@veilo/sdk-core 0.1.17 → 0.4.0

package/dist/tests/shield-owner.test.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert_1 = require("assert");
+const web3_js_1 = require("@solana/web3.js");
+const src_1 = require("../src");
+const OWNER_RELAYER = "https://relayer-server.onrender.com";
+function json(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+describe("resolveShieldOwner()", () => {
+    const originalFetch = globalThis.fetch;
+    afterEach(() => {
+        globalThis.fetch = originalFetch;
+    });
+    it("uses Veilo's default owner service without exposing a client parameter", async () => {
+        const wallet = web3_js_1.Keypair.generate().publicKey;
+        let requestedUrl = "";
+        let requestedHeaders;
+        globalThis.fetch = async (input, init) => {
+            requestedUrl = String(input);
+            requestedHeaders = init?.headers;
+            return json({
+                success: true,
+                username: "alice",
+                pubK: wallet.toBase58(),
+                veiloPublicKey: "123456789",
+            });
+        };
+        const owner = await (0, src_1.resolveShieldOwner)({ username: "alice" });
+        assert_1.strict.equal(requestedUrl, `${OWNER_RELAYER}/api/auth/veiloPublicKey?username=alice`);
+        assert_1.strict.equal(new Headers(requestedHeaders).has("x-api-key"), false, "public owner lookup must not embed a client-side API secret");
+        assert_1.strict.equal(owner.veiloPublicKey, 123456789n);
+        assert_1.strict.equal(owner.noteViewingKey.toBase58(), wallet.toBase58());
+        assert_1.strict.equal(owner.acknowledgeOwnerInvariant, true);
+    });
+    it("pre-registers an unknown Solana address through the same default service", async () => {
+        const wallet = web3_js_1.Keypair.generate().publicKey;
+        const requests = [];
+        globalThis.fetch = async (input, init) => {
+            requests.push({
+                url: String(input),
+                method: init?.method,
+                body: typeof init?.body === "string" ? init.body : undefined,
+            });
+            if (requests.length === 1) {
+                return json({ success: false, error: "not found" }, 404);
+            }
+            return json({ success: true, veiloPublicKey: "987654321" });
+        };
+        const owner = await (0, src_1.resolveShieldOwner)({ publicKey: wallet });
+        assert_1.strict.equal(requests[0].url, `${OWNER_RELAYER}/api/auth/veiloPublicKey?publicKey=${wallet.toBase58()}`);
+        assert_1.strict.equal(requests[1].url, `${OWNER_RELAYER}/api/auth/pre-register-key`);
+        assert_1.strict.equal(requests[1].method, "POST");
+        assert_1.strict.deepEqual(JSON.parse(requests[1].body), {
+            solanaAddress: wallet.toBase58(),
+        });
+        assert_1.strict.equal(owner.veiloPublicKey, 987654321n);
+        assert_1.strict.equal(owner.noteViewingKey.toBase58(), wallet.toBase58());
+        assert_1.strict.equal(owner.acknowledgeOwnerInvariant, true);
+    });
+    it("rejects a lookup that returns only one half of the owner", async () => {
+        globalThis.fetch = async () => json({ success: true, pubK: web3_js_1.Keypair.generate().publicKey.toBase58() });
+        await assert_1.strict.rejects((0, src_1.resolveShieldOwner)({ username: "alice" }), (error) => {
+            assert_1.strict.ok(error instanceof src_1.ShieldError);
+            assert_1.strict.match(error.message, /both keys/i);
+            return true;
+        });
+    });
+    it("rejects a public-key lookup if Veilo returns a different wallet", async () => {
+        const requested = web3_js_1.Keypair.generate().publicKey;
+        const returned = web3_js_1.Keypair.generate().publicKey;
+        globalThis.fetch = async () => json({
+            success: true,
+            pubK: returned.toBase58(),
+            veiloPublicKey: "123",
+        });
+        await assert_1.strict.rejects((0, src_1.resolveShieldOwner)({ publicKey: requested }), (error) => {
+            assert_1.strict.ok(error instanceof src_1.ShieldError);
+            assert_1.strict.match(error.message, /different wallet/i);
+            assert_1.strict.equal(error.context?.requested, requested.toBase58());
+            assert_1.strict.equal(error.context?.returned, returned.toBase58());
+            return true;
+        });
+    });
+});

package/dist/tests/shield-preflight.test.d.ts

@@ -0,0 +1 @@
+import "mocha";

package/dist/tests/shield-preflight.test.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert_1 = require("assert");
+const web3_js_1 = require("@solana/web3.js");
+const spl_token_1 = require("@solana/spl-token");
+const src_1 = require("../src");
+const USDC = new web3_js_1.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
+describe("preflightShield()", () => {
+    it("rejects a zero-allowance delegate and returns a revoke remedy", async () => {
+        const signer = web3_js_1.Keypair.generate().publicKey;
+        const delegate = web3_js_1.Keypair.generate().publicKey;
+        const tokenAccount = web3_js_1.Keypair.generate().publicKey;
+        const data = Buffer.alloc(spl_token_1.AccountLayout.span);
+        spl_token_1.AccountLayout.encode({
+            mint: USDC,
+            owner: signer,
+            amount: 10000000n,
+            delegateOption: 1,
+            delegate,
+            state: spl_token_1.AccountState.Initialized,
+            isNativeOption: 0,
+            isNative: 0n,
+            delegatedAmount: 0n,
+            closeAuthorityOption: 0,
+            closeAuthority: web3_js_1.PublicKey.default,
+        }, data);
+        const connection = {
+            async getAccountInfo() {
+                return {
+                    data,
+                    executable: false,
+                    lamports: 0,
+                    owner: spl_token_1.TOKEN_PROGRAM_ID,
+                    rentEpoch: 0,
+                };
+            },
+        };
+        await assert_1.strict.rejects((0, src_1.preflightShield)({
+            connection,
+            amount: 1000000n,
+            mint: USDC,
+            signer: { publicKey: signer, tokenAccount },
+            options: { skipPoolState: true, skipBalance: true },
+        }), (error) => {
+            assert_1.strict.ok(error instanceof src_1.ShieldError);
+            assert_1.strict.equal(error.code, "TOKEN_ACCOUNT_DELEGATED");
+            assert_1.strict.equal(error.context?.delegatedAmount, "0");
+            assert_1.strict.equal(error.remedy?.instructions.length, 1);
+            assert_1.strict.equal(error.remedy?.instructions[0].programId.toBase58(), spl_token_1.TOKEN_PROGRAM_ID.toBase58());
+            return true;
+        });
+    });
+    it("uses the caller's zero priority fee in the SOL balance requirement", async () => {
+        const signer = web3_js_1.Keypair.generate().publicKey;
+        const amount = 1000n;
+        const rentPerMarker = 10n;
+        const exactlyEnough = amount + rentPerMarker * 2n + 5000n;
+        const connection = {
+            async getMinimumBalanceForRentExemption() {
+                return Number(rentPerMarker);
+            },
+            async getBalance() {
+                return Number(exactlyEnough);
+            },
+        };
+        await (0, src_1.preflightShield)({
+            connection,
+            amount,
+            mint: src_1.NATIVE_SOL_MINT,
+            signer: { publicKey: signer, tokenAccount: signer },
+            options: { skipPoolState: true },
+            computeUnitPriceMicroLamports: 0,
+        });
+        await assert_1.strict.rejects((0, src_1.preflightShield)({
+            connection,
+            amount,
+            mint: src_1.NATIVE_SOL_MINT,
+            signer: { publicKey: signer, tokenAccount: signer },
+            options: { skipPoolState: true },
+        }), (error) => {
+            assert_1.strict.ok(error instanceof src_1.ShieldError);
+            assert_1.strict.equal(error.code, "INSUFFICIENT_SOL");
+            return true;
+        });
+    });
+});

package/dist/tests/shield-realproof.test.d.ts

@@ -0,0 +1 @@
+import "mocha";

package/dist/tests/shield-realproof.test.js

@@ -0,0 +1,272 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert_1 = require("assert");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const web3_js_1 = require("@solana/web3.js");
+const spl_token_1 = require("@solana/spl-token");
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const src_1 = require("../src");
+/**
+ * The test that proves the proof is real.
+ *
+ * Every other shield test stubs the prover, so they verify assembly, size, and
+ * ownership — but not the one thing everything else rests on: that the circuit
+ * inputs `shield()` constructs actually satisfy the transaction circuit. A
+ * shield that assembles perfectly and proves nothing is worthless, and the
+ * failure would only surface on-chain as a generic "proof verification failed".
+ *
+ * So this runs the REAL snarkjs prover against the REAL circuit artifacts and
+ * verifies the result against the REAL verification key — the same three files
+ * the deployed program's verifier was built from. No RPC and no wallet needed:
+ * proof validity is a property of the witness, not of the network.
+ *
+ * Skipped automatically when the artifacts are absent (they are large and live
+ * outside this package), so a fresh checkout still gets a green suite.
+ */
+const ARTIFACT_ROOTS = [
+    (0, path_1.resolve)(__dirname, "../../privacy-program/zk/circuits"),
+    (0, path_1.resolve)(process.cwd(), "../privacy-program/zk/circuits"),
+];
+function findArtifacts() {
+    for (const root of ARTIFACT_ROOTS) {
+        const wasm = (0, path_1.resolve)(root, "transaction/transaction_js/transaction.wasm");
+        const zkey = (0, path_1.resolve)(root, "transaction/transaction_final.zkey");
+        const vkey = (0, path_1.resolve)(root, "transaction/transaction_verification_key.json");
+        if ((0, fs_1.existsSync)(wasm) && (0, fs_1.existsSync)(zkey) && (0, fs_1.existsSync)(vkey)) {
+            return { wasm, zkey, vkey };
+        }
+    }
+    return null;
+}
+const artifacts = findArtifacts();
+(artifacts ? describe : describe.skip)("shield() with the real prover", function () {
+    this.timeout(600000);
+    let groth16;
+    let vkey;
+    before(async function () {
+        await (0, src_1.initPoseidon)();
+        try {
+            ({ groth16 } = await Promise.resolve().then(() => __importStar(require("snarkjs"))));
+        }
+        catch {
+            this.skip();
+        }
+        vkey = JSON.parse((0, fs_1.readFileSync)(artifacts.vkey, "utf8"));
+    });
+    async function stubAlt(mint, outputTreeId) {
+        return new web3_js_1.AddressLookupTableAccount({
+            key: web3_js_1.PublicKey.unique(),
+            state: {
+                deactivationSlot: BigInt("18446744073709551615"),
+                lastExtendedSlot: 0,
+                lastExtendedSlotStartIndex: 0,
+                authority: undefined,
+                addresses: (0, src_1.requiredAltKeys)({ mint, outputTreeId }).map((k) => k.address),
+            },
+        });
+    }
+    const connection = {
+        getLatestBlockhash: async () => ({
+            blockhash: "11111111111111111111111111111111",
+            lastValidBlockHeight: 1,
+        }),
+        getMinimumBalanceForRentExemption: async () => 961680,
+    };
+    /**
+     * The real prover, capturing the public signals so we can verify them
+     * independently of the proof itself.
+     */
+    function realProver(capture) {
+        return async (inputs) => {
+            const { formatInputsForSnarkjs } = await Promise.resolve().then(() => __importStar(require("../src/proof.js")));
+            const { proof, publicSignals } = await groth16.fullProve(formatInputsForSnarkjs(inputs), artifacts.wasm, artifacts.zkey);
+            capture.publicSignals = publicSignals;
+            return proof;
+        };
+    }
+    async function runShield(opts = {}) {
+        const mint = opts.mint ?? src_1.NATIVE_SOL_MINT;
+        const amount = opts.amount ?? 1500000000n;
+        const outputTreeId = opts.outputTreeId ?? 0;
+        // The recipient is a completely separate party from the signer — this is
+        // the shield-to-someone-else case, which is the whole point of the feature.
+        const recipientWallet = tweetnacl_1.default.sign.keyPair();
+        const recipientVeiloKey = (0, src_1.generateKeypair)();
+        const owner = (0, src_1.unsafeShieldOwner)({
+            veiloPublicKey: recipientVeiloKey.publicKey,
+            noteViewingKey: new web3_js_1.PublicKey(recipientWallet.publicKey),
+            acknowledgeOwnerInvariant: true,
+        });
+        const signerPubkey = web3_js_1.PublicKey.unique();
+        const capture = {};
+        const result = await (0, src_1.shield)({
+            connection,
+            amount,
+            mint,
+            owner,
+            signer: {
+                publicKey: signerPubkey,
+                tokenAccount: mint.equals(src_1.NATIVE_SOL_MINT)
+                    ? undefined
+                    : await (0, spl_token_1.getAssociatedTokenAddress)(mint, signerPubkey),
+            },
+            prover: realProver(capture),
+            treeSource: (0, src_1.staticTreeSource)({
+                inputTreeId: 0,
+                // A plausible root. Deposits do not constrain it (the circuit disables
+                // the Merkle check for zero-amount inputs) but it IS a public input, so
+                // it must survive into the proof unchanged.
+                inputRoot: (0, src_1.bigIntToBytesBE)(0x1f2e3d4c5b6a798897a6b5c4d3e2f10011223344556677889900aabbccddeeffn %
+                    src_1.BN254_FR_MODULUS),
+                outputTreeId,
+                outputNextIndex: 7,
+            }),
+            alt: (0, src_1.explicitAlt)(await stubAlt(mint, outputTreeId)),
+            cache: (0, src_1.noCache)(),
+            preflight: false,
+        });
+        return { result, owner, recipientWallet, signerPubkey, capture, mint, amount };
+    }
+    it("produces a Groth16 proof that the real verification key accepts", async () => {
+        const { result, capture } = await runShield();
+        assert_1.strict.ok(capture.publicSignals, "prover did not return public signals");
+        // Reconstruct the snarkjs-shaped proof from what shield() cached, so we are
+        // verifying the bytes that actually go on-chain rather than the prover's
+        // own output object.
+        const raw = toSnarkjsProof(result.proofCache.proof);
+        const ok = await groth16.verify(vkey, capture.publicSignals, raw);
+        assert_1.strict.ok(ok, "the real verification key REJECTED the proof shield() built — the circuit " +
+            "inputs are wrong and every shield would fail on-chain with 'proof verification failed'");
+    });
+    it("commits the public inputs the instruction actually carries", async () => {
+        const { result, capture, amount } = await runShield({ amount: 2000000n });
+        const signals = capture.publicSignals;
+        // The circuit's public signals, in order, are the same eight values the
+        // program reads back out of the instruction. If these drift, the on-chain
+        // verifier rejects even though snarkjs is happy — so check them explicitly
+        // against what got encoded, not against what we passed in.
+        const cache = result.proofCache;
+        const asField = (hex) => (0, src_1.bytesToBigIntBE)(unhex(hex)) % src_1.BN254_FR_MODULUS;
+        const bySignal = signals.map((s) => BigInt(s));
+        const expected = new Set([
+            asField(cache.root),
+            asField(cache.extDataHash),
+            asField(cache.inputNullifiers[0]),
+            asField(cache.inputNullifiers[1]),
+            asField(cache.outputCommitments[0]),
+            asField(cache.outputCommitments[1]),
+        ].map((v) => v.toString()));
+        for (const want of expected) {
+            assert_1.strict.ok(bySignal.some((s) => s.toString() === want), `public signal ${want} is committed by the proof but absent from the ` +
+                `instruction encoding — the on-chain verifier would reject this`);
+        }
+        // The deposit amount must appear as the (positive) public amount.
+        assert_1.strict.equal(cache.publicAmount, amount.toString());
+    });
+    it("binds ext_data_hash to the ExtData the instruction encodes", async () => {
+        const { result, signerPubkey } = await runShield();
+        const cache = result.proofCache;
+        const recomputed = (0, src_1.computeExtDataHash)({
+            recipient: new web3_js_1.PublicKey(cache.extData.recipient),
+            relayer: new web3_js_1.PublicKey(cache.extData.relayer),
+            fee: BigInt(cache.extData.fee),
+            refund: BigInt(cache.extData.refund),
+            claimant: new web3_js_1.PublicKey(cache.extData.claimant),
+        });
+        assert_1.strict.equal(Buffer.from(recomputed).toString("hex"), cache.extDataHash, "ext_data_hash does not match the encoded ExtData — the program checks this " +
+            "equality before verifying the proof and would reject with InvalidExtData");
+        assert_1.strict.equal(cache.extData.relayer, signerPubkey.toBase58());
+        // The claimant slot must be the default for flows without claimant-gated
+        // recovery; a non-default value here silently changes the hash.
+        assert_1.strict.equal(cache.extData.claimant, "11111111111111111111111111111111");
+    });
+    it("creates a note only the recipient can find, from a signer who is not the owner", async () => {
+        const { result, owner, recipientWallet, signerPubkey, mint, amount } = await runShield({ amount: 3000000000n });
+        // The signer is nobody's owner here.
+        assert_1.strict.notEqual(owner.noteViewingKey.toBase58(), signerPubkey.toBase58());
+        const recovered = (0, src_1.decryptCompactNoteCipher)(recipientWallet.secretKey, result.note.compact.ephemeralPublicKey, result.note.compact.compactBlob);
+        assert_1.strict.ok(recovered, "the recipient could not decrypt the note meant for them");
+        assert_1.strict.equal(recovered.amount, amount);
+        // And the recovered secret must reconstruct the on-chain commitment — this
+        // is what makes the note actually spendable rather than merely readable.
+        const rebuilt = (0, src_1.commitUTXO)({
+            amount,
+            pubkey: owner.veiloPublicKey,
+            blinding: (0, src_1.bytesToBigIntBE)(recovered.blinding),
+            mintAddress: (0, src_1.pubkeyToField)(mint),
+        });
+        assert_1.strict.equal(Buffer.from(rebuilt).toString("hex"), Buffer.from(result.note.commitment).toString("hex"), "the decrypted blinding does not reproduce the committed note — the note " +
+            "would be undiscoverable and unspendable");
+        // The stranger check, restated on a real proof rather than a stubbed one.
+        const stranger = tweetnacl_1.default.sign.keyPair();
+        assert_1.strict.equal((0, src_1.decryptCompactNoteCipher)(stranger.secretKey, result.note.compact.ephemeralPublicKey, result.note.compact.compactBlob), null);
+    });
+    it("proves an SPL shield as well as a native one", async () => {
+        const USDC = new web3_js_1.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
+        const { result, capture } = await runShield({ mint: USDC, amount: 25000000n });
+        const ok = await groth16.verify(vkey, capture.publicSignals, toSnarkjsProof(result.proofCache.proof));
+        assert_1.strict.ok(ok, "the SPL shield's proof was rejected by the verification key");
+    });
+});
+// -- helpers ------------------------------------------------------------------
+const unhex = (s) => new Uint8Array(Buffer.from(s, "hex"));
+/**
+ * Turn the packed on-chain proof back into the snarkjs object shape.
+ *
+ * `encodeSnarkjsProofToTransactionProof` swaps the G2 coordinate pairs for
+ * alt_bn128, so the inverse has to swap them back. Round-tripping through this
+ * is deliberate: it verifies the exact 256 bytes the instruction carries, not
+ * the prover's output.
+ */
+function toSnarkjsProof(packed) {
+    const be = (bytes, from) => BigInt("0x" + Buffer.from(bytes.slice(from, from + 32)).toString("hex")).toString();
+    return {
+        pi_a: [be(packed.proofA, 0), be(packed.proofA, 32), "1"],
+        pi_b: [
+            [be(packed.proofB, 32), be(packed.proofB, 0)],
+            [be(packed.proofB, 96), be(packed.proofB, 64)],
+            ["1", "0"],
+        ],
+        pi_c: [be(packed.proofC, 0), be(packed.proofC, 32), "1"],
+        protocol: "groth16",
+        curve: "bn128",
+    };
+}

package/dist/tests/shield.test.d.ts

@@ -0,0 +1 @@
+import "mocha";