@veilo/sdk-core 0.3.3 → 0.5.0

package/dist/esm/notes/model.js

@@ -0,0 +1,99 @@
+import { randomBytes } from "../random.js";
+import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon1, poseidon4, pubkeyToField, } from "../poseidon.js";
+// -----------------------------------------------------------------------------
+// Keypair Functions
+// -----------------------------------------------------------------------------
+/**
+ * Generate a random keypair.
+ * Private key is a random 32-byte scalar.
+ * Public key is derived via Poseidon: pubkey = Poseidon(privateKey)
+ */
+export function generateKeypair() {
+    const privateKeyBytes = new Uint8Array(randomBytes(32));
+    const privateKey = bytesToBigIntBE(privateKeyBytes) % BN254_FR_MODULUS;
+    const publicKey = derivePublicKey(privateKey);
+    return { privateKey, publicKey };
+}
+/**
+ * Derive public key from private key.
+ * Matches circuit's Keypair template: publicKey = Poseidon(privateKey)
+ */
+export function derivePublicKey(privateKey) {
+    return poseidon1(privateKey);
+}
+/**
+ * Create keypair from a known private key.
+ */
+export function keypairFromPrivateKey(privateKey) {
+    return {
+        privateKey: privateKey % BN254_FR_MODULUS,
+        publicKey: derivePublicKey(privateKey % BN254_FR_MODULUS),
+    };
+}
+// -----------------------------------------------------------------------------
+// UTXO Commitment Functions
+// -----------------------------------------------------------------------------
+/**
+ * Compute UTXO commitment.
+ * Matches circuit's UTXOCommitment template:
+ *   commitment = Poseidon(amount, pubkey, blinding, mintAddress)
+ */
+export function commitUTXO(utxo) {
+    const commitment = poseidon4(utxo.amount, utxo.pubkey, utxo.blinding, utxo.mintAddress);
+    return bigIntToBytesBE(commitment);
+}
+/**
+ * Create a random UTXO with the given parameters.
+ */
+export function createUTXO(params) {
+    const blindingBytes = new Uint8Array(randomBytes(32));
+    const blinding = bytesToBigIntBE(blindingBytes) % BN254_FR_MODULUS;
+    const utxo = {
+        amount: params.amount,
+        pubkey: params.pubkey,
+        blinding,
+        mintAddress: pubkeyToField(params.mintAddress),
+    };
+    const commitment = commitUTXO(utxo);
+    return {
+        ...utxo,
+        commitment,
+    };
+}
+/**
+ * Create a UTXO with a specified private key (for owned UTXOs).
+ */
+export function createOwnedUTXO(params) {
+    const keypair = keypairFromPrivateKey(params.privateKey);
+    const utxo = createUTXO({
+        amount: params.amount,
+        pubkey: keypair.publicKey,
+        mintAddress: params.mintAddress,
+    });
+    return {
+        ...utxo,
+        privateKey: keypair.privateKey,
+    };
+}
+/**
+ * Create a zero UTXO (for deposits where no input exists).
+ * Zero UTXOs have amount=0 and are used as placeholders in 2-in-2-out transactions.
+ */
+export function createZeroUTXO(pubkey, mintAddress) {
+    return createUTXO({
+        amount: 0n,
+        pubkey,
+        mintAddress,
+    });
+}
+/**
+ * Create a zero UTXO with private key (for owned zero UTXOs).
+ */
+export function createOwnedZeroUTXO(privateKey, mintAddress) {
+    const keypair = keypairFromPrivateKey(privateKey);
+    const utxo = createZeroUTXO(keypair.publicKey, mintAddress);
+    return {
+        ...utxo,
+        privateKey: keypair.privateKey,
+    };
+}

package/dist/esm/notes/nullifier.d.ts

@@ -0,0 +1,27 @@
+import type { InputUTXO, SerializedUTXO } from "./model.js";
+/**
+ * Compute signature for nullifier derivation.
+ * Matches circuit's Signature template:
+ *   signature = Poseidon(privateKey, commitment, pathIndex)
+ */
+export declare function computeSignature(privateKey: bigint, commitment: bigint, pathIndex: bigint): bigint;
+/**
+ * Derive nullifier for a UTXO.
+ * Matches circuit's UTXONullifier template:
+ *   signature = Poseidon(privateKey, commitment, pathIndex)
+ *   nullifier = Poseidon(commitment, pathIndex, signature)
+ *
+ * The signature-based nullifier ensures only the private key holder can spend.
+ */
+export declare function deriveNullifier(utxo: SerializedUTXO, pathIndex: number, privateKey: bigint): Uint8Array;
+/**
+ * Convert InputUTXO to the format expected by the circuit.
+ */
+export declare function inputUTXOToCircuitFormat(input: InputUTXO): {
+    amount: bigint;
+    pubkey: bigint;
+    blinding: bigint;
+    pathElements: bigint[];
+    pathIndex: number;
+    privateKey: bigint;
+};

package/dist/esm/notes/nullifier.js

@@ -0,0 +1,40 @@
+import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon3, } from "../poseidon.js";
+// -----------------------------------------------------------------------------
+// Nullifier Functions
+// -----------------------------------------------------------------------------
+/**
+ * Compute signature for nullifier derivation.
+ * Matches circuit's Signature template:
+ *   signature = Poseidon(privateKey, commitment, pathIndex)
+ */
+export function computeSignature(privateKey, commitment, pathIndex) {
+    return poseidon3(privateKey, commitment, pathIndex);
+}
+/**
+ * Derive nullifier for a UTXO.
+ * Matches circuit's UTXONullifier template:
+ *   signature = Poseidon(privateKey, commitment, pathIndex)
+ *   nullifier = Poseidon(commitment, pathIndex, signature)
+ *
+ * The signature-based nullifier ensures only the private key holder can spend.
+ */
+export function deriveNullifier(utxo, pathIndex, privateKey) {
+    const commitment = bytesToBigIntBE(utxo.commitment) % BN254_FR_MODULUS;
+    const pathIndexField = BigInt(pathIndex) % BN254_FR_MODULUS;
+    const signature = computeSignature(privateKey, commitment, pathIndexField);
+    const nullifier = poseidon3(commitment, pathIndexField, signature);
+    return bigIntToBytesBE(nullifier);
+}
+/**
+ * Convert InputUTXO to the format expected by the circuit.
+ */
+export function inputUTXOToCircuitFormat(input) {
+    return {
+        amount: input.amount,
+        pubkey: input.pubkey,
+        blinding: input.blinding,
+        pathElements: input.pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
+        pathIndex: input.pathIndex,
+        privateKey: input.privateKey,
+    };
+}

package/dist/esm/notes/recovery.d.ts

@@ -0,0 +1,10 @@
+import type { DecryptedNote } from "./mailbox.js";
+/**
+ * Fetch all encrypted notes for a wallet from the relayer's Blind Mailbox endpoint
+ * and decrypt them using the wallet's secret key.
+ *
+ * @param walletPublicKey  Base58 wallet address used to query the relayer
+ * @param walletSecretKey  Full 64-byte keypair.secretKey for decryption
+ * @param relayerUrl       Relayer base URL (e.g. "https://relay.veilo.app")
+ */
+export declare function fetchAndDecryptNotes(walletPublicKey: string, walletSecretKey: Uint8Array, relayerUrl: string): Promise<DecryptedNote[]>;

package/dist/esm/notes/recovery.js

@@ -0,0 +1,28 @@
+import { decryptBlindMailboxNote } from "./mailbox.js";
+/**
+ * Fetch all encrypted notes for a wallet from the relayer's Blind Mailbox endpoint
+ * and decrypt them using the wallet's secret key.
+ *
+ * @param walletPublicKey  Base58 wallet address used to query the relayer
+ * @param walletSecretKey  Full 64-byte keypair.secretKey for decryption
+ * @param relayerUrl       Relayer base URL (e.g. "https://relay.veilo.app")
+ */
+export async function fetchAndDecryptNotes(walletPublicKey, walletSecretKey, relayerUrl) {
+    const resp = await fetch(`${relayerUrl}/api/notes?recipientPublicKey=${walletPublicKey}`);
+    if (!resp.ok) {
+        throw new Error(`fetchAndDecryptNotes: ${resp.status} ${resp.statusText}`);
+    }
+    const { notes } = (await resp.json());
+    const results = [];
+    for (const note of notes) {
+        try {
+            const epk = Buffer.from(note.ephemeralPublicKey, "base64");
+            const decrypted = decryptBlindMailboxNote(walletSecretKey, new Uint8Array(epk), note.encryptedBlob);
+            results.push(decrypted);
+        }
+        catch {
+            // Note not for this key or corrupted — skip silently
+        }
+    }
+    return results;
+}

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/esm/poseidon.d.ts

@@ -0,0 +1,29 @@
+import { PublicKey } from "@solana/web3.js";
+/** Poseidon hash function type from circomlibjs. */
+export type PoseidonFn = ((inputs: bigint[]) => any) & {
+    F: {
+        toObject: (e: any) => bigint;
+    };
+};
+/** Initialize the Poseidon hash instance. Must be called once before using any UTXO/merkle/proof helpers. */
+export declare function initPoseidon(): Promise<void>;
+/** Get the initialized Poseidon instance. Throws if `initPoseidon()` has not been called. */
+export declare function getPoseidon(): PoseidonFn;
+/** The BN254 (alt_bn128) scalar field modulus. All Poseidon outputs are reduced modulo this value. */
+export declare const BN254_FR_MODULUS: bigint;
+/** Convert a big-endian byte array to a bigint. */
+export declare function bytesToBigIntBE(bytes: Uint8Array): bigint;
+/** Convert a bigint to a 32-byte big-endian array. */
+export declare function bigIntToBytesBE(x: bigint): Uint8Array;
+/** Convert ffjavascript field element → bigint safely */
+export declare function frToBigInt(fe: any): bigint;
+/** Poseidon hash with 1 input - used for keypair derivation: pubkey = Poseidon(privateKey) */
+export declare function poseidon1(a: bigint): bigint;
+/** Poseidon hash with 2 inputs */
+export declare function poseidon2(a: bigint, b: bigint): bigint;
+/** Poseidon hash with 3 inputs - used for signature: Poseidon(privateKey, commitment, pathIndex) */
+export declare function poseidon3(a: bigint, b: bigint, c: bigint): bigint;
+/** Poseidon hash with 4 inputs - used for UTXO commitment: Poseidon(amount, pubkey, blinding, mintAddress) */
+export declare function poseidon4(a: bigint, b: bigint, c: bigint, d: bigint): bigint;
+/** Convert a Solana PublicKey to a BN254 field element */
+export declare function pubkeyToField(pubkey: PublicKey): bigint;

package/dist/esm/program.d.ts

@@ -0,0 +1,37 @@
+import { Program, Idl, Wallet } from "@coral-xyz/anchor";
+import { Connection, PublicKey } from "@solana/web3.js";
+export declare const PRIVACY_POOL_IDL: Idl;
+/** Deployed program ID extracted from the bundled IDL. */
+export declare const PRIVACY_POOL_PROGRAM_ID: PublicKey;
+/**
+ * Create an Anchor `Program` instance for the Veilo Privacy Pool.
+ *
+ * @param connection  Solana RPC connection
+ * @param wallet      Anchor-compatible wallet (must implement `publicKey` and `signTransaction`)
+ * @param opts        Optional commitment level (default: "confirmed")
+ *
+ * @example
+ * ```ts
+ * import { createVeiloProgram } from "@veilo/sdk-core";
+ * import { Connection } from "@solana/web3.js";
+ *
+ * const program = createVeiloProgram(
+ *   new Connection("https://api.devnet.solana.com"),
+ *   wallet,
+ * );
+ * ```
+ */
+export declare function createVeiloProgram(connection: Connection, wallet: Wallet, opts?: {
+    commitment?: "processed" | "confirmed" | "finalized";
+}): Program;
+/**
+ * Create a `Program` for reading on-chain accounts, with no wallet.
+ *
+ * The shield path never signs, so requiring a `Wallet` just to decode a
+ * `MerkleTreeAccount` would force integrators to invent a dummy one. This is
+ * safe for `program.account.*.fetch` and the coders; anything that would submit
+ * a transaction will fail, which is the intent.
+ */
+export declare function createReadonlyVeiloProgram(connection: Connection, opts?: {
+    commitment?: "processed" | "confirmed" | "finalized";
+}): Program;

package/dist/esm/program.js

@@ -1,6 +1,6 @@
 import { Program, AnchorProvider } from "@coral-xyz/anchor";
 import { PublicKey } from "@solana/web3.js";
-import IDL_JSON from "./idl/privacy_pool.json";
+import IDL_JSON from "./idl/privacy_pool.js";
 // Re-export so consumers can access the raw IDL if needed
 export const PRIVACY_POOL_IDL = IDL_JSON;
 /** Deployed program ID extracted from the bundled IDL. */
@@ -29,3 +29,25 @@ export function createVeiloProgram(connection, wallet, opts) {
     });
     return new Program(PRIVACY_POOL_IDL, provider);
 }
+/**
+ * Create a `Program` for reading on-chain accounts, with no wallet.
+ *
+ * The shield path never signs, so requiring a `Wallet` just to decode a
+ * `MerkleTreeAccount` would force integrators to invent a dummy one. This is
+ * safe for `program.account.*.fetch` and the coders; anything that would submit
+ * a transaction will fail, which is the intent.
+ */
+export function createReadonlyVeiloProgram(connection, opts) {
+    const provider = new AnchorProvider(connection, 
+    // No signing surface: reads only.
+    {
+        publicKey: PublicKey.default,
+        signTransaction: () => {
+            throw new Error("createReadonlyVeiloProgram: this program cannot sign");
+        },
+        signAllTransactions: () => {
+            throw new Error("createReadonlyVeiloProgram: this program cannot sign");
+        },
+    }, { commitment: opts?.commitment ?? "confirmed" });
+    return new Program(PRIVACY_POOL_IDL, provider);
+}

package/dist/esm/proof.d.ts

@@ -0,0 +1 @@
+export * from "./proofs/index.js";

package/dist/esm/proof.js

@@ -1,281 +1,2 @@
-import { sha256 } from "@noble/hashes/sha256";
-import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon2, poseidon3, pubkeyToField, } from "./poseidon";
-import { deriveNullifier } from "./utxo";
-// -----------------------------------------------------------------------------
-// ExtData Hash Computation
-// -----------------------------------------------------------------------------
-/**
- * Compute the external data hash.
- * Matches on-chain computation:
- *   hash1 = Poseidon(recipient, relayer)
- *   hash2 = Poseidon(fee, refund)
- *   extDataHash = Poseidon(hash1, hash2, claimant)
- */
-export function computeExtDataHash(extData) {
-    const recipientField = pubkeyToField(extData.recipient);
-    const relayerField = pubkeyToField(extData.relayer);
-    const feeField = extData.fee % BN254_FR_MODULUS;
-    const refundField = extData.refund % BN254_FR_MODULUS;
-    const claimantField = pubkeyToField(extData.claimant);
-    const hash1 = poseidon2(recipientField, relayerField);
-    const hash2 = poseidon2(feeField, refundField);
-    const finalHash = poseidon3(hash1, hash2, claimantField);
-    return bigIntToBytesBE(finalHash);
-}
-// -----------------------------------------------------------------------------
-// Circuit Input Preparation
-// -----------------------------------------------------------------------------
-/**
- * Convert i64 to field element (handles negative via modular arithmetic).
- * For negative values, we add the field modulus to get the equivalent positive representation.
- */
-export function i64ToField(value) {
-    if (value >= 0n) {
-        return value % BN254_FR_MODULUS;
-    }
-    return (BN254_FR_MODULUS + value) % BN254_FR_MODULUS;
-}
-/**
- * Prepare transaction circuit inputs from high-level parameters.
- * This converts the SDK types into the format expected by the circuit.
- */
-export function prepareTransactionInputs(params) {
-    const { inputUTXOs, outputUTXOs, root, publicAmount, extData, mintAddress } = params;
-    const extDataHash = computeExtDataHash(extData);
-    const mintField = pubkeyToField(mintAddress);
-    // Prepare input UTXO data
-    const inAmount = [
-        inputUTXOs[0].amount,
-        inputUTXOs[1].amount,
-    ];
-    const inPubkey = [
-        inputUTXOs[0].pubkey,
-        inputUTXOs[1].pubkey,
-    ];
-    const inBlinding = [
-        inputUTXOs[0].blinding,
-        inputUTXOs[1].blinding,
-    ];
-    const inPathIndex = [
-        inputUTXOs[0].pathIndex,
-        inputUTXOs[1].pathIndex,
-    ];
-    const inPathElements = [
-        inputUTXOs[0].pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
-        inputUTXOs[1].pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
-    ];
-    const inPrivateKey = [
-        inputUTXOs[0].privateKey,
-        inputUTXOs[1].privateKey,
-    ];
-    // Prepare output UTXO data
-    const outAmount = [
-        outputUTXOs[0].amount,
-        outputUTXOs[1].amount,
-    ];
-    const outPubkey = [
-        outputUTXOs[0].pubkey,
-        outputUTXOs[1].pubkey,
-    ];
-    const outBlinding = [
-        outputUTXOs[0].blinding,
-        outputUTXOs[1].blinding,
-    ];
-    // Derive nullifiers for input UTXOs
-    const inputNullifiers = [
-        deriveNullifier(inputUTXOs[0], inputUTXOs[0].pathIndex, inputUTXOs[0].privateKey),
-        deriveNullifier(inputUTXOs[1], inputUTXOs[1].pathIndex, inputUTXOs[1].privateKey),
-    ];
-    return {
-        root,
-        publicAmount,
-        extDataHash,
-        mintAddress,
-        inputNullifiers,
-        outputCommitments: [outputUTXOs[0].commitment, outputUTXOs[1].commitment],
-        inAmount,
-        inPubkey,
-        inBlinding,
-        inPathIndex,
-        inPathElements,
-        inPrivateKey,
-        outAmount,
-        outPubkey,
-        outBlinding,
-    };
-}
-// -----------------------------------------------------------------------------
-// Proof Packing
-// -----------------------------------------------------------------------------
-/**
- * Convert bigint to 32-byte big-endian representation.
- * The alt_bn128 Solana precompile (and ark-works via change_endianness) expect BE.
- */
-function bigintTo32BytesBE(x) {
-    const out = new Uint8Array(32);
-    let v = x;
-    for (let i = 31; i >= 0; i--) {
-        out[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return out;
-}
-/**
- * Turn a snarkjs Groth16 proof into 256 bytes:
- *   A(G1) | B(G2) | C(G1)
- * where:
- *   A = (ax, ay)               -> 64 bytes
- *   B = (bx1, bx0, by1, by0)  -> 128 bytes  (swapped pairs for alt_bn128)
- *   C = (cx, cy)               -> 64 bytes
- *
- * Each field element is encoded as 32-byte BE to match the on-chain verifier.
- * We ignore the extra projective/z components snarkjs keeps.
- */
-export function packProofToBytes(proof) {
-    const chunks = [];
-    const ax = BigInt(proof.pi_a[0]);
-    const ay = BigInt(proof.pi_a[1]);
-    chunks.push(bigintTo32BytesBE(ax), bigintTo32BytesBE(ay));
-    const bx = proof.pi_b[0];
-    const by = proof.pi_b[1];
-    const bx0 = BigInt(bx[0]);
-    const bx1 = BigInt(bx[1]);
-    const by0 = BigInt(by[0]);
-    const by1 = BigInt(by[1]);
-    // alt_bn128 expects the G2 pairs swapped: bx1 before bx0, by1 before by0
-    chunks.push(bigintTo32BytesBE(bx1), bigintTo32BytesBE(bx0), bigintTo32BytesBE(by1), bigintTo32BytesBE(by0));
-    const cx = BigInt(proof.pi_c[0]);
-    const cy = BigInt(proof.pi_c[1]);
-    chunks.push(bigintTo32BytesBE(cx), bigintTo32BytesBE(cy));
-    const out = new Uint8Array(32 * (2 + 4 + 2)); // 256
-    let offset = 0;
-    for (const c of chunks) {
-        out.set(c, offset);
-        offset += c.length;
-    }
-    return out;
-}
-/**
- * Encode a snarkjs proof into the TransactionProofStruct format expected by the on-chain program.
- */
-export function encodeSnarkjsProofToTransactionProof(proof) {
-    const full = packProofToBytes(proof);
-    if (full.length !== 256) {
-        throw new Error(`Expected 256 proof bytes, got ${full.length}`);
-    }
-    const proofA = full.slice(0, 64);
-    const proofB = full.slice(64, 192);
-    const proofC = full.slice(192, 256);
-    return {
-        proofA: Array.from(proofA),
-        proofB: Array.from(proofB),
-        proofC: Array.from(proofC),
-    };
-}
-// -----------------------------------------------------------------------------
-// Snarkjs Input Formatting
-// -----------------------------------------------------------------------------
-/**
- * Convert TransactionCircuitInputs to the format expected by snarkjs.groth16.fullProve().
- * All values are converted to strings (snarkjs expects string inputs for field elements).
- */
-export function formatInputsForSnarkjs(inputs) {
-    return {
-        // Public inputs
-        root: bytesToBigIntBE(inputs.root).toString(),
-        publicAmount: i64ToField(inputs.publicAmount).toString(),
-        extDataHash: bytesToBigIntBE(inputs.extDataHash).toString(),
-        mintAddress: pubkeyToField(inputs.mintAddress).toString(),
-        inputNullifier: inputs.inputNullifiers.map((n) => bytesToBigIntBE(n).toString()),
-        outputCommitment: inputs.outputCommitments.map((c) => bytesToBigIntBE(c).toString()),
-        // Private inputs - Input UTXOs
-        inAmount: inputs.inAmount.map((a) => a.toString()),
-        inPubkey: inputs.inPubkey.map((p) => p.toString()),
-        inBlinding: inputs.inBlinding.map((b) => b.toString()),
-        inPathIndex: inputs.inPathIndex.map((i) => i.toString()),
-        inPathElements: inputs.inPathElements.map((path) => path.map((e) => e.toString())),
-        inPrivateKey: inputs.inPrivateKey.map((k) => k.toString()),
-        // Private inputs - Output UTXOs
-        outAmount: inputs.outAmount.map((a) => a.toString()),
-        outPubkey: inputs.outPubkey.map((p) => p.toString()),
-        outBlinding: inputs.outBlinding.map((b) => b.toString()),
-    };
-}
-/**
- * Convert SwapCircuitInputs into the shape expected by
- * snarkjs.groth16.fullProve() for swap.circom. Every value is emitted as a
- * decimal string (or string array) because snarkjs only accepts field
- * elements as strings.
- *
- * Mirrors `generateSwapProof` in
- * relayer-server/src/controllers/swap.helpers.ts so SDK-side swap proofs
- * verify against the same circuit the relayer uses.
- */
-export function formatSwapInputsForSnarkjs(inputs) {
-    return {
-        // Public inputs
-        sourceRoot: bytesToBigIntBE(inputs.sourceRoot).toString(),
-        swapParamsHash: bytesToBigIntBE(inputs.swapParamsHash).toString(),
-        extDataHash: bytesToBigIntBE(inputs.extDataHash).toString(),
-        sourceMint: pubkeyToField(inputs.sourceMint).toString(),
-        destMint: pubkeyToField(inputs.destMint).toString(),
-        inputNullifier: inputs.inputNullifiers.map((n) => bytesToBigIntBE(n).toString()),
-        changeCommitment: bytesToBigIntBE(inputs.changeCommitment).toString(),
-        destCommitment: bytesToBigIntBE(inputs.destCommitment).toString(),
-        swapAmount: inputs.swapAmount.toString(),
-        // Private inputs - Input UTXOs
-        inAmount: inputs.inAmount.map((a) => a.toString()),
-        inPubkey: inputs.inPubkey.map((p) => p.toString()),
-        inBlinding: inputs.inBlinding.map((b) => b.toString()),
-        inPathIndex: inputs.inPathIndex.map((i) => i.toString()),
-        inPathElements: inputs.inPathElements.map((path) => path.map((e) => e.toString())),
-        inPrivateKey: inputs.inPrivateKey.map((k) => k.toString()),
-        // Private inputs - Change UTXO
-        changeAmount: inputs.changeAmount.toString(),
-        changePubkey: inputs.changePubkey.toString(),
-        changeBlinding: inputs.changeBlinding.toString(),
-        // Private inputs - Destination UTXO
-        destAmount: inputs.destAmount.toString(),
-        destPubkey: inputs.destPubkey.toString(),
-        destBlinding: inputs.destBlinding.toString(),
-        // Swap params
-        minAmountOut: inputs.minAmountOut.toString(),
-        deadline: inputs.deadline.toString(),
-    };
-}
-// -----------------------------------------------------------------------------
-// Swap Parameter Hashing
-// -----------------------------------------------------------------------------
-/**
- * Compute the swap params hash that the swap circuit and on-chain program verify.
- * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapParamsHash`.
- *
- * Circuit formula (swap.circom lines 293-307):
- *   mintPairHash   = Poseidon(sourceMint, destMint)
- *   swapTermsHash  = Poseidon(minAmountOut, deadline, destAmount)
- *   swapParamsHash = Poseidon(mintPairHash, swapTermsHash)
- *
- * @param sourceMint   Source pool mint
- * @param destMint     Destination pool mint
- * @param minAmountOut Minimum accepted output amount (slippage protected)
- * @param deadline     Unix timestamp deadline (i64, 0 = no deadline)
- * @param destAmount   Actual amount committed to destination UTXO (≥ minAmountOut -
- *                     relayerFee). If omitted, defaults to minAmountOut.
- */
-export function computeSwapParamsHash(sourceMint, destMint, minAmountOut, deadline, destAmount) {
-    const srcField = pubkeyToField(sourceMint);
-    const dstField = pubkeyToField(destMint);
-    const mintPairHash = poseidon2(srcField, dstField);
-    const dest = destAmount ?? minAmountOut;
-    const swapTermsHash = poseidon3(minAmountOut, deadline, dest);
-    const paramsHash = poseidon2(mintPairHash, swapTermsHash);
-    return bigIntToBytesBE(paramsHash);
-}
-/**
- * Compute the swap data hash committed on-chain for Jupiter instruction integrity.
- * SHA-256 of the raw Jupiter swap instruction data bytes.
- * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapDataHash`.
- */
-export function computeSwapDataHash(swapData) {
-    return sha256(swapData instanceof Buffer ? new Uint8Array(swapData) : swapData);
-}
+// Backward-compatible entry point. Proof responsibilities live in src/proofs.
+export * from "./proofs/index.js";

package/dist/esm/proofs/encoding.d.ts

@@ -0,0 +1,17 @@
+import type { RawProof, TransactionProofStruct } from "./types.js";
+/**
+ * Turn a snarkjs Groth16 proof into 256 bytes:
+ *   A(G1) | B(G2) | C(G1)
+ * where:
+ *   A = (ax, ay)               -> 64 bytes
+ *   B = (bx1, bx0, by1, by0)  -> 128 bytes  (swapped pairs for alt_bn128)
+ *   C = (cx, cy)               -> 64 bytes
+ *
+ * Each field element is encoded as 32-byte BE to match the on-chain verifier.
+ * We ignore the extra projective/z components snarkjs keeps.
+ */
+export declare function packProofToBytes(proof: RawProof): Uint8Array;
+/**
+ * Encode a snarkjs proof into the TransactionProofStruct format expected by the on-chain program.
+ */
+export declare function encodeSnarkjsProofToTransactionProof(proof: RawProof): TransactionProofStruct;