethPrices: Record<string, string>;
+}
+interface ITornadoWithdrawRequest {
+    proof: `0x${string}`;
+    args: [`0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`, `0x${string}`];
+    contract: `0x${string}`;
+}
+interface ITornadoWithdrawResponse {
+    id: string;
+}
+interface IRelayerClient {
+    getStatus(hostname: string): Promise<IRelayerStatusResponse>;
+    withdraw(relayerUrl: string, body: ITornadoWithdrawRequest): Promise<ITornadoWithdrawResponse>;
+}
+
+interface InstanceRegistryConfig extends IScrapeableContract {
+    lastDeployedOnBlock?: bigint;
+}
+interface ProtocolConfigState {
+    chainId: bigint;
+    ensSubdomainKey: string;
+    instanceRegistry: InstanceRegistryConfig;
+    relayerRegistry: IScrapeableContract;
+    aggregator: IContract;
+}
+
+type RootState = ReturnType<ReturnType<typeof combineReducers<typeof reducers>>>;
+/** HD and signature secrets are re-derived on sync, so they stay out of snapshots. */
+type PublicRootState = Omit<RootState, 'userSecrets' | 'signatureSecrets'>;
+
 declare const POOL_EVENTS_SIGNATURES: {
     readonly Deposited: {
         readonly name: "Deposit";
@@ -181,7 +226,7 @@ declare const INSTANCE_REGISTRY_EVENT_SIGNATURES: {
 };
 
 type IEventsMap = Record<string, ParseAbiItem<string>>;
-interface IGetEventsParams<T> {
+interface IGetEventsParams$1<T> {
     events: T | T[];
     fromBlock: bigint;
     toBlock?: bigint;
@@ -202,7 +247,7 @@ type IGroupedEvents<NamesTable extends Record<string, unknown>> = {
 };
 type GetEventsFn<EventsMap extends IEventsMap, ParsedEvents extends {
     [key in keyof EventsMap]: unknown;
-}> = <const T extends keyof ParsedEvents = never>(params: IGetEventsParams<T>) => Promise<Pick<IGroupedEvents<ParsedEvents>, T> & {
+}> = <const T extends keyof ParsedEvents = never>(params: IGetEventsParams$1<T>) => Promise<Pick<IGroupedEvents<ParsedEvents>, T> & {
     fromBlock: bigint;
     toBlock: bigint;
 }>;
@@ -211,7 +256,6 @@ interface IPoolConfig {
     isERC20: boolean;
     token: Address;
     state: 0 | 1;
-    uniswapPoolSwappingFee: number;
     protocolFeePercentage: number;
     denomination: bigint;
     rootHistorySize: number;
@@ -224,6 +268,14 @@ interface IRelayerAggregatorData {
 }
 interface IDataService {
     getPoolEvents: GetEventsFn<typeof POOL_EVENTS_SIGNATURES, IPoolEvents>;
+    getBlockNumber(): Promise<bigint>;
+    parsePoolEvents(events: ExternalRawEvent[]): {
+        Deposited: IRawDepositEvent[];
+        Withdrawn: IRawWithdrawalEvent[];
+    };
+    parseRelayerRegistryEvents(events: ExternalRawEvent[]): {
+        RelayerRegistered: IRelayerRegisteredEvent[];
+    };
     getRelayerRegistryEvents: GetEventsFn<typeof RELAYER_REGISTRY_EVENTS_SIGNATURES, IRelayerRegistryEvents>;
     getInstanceRegistryEvents: GetEventsFn<typeof INSTANCE_REGISTRY_EVENT_SIGNATURES, IInstanceRegistryEvents>;
     getAsset(assetAddress: Address): Promise<IAsset>;
@@ -240,7 +292,47 @@ interface IDataService {
     getLatestBlockTimestamp(): Promise<bigint>;
     getRelayerData(aggregatorAddress: Address, relayerNameHashes: bigint[], subdomains: string[]): Promise<IRelayerAggregatorData[]>;
     getAccountNonce(accountAddress: Address): Promise<number>;
-    quoteEthToToken(amountInWei: bigint, tokenAddress: Address, poolFee: number): Promise<bigint>;
+    quoteWeiInToken(paymasterAddress: Address, feeToken: Address, weiAmount: bigint): Promise<bigint>;
+}
+
+/** Identifies one contract to sync from a given block. */
+interface IGetEventsParams {
+    chainId: bigint;
+    address: Address;
+    fromBlock: bigint;
+}
+interface IGetPoolEventsResult {
+    Deposited: IRawDepositEvent[];
+    Withdrawn: IRawWithdrawalEvent[];
+    /** Highest block the returned events are synced up to. */
+    toBlock: bigint;
+}
+interface IGetRelayerRegistryEventsResult {
+    RelayerRegistered: IRelayerRegisteredEvent[];
+    /** Highest block the returned events are synced up to. */
+    toBlock: bigint;
+}
+interface ISyncService {
+    /**
+     * Fetches a single pool's `Deposited`/`Withdrawn` events from `fromBlock`.
+     * Uses the external sync provider for the bulk of a large range and the chain
+     * for the remaining tail; falls back to a chain-only fetch otherwise.
+     */
+    getPoolEvents(params: IGetEventsParams): Promise<IGetPoolEventsResult>;
+    /**
+     * Fetches the relayer registry's `RelayerRegistered` events from `fromBlock`,
+     * with the same external-then-chain strategy as {@link getPoolEvents}.
+     */
+    getRelayerRegistryEvents(params: IGetEventsParams): Promise<IGetRelayerRegistryEventsResult>;
+    /**
+     * Resolves a pool's scan-start block. Uses the external provider's first
+     * covered block when available (an O(1) lookup), else falls back to the
+     * on-chain deployment-block binary search.
+     */
+    getPoolDeploymentBlock(params: {
+        chainId: bigint;
+        address: Address;
+    }): Promise<bigint>;
 }
 
 type SpecificAssetBalanceFn<isAsync extends boolean = false> = <const Adresses extends Address | Address[] = Address[], ReturnType = Adresses extends unknown[] ? Map<Address, bigint> : bigint>(assetAddress?: Adresses) => isAsync extends true ? Promise<ReturnType> : ReturnType;
@@ -280,6 +372,7 @@ interface IRelayerFeeConfig {
 interface StoreFactoryParams {
     secretManagerFactory: () => Promise<ISecretManager>;
     dataService: IDataService;
+    syncService: ISyncService;
     relayerClient: IRelayerClient;
     paymasterConfig: IChainsPaymastersConfig;
     storageToSyncTo?: Storage;
@@ -294,6 +387,66 @@ declare enum DepositStrategy {
     MinFee = 1
 }
 
+type ImportNoteResult = {
+    note: string;
+    status: 'imported';
+    poolAddress: Address;
+} | {
+    note: string;
+    status: 'wrong-chain';
+} | {
+    note: string;
+    status: 'not-found';
+};
+
+/**
+ * How the batch delegator for a tail-call paymaster withdrawal is produced.
+ * Only honored when `tailCalls` are present (see `paymasterWithdrawThunk`).
+ *
+ * - `deterministic` (default): recoverable. With `path`, the delegator is a
+ *   classical wallet-path address; without `path`, an ephemeral address keyed by
+ *   the batch's first deposit.
+ * - `random`: a throwaway, unrecoverable EOA — an explicit opt-out of
+ *   recoverability. Never the default, because in the tail-call path the
+ *   delegator holds the withdrawn funds.
+ */
+type DelegationConfig = {
+    mode: 'deterministic';
+    path?: string;
+} | {
+    mode: 'random';
+};
+
+interface SerializedAuth {
+    address: Address$1;
+    chainId: Hex;
+    nonce: Hex;
+    r: Hex;
+    s: Hex;
+    yParity: Hex;
+}
+/**
+ * A userOp serialized to the hex shape expected by `eth_sendUserOperation`, so
+ * it can be carried as plain (JSON-serializable) data from the prepare phase
+ * (thunk) to the broadcast phase.
+ */
+interface SerializedUserOperation {
+    sender: `0x${string}`;
+    nonce: `0x${string}`;
+    callData: `0x${string}`;
+    callGasLimit: `0x${string}`;
+    verificationGasLimit: `0x${string}`;
+    preVerificationGas: `0x${string}`;
+    maxFeePerGas: `0x${string}`;
+    maxPriorityFeePerGas: `0x${string}`;
+    paymaster?: `0x${string}`;
+    paymasterVerificationGasLimit?: `0x${string}`;
+    paymasterPostOpGasLimit?: `0x${string}`;
+    paymasterData?: `0x${string}`;
+    signature: `0x${string}`;
+    eip7702Auth?: SerializedAuth;
+}
+
 interface SignedDelegation {
     senderAddress: `0x${string}`;
     authorization: SignedAuthorization;
@@ -305,6 +458,16 @@ interface IPaymasterWithdrawalPayload {
     isERC20: boolean;
     delegation?: SignedDelegation;
 }
+interface IGenericPaymasterWithdrawalPayload {
+    mode: 'paymaster';
+    proof: TornadoProveOutput;
+    poolAddress: Address;
+    isERC20: boolean;
+    paymasterAddress: `0x${string}`;
+    entryPointAddress: `0x${string}`;
+    bundlerUrl: string;
+    userOperation: SerializedUserOperation;
+}
 interface PaymasterBroadcastResult {
     userOpHash: Hash;
 }
@@ -312,12 +475,6 @@ interface IPaymasterBroadcasterClient {
     broadcast(withdrawals: IPaymasterWithdrawalPayload[]): Promise<PaymasterBroadcastResult[]>;
 }
 
-type DelegationConfig = {
-    mode: 'deterministic';
-    path?: string;
-} | {
-    mode: 'random';
-};
 type StringAddress = `0x${string}`;
 interface IPaymasterConfig {
     paymasterAddress: StringAddress;
@@ -332,7 +489,7 @@ interface IRelayerWithdrawalPayload {
     poolAddress: Address;
     relayerUrl: string;
 }
-type IWithdrawalPayload = IRelayerWithdrawalPayload | IPaymasterWithdrawalPayload;
+type IWithdrawalPayload = IRelayerWithdrawalPayload | IGenericPaymasterWithdrawalPayload;
 interface TCPrivateOperation<Mode extends IWithdrawalPayload['mode'] = 'relayer' | 'paymaster'> extends PrivateOperation {
     withdrawals: (IWithdrawalPayload & {
         mode: Mode;
@@ -346,7 +503,7 @@ interface ITornadoArtifacts {
     provingKey: ArrayBuffer;
 }
 type TCProtocolConfig = Omit<ProtocolConfigState, 'chainId'>;
-interface PrivacyPoolsV1ProtocolParams {
+interface TCProtocolParams {
     accountIndex?: number;
     paymasterConfig: IChainsPaymastersConfig;
     secretManagerFactory: (params: SecretManagerParams) => Promise<ISecretManager>;
@@ -355,9 +512,14 @@ interface PrivacyPoolsV1ProtocolParams {
     protocolConfig: TCProtocolConfig;
     relayerConfig?: IRelayerFeeConfig;
     artifactsLoader?: () => Promise<ITornadoArtifacts>;
-    proverFactory?: () => Promise<ITornadoProver>;
     initialState?: () => Promise<Record<string, PublicRootState>>;
     stateManagerWorkerUrl?: string;
+    /**
+     * When a pool is at least this many blocks behind, use the host's
+     * `externalSyncProvider` (if any) for the bulk of the sync instead of the
+     * chain. Omit to always sync from the chain.
+     */
+    minExternalSyncBlocksAmount?: number;
 }
 interface IBaseOperationParams {
 }
@@ -377,8 +539,27 @@ interface IRelayerWithdrawParams extends IWithdrawBaseParams {
 interface IPaymasterWithdrawParams extends IWithdrawBaseParams {
     mode: 'paymaster';
     delegation?: DelegationConfig;
+    tailCalls?: (address: AccountId) => Promise<TxData[]>;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used when bundler estimation fails;
+     * when estimation succeeds the bundler estimate still wins.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type IWithdrawapOperationParams = IRelayerWithdrawParams | IPaymasterWithdrawParams;
+interface IGetNotesParams extends IBaseOperationParams {
+    includeSpent?: boolean;
+    assets?: Address[];
+}
+type TCNote = Pick<IDepositWithBalance, 'commitment' | 'balance' | 'assetAddress' | 'timestamp' | 'leafIndex' | 'pool'> & {
+    /** Fixed pool denomination for this note. */
+    amount: bigint;
+    /** HD deposit index, or -1 for imported and signature-derived notes. */
+    depositIndex: number;
+    /** Global signature-scheme nonce. Present only for signature-derived notes. */
+    nonce?: number;
+};
 type StoreKey = `${string}-${string}`;
 type StoreStorageKey = `tornado-cash-state-${StoreKey}`;
 interface IStateManager {
@@ -399,6 +580,20 @@ interface IStateManager {
      * All assets if not specified.
      */
     getBalances: SpecificAssetBalanceFn<true>;
+    /**
+     * Gets all notes for the account.
+     * @param includeSpent - If true, include notes with zero balance
+     * @param assets - Optional filter by specific assets
+     */
+    getNotes: (params: IGetNotesParams) => Promise<TCNote[]>;
+    /**
+     * Parses legacy (pre-SDK) Tornado Cash note strings and, for any that match
+     * a synced on-chain deposit on the current chain, registers them as
+     * importable user secrets.
+     */
+    importNotes: (params: {
+        notes: string[];
+    }) => Promise<ImportNoteResult[]>;
     dumpState: () => Record<StoreStorageKey, PublicRootState>;
 }
 
@@ -411,23 +606,30 @@ type TCBroadcaster = Broadcaster<TCPrivateOperation, ITornadoWithdrawResponse[]>
 interface TCBaseCredential {
     accountIndex: number;
 }
-interface TCPluginParameters extends TCBroadcasterParameters, TCBaseCredential {
+interface TCPluginParameters extends TCBroadcasterParameters, TCBaseCredential, Pick<TCProtocolParams, 'initialState' | 'minExternalSyncBlocksAmount'> {
+    secretManagerFactory?: TCProtocolParams['secretManagerFactory'];
     protocolConfig: TCProtocolConfig;
     relayerConfig?: IRelayerFeeConfig;
-    initialState?: PrivacyPoolsV1ProtocolParams['initialState'];
-    artifacts: ITornadoArtifacts;
     stateManagerWorkerUrl?: string;
+    artifactsLoader?: () => Promise<ITornadoArtifacts>;
 }
 type TCAddress = Address$1;
 type TCAssetAmount<Tag extends string | undefined = undefined> = AssetAmount<ERC20AssetId, bigint, Tag>;
 type TCAssetBalance = TCAssetAmount;
-interface TCRelayerUnshieldOptions {
+interface TCRelayerUnshieldOptions extends UnshieldOptions {
     mode: 'relayer';
     preferredRelayersEns?: string[];
 }
-interface TCPaymasterUnshieldOptions {
+interface TCPaymasterUnshieldOptions extends UnshieldOptions {
     mode: 'paymaster';
     delegation?: DelegationConfig;
+    /**
+     * Optional baseline for the execution-phase gas of user `tailCalls` (not
+     * including per-note direct withdraws). Used as the batch execution-tail
+     * baseline when bundler estimation fails; when estimation succeeds the
+     * bundler estimate still wins. Defaults to the SDK's static callGasLimit.
+     */
+    tailCallsGasEstimate?: bigint;
 }
 type TCPrepareUnshieldOptions = TCRelayerUnshieldOptions | TCPaymasterUnshieldOptions;
 interface TCPrepareShieldOptions {
@@ -444,11 +646,13 @@ type TCInstance = PluginInstance<TCAddress, {
         output: TCAssetAmount;
         read: TCAssetBalance;
     };
+    note: TCNote;
     extras: {
         sync(): Promise<void>;
         prepareShield(asset: TCAssetAmount, options: TCPrepareShieldOptions): Promise<TCPublicOperation>;
         prepareUnshield(asset: TCAssetAmount, to: Address$1, options: TCRelayerUnshieldOptions): Promise<TCPrivateOperation<'relayer'>>;
         prepareUnshield(asset: TCAssetAmount, to: Address$1, options: TCPaymasterUnshieldOptions): Promise<TCPrivateOperation<'paymaster'>>;
+        importNotes(notes: string | string[]): Promise<ImportNoteResult[]>;
     };
     publicOp: TCPublicOperation;
     privateOp: TCPrivateOperation;
@@ -461,7 +665,7 @@ type RequireOnly<T, Keys extends keyof T> = Partial<T> & Pick<T, Keys>;
 declare class TornadoCashProtocol implements TCInstance {
     readonly host: Host;
     private stateManager;
-    constructor(host: Host, { accountIndex, initialState, protocolConfig, artifactsLoader, stateManagerWorkerUrl, relayerConfig, paymasterConfig, relayerClientFactory }: RequireOnly<PrivacyPoolsV1ProtocolParams, 'protocolConfig'>);
+    constructor(host: Host, { accountIndex, initialState, protocolConfig, artifactsLoader, stateManagerWorkerUrl, relayerConfig, paymasterConfig, relayerClientFactory, minExternalSyncBlocksAmount, secretManagerFactory, }: RequireOnly<TCProtocolParams, 'protocolConfig'>);
     instanceId: () => Promise<"0x1">;
     /**
      * Only process supported assets or error out?
@@ -469,13 +673,57 @@ declare class TornadoCashProtocol implements TCInstance {
      * The assets retain the provided order. If an asset is not supported its balance will be 0
      */
     balance(assets?: ERC20AssetId[]): Promise<TCAssetBalance[]>;
+    /**
+     * Returns all notes for the account.
+     * @param assets - Filter by specific assets (optional, if empty returns all)
+     * @param includeSpent - Include notes with zero balance (default: false)
+     */
+    notes(assets?: ERC20AssetId[], includeSpent?: boolean): Promise<TCNote[]>;
+    /**
+     * Parses legacy (pre-SDK) Tornado Cash note strings and registers any that
+     * match a synced on-chain deposit on the current chain as user secrets.
+     */
+    importNotes(notes: string | string[]): Promise<ImportNoteResult[]>;
     prepareShield(assets: TCAssetAmount, options?: TCPrepareShieldOptions | `0x${string}`): Promise<TCPublicOperation>;
+    prepareUnshield(assets: AssetAmount, to: AccountId): Promise<TCPrivateOperation<'relayer'>>;
     prepareUnshield(assets: AssetAmount, to: AccountId, options?: TCRelayerUnshieldOptions): Promise<TCPrivateOperation<'relayer'>>;
     prepareUnshield(assets: AssetAmount, to: AccountId, options?: TCPaymasterUnshieldOptions): Promise<TCPrivateOperation<'paymaster'>>;
     sync(): Promise<void>;
     dumpState(): Promise<Record<`tornado-cash-state-${string}-${string}`, PublicRootState>>;
 }
 
+declare const NOTE_TYPES: {
+    readonly TornadoCashNote: readonly [{
+        readonly name: "nonce";
+        readonly type: "uint64";
+    }];
+};
+interface NoteEnvelope {
+    domain: TypedDataDomain;
+    types: typeof NOTE_TYPES;
+    primaryType: 'TornadoCashNote';
+    message: {
+        nonce: bigint;
+    };
+}
+interface EnvelopeSigner {
+    signEnvelope(envelope: NoteEnvelope): Promise<Hex$1>;
+}
+declare class KeystoreEnvelopeSigner implements EnvelopeSigner {
+    private readonly keystore;
+    private readonly accountIndex;
+    constructor(keystore: Keystore, accountIndex: number);
+    signEnvelope(envelope: NoteEnvelope): Promise<Hex$1>;
+}
+interface SignatureSecretManagerParams extends SecretManagerParams {
+    signer?: EnvelopeSigner;
+}
+interface SignatureSecretSource {
+    getSignatureSecrets: (params: SignatureDeriveParams) => Promise<Secret>;
+    deriveSignatureEphemeralSigner: (params: SignatureDeriveParams) => Promise<`0x${string}`>;
+}
+declare function SignatureSecretManager({ host, accountIndex, signer, }: SignatureSecretManagerParams): Promise<SignatureSecretSource>;
+
 interface Commitment {
     hash: string;
     token: Address$2;
@@ -490,6 +738,40 @@ interface Nullifier {
 }
 
 declare const E_ADDRESS = "0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee";
+declare const TornadoPaymasterConfigs: {
+    readonly 11155111: {
+        readonly bundlerUrl: "https://public.pimlico.io/v2/11155111/rpc";
+        readonly entryPointAddress: "0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108";
+        readonly paymasterAddress: "0x1c5aCCb9c09D72945b79EC986776136bE01d7B2F";
+        readonly poolsAccountsMap: {
+            readonly '0x8c4a04d872a6c1be37964a21ba3a138525dff50b': "0xa616aAE443FCCABfc2F1EA2Afe001E5046FFDCe0";
+            readonly '0x8cc930096b4df705a007c4a039bdfa1320ed2508': "0x67a898343F32641206d0f30CB3367944a8919A3A";
+            readonly '0x6921fd1a97441dd603a997ed6ddf388658daf754': "0xbF0a7969dacF8337716d0F283df0574dF56b0479";
+        };
+    };
+    readonly 1: {
+        readonly bundlerUrl: "https://public.pimlico.io/v2/1/rpc";
+        readonly entryPointAddress: "0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108";
+        readonly paymasterAddress: "0xe06CB96C57D2442f8F60F5017354BC08F7e91308";
+        readonly poolsAccountsMap: {
+            readonly '0x12d66f87a04a9e220743712ce6d9bb1b5616b8fc': "0x4a3F73a23563bB467Aa034d0fAB61e7BcDf26161";
+            readonly '0x47ce0c6ed5b0ce3d3a51fdb1c52dc66a7c3c2936': "0xC086b50Dd859Bb15D553327178DEdbC347B5b905";
+            readonly '0x910cbd523d972eb0a6f4cae4618ad62622b39dbf': "0x08d1103bff53CBdC9DB1e81B79475CEad2e35870";
+            readonly '0xa160cdab225685da1d56aa342ad8841c3b53f291': "0x3aF851f9BeEeE6E9fa06022f34Dc4C453D265aE5";
+            readonly '0xd4b88df4d29f5cedd6857912842cff3b20c8cfa3': "0xe6be288aeCa9FAB56D9792686Ec571Fb1AF37F55";
+            readonly '0xfd8610d20aa15b7b2e3be39b396a1bc3516c7144': "0xf6f35246EbDA061bB17b6C7ED7B7049065eD61f3";
+            readonly '0x07687e702b410Fa43f4cB4Af7FA097918ffD2730': "0x36A5b4bCE77700B9C52cFEE53Fc8cA3B58eb7E35";
+            readonly '0x23773e65ed146a459791799d01336db287f25334': "0x83Ff713F0939409E1c6023bc8aaB3E49eD968c8D";
+            readonly '0x4736dcf1b7a3d580672cce6e7c65cd5cc9cfba9d': "0xB1C7e712AF153073979AdC5ef8B1Cc5A7b0cf031";
+            readonly '0xd96f2b1c14db8458374d9aca76e26c3d18364307': "0x44336242f9766b4c751F6958499C5cc18325e25B";
+            readonly '0x169ad27a470d064dede56a2d3ff727986b15d52b': "0xF006862cCa4829D3f3ddD52d93fC49C03D380a5F";
+            readonly '0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f': "0x5DF524b6c9303eD94A7767c2eD787ee223c9bC54";
+            readonly '0x178169b423a011fff22b9e3f3abea13414ddd0f1': "0x0fdF2f686B600523F9752aEca0abb6AD9603A22C";
+            readonly '0x610b717796ad172b316836ac95a2ffad065ceab4': "0xec3Cca694EEe55808B3f5EFEDd0bC03E52e47834";
+            readonly '0xbb93e510bbcd0b7beb5a853875f9ec60275cf498': "0xC2C427E6ADF66F412921C17958CeDD9C7710F521";
+        };
+    };
+};
 declare const TornadoCashConfigs: {
     readonly 1: {
         readonly ensSubdomainKey: "mainnet-tornado";
@@ -505,7 +787,6 @@ declare const TornadoCashConfigs: {
             readonly address: 1329937909414098670091808248270266272594403334985n;
         };
         readonly weth: 1097077688018008265106216665536940668749033598146n;
-        readonly uniswapQuoterV2: 559478315000592720989748010348495519536007655966n;
     };
     readonly 11155111: {
         readonly ensSubdomainKey: "sepolia-tornado";
@@ -521,8 +802,7 @@ declare const TornadoCashConfigs: {
             readonly address: 368418168928372787409224158240737522620871644738n;
         };
         readonly weth: 1461358721292675304620367034492138750323989506836n;
-        readonly uniswapQuoterV2: 1353730886217084326490181093487957540173111046067n;
     };
 };
 
-export { type Commitment, DepositStrategy, E_ADDRESS, type ISecretManager, type Nullifier, SecretManager, type SecretManagerParams, type TCAddress, type TCAssetAmount, type TCAssetBalance, type TCBroadcaster, type TCBroadcasterParameters, type TCInstance, type TCPaymasterUnshieldOptions, type TCPluginParameters, type TCPrepareShieldOptions, type TCPrepareUnshieldOptions, type TCRelayerUnshieldOptions, TornadoCashConfigs, TornadoCashProtocol, createTCBroadcaster, createTCPlugin };
+export { type Commitment, DepositStrategy, E_ADDRESS, type EnvelopeSigner, type ISecretManager, type ImportNoteResult, KeystoreEnvelopeSigner, type LegacySecretManager, type NoteEnvelope, type Nullifier, SecretManager, type SecretManagerParams, SignatureSecretManager, type SignatureSecretManagerParams, type TCAddress, type TCAssetAmount, type TCAssetBalance, type TCBroadcaster, type TCBroadcasterParameters, type TCInstance, type TCNote, type TCPaymasterUnshieldOptions, type TCPluginParameters, type TCPrepareShieldOptions, type TCPrepareUnshieldOptions, type TCRelayerUnshieldOptions, TornadoCashConfigs, TornadoCashProtocol, TornadoPaymasterConfigs, createTCBroadcaster, createTCPlugin };