@veilo/sdk-core 0.3.3 → 0.4.0

package/dist/tests/shield.test.js

@@ -0,0 +1,403 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert_1 = require("assert");
+const web3_js_1 = require("@solana/web3.js");
+const spl_token_1 = require("@solana/spl-token");
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const src_1 = require("../src");
+/**
+ * The de-risking test for `shield()`.
+ *
+ * Everything expensive and non-deterministic is stubbed — the prover, the tree
+ * source, the lookup table, the RPC — so what remains under test is the part
+ * that actually decides whether a shield works: does the assembled transaction
+ * fit in 1232 bytes, is it unsigned, does the note belong to the right person,
+ * and does `rebuild()` really avoid re-proving.
+ *
+ * The size assertions are the point. A shield that is 40 bytes too large fails
+ * at the wallet with an opaque error, and no amount of on-chain testing tells
+ * you which account caused it.
+ */
+const USDC = new web3_js_1.PublicKey("EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v");
+const BLOCKHASH_2 = new web3_js_1.PublicKey(new Uint8Array(32).fill(2)).toBase58();
+const BLOCKHASH_3 = new web3_js_1.PublicKey(new Uint8Array(32).fill(3)).toBase58();
+const BLOCKHASH_4 = new web3_js_1.PublicKey(new Uint8Array(32).fill(4)).toBase58();
+// --- stubs -------------------------------------------------------------------
+let proverCalls = 0;
+/** A structurally valid Groth16 proof. The values are nonsense; the sizes are not. */
+const stubProver = async () => {
+    proverCalls++;
+    const f = (n) => n.toString();
+    return {
+        pi_a: [f(1), f(2), f(1)],
+        pi_b: [
+            [f(3), f(4)],
+            [f(5), f(6)],
+            [f(1), f(0)],
+        ],
+        pi_c: [f(7), f(8), f(1)],
+        protocol: "groth16",
+        curve: "bn128",
+    };
+};
+function stubConnection(overrides = {}) {
+    return {
+        getLatestBlockhash: async () => ({
+            blockhash: "11111111111111111111111111111111",
+            lastValidBlockHeight: 123456789,
+        }),
+        getMinimumBalanceForRentExemption: async () => 961680,
+        ...overrides,
+    };
+}
+/** A lookup table containing exactly the accounts a shield needs compressed. */
+async function stubAlt(mint, outputTreeId, extra = []) {
+    const required = (0, src_1.requiredAltKeys)({ mint, outputTreeId }).map((k) => k.address);
+    const addresses = [...required, ...extra];
+    return new web3_js_1.AddressLookupTableAccount({
+        key: web3_js_1.PublicKey.unique(),
+        state: {
+            deactivationSlot: BigInt("18446744073709551615"),
+            lastExtendedSlot: 0,
+            lastExtendedSlotStartIndex: 0,
+            authority: undefined,
+            addresses,
+        },
+    });
+}
+function makeOwner() {
+    const wallet = tweetnacl_1.default.sign.keyPair();
+    return {
+        owner: (0, src_1.unsafeShieldOwner)({
+            veiloPublicKey: (0, src_1.generateKeypair)().publicKey,
+            noteViewingKey: new web3_js_1.PublicKey(wallet.publicKey),
+            acknowledgeOwnerInvariant: true,
+        }),
+        secretKey: wallet.secretKey,
+    };
+}
+const TARGET = {
+    inputTreeId: 0,
+    inputRoot: new Uint8Array(32).fill(9),
+    outputTreeId: 0,
+    outputNextIndex: 4242,
+};
+// --- tests -------------------------------------------------------------------
+describe("shield()", function () {
+    this.timeout(60000);
+    before(async () => {
+        await (0, src_1.initPoseidon)();
+    });
+    beforeEach(() => {
+        proverCalls = 0;
+    });
+    async function buildShield(opts = {}) {
+        const mint = opts.mint ?? src_1.NATIVE_SOL_MINT;
+        const outputTreeId = opts.outputTreeId ?? 0;
+        const { owner, secretKey } = opts.owner
+            ? { owner: opts.owner, secretKey: new Uint8Array(64) }
+            : makeOwner();
+        const signerPubkey = web3_js_1.Keypair.generate().publicKey;
+        const alt = await stubAlt(mint, outputTreeId);
+        const result = await (0, src_1.shield)({
+            connection: stubConnection(),
+            amount: opts.amount ?? 1000000000n,
+            mint,
+            owner,
+            signer: {
+                publicKey: signerPubkey,
+                tokenAccount: opts.signerTokenAccount,
+            },
+            prover: stubProver,
+            treeSource: (0, src_1.staticTreeSource)({ ...TARGET, outputTreeId }),
+            alt: (0, src_1.explicitAlt)(alt),
+            cache: (0, src_1.noCache)(),
+            preflight: false,
+            computeUnitPriceMicroLamports: opts.computeUnitPriceMicroLamports,
+        });
+        return { result, owner, secretKey, alt, signerPubkey, mint };
+    }
+    describe("size budget", () => {
+        it("fits under 1232 bytes for native SOL", async () => {
+            const { result } = await buildShield();
+            assert_1.strict.ok(result.quote.serializedSize <= src_1.MAX_TRANSACTION_BYTES, `SOL shield is ${result.quote.serializedSize} bytes, over ${src_1.MAX_TRANSACTION_BYTES}`);
+            assert_1.strict.equal(result.quote.serializedSize, result.transaction.serialize().length, "size quote must match the actual wire transaction exactly");
+            console.log(`        SOL/tree0:   ${result.quote.serializedSize} bytes ` +
+                `(${src_1.MAX_TRANSACTION_BYTES - result.quote.serializedSize} spare)`);
+        });
+        it("fits for an SPL mint on tree 0", async () => {
+            const signer = web3_js_1.Keypair.generate().publicKey;
+            const ata = await (0, spl_token_1.getAssociatedTokenAddress)(USDC, signer);
+            const { result } = await buildShield({ mint: USDC, signerTokenAccount: ata });
+            assert_1.strict.ok(result.quote.serializedSize <= src_1.MAX_TRANSACTION_BYTES, `USDC shield is ${result.quote.serializedSize} bytes`);
+            console.log(`        USDC/tree0:  ${result.quote.serializedSize} bytes ` +
+                `(${src_1.MAX_TRANSACTION_BYTES - result.quote.serializedSize} spare)`);
+        });
+        it("fits for an SPL mint on a non-zero tree", async () => {
+            const signer = web3_js_1.Keypair.generate().publicKey;
+            const ata = await (0, spl_token_1.getAssociatedTokenAddress)(USDC, signer);
+            const { result } = await buildShield({
+                mint: USDC,
+                outputTreeId: 3,
+                signerTokenAccount: ata,
+            });
+            assert_1.strict.ok(result.quote.serializedSize <= src_1.MAX_TRANSACTION_BYTES, `USDC/tree3 shield is ${result.quote.serializedSize} bytes — this is the case ` +
+                `that breaks first when the shared ALT only covers tree 0`);
+            console.log(`        USDC/tree3:  ${result.quote.serializedSize} bytes ` +
+                `(${src_1.MAX_TRANSACTION_BYTES - result.quote.serializedSize} spare)`);
+        });
+        it("reports which keys could not be compressed when it does not fit", async () => {
+            // A table missing the pool PDAs forces them to static keys.
+            const emptyAlt = new web3_js_1.AddressLookupTableAccount({
+                key: web3_js_1.PublicKey.unique(),
+                state: {
+                    deactivationSlot: BigInt("18446744073709551615"),
+                    lastExtendedSlot: 0,
+                    lastExtendedSlotStartIndex: 0,
+                    authority: undefined,
+                    addresses: [],
+                },
+            });
+            const { owner } = makeOwner();
+            await assert_1.strict.rejects((0, src_1.shield)({
+                connection: stubConnection(),
+                amount: 1000000n,
+                mint: USDC,
+                owner,
+                signer: { publicKey: web3_js_1.Keypair.generate().publicKey },
+                prover: stubProver,
+                treeSource: (0, src_1.staticTreeSource)(TARGET),
+                alt: (0, src_1.explicitAlt)(emptyAlt),
+                cache: (0, src_1.noCache)(),
+                preflight: false,
+            }), (e) => {
+                assert_1.strict.ok(e instanceof src_1.ShieldError);
+                assert_1.strict.equal(e.code, "TX_TOO_LARGE");
+                const keys = e.context?.uncompressedKeys;
+                assert_1.strict.ok(Array.isArray(keys) && keys.length > 0, "expected uncompressed key list");
+                return true;
+            });
+        });
+        it("omitting the priority fee saves bytes", async () => {
+            const withFee = await buildShield({ computeUnitPriceMicroLamports: 50000 });
+            const withoutFee = await buildShield({ computeUnitPriceMicroLamports: 0 });
+            assert_1.strict.ok(withoutFee.result.quote.serializedSize < withFee.result.quote.serializedSize, "dropping the priority-fee instruction should shrink the transaction");
+        });
+    });
+    describe("transaction shape", () => {
+        it("returns an unsigned v0 transaction with exactly one signature slot", async () => {
+            const { result } = await buildShield();
+            const tx = result.transaction;
+            assert_1.strict.ok(tx instanceof web3_js_1.VersionedTransaction);
+            assert_1.strict.equal(tx.signatures.length, 1, "expected exactly one signer");
+            assert_1.strict.ok(tx.signatures[0].every((b) => b === 0), "transaction must be returned UNSIGNED — the SDK never holds a key");
+        });
+        it("uses exactly one address lookup table", async () => {
+            const { result, alt } = await buildShield();
+            const lookups = result.transaction.message.addressTableLookups;
+            assert_1.strict.equal(lookups.length, 1);
+            assert_1.strict.equal(lookups[0].accountKey.toBase58(), alt.key.toBase58());
+        });
+        it("makes the signer the fee payer", async () => {
+            const { result, signerPubkey } = await buildShield();
+            assert_1.strict.equal(result.transaction.message.staticAccountKeys[0].toBase58(), signerPubkey.toBase58());
+        });
+        it("targets the Veilo program", async () => {
+            const { result } = await buildShield();
+            const keys = [
+                ...result.transaction.message.staticAccountKeys.map((k) => k.toBase58()),
+            ];
+            const lookups = result.transaction.message.addressTableLookups;
+            assert_1.strict.ok(keys.includes(src_1.PRIVACY_POOL_PROGRAM_ID.toBase58()) || lookups.length > 0, "program id must be reachable");
+        });
+    });
+    describe("note ownership", () => {
+        it("creates a note the recipient — and only the recipient — can decrypt", async () => {
+            const { result, secretKey } = await buildShield({ amount: 5000000n });
+            const recovered = (0, src_1.decryptCompactNoteCipher)(secretKey, result.note.compact.ephemeralPublicKey, result.note.compact.compactBlob);
+            assert_1.strict.ok(recovered, "the owner could not decrypt their own note");
+            assert_1.strict.equal(recovered.amount, 5000000n);
+            assert_1.strict.equal((0, src_1.bytesToBigIntBE)(recovered.blinding), result.note.blinding, "decrypted blinding must match the note");
+            const stranger = tweetnacl_1.default.sign.keyPair();
+            assert_1.strict.equal((0, src_1.decryptCompactNoteCipher)(stranger.secretKey, result.note.compact.ephemeralPublicKey, result.note.compact.compactBlob), null, "a stranger should not be able to decrypt this note");
+        });
+        it("binds the commitment to the owner's veilo key, not the signer", async () => {
+            const { result, owner, mint } = await buildShield({ amount: 7n });
+            const expected = (0, src_1.commitUTXO)({
+                amount: 7n,
+                pubkey: owner.veiloPublicKey,
+                blinding: result.note.blinding,
+                mintAddress: (0, src_1.pubkeyToField)(mint),
+            });
+            assert_1.strict.equal(Buffer.from(result.note.commitment).toString("hex"), Buffer.from(expected).toString("hex"));
+        });
+        it("refuses a hand-built owner that has not acknowledged the invariant", async () => {
+            const alt = await stubAlt(src_1.NATIVE_SOL_MINT, 0);
+            await assert_1.strict.rejects((0, src_1.shield)({
+                connection: stubConnection(),
+                amount: 1n,
+                owner: {
+                    veiloPublicKey: (0, src_1.generateKeypair)().publicKey,
+                    noteViewingKey: web3_js_1.PublicKey.unique(),
+                },
+                signer: { publicKey: web3_js_1.PublicKey.unique() },
+                prover: stubProver,
+                treeSource: (0, src_1.staticTreeSource)(TARGET),
+                alt: (0, src_1.explicitAlt)(alt),
+                cache: (0, src_1.noCache)(),
+                preflight: false,
+            }), (e) => {
+                assert_1.strict.ok(e instanceof src_1.ShieldError);
+                assert_1.strict.equal(e.code, "OWNER_INVARIANT_UNACKNOWLEDGED");
+                return true;
+            });
+            assert_1.strict.equal(proverCalls, 0, "should fail before spending time on a proof");
+        });
+        it("rejects a non-positive amount", async () => {
+            const alt = await stubAlt(src_1.NATIVE_SOL_MINT, 0);
+            const { owner } = makeOwner();
+            await assert_1.strict.rejects((0, src_1.shield)({
+                connection: stubConnection(),
+                amount: 0n,
+                owner,
+                signer: { publicKey: web3_js_1.PublicKey.unique() },
+                prover: stubProver,
+                treeSource: (0, src_1.staticTreeSource)(TARGET),
+                alt: (0, src_1.explicitAlt)(alt),
+                cache: (0, src_1.noCache)(),
+                preflight: false,
+            }), /positive/);
+        });
+        it("rejects a full output tree before invoking the prover", async () => {
+            const alt = await stubAlt(src_1.NATIVE_SOL_MINT, 0);
+            const { owner } = makeOwner();
+            await assert_1.strict.rejects((0, src_1.shield)({
+                connection: stubConnection(),
+                amount: 1n,
+                owner,
+                signer: { publicKey: web3_js_1.Keypair.generate().publicKey },
+                prover: stubProver,
+                treeSource: (0, src_1.staticTreeSource)({
+                    ...TARGET,
+                    outputNextIndex: 2 ** 22,
+                }),
+                alt: (0, src_1.explicitAlt)(alt),
+                cache: (0, src_1.noCache)(),
+                preflight: false,
+            }), (error) => {
+                assert_1.strict.ok(error instanceof src_1.ShieldError);
+                assert_1.strict.equal(error.code, "TREE_FULL");
+                return true;
+            });
+            assert_1.strict.equal(proverCalls, 0, "a full tree must fail before proof generation");
+        });
+    });
+    describe("rebuild()", () => {
+        it("does not invoke the prover again", async () => {
+            const { result, alt } = await buildShield();
+            assert_1.strict.equal(proverCalls, 1);
+            await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_2, lastValidBlockHeight: 2 },
+            });
+            await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_3, lastValidBlockHeight: 3 },
+            });
+            await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_4, lastValidBlockHeight: 4 },
+            });
+            assert_1.strict.equal(proverCalls, 1, "rebuild() must reuse the cached proof — re-proving costs 10-30s");
+        });
+        it("changes only the blockhash and the deadline bytes", async () => {
+            const { result, alt } = await buildShield();
+            const before = result.transaction.message.compiledInstructions;
+            const again = await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_2, lastValidBlockHeight: 2 },
+                deadlineSeconds: 7200,
+            });
+            const after = again.transaction.message.compiledInstructions;
+            assert_1.strict.equal(before.length, after.length);
+            // The transact instruction is last; its data must differ ONLY in the
+            // 8-byte deadline field.
+            const b = Buffer.from(before[before.length - 1].data);
+            const a = Buffer.from(after[after.length - 1].data);
+            assert_1.strict.equal(a.length, b.length);
+            const differing = [];
+            for (let i = 0; i < a.length; i++)
+                if (a[i] !== b[i])
+                    differing.push(i);
+            assert_1.strict.ok(differing.length > 0 && differing.length <= 8, `expected only the deadline to change, but ${differing.length} bytes differ`);
+            // Deadline sits after discriminator(8) + root(32) + treeIds(4) +
+            // publicAmount(8) + extDataHash(32) + mint(32) + nullifiers/commitments(128).
+            const deadlineOffset = 8 + 32 + 4 + 8 + 32 + 32 + 128;
+            for (const i of differing) {
+                assert_1.strict.ok(i >= deadlineOffset && i < deadlineOffset + 8, `byte ${i} changed but is outside the deadline field at ${deadlineOffset}..${deadlineOffset + 8}`);
+            }
+        });
+        it("keeps the account keys identical", async () => {
+            const { result, alt } = await buildShield();
+            const again = await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_2, lastValidBlockHeight: 2 },
+            });
+            assert_1.strict.deepEqual(result.transaction.message.staticAccountKeys.map((k) => k.toBase58()), again.transaction.message.staticAccountKeys.map((k) => k.toBase58()));
+        });
+        it("carries the new blockhash through to the result", async () => {
+            const { result, alt } = await buildShield();
+            const again = await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_2, lastValidBlockHeight: 99 },
+            });
+            assert_1.strict.equal(again.blockhash, BLOCKHASH_2);
+            assert_1.strict.equal(again.lastValidBlockHeight, 99);
+            assert_1.strict.ok(again.deadline >= result.deadline);
+        });
+        it("preserves the note across rebuilds", async () => {
+            const { result, alt, secretKey } = await buildShield();
+            const again = await (0, src_1.rebuild)(result, {
+                alt,
+                blockhash: { blockhash: BLOCKHASH_2, lastValidBlockHeight: 2 },
+            });
+            assert_1.strict.equal(Buffer.from(again.note.commitment).toString("hex"), Buffer.from(result.note.commitment).toString("hex"));
+            assert_1.strict.ok((0, src_1.decryptCompactNoteCipher)(secretKey, again.note.compact.ephemeralPublicKey, again.note.compact.compactBlob));
+        });
+    });
+    describe("proof cache", () => {
+        it("round-trips through JSON", async () => {
+            const { result } = await buildShield();
+            const back = (0, src_1.deserializeProofCache)((0, src_1.serializeProofCache)(result.proofCache));
+            assert_1.strict.deepEqual(back, result.proofCache);
+        });
+        it("carries no secret material", async () => {
+            const { result } = await buildShield();
+            const json = (0, src_1.serializeProofCache)(result.proofCache);
+            // The blinding is the secret that makes a note spendable. It must never
+            // appear in the cache, which is explicitly documented as safe to transmit.
+            const blindingHex = result.note.blinding.toString(16).padStart(64, "0");
+            assert_1.strict.ok(!json.toLowerCase().includes(blindingHex.toLowerCase()), "the proof cache leaked the note blinding");
+            assert_1.strict.ok(!json.includes("privateKey"));
+        });
+        it("rejects an unknown cache version", () => {
+            assert_1.strict.throws(() => (0, src_1.deserializeProofCache)(JSON.stringify({ version: 99 })), /version/);
+        });
+    });
+    describe("quote", () => {
+        it("prices the burned nullifier-marker rent", async () => {
+            const { result } = await buildShield();
+            // Two markers at the stubbed rent-exemption minimum.
+            assert_1.strict.equal(result.quote.estimatedRentLamports, 961680n * 2n);
+            assert_1.strict.ok(result.quote.estimatedFeeLamports > 0n);
+        });
+        it("reports the predicted leaf index as given by the tree source", async () => {
+            const { result } = await buildShield();
+            assert_1.strict.equal(result.predictedLeafIndex, TARGET.outputNextIndex);
+        });
+    });
+});

package/dist/tests/utxo.test.d.ts

@@ -0,0 +1 @@
+import "mocha";

package/dist/tests/utxo.test.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert_1 = require("assert");
+const src_1 = require("../src");
+describe("UTXO helpers", function () {
+    this.timeout(10000);
+    before(async () => {
+        await (0, src_1.initPoseidon)();
+    });
+    describe("Keypair generation", () => {
+        it("generates a random keypair", () => {
+            const kp = (0, src_1.generateKeypair)();
+            assert_1.strict.ok(kp.privateKey > 0n, "privateKey should be positive");
+            assert_1.strict.ok(kp.publicKey > 0n, "publicKey should be positive");
+            assert_1.strict.ok(kp.privateKey < src_1.BN254_FR_MODULUS, "privateKey should be less than field modulus");
+            assert_1.strict.ok(kp.publicKey < src_1.BN254_FR_MODULUS, "publicKey should be less than field modulus");
+        });
+        it("derives public key deterministically", () => {
+            const privateKey = 12345n;
+            const pubkey1 = (0, src_1.derivePublicKey)(privateKey);
+            const pubkey2 = (0, src_1.derivePublicKey)(privateKey);
+            assert_1.strict.equal(pubkey1, pubkey2, "public key derivation should be deterministic");
+        });
+        it("creates keypair from private key", () => {
+            const privateKey = 67890n;
+            const kp = (0, src_1.keypairFromPrivateKey)(privateKey);
+            assert_1.strict.equal(kp.privateKey, privateKey);
+            assert_1.strict.equal(kp.publicKey, (0, src_1.derivePublicKey)(privateKey));
+        });
+    });
+    describe("UTXO creation", () => {
+        it("creates a UTXO with commitment", () => {
+            const kp = (0, src_1.generateKeypair)();
+            const utxo = (0, src_1.createUTXO)({
+                amount: 1000000n,
+                pubkey: kp.publicKey,
+                mintAddress: src_1.NATIVE_SOL_MINT,
+            });
+            assert_1.strict.equal(utxo.amount, 1000000n);
+            assert_1.strict.equal(utxo.pubkey, kp.publicKey);
+            assert_1.strict.ok(utxo.blinding > 0n, "blinding should be positive");
+            assert_1.strict.equal(utxo.commitment.length, 32);
+        });
+        it("creates an owned UTXO with private key", () => {
+            const privateKey = 11111n;
+            const utxo = (0, src_1.createOwnedUTXO)({
+                amount: 500000n,
+                privateKey,
+                mintAddress: src_1.NATIVE_SOL_MINT,
+            });
+            assert_1.strict.equal(utxo.amount, 500000n);
+            assert_1.strict.equal(utxo.privateKey, privateKey);
+            assert_1.strict.equal(utxo.pubkey, (0, src_1.derivePublicKey)(privateKey));
+            assert_1.strict.equal(utxo.commitment.length, 32);
+        });
+        it("creates a zero UTXO", () => {
+            const kp = (0, src_1.generateKeypair)();
+            const utxo = (0, src_1.createZeroUTXO)(kp.publicKey, src_1.NATIVE_SOL_MINT);
+            assert_1.strict.equal(utxo.amount, 0n);
+            assert_1.strict.equal(utxo.pubkey, kp.publicKey);
+            assert_1.strict.equal(utxo.commitment.length, 32);
+        });
+        it("creates an owned zero UTXO", () => {
+            const privateKey = 22222n;
+            const utxo = (0, src_1.createOwnedZeroUTXO)(privateKey, src_1.NATIVE_SOL_MINT);
+            assert_1.strict.equal(utxo.amount, 0n);
+            assert_1.strict.equal(utxo.privateKey, privateKey);
+            assert_1.strict.equal(utxo.pubkey, (0, src_1.derivePublicKey)(privateKey));
+        });
+    });
+    describe("UTXO commitment", () => {
+        it("computes commitment deterministically", () => {
+            const kp = (0, src_1.generateKeypair)();
+            const utxo1 = {
+                amount: 1000n,
+                pubkey: kp.publicKey,
+                blinding: 12345n,
+                mintAddress: 0n,
+            };
+            const utxo2 = { ...utxo1 };
+            const commitment1 = (0, src_1.commitUTXO)(utxo1);
+            const commitment2 = (0, src_1.commitUTXO)(utxo2);
+            assert_1.strict.equal(commitment1.length, 32);
+            assert_1.strict.equal(Buffer.compare(Buffer.from(commitment1), Buffer.from(commitment2)), 0, "commitment should be deterministic");
+        });
+        it("produces different commitments for different amounts", () => {
+            const kp = (0, src_1.generateKeypair)();
+            const utxo1 = {
+                amount: 1000n,
+                pubkey: kp.publicKey,
+                blinding: 12345n,
+                mintAddress: 0n,
+            };
+            const utxo2 = {
+                ...utxo1,
+                amount: 2000n,
+            };
+            const commitment1 = (0, src_1.commitUTXO)(utxo1);
+            const commitment2 = (0, src_1.commitUTXO)(utxo2);
+            assert_1.strict.notEqual(Buffer.compare(Buffer.from(commitment1), Buffer.from(commitment2)), 0, "different amounts should produce different commitments");
+        });
+    });
+    describe("Nullifier derivation", () => {
+        it("derives nullifier from UTXO", () => {
+            const privateKey = 33333n;
+            const utxo = (0, src_1.createOwnedUTXO)({
+                amount: 1000000n,
+                privateKey,
+                mintAddress: src_1.NATIVE_SOL_MINT,
+            });
+            const pathIndex = 5;
+            const nullifier = (0, src_1.deriveNullifier)(utxo, pathIndex, privateKey);
+            assert_1.strict.equal(nullifier.length, 32);
+        });
+        it("produces different nullifiers for different path indices", () => {
+            const privateKey = 44444n;
+            const utxo = (0, src_1.createOwnedUTXO)({
+                amount: 1000000n,
+                privateKey,
+                mintAddress: src_1.NATIVE_SOL_MINT,
+            });
+            const nullifier1 = (0, src_1.deriveNullifier)(utxo, 0, privateKey);
+            const nullifier2 = (0, src_1.deriveNullifier)(utxo, 1, privateKey);
+            assert_1.strict.notEqual(Buffer.compare(Buffer.from(nullifier1), Buffer.from(nullifier2)), 0, "different path indices should produce different nullifiers");
+        });
+        it("produces same nullifier for same inputs", () => {
+            const privateKey = 55555n;
+            const utxo = (0, src_1.createOwnedUTXO)({
+                amount: 1000000n,
+                privateKey,
+                mintAddress: src_1.NATIVE_SOL_MINT,
+            });
+            const pathIndex = 10;
+            const nullifier1 = (0, src_1.deriveNullifier)(utxo, pathIndex, privateKey);
+            const nullifier2 = (0, src_1.deriveNullifier)(utxo, pathIndex, privateKey);
+            assert_1.strict.equal(Buffer.compare(Buffer.from(nullifier1), Buffer.from(nullifier2)), 0, "same inputs should produce same nullifier");
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veilo/sdk-core",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "TypeScript SDK for the Veilo Privacy Pool - UTXO-based privacy protocol on Solana with ZK-SNARKs",
   "homepage": "https://github.com/VeiloSolana/veilo-sdk#readme",
   "bugs": {
@@ -18,19 +18,64 @@
   "types": "dist/cjs/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/esm/index.js",
-      "require": "./dist/cjs/index.js",
-      "types": "./dist/cjs/index.d.ts"
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
     },
     "./config": {
-      "import": "./dist/esm/config.js",
-      "require": "./dist/cjs/config.js",
-      "types": "./dist/cjs/config.d.ts"
+      "import": {
+        "types": "./dist/esm/config.d.ts",
+        "default": "./dist/esm/config.js"
+      },
+      "require": {
+        "types": "./dist/cjs/config.d.ts",
+        "default": "./dist/cjs/config.js"
+      }
     },
     "./poseidon": {
-      "import": "./dist/esm/poseidon.js",
-      "require": "./dist/cjs/poseidon.js",
-      "types": "./dist/cjs/poseidon.d.ts"
+      "import": {
+        "types": "./dist/esm/poseidon.d.ts",
+        "default": "./dist/esm/poseidon.js"
+      },
+      "require": {
+        "types": "./dist/cjs/poseidon.d.ts",
+        "default": "./dist/cjs/poseidon.js"
+      }
+    },
+    "./proof": {
+      "import": {
+        "types": "./dist/esm/proof.d.ts",
+        "default": "./dist/esm/proof.js"
+      },
+      "require": {
+        "types": "./dist/cjs/proof.d.ts",
+        "default": "./dist/cjs/proof.js"
+      }
+    },
+    "./prover": {
+      "import": {
+        "types": "./dist/esm/prover.d.ts",
+        "default": "./dist/esm/prover.js"
+      },
+      "require": {
+        "types": "./dist/cjs/prover.d.ts",
+        "default": "./dist/cjs/prover.js"
+      }
+    },
+    "./shield": {
+      "import": {
+        "types": "./dist/esm/shield/index.d.ts",
+        "default": "./dist/esm/shield/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/shield/index.d.ts",
+        "default": "./dist/cjs/shield/index.js"
+      }
     },
     "./package.json": "./package.json"
   },
@@ -40,14 +85,27 @@
   "sideEffects": false,
   "files": [
     "dist/",
+    "config.js",
+    "config.d.ts",
+    "poseidon.js",
+    "poseidon.d.ts",
+    "proof.js",
+    "proof.d.ts",
+    "prover.js",
+    "prover.d.ts",
+    "shield.js",
+    "shield.d.ts",
     "README.md",
+    "SHIELD_INTEGRATION.md",
     "LICENSE"
   ],
   "directories": {
     "test": "tests"
   },
   "scripts": {
-    "build": "rm -rf dist/ && tsc -p tsconfig.json && tsc -p tsconfig.esm.json",
+    "gen:idl": "node scripts/gen-idl.mjs",
+    "verify:cipher-parity": "npm run build && node scripts/verify-compact-cipher-parity.mjs",
+    "build": "rm -rf dist/ && tsc -p tsconfig.json && tsc -p tsconfig.esm.json && echo '{\"type\":\"module\"}' > dist/esm/package.json",
     "test": "rm -rf dist/ && export ANCHOR_PROVIDER_URL=https://api.devnet.solana.com && export ANCHOR_WALLET=$HOME/.config/solana/id.json && tsc -p test-tsconfig.json && mocha -t 1000000 \"dist/tests/**/*.js\""
   },
   "dependencies": {

package/poseidon.d.ts

@@ -0,0 +1,2 @@
+// Stub for legacy resolvers — see poseidon.js
+export * from "./dist/cjs/poseidon.js";

package/poseidon.js

@@ -0,0 +1,4 @@
+// Stub for legacy resolvers (TypeScript moduleResolution: "node", older bundlers)
+// that ignore the "exports" map. Modern resolvers use "./poseidon" from package.json
+// exports and never reach this file.
+module.exports = require("./dist/cjs/poseidon.js");

package/proof.d.ts

@@ -0,0 +1,2 @@
+// Stub for legacy resolvers — see proof.js
+export * from "./dist/cjs/proof.js";