@lethenymous/sdk 0.0.0-stage → 0.1.0

package/dist/instructions.js

@@ -0,0 +1,78 @@
+import { PublicKey, SYSVAR_RENT_PUBKEY, SystemProgram, TransactionInstruction, } from "@solana/web3.js";
+import { TOKEN_PROGRAM_ID, PROGRAM_ID, discriminator, concat, u16, u64, vec, bytes32, enumByte } from "./encoding.js";
+import { pda } from "./pda.js";
+const meta = (pubkey, isSigner = false, isWritable = false) => ({ pubkey, isSigner, isWritable });
+const ro = (key) => meta(key);
+const rw = (key) => meta(key, false, true);
+const signer = (key) => meta(key, true, true);
+function ix(name, args, accounts, programId) {
+    return new TransactionInstruction({ programId, keys: accounts, data: concat(discriminator(name), args) });
+}
+export function initializePool(payer, authority, creator, a, b, feeBps, programId = PROGRAM_ID) {
+    if (Buffer.compare(a.toBuffer(), b.toBuffer()) >= 0)
+        throw new Error("Mints must be ordered");
+    const [pool] = pda.pool(a, b, feeBps, programId);
+    return ix("initialize_pool", u16(feeBps), [
+        signer(payer), signer(authority), ro(creator), ro(a), ro(b), rw(pool),
+        rw(pda.vaultA(pool, programId)[0]), rw(pda.vaultB(pool, programId)[0]),
+        rw(pda.protocolFeeA(pool, programId)[0]), rw(pda.protocolFeeB(pool, programId)[0]),
+        rw(pda.creatorFeeA(pool, programId)[0]), rw(pda.creatorFeeB(pool, programId)[0]),
+        rw(pda.lpMint(pool, programId)[0]), rw(pda.lpLock(pool, programId)[0]),
+        ro(TOKEN_PROGRAM_ID), ro(SystemProgram.programId), ro(SYSVAR_RENT_PUBKEY),
+    ], programId);
+}
+export function initializeShieldedState(payer, pool, state, programId = PROGRAM_ID) {
+    const s = state ?? { tokenAMint: PublicKey.default, tokenBMint: PublicKey.default };
+    return ix("initialize_shielded_state", Buffer.alloc(0), [
+        signer(payer), ro(pool), ro(s.tokenAMint), ro(s.tokenBMint),
+        rw(pda.shielded(pool, programId)[0]), rw(pda.tree(pool, programId)[0]),
+        rw(pda.custodyA(pool, programId)[0]), rw(pda.custodyB(pool, programId)[0]),
+        ro(TOKEN_PROGRAM_ID), ro(SystemProgram.programId), ro(SYSVAR_RENT_PUBKEY),
+    ], programId);
+}
+export function addLiquidity(provider, pool, providerA, providerB, providerLp, a, b, minLp, programId = PROGRAM_ID) {
+    return ix("add_liquidity", concat(u64(a), u64(b), u64(minLp)), [
+        signer(provider), rw(pool.address), ro(pool.tokenAMint), ro(pool.tokenBMint),
+        rw(pool.tokenAVault), rw(pool.tokenBVault), rw(pool.lpMint), rw(pda.lpLock(pool.address, programId)[0]),
+        rw(providerA), rw(providerB), rw(providerLp), ro(TOKEN_PROGRAM_ID),
+    ], programId);
+}
+export function shield(depositor, pool, state, asset, amount, owner, randomness, encrypted, depositorA, depositorB, programId = PROGRAM_ID) {
+    return ix("shield", concat(enumByte(asset), u64(amount), bytes32(owner), bytes32(randomness), vec(encrypted)), [
+        signer(depositor), ro(pool.address), rw(pda.shielded(pool.address, programId)[0]), rw(state.tree),
+        ro(pool.tokenAMint), ro(pool.tokenBMint), rw(state.custodyA), rw(state.custodyB),
+        rw(depositorA), rw(depositorB), ro(TOKEN_PROGRAM_ID),
+    ], programId);
+}
+export function removeLiquidity(provider, pool, providerA, providerB, providerLp, lpAmount, minA, minB, programId = PROGRAM_ID) {
+    return ix("remove_liquidity", concat(u64(lpAmount), u64(minA), u64(minB)), [
+        signer(provider), rw(pool.address), ro(pool.tokenAMint), ro(pool.tokenBMint),
+        rw(pool.tokenAVault), rw(pool.tokenBVault), rw(pool.lpMint), rw(providerA), rw(providerB),
+        rw(providerLp), ro(TOKEN_PROGRAM_ID),
+    ], programId);
+}
+export function swap(trader, pool, traderA, traderB, direction, amountIn, minAmountOut, programId = PROGRAM_ID) {
+    return ix("swap", concat(enumByte(direction), u64(amountIn), u64(minAmountOut)), [
+        signer(trader), rw(pool.address), ro(pool.tokenAMint), ro(pool.tokenBMint),
+        rw(pool.tokenAVault), rw(pool.tokenBVault), ro(pool.lpMint),
+        rw(pool.protocolFeeVaultA), rw(pool.protocolFeeVaultB), rw(pool.creatorFeeVaultA), rw(pool.creatorFeeVaultB),
+        rw(traderA), rw(traderB), ro(TOKEN_PROGRAM_ID),
+    ], programId);
+}
+export function unshield(payer, pool, state, asset, amount, root, rootSequence, generation, nullifierValue, recipient, recipientA, recipientB, proof, publicInputs, programId = PROGRAM_ID) {
+    return ix("unshield", concat(enumByte(asset), bytes32(root), u64(rootSequence), u64(generation), u64(amount), bytes32(nullifierValue), vec(proof), vec(publicInputs)), [
+        signer(payer), ro(pool.address), rw(pda.shielded(pool.address, programId)[0]), rw(state.tree),
+        ro(pool.tokenAMint), ro(pool.tokenBMint), rw(state.custodyA), rw(state.custodyB), ro(recipient),
+        rw(recipientA), rw(recipientB), rw(pda.spent(pool.address, nullifierValue, programId)[0]),
+        ro(TOKEN_PROGRAM_ID), ro(SystemProgram.programId),
+    ], programId);
+}
+export function privateSwap(payer, pool, state, direction, root, rootSequence, generation, nullifierValue, amountIn, amountOut, changeAmount, changeCommitment, outputCommitment, proof, programId = PROGRAM_ID) {
+    return ix("private_swap", concat(enumByte(direction), bytes32(root), u64(rootSequence), u64(generation), bytes32(nullifierValue), u64(amountIn), u64(amountOut), u64(changeAmount), bytes32(changeCommitment), bytes32(outputCommitment), vec(proof)), [
+        signer(payer), rw(pool.address), rw(pda.shielded(pool.address, programId)[0]), rw(state.tree),
+        rw(pool.tokenAMint), rw(pool.tokenBMint), ro(pool.lpMint), rw(pool.tokenAVault), rw(pool.tokenBVault),
+        rw(pool.protocolFeeVaultA), rw(pool.protocolFeeVaultB), rw(pool.creatorFeeVaultA), rw(pool.creatorFeeVaultB),
+        rw(state.custodyA), rw(state.custodyB), ro(TOKEN_PROGRAM_ID), ro(SystemProgram.programId),
+        rw(pda.spent(pool.address, nullifierValue, programId)[0]),
+    ], programId);
+}

package/dist/math.d.ts

@@ -0,0 +1,18 @@
+export declare const FEE_DENOMINATOR = 10000n;
+export declare const MINIMUM_LIQUIDITY = 1000n;
+export interface FeeBreakdown {
+    totalFee: bigint;
+    protocolFee: bigint;
+    creatorFee: bigint;
+    lpFee: bigint;
+    pricingInput: bigint;
+}
+export declare function validateFeeTier(feeBps: number): void;
+export declare function feeBreakdown(amountIn: bigint, feeBps: number): FeeBreakdown;
+export declare function minimumLpClaimReserve(totalLp: bigint, lockedLp?: bigint): bigint;
+export declare function swapOutput(reserveIn: bigint, reserveOut: bigint, amountIn: bigint, feeBps: number): bigint;
+export declare function swapOutputPreservingLpClaims(reserveIn: bigint, reserveOut: bigint, amountIn: bigint, feeBps: number, totalLp: bigint, lockedLp?: bigint): bigint;
+export declare function initialLp(a: bigint, b: bigint): bigint;
+export declare function proportional(amount: bigint, lp: bigint, supply: bigint): bigint;
+export declare function optimalDeposit(maxA: bigint, maxB: bigint, reserveA: bigint, reserveB: bigint): [bigint, bigint];
+export declare function sqrt(n: bigint): bigint;

package/dist/math.js

@@ -0,0 +1,76 @@
+export const FEE_DENOMINATOR = 10000n;
+export const MINIMUM_LIQUIDITY = 1000n;
+export function validateFeeTier(feeBps) {
+    if (!Number.isInteger(feeBps) || ![100, 200, 300].includes(feeBps))
+        throw new Error("Invalid fee tier");
+}
+export function feeBreakdown(amountIn, feeBps) {
+    if (amountIn <= 0n)
+        throw new Error("Amount must be positive");
+    validateFeeTier(feeBps);
+    const totalFee = amountIn * BigInt(feeBps) / FEE_DENOMINATOR;
+    const protocolFee = totalFee * 5000n / 10000n;
+    const creatorFee = totalFee * 2000n / 10000n;
+    return {
+        totalFee,
+        protocolFee,
+        creatorFee,
+        lpFee: totalFee - protocolFee - creatorFee,
+        pricingInput: amountIn - totalFee,
+    };
+}
+function ceilDiv(numerator, denominator) {
+    if (numerator <= 0n || denominator <= 0n)
+        throw new Error("Insufficient liquidity");
+    return (numerator - 1n) / denominator + 1n;
+}
+export function minimumLpClaimReserve(totalLp, lockedLp = MINIMUM_LIQUIDITY) {
+    if (lockedLp <= 0n || lockedLp >= totalLp)
+        throw new Error("Insufficient liquidity");
+    return [ceilDiv(totalLp, lockedLp), ceilDiv(totalLp, totalLp - lockedLp)].reduce((a, b) => a > b ? a : b);
+}
+export function swapOutput(reserveIn, reserveOut, amountIn, feeBps) {
+    if (reserveIn <= 0n || reserveOut <= 0n)
+        throw new Error("Zero reserve");
+    const fee = feeBreakdown(amountIn, feeBps);
+    const effective = fee.pricingInput * FEE_DENOMINATOR;
+    const denominator = reserveIn * FEE_DENOMINATOR + effective;
+    const output = reserveOut * effective / denominator;
+    if (output <= 0n || output >= reserveOut)
+        throw new Error("Invalid output");
+    return output;
+}
+export function swapOutputPreservingLpClaims(reserveIn, reserveOut, amountIn, feeBps, totalLp, lockedLp = MINIMUM_LIQUIDITY) {
+    const output = swapOutput(reserveIn, reserveOut, amountIn, feeBps);
+    if (reserveOut - output < minimumLpClaimReserve(totalLp, lockedLp)) {
+        throw new Error("Reserve is too low for LP claims");
+    }
+    return output;
+}
+export function initialLp(a, b) {
+    return sqrt(a * b);
+}
+export function proportional(amount, lp, supply) {
+    if (supply <= 0n || lp > supply)
+        throw new Error("Insufficient liquidity");
+    return amount * lp / supply;
+}
+export function optimalDeposit(maxA, maxB, reserveA, reserveB) {
+    if (maxA <= 0n || maxB <= 0n || reserveA <= 0n || reserveB <= 0n)
+        throw new Error("Zero amount");
+    const b = maxA * reserveB / reserveA;
+    return b <= maxB ? [maxA, b] : [maxB * reserveA / reserveB, maxB];
+}
+export function sqrt(n) {
+    if (n < 0n)
+        throw new Error("Negative square root");
+    if (n < 2n)
+        return n;
+    let x = n;
+    let y = (x + 1n) / 2n;
+    while (y < x) {
+        x = y;
+        y = (x + n / x) / 2n;
+    }
+    return x;
+}

package/dist/merkle.d.ts

@@ -0,0 +1,4 @@
+import type { TreeState } from "./types.js";
+export declare const TREE_DEPTH = 16, ROOT_HISTORY = 32, TREE_CAPACITY: bigint;
+export declare function rootFromTree(tree: TreeState): Uint8Array;
+export declare function verifyPath(leaf: Uint8Array, index: bigint, siblings: Uint8Array[], root: Uint8Array): boolean;

package/dist/merkle.js

@@ -0,0 +1,10 @@
+import { hash2 } from "./crypto.js";
+export const TREE_DEPTH = 16, ROOT_HISTORY = 32, TREE_CAPACITY = 1n << 16n;
+export function rootFromTree(tree) { if (tree.nextIndex === TREE_CAPACITY) {
+    if (tree.frontierPresent[15] !== 1)
+        throw new Error("Invalid terminal tree");
+    return tree.frontier[15];
+} let node = tree.emptySubtrees[0]; for (let i = 0; i < TREE_DEPTH; i++)
+    node = ((tree.nextIndex >> BigInt(i)) & 1n) === 1n ? hash2(tree.frontier[i], node) : hash2(node, tree.emptySubtrees[i]); return node; }
+export function verifyPath(leaf, index, siblings, root) { let n = leaf; for (let i = 0; i < TREE_DEPTH; i++)
+    n = ((index >> BigInt(i)) & 1n) === 0n ? hash2(n, siblings[i]) : hash2(siblings[i], n); return Buffer.from(n).equals(Buffer.from(root)); }

package/dist/pda.d.ts

@@ -0,0 +1,18 @@
+import { PublicKey } from "@solana/web3.js";
+export declare const pda: {
+    pool: (a: PublicKey, b: PublicKey, feeBps: number, programId?: PublicKey) => [PublicKey, number];
+    vaultA: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    vaultB: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    protocolFeeA: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    protocolFeeB: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    creatorFeeA: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    creatorFeeB: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    lpMint: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    lpLock: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    shielded: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    tree: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    custodyA: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    custodyB: (pool: PublicKey, programId?: PublicKey) => [PublicKey, number];
+    spent: (pool: PublicKey, nullifier: Uint8Array, programId?: PublicKey) => [PublicKey, number];
+    protocolConfig: (programId?: PublicKey) => [PublicKey, number];
+};

package/dist/pda.js

@@ -0,0 +1,21 @@
+import { PublicKey } from "@solana/web3.js";
+import { PROGRAM_ID } from "./encoding.js";
+export const pda = {
+    pool: (a, b, feeBps, programId = PROGRAM_ID) => PublicKey.findProgramAddressSync([Buffer.from("pool"), a.toBuffer(), b.toBuffer(), u16le(feeBps)], programId),
+    vaultA: (pool, programId = PROGRAM_ID) => find("vault-a", pool, programId),
+    vaultB: (pool, programId = PROGRAM_ID) => find("vault-b", pool, programId),
+    protocolFeeA: (pool, programId = PROGRAM_ID) => find("protocol-fee-a", pool, programId),
+    protocolFeeB: (pool, programId = PROGRAM_ID) => find("protocol-fee-b", pool, programId),
+    creatorFeeA: (pool, programId = PROGRAM_ID) => find("creator-fee-a", pool, programId),
+    creatorFeeB: (pool, programId = PROGRAM_ID) => find("creator-fee-b", pool, programId),
+    lpMint: (pool, programId = PROGRAM_ID) => find("lp", pool, programId),
+    lpLock: (pool, programId = PROGRAM_ID) => find("lp-lock", pool, programId),
+    shielded: (pool, programId = PROGRAM_ID) => find("shielded", pool, programId),
+    tree: (pool, programId = PROGRAM_ID) => find("tree", pool, programId),
+    custodyA: (pool, programId = PROGRAM_ID) => find("custody-a", pool, programId),
+    custodyB: (pool, programId = PROGRAM_ID) => find("custody-b", pool, programId),
+    spent: (pool, nullifier, programId = PROGRAM_ID) => PublicKey.findProgramAddressSync([Buffer.from("spent"), pool.toBuffer(), Buffer.from(nullifier)], programId),
+    protocolConfig: (programId = PROGRAM_ID) => PublicKey.findProgramAddressSync([Buffer.from("protocol-config")], programId),
+};
+function find(seed, pool, programId) { return PublicKey.findProgramAddressSync([Buffer.from(seed), pool.toBuffer()], programId); }
+function u16le(v) { const b = Buffer.alloc(2); b.writeUInt16LE(v); return b; }

package/dist/prover.d.ts

@@ -0,0 +1,26 @@
+import type { PrivateSwapProverInput, Prover, UnshieldProverInput } from "./types.js";
+export declare const BN254_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+export declare const PRODUCTION_ARTIFACT_SHA256: {
+    readonly privateSwapPk: "26f9aaa5ff0924bc5c1d4a6fc618f70147d4f8b6d76acdfca3eabbd704cf51f5";
+    readonly unshieldPk: "156b0759e8819cb529c59249fbef6e075651655c8f8361f97616a8a1fc981563";
+};
+export declare function encodeUnshieldPublicInputs(input: Pick<UnshieldProverInput, "pool" | "asset" | "root" | "nullifier" | "amount" | "recipient">): Uint8Array;
+export declare function encodePrivateSwapPublicInputs(input: Pick<PrivateSwapProverInput, "pool" | "assetIn" | "assetOut" | "root" | "rootSequence" | "generation" | "nullifier" | "reserveIn" | "reserveOut" | "feeBps" | "amountIn" | "amountOut" | "changeAmount" | "changeCommitment" | "outputCommitment" | "direction" | "swapNonce">): Uint8Array;
+export interface ProductionProverConfig {
+    executablePath: string;
+    privateSwapPkPath: string;
+    unshieldPkPath: string;
+    timeoutMs?: number;
+}
+export declare class ProductionProver implements Prover {
+    private readonly config;
+    constructor(config: ProductionProverConfig);
+    proveUnshield(input: UnshieldProverInput): Promise<{
+        proof: Uint8Array;
+        publicInputs: Uint8Array;
+    }>;
+    provePrivateSwap(input: PrivateSwapProverInput): Promise<{
+        proof: Uint8Array;
+        publicInputs: Uint8Array;
+    }>;
+}

package/dist/prover.js

@@ -0,0 +1,177 @@
+import { createHash } from "node:crypto";
+import { realpath, stat } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { platform, arch } from "node:process";
+import { dirname } from "node:path";
+const hex = (value) => Buffer.from(value).toString("hex");
+const decimal = (value) => value.toString(10);
+const MAX_U64 = 0xffffffffffffffffn;
+export const BN254_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const PROVER_VERSION = "production-prover 0.2.0 ipc-v1";
+const PROVER_OUTPUT_MAGIC = Buffer.from("ZKCP");
+const PRIVATE_PROVER_SHA256_BY_TARGET = {
+    // This digest is updated only when the authenticated release binary is built.
+    "darwin-arm64": "1772e91b6e6048e90eafee865e06097ebd15cf319a89263d4a0d6e8f2eca2eac",
+};
+export const PRODUCTION_ARTIFACT_SHA256 = {
+    privateSwapPk: "26f9aaa5ff0924bc5c1d4a6fc618f70147d4f8b6d76acdfca3eabbd704cf51f5",
+    unshieldPk: "156b0759e8819cb529c59249fbef6e075651655c8f8361f97616a8a1fc981563",
+};
+const PRODUCTION_ARTIFACT_SIZE = { privateSwapPk: 2_829_872, unshieldPk: 1_409_808 };
+const requireBytes32 = (value, label) => {
+    if (value.length !== 32)
+        throw new Error(`${label} must be 32 bytes`);
+    return value;
+};
+const field = (value) => {
+    const number = typeof value === "bigint" ? value : BigInt(`0x${hex(requireBytes32(value, "field"))}`);
+    if (number < 0n || number >= BN254_MODULUS)
+        throw new Error("Noncanonical BN254 field value");
+    const output = Buffer.alloc(32);
+    let current = number;
+    for (let index = 31; index >= 0; index--) {
+        output[index] = Number(current & 255n);
+        current >>= 8n;
+    }
+    return output;
+};
+const u64Field = (value) => {
+    if (value < 0n || value > MAX_U64)
+        throw new Error("Invalid u64 public input");
+    return field(value);
+};
+const limb = (value) => {
+    if (value.length < 16)
+        throw new Error("Public-key limb must be at least 16 bytes");
+    return Buffer.concat([Buffer.alloc(16), Buffer.from(value.subarray(0, 16))]);
+};
+export function encodeUnshieldPublicInputs(input) {
+    return Buffer.concat([
+        u64Field(0x5a4b43504d4d0003n), limb(input.pool.toBytes()), limb(input.pool.toBytes().subarray(16)),
+        limb(input.asset.toBytes()), limb(input.asset.toBytes().subarray(16)), field(input.root), field(input.nullifier),
+        u64Field(input.amount), limb(input.recipient.toBytes()), limb(input.recipient.toBytes().subarray(16)),
+    ]);
+}
+export function encodePrivateSwapPublicInputs(input) {
+    if (!Number.isSafeInteger(input.feeBps) || input.feeBps < 0 || input.feeBps > 0xffff)
+        throw new Error("Invalid fee tier encoding");
+    if (!Number.isSafeInteger(input.direction) || input.direction < 0 || input.direction > 1)
+        throw new Error("Invalid swap direction");
+    return Buffer.concat([
+        u64Field(0x5a4b43504d4d0003n), limb(input.pool.toBytes()), limb(input.pool.toBytes().subarray(16)),
+        limb(input.assetIn.toBytes()), limb(input.assetIn.toBytes().subarray(16)), limb(input.assetOut.toBytes()), limb(input.assetOut.toBytes().subarray(16)),
+        field(input.root), u64Field(input.rootSequence), u64Field(input.generation), field(input.nullifier),
+        u64Field(input.reserveIn), u64Field(input.reserveOut), u64Field(BigInt(input.feeBps)), u64Field(input.amountIn), u64Field(input.amountOut),
+        u64Field(input.changeAmount), field(input.changeCommitment), field(input.outputCommitment), u64Field(BigInt(input.direction)), u64Field(1n), u64Field(input.swapNonce),
+    ]);
+}
+function targetKey() { return `${platform}-${arch}`; }
+async function sha256File(path) {
+    return createHash("sha256").update(await import("node:fs/promises").then(fs => fs.readFile(path))).digest("hex");
+}
+async function verifyArtifact(path, circuit) {
+    const expected = circuit === "private" ? PRODUCTION_ARTIFACT_SHA256.privateSwapPk : PRODUCTION_ARTIFACT_SHA256.unshieldPk;
+    const expectedSize = circuit === "private" ? PRODUCTION_ARTIFACT_SIZE.privateSwapPk : PRODUCTION_ARTIFACT_SIZE.unshieldPk;
+    const info = await stat(path);
+    if (!info.isFile() || info.size !== expectedSize)
+        throw new Error(`Production ${circuit} proving-key size mismatch`);
+    if ((await sha256File(path)).toLowerCase() !== expected)
+        throw new Error(`Production ${circuit} proving-key hash mismatch`);
+}
+function boundedChild(executable, args, input, limits) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(executable, args, { env: { RUST_BACKTRACE: "0" }, shell: false, stdio: ["pipe", "pipe", "pipe"] });
+        const stdout = [];
+        const stderr = [];
+        let stdoutLength = 0;
+        let stderrLength = 0;
+        let settled = false;
+        const finish = (error) => { if (settled)
+            return; settled = true; clearTimeout(timer); if (error)
+            reject(error);
+        else
+            resolve({ stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr) }); };
+        const kill = (error) => { child.kill("SIGKILL"); finish(error); };
+        const timer = setTimeout(() => kill(new Error("Production prover timed out")), limits.timeoutMs);
+        child.on("error", error => finish(error));
+        child.stdout.on("data", chunk => { stdoutLength += chunk.length; if (stdoutLength > limits.stdout)
+            kill(new Error("Production prover stdout exceeded its limit"));
+        else
+            stdout.push(Buffer.from(chunk)); });
+        child.stderr.on("data", chunk => { stderrLength += chunk.length; if (stderrLength > limits.stderr)
+            kill(new Error("Production prover stderr exceeded its limit"));
+        else
+            stderr.push(Buffer.from(chunk)); });
+        child.on("close", code => { if (code === 0)
+            finish();
+        else
+            finish(new Error(`Production prover failed with exit code ${code ?? "unknown"}`)); });
+        if (input) {
+            child.stdin.end(input);
+        }
+        else
+            child.stdin.end();
+    });
+}
+async function verifyExecutable(path) {
+    const resolved = await realpath(path);
+    const info = await stat(resolved);
+    const parent = await stat(dirname(resolved));
+    if (!info.isFile())
+        throw new Error("Production prover executable is not a regular file");
+    if (process.platform !== "win32" && ((info.mode | parent.mode) & 0o022) !== 0)
+        throw new Error("Production prover executable or directory is writable by group/other");
+    const expected = PRIVATE_PROVER_SHA256_BY_TARGET[targetKey()];
+    if (!expected || expected === "RELEASE_BUILD_REQUIRED")
+        throw new Error(`No authenticated production prover digest for ${targetKey()}`);
+    if ((await sha256File(resolved)).toLowerCase() !== expected)
+        throw new Error("Production prover executable hash mismatch");
+    const version = await boundedChild(resolved, ["--version"], undefined, { stdout: 256, stderr: 1024, timeoutMs: 2_000 });
+    if (version.stdout.toString("utf8") !== `${PROVER_VERSION}\n`)
+        throw new Error("Production prover version mismatch");
+    return resolved;
+}
+function pathTokens(witness) {
+    if (witness.index < 0n || witness.index >= 1n << 16n || witness.siblings.length !== 16)
+        throw new Error("Invalid Merkle witness");
+    return [decimal(witness.index), decimal(witness.generation), ...witness.siblings.map(value => hex(requireBytes32(value, "Merkle sibling")))];
+}
+function requestFrame(circuit, tokens) {
+    const frame = `zkcpmm-prover-ipc-v1\n${circuit}\n${tokens.length}\n${tokens.join("\n")}\n`;
+    const encoded = Buffer.from(frame, "utf8");
+    if (encoded.length > 16 * 1024)
+        throw new Error("Production prover request exceeds its limit");
+    return encoded;
+}
+function parseOutput(circuit, output) {
+    const inputLength = circuit === "private" ? 704 : 320;
+    if (output.length !== 16 + 256 + inputLength || !output.subarray(0, 4).equals(PROVER_OUTPUT_MAGIC) || output[4] !== 1 || output[5] !== (circuit === "private" ? 0 : 1) || output.readUInt16BE(6) !== 0 || output.readUInt32BE(8) !== 256 || output.readUInt32BE(12) !== inputLength)
+        throw new Error("Invalid production prover response frame");
+    return { proof: output.subarray(16, 272), publicInputs: output.subarray(272) };
+}
+async function prove(config, circuit, tokens) {
+    const executable = await verifyExecutable(config.executablePath);
+    await verifyArtifact(circuit === "private" ? config.privateSwapPkPath : config.unshieldPkPath, circuit);
+    const request = requestFrame(circuit, tokens);
+    try {
+        const result = await boundedChild(executable, ["--stdin-v1", circuit, "--pk", circuit === "private" ? config.privateSwapPkPath : config.unshieldPkPath], request, { stdout: circuit === "private" ? 977 : 593, stderr: 16 * 1024, timeoutMs: Math.min(Math.max(config.timeoutMs ?? 120_000, 1_000), 300_000) });
+        return parseOutput(circuit, result.stdout);
+    }
+    finally {
+        request.fill(0);
+    }
+}
+export class ProductionProver {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async proveUnshield(input) {
+        const tokens = [hex(input.pool.toBytes()), hex(input.asset.toBytes()), hex(requireBytes32(input.root, "root")), hex(requireBytes32(input.nullifier, "nullifier")), decimal(input.amount), hex(input.recipient.toBytes()), hex(requireBytes32(input.spendSecret, "spend secret")), hex(requireBytes32(input.randomness, "randomness")), ...pathTokens(input.witness)];
+        return prove(this.config, "unshield", tokens);
+    }
+    async provePrivateSwap(input) {
+        const tokens = [hex(input.pool.toBytes()), hex(input.assetIn.toBytes()), hex(input.assetOut.toBytes()), hex(requireBytes32(input.root, "root")), decimal(input.rootSequence), decimal(input.generation), hex(requireBytes32(input.nullifier, "nullifier")), decimal(input.reserveIn), decimal(input.reserveOut), String(input.feeBps), decimal(input.amountIn), decimal(input.amountOut), decimal(input.changeAmount), hex(requireBytes32(input.changeCommitment, "change commitment")), hex(requireBytes32(input.outputCommitment, "output commitment")), String(input.direction), decimal(input.swapNonce), hex(requireBytes32(input.inputSpendSecret, "input spend secret")), hex(requireBytes32(input.inputRandomness, "input randomness")), ...pathTokens(input.witness), hex(requireBytes32(input.changeSpendSecret, "change spend secret")), hex(requireBytes32(input.changeRandomness, "change randomness")), hex(requireBytes32(input.outputSpendSecret, "output spend secret")), hex(requireBytes32(input.outputRandomness, "output randomness"))];
+        return prove(this.config, "private", tokens);
+    }
+}

package/dist/store.d.ts

@@ -0,0 +1,39 @@
+import type { JournaledNoteStore, MerkleCheckpointStore, Note, OperationRecord } from "./types.js";
+export declare class EncryptedFileNoteStore implements JournaledNoteStore, MerkleCheckpointStore {
+    private readonly path;
+    private readonly encryptionKey;
+    private readonly owner;
+    private readonly lockPath;
+    private readonly notes;
+    private readonly operations;
+    private sequence;
+    private previousDigest;
+    constructor(path: string, encryptionKey: Uint8Array, owner: Uint8Array);
+    static fromSeed(path: string, seed: Uint8Array, owner: Uint8Array): EncryptedFileNoteStore;
+    private validateNote;
+    private apply;
+    private readJournal;
+    private acquireLock;
+    private append;
+    private mutate;
+    getNotes(ownerCommitment?: Uint8Array<ArrayBufferLike>): Promise<Note[]>;
+    saveNote(input: Note): Promise<void>;
+    reserveNote(commitment: Uint8Array, operationId: Uint8Array, ownerCommitment: Uint8Array): Promise<Note>;
+    reserveNoteAndBegin(commitment: Uint8Array, operationId: Uint8Array, ownerCommitment: Uint8Array, operation: OperationRecord): Promise<Note>;
+    markSubmitted(commitment: Uint8Array, operationId: Uint8Array, signature: string): Promise<void>;
+    markSpent(commitment: Uint8Array, operationId?: Uint8Array): Promise<void>;
+    releaseReservation(commitment: Uint8Array, operationId?: Uint8Array): Promise<void>;
+    beginOperation(operation: OperationRecord): Promise<void>;
+    updateOperation(id: Uint8Array, patch: Partial<Pick<OperationRecord, "metadata" | "outputNotes">>): Promise<void>;
+    markPrepared(id: Uint8Array, signedTransaction: Uint8Array, lastValidBlockHeight: bigint): Promise<void>;
+    markOperationSubmitted(id: Uint8Array, signature: string): Promise<void>;
+    markOperationFinalized(id: Uint8Array): Promise<void>;
+    markOperationFailed(id: Uint8Array, reason: string): Promise<void>;
+    markOperationUnknown(id: Uint8Array, reason: string): Promise<void>;
+    getPendingOperations(): Promise<OperationRecord[]>;
+    exportBackup(): Promise<Uint8Array>;
+    importBackup(backup: Uint8Array): Promise<void>;
+    private checkpointPath;
+    loadMerkleCheckpoint(identity: string): Promise<Uint8Array | undefined>;
+    saveMerkleCheckpoint(identity: string, checkpoint: Uint8Array): Promise<void>;
+}