@veilo/sdk-core 0.3.3 → 0.5.0

package/dist/esm/proofs/encoding.js

@@ -0,0 +1,68 @@
+// -----------------------------------------------------------------------------
+// Proof Packing
+// -----------------------------------------------------------------------------
+/**
+ * Convert bigint to 32-byte big-endian representation.
+ * The alt_bn128 Solana precompile (and ark-works via change_endianness) expect BE.
+ */
+function bigintTo32BytesBE(x) {
+    const out = new Uint8Array(32);
+    let v = x;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
+/**
+ * Turn a snarkjs Groth16 proof into 256 bytes:
+ *   A(G1) | B(G2) | C(G1)
+ * where:
+ *   A = (ax, ay)               -> 64 bytes
+ *   B = (bx1, bx0, by1, by0)  -> 128 bytes  (swapped pairs for alt_bn128)
+ *   C = (cx, cy)               -> 64 bytes
+ *
+ * Each field element is encoded as 32-byte BE to match the on-chain verifier.
+ * We ignore the extra projective/z components snarkjs keeps.
+ */
+export function packProofToBytes(proof) {
+    const chunks = [];
+    const ax = BigInt(proof.pi_a[0]);
+    const ay = BigInt(proof.pi_a[1]);
+    chunks.push(bigintTo32BytesBE(ax), bigintTo32BytesBE(ay));
+    const bx = proof.pi_b[0];
+    const by = proof.pi_b[1];
+    const bx0 = BigInt(bx[0]);
+    const bx1 = BigInt(bx[1]);
+    const by0 = BigInt(by[0]);
+    const by1 = BigInt(by[1]);
+    // alt_bn128 expects the G2 pairs swapped: bx1 before bx0, by1 before by0
+    chunks.push(bigintTo32BytesBE(bx1), bigintTo32BytesBE(bx0), bigintTo32BytesBE(by1), bigintTo32BytesBE(by0));
+    const cx = BigInt(proof.pi_c[0]);
+    const cy = BigInt(proof.pi_c[1]);
+    chunks.push(bigintTo32BytesBE(cx), bigintTo32BytesBE(cy));
+    const out = new Uint8Array(32 * (2 + 4 + 2)); // 256
+    let offset = 0;
+    for (const c of chunks) {
+        out.set(c, offset);
+        offset += c.length;
+    }
+    return out;
+}
+/**
+ * Encode a snarkjs proof into the TransactionProofStruct format expected by the on-chain program.
+ */
+export function encodeSnarkjsProofToTransactionProof(proof) {
+    const full = packProofToBytes(proof);
+    if (full.length !== 256) {
+        throw new Error(`Expected 256 proof bytes, got ${full.length}`);
+    }
+    const proofA = full.slice(0, 64);
+    const proofB = full.slice(64, 192);
+    const proofC = full.slice(192, 256);
+    return {
+        proofA: Array.from(proofA),
+        proofB: Array.from(proofB),
+        proofC: Array.from(proofC),
+    };
+}

package/dist/esm/proofs/formatting.d.ts

@@ -0,0 +1,6 @@
+import type { TransactionCircuitInputs } from "./types.js";
+/**
+ * Convert TransactionCircuitInputs to the format expected by snarkjs.groth16.fullProve().
+ * All values are converted to strings (snarkjs expects string inputs for field elements).
+ */
+export declare function formatInputsForSnarkjs(inputs: TransactionCircuitInputs): Record<string, any>;

package/dist/esm/proofs/formatting.js

@@ -0,0 +1,31 @@
+import { bytesToBigIntBE, pubkeyToField } from "../poseidon.js";
+import { i64ToField } from "./transaction.js";
+// -----------------------------------------------------------------------------
+// Snarkjs Input Formatting
+// -----------------------------------------------------------------------------
+/**
+ * Convert TransactionCircuitInputs to the format expected by snarkjs.groth16.fullProve().
+ * All values are converted to strings (snarkjs expects string inputs for field elements).
+ */
+export function formatInputsForSnarkjs(inputs) {
+    return {
+        // Public inputs
+        root: bytesToBigIntBE(inputs.root).toString(),
+        publicAmount: i64ToField(inputs.publicAmount).toString(),
+        extDataHash: bytesToBigIntBE(inputs.extDataHash).toString(),
+        mintAddress: pubkeyToField(inputs.mintAddress).toString(),
+        inputNullifier: inputs.inputNullifiers.map((n) => bytesToBigIntBE(n).toString()),
+        outputCommitment: inputs.outputCommitments.map((c) => bytesToBigIntBE(c).toString()),
+        // Private inputs - Input UTXOs
+        inAmount: inputs.inAmount.map((a) => a.toString()),
+        inPubkey: inputs.inPubkey.map((p) => p.toString()),
+        inBlinding: inputs.inBlinding.map((b) => b.toString()),
+        inPathIndex: inputs.inPathIndex.map((i) => i.toString()),
+        inPathElements: inputs.inPathElements.map((path) => path.map((e) => e.toString())),
+        inPrivateKey: inputs.inPrivateKey.map((k) => k.toString()),
+        // Private inputs - Output UTXOs
+        outAmount: inputs.outAmount.map((a) => a.toString()),
+        outPubkey: inputs.outPubkey.map((p) => p.toString()),
+        outBlinding: inputs.outBlinding.map((b) => b.toString()),
+    };
+}

package/dist/esm/proofs/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./types.js";
+export * from "./transaction.js";
+export * from "./encoding.js";
+export * from "./formatting.js";
+export * from "./swap.js";

package/dist/esm/proofs/index.js

@@ -0,0 +1,5 @@
+export * from "./types.js";
+export * from "./transaction.js";
+export * from "./encoding.js";
+export * from "./formatting.js";
+export * from "./swap.js";

package/dist/esm/proofs/swap.d.ts

@@ -0,0 +1,87 @@
+import { PublicKey } from "@solana/web3.js";
+import type { InputUTXO, SerializedUTXO } from "../notes/model.js";
+import type { ExtData, RawProof } from "./types.js";
+/**
+ * Swap circuit inputs. Matches the signal shape declared by swap.circom's
+ * main component (see zk-circuits/swap.circom lines 208-238). Unlike the
+ * transaction circuit, the swap circuit distinguishes a "change" output
+ * (same mint as source) from a "dest" output (dest mint) and takes a
+ * swap-specific params hash and swapAmount alongside the usual inputs.
+ */
+export type SwapCircuitInputs = {
+    sourceRoot: Uint8Array;
+    swapParamsHash: Uint8Array;
+    extDataHash: Uint8Array;
+    sourceMint: PublicKey;
+    destMint: PublicKey;
+    inputNullifiers: [Uint8Array, Uint8Array];
+    changeCommitment: Uint8Array;
+    destCommitment: Uint8Array;
+    swapAmount: bigint;
+    inAmount: [bigint, bigint];
+    inPubkey: [bigint, bigint];
+    inBlinding: [bigint, bigint];
+    inPathIndex: [number, number];
+    inPathElements: [bigint[], bigint[]];
+    inPrivateKey: [bigint, bigint];
+    changeAmount: bigint;
+    changePubkey: bigint;
+    changeBlinding: bigint;
+    destAmount: bigint;
+    destPubkey: bigint;
+    destBlinding: bigint;
+    minAmountOut: bigint;
+    deadline: bigint;
+};
+/** Proof builder accepted by SDK-side private swap flows. */
+export type SwapProofBuilder = (inputs: SwapCircuitInputs) => Promise<RawProof>;
+/**
+ * Prepare the exact witness/public inputs used by the relayer's swap circuit.
+ * Output 0 must be source-mint change and output 1 the destination-mint note.
+ */
+export declare function prepareSwapInputs(params: {
+    inputUTXOs: [InputUTXO, InputUTXO];
+    changeUTXO: SerializedUTXO;
+    destUTXO: SerializedUTXO;
+    sourceRoot: Uint8Array;
+    sourceMint: PublicKey;
+    destMint: PublicKey;
+    swapAmount: bigint;
+    minAmountOut: bigint;
+    deadline: bigint;
+    extData: ExtData;
+}): SwapCircuitInputs;
+/**
+ * Convert SwapCircuitInputs into the shape expected by
+ * snarkjs.groth16.fullProve() for swap.circom. Every value is emitted as a
+ * decimal string (or string array) because snarkjs only accepts field
+ * elements as strings.
+ *
+ * Mirrors `generateSwapProof` in
+ * relayer-server/src/controllers/swap.helpers.ts so SDK-side swap proofs
+ * verify against the same circuit the relayer uses.
+ */
+export declare function formatSwapInputsForSnarkjs(inputs: SwapCircuitInputs): Record<string, any>;
+/**
+ * Compute the swap params hash that the swap circuit and on-chain program verify.
+ * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapParamsHash`.
+ *
+ * Circuit formula (swap.circom lines 293-307):
+ *   mintPairHash   = Poseidon(sourceMint, destMint)
+ *   swapTermsHash  = Poseidon(minAmountOut, deadline, destAmount)
+ *   swapParamsHash = Poseidon(mintPairHash, swapTermsHash)
+ *
+ * @param sourceMint   Source pool mint
+ * @param destMint     Destination pool mint
+ * @param minAmountOut Minimum accepted output amount (slippage protected)
+ * @param deadline     Positive Unix timestamp deadline (the program rejects 0)
+ * @param destAmount   Actual amount committed to destination UTXO (≥ minAmountOut -
+ *                     relayerFee). If omitted, defaults to minAmountOut.
+ */
+export declare function computeSwapParamsHash(sourceMint: PublicKey, destMint: PublicKey, minAmountOut: bigint, deadline: bigint, destAmount?: bigint): Uint8Array;
+/**
+ * Compute the swap data hash committed on-chain for Jupiter instruction integrity.
+ * SHA-256 of the raw Jupiter swap instruction data bytes.
+ * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapDataHash`.
+ */
+export declare function computeSwapDataHash(swapData: Uint8Array | Buffer): Uint8Array;

package/dist/esm/proofs/swap.js

@@ -0,0 +1,138 @@
+import { sha256 } from "@noble/hashes/sha256";
+import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon2, poseidon3, pubkeyToField, } from "../poseidon.js";
+import { deriveNullifier } from "../notes/nullifier.js";
+import { computeExtDataHash } from "./transaction.js";
+/**
+ * Prepare the exact witness/public inputs used by the relayer's swap circuit.
+ * Output 0 must be source-mint change and output 1 the destination-mint note.
+ */
+export function prepareSwapInputs(params) {
+    const { inputUTXOs, changeUTXO, destUTXO, sourceRoot, sourceMint, destMint, swapAmount, minAmountOut, deadline, extData, } = params;
+    const totalInput = inputUTXOs[0].amount + inputUTXOs[1].amount;
+    if (swapAmount <= 0n)
+        throw new Error("swapAmount must be positive");
+    if (deadline <= 0n) {
+        throw new Error("deadline must be a positive Unix timestamp");
+    }
+    if (totalInput !== swapAmount + changeUTXO.amount) {
+        throw new Error(`Swap balance mismatch: inputs=${totalInput}, swap=${swapAmount}, change=${changeUTXO.amount}`);
+    }
+    if (destUTXO.amount < minAmountOut) {
+        throw new Error("Destination note amount is below minAmountOut");
+    }
+    if (changeUTXO.mintAddress !== pubkeyToField(sourceMint)) {
+        throw new Error("Change UTXO must use the source mint");
+    }
+    if (destUTXO.mintAddress !== pubkeyToField(destMint)) {
+        throw new Error("Destination UTXO must use the destination mint");
+    }
+    return {
+        sourceRoot,
+        swapParamsHash: computeSwapParamsHash(sourceMint, destMint, minAmountOut, deadline, destUTXO.amount),
+        extDataHash: computeExtDataHash(extData),
+        sourceMint,
+        destMint,
+        inputNullifiers: [
+            deriveNullifier(inputUTXOs[0], inputUTXOs[0].pathIndex, inputUTXOs[0].privateKey),
+            deriveNullifier(inputUTXOs[1], inputUTXOs[1].pathIndex, inputUTXOs[1].privateKey),
+        ],
+        changeCommitment: changeUTXO.commitment,
+        destCommitment: destUTXO.commitment,
+        swapAmount,
+        inAmount: [inputUTXOs[0].amount, inputUTXOs[1].amount],
+        inPubkey: [inputUTXOs[0].pubkey, inputUTXOs[1].pubkey],
+        inBlinding: [inputUTXOs[0].blinding, inputUTXOs[1].blinding],
+        inPathIndex: [inputUTXOs[0].pathIndex, inputUTXOs[1].pathIndex],
+        inPathElements: [
+            inputUTXOs[0].pathElements.map((element) => bytesToBigIntBE(element) % BN254_FR_MODULUS),
+            inputUTXOs[1].pathElements.map((element) => bytesToBigIntBE(element) % BN254_FR_MODULUS),
+        ],
+        inPrivateKey: [inputUTXOs[0].privateKey, inputUTXOs[1].privateKey],
+        changeAmount: changeUTXO.amount,
+        changePubkey: changeUTXO.pubkey,
+        changeBlinding: changeUTXO.blinding,
+        destAmount: destUTXO.amount,
+        destPubkey: destUTXO.pubkey,
+        destBlinding: destUTXO.blinding,
+        minAmountOut,
+        deadline,
+    };
+}
+/**
+ * Convert SwapCircuitInputs into the shape expected by
+ * snarkjs.groth16.fullProve() for swap.circom. Every value is emitted as a
+ * decimal string (or string array) because snarkjs only accepts field
+ * elements as strings.
+ *
+ * Mirrors `generateSwapProof` in
+ * relayer-server/src/controllers/swap.helpers.ts so SDK-side swap proofs
+ * verify against the same circuit the relayer uses.
+ */
+export function formatSwapInputsForSnarkjs(inputs) {
+    return {
+        // Public inputs
+        sourceRoot: bytesToBigIntBE(inputs.sourceRoot).toString(),
+        swapParamsHash: bytesToBigIntBE(inputs.swapParamsHash).toString(),
+        extDataHash: bytesToBigIntBE(inputs.extDataHash).toString(),
+        sourceMint: pubkeyToField(inputs.sourceMint).toString(),
+        destMint: pubkeyToField(inputs.destMint).toString(),
+        inputNullifier: inputs.inputNullifiers.map((n) => bytesToBigIntBE(n).toString()),
+        changeCommitment: bytesToBigIntBE(inputs.changeCommitment).toString(),
+        destCommitment: bytesToBigIntBE(inputs.destCommitment).toString(),
+        swapAmount: inputs.swapAmount.toString(),
+        // Private inputs - Input UTXOs
+        inAmount: inputs.inAmount.map((a) => a.toString()),
+        inPubkey: inputs.inPubkey.map((p) => p.toString()),
+        inBlinding: inputs.inBlinding.map((b) => b.toString()),
+        inPathIndex: inputs.inPathIndex.map((i) => i.toString()),
+        inPathElements: inputs.inPathElements.map((path) => path.map((e) => e.toString())),
+        inPrivateKey: inputs.inPrivateKey.map((k) => k.toString()),
+        // Private inputs - Change UTXO
+        changeAmount: inputs.changeAmount.toString(),
+        changePubkey: inputs.changePubkey.toString(),
+        changeBlinding: inputs.changeBlinding.toString(),
+        // Private inputs - Destination UTXO
+        destAmount: inputs.destAmount.toString(),
+        destPubkey: inputs.destPubkey.toString(),
+        destBlinding: inputs.destBlinding.toString(),
+        // Swap params
+        minAmountOut: inputs.minAmountOut.toString(),
+        deadline: inputs.deadline.toString(),
+    };
+}
+// -----------------------------------------------------------------------------
+// Swap Parameter Hashing
+// -----------------------------------------------------------------------------
+/**
+ * Compute the swap params hash that the swap circuit and on-chain program verify.
+ * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapParamsHash`.
+ *
+ * Circuit formula (swap.circom lines 293-307):
+ *   mintPairHash   = Poseidon(sourceMint, destMint)
+ *   swapTermsHash  = Poseidon(minAmountOut, deadline, destAmount)
+ *   swapParamsHash = Poseidon(mintPairHash, swapTermsHash)
+ *
+ * @param sourceMint   Source pool mint
+ * @param destMint     Destination pool mint
+ * @param minAmountOut Minimum accepted output amount (slippage protected)
+ * @param deadline     Positive Unix timestamp deadline (the program rejects 0)
+ * @param destAmount   Actual amount committed to destination UTXO (≥ minAmountOut -
+ *                     relayerFee). If omitted, defaults to minAmountOut.
+ */
+export function computeSwapParamsHash(sourceMint, destMint, minAmountOut, deadline, destAmount) {
+    const srcField = pubkeyToField(sourceMint);
+    const dstField = pubkeyToField(destMint);
+    const mintPairHash = poseidon2(srcField, dstField);
+    const dest = destAmount ?? minAmountOut;
+    const swapTermsHash = poseidon3(minAmountOut, deadline, dest);
+    const paramsHash = poseidon2(mintPairHash, swapTermsHash);
+    return bigIntToBytesBE(paramsHash);
+}
+/**
+ * Compute the swap data hash committed on-chain for Jupiter instruction integrity.
+ * SHA-256 of the raw Jupiter swap instruction data bytes.
+ * Mirrors relayer-server/src/controllers/swap.helpers.ts `computeSwapDataHash`.
+ */
+export function computeSwapDataHash(swapData) {
+    return sha256(swapData instanceof Buffer ? new Uint8Array(swapData) : swapData);
+}

package/dist/esm/proofs/transaction.d.ts

@@ -0,0 +1,28 @@
+import { PublicKey } from "@solana/web3.js";
+import type { InputUTXO, SerializedUTXO } from "../notes/model.js";
+import type { ExtData, TransactionCircuitInputs } from "./types.js";
+/**
+ * Compute the external data hash.
+ * Matches on-chain computation:
+ *   hash1 = Poseidon(recipient, relayer)
+ *   hash2 = Poseidon(fee, refund)
+ *   extDataHash = Poseidon(hash1, hash2, claimant)
+ */
+export declare function computeExtDataHash(extData: ExtData): Uint8Array;
+/**
+ * Convert i64 to field element (handles negative via modular arithmetic).
+ * For negative values, we add the field modulus to get the equivalent positive representation.
+ */
+export declare function i64ToField(value: bigint): bigint;
+/**
+ * Prepare transaction circuit inputs from high-level parameters.
+ * This converts the SDK types into the format expected by the circuit.
+ */
+export declare function prepareTransactionInputs(params: {
+    inputUTXOs: [InputUTXO, InputUTXO];
+    outputUTXOs: [SerializedUTXO, SerializedUTXO];
+    root: Uint8Array;
+    publicAmount: bigint;
+    extData: ExtData;
+    mintAddress: PublicKey;
+}): TransactionCircuitInputs;

package/dist/esm/proofs/transaction.js

@@ -0,0 +1,105 @@
+import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon2, poseidon3, pubkeyToField, } from "../poseidon.js";
+import { deriveNullifier } from "../notes/nullifier.js";
+// -----------------------------------------------------------------------------
+// ExtData Hash Computation
+// -----------------------------------------------------------------------------
+/**
+ * Compute the external data hash.
+ * Matches on-chain computation:
+ *   hash1 = Poseidon(recipient, relayer)
+ *   hash2 = Poseidon(fee, refund)
+ *   extDataHash = Poseidon(hash1, hash2, claimant)
+ */
+export function computeExtDataHash(extData) {
+    const recipientField = pubkeyToField(extData.recipient);
+    const relayerField = pubkeyToField(extData.relayer);
+    const feeField = extData.fee % BN254_FR_MODULUS;
+    const refundField = extData.refund % BN254_FR_MODULUS;
+    const claimantField = pubkeyToField(extData.claimant);
+    const hash1 = poseidon2(recipientField, relayerField);
+    const hash2 = poseidon2(feeField, refundField);
+    const finalHash = poseidon3(hash1, hash2, claimantField);
+    return bigIntToBytesBE(finalHash);
+}
+// -----------------------------------------------------------------------------
+// Circuit Input Preparation
+// -----------------------------------------------------------------------------
+/**
+ * Convert i64 to field element (handles negative via modular arithmetic).
+ * For negative values, we add the field modulus to get the equivalent positive representation.
+ */
+export function i64ToField(value) {
+    if (value >= 0n) {
+        return value % BN254_FR_MODULUS;
+    }
+    return (BN254_FR_MODULUS + value) % BN254_FR_MODULUS;
+}
+/**
+ * Prepare transaction circuit inputs from high-level parameters.
+ * This converts the SDK types into the format expected by the circuit.
+ */
+export function prepareTransactionInputs(params) {
+    const { inputUTXOs, outputUTXOs, root, publicAmount, extData, mintAddress } = params;
+    const extDataHash = computeExtDataHash(extData);
+    const mintField = pubkeyToField(mintAddress);
+    // Prepare input UTXO data
+    const inAmount = [
+        inputUTXOs[0].amount,
+        inputUTXOs[1].amount,
+    ];
+    const inPubkey = [
+        inputUTXOs[0].pubkey,
+        inputUTXOs[1].pubkey,
+    ];
+    const inBlinding = [
+        inputUTXOs[0].blinding,
+        inputUTXOs[1].blinding,
+    ];
+    const inPathIndex = [
+        inputUTXOs[0].pathIndex,
+        inputUTXOs[1].pathIndex,
+    ];
+    const inPathElements = [
+        inputUTXOs[0].pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
+        inputUTXOs[1].pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
+    ];
+    const inPrivateKey = [
+        inputUTXOs[0].privateKey,
+        inputUTXOs[1].privateKey,
+    ];
+    // Prepare output UTXO data
+    const outAmount = [
+        outputUTXOs[0].amount,
+        outputUTXOs[1].amount,
+    ];
+    const outPubkey = [
+        outputUTXOs[0].pubkey,
+        outputUTXOs[1].pubkey,
+    ];
+    const outBlinding = [
+        outputUTXOs[0].blinding,
+        outputUTXOs[1].blinding,
+    ];
+    // Derive nullifiers for input UTXOs
+    const inputNullifiers = [
+        deriveNullifier(inputUTXOs[0], inputUTXOs[0].pathIndex, inputUTXOs[0].privateKey),
+        deriveNullifier(inputUTXOs[1], inputUTXOs[1].pathIndex, inputUTXOs[1].privateKey),
+    ];
+    return {
+        root,
+        publicAmount,
+        extDataHash,
+        mintAddress,
+        inputNullifiers,
+        outputCommitments: [outputUTXOs[0].commitment, outputUTXOs[1].commitment],
+        inAmount,
+        inPubkey,
+        inBlinding,
+        inPathIndex,
+        inPathElements,
+        inPrivateKey,
+        outAmount,
+        outPubkey,
+        outBlinding,
+    };
+}

package/dist/esm/proofs/types.d.ts

@@ -0,0 +1,70 @@
+import { PublicKey } from "@solana/web3.js";
+/**
+ * External data that gets hashed into ext_data_hash.
+ * These are public parameters that affect financial flows.
+ */
+export type ExtData = {
+    /** Who receives withdrawal (for withdrawals) */
+    recipient: PublicKey;
+    /** Who submits tx and gets fee */
+    relayer: PublicKey;
+    /** Fee to relayer in lamports/token units */
+    fee: bigint;
+    /** Refund to user in lamports/token units (for gas compensation) */
+    refund: bigint;
+    /** Claimant key committed into the proof */
+    claimant: PublicKey;
+};
+/**
+ * Transaction circuit inputs (8 public inputs, many private inputs).
+ * This structure is used to prepare inputs for the snarkjs prover.
+ */
+export type TransactionCircuitInputs = {
+    /** Merkle root of UTXO tree */
+    root: Uint8Array;
+    /** Net deposit/withdrawal amount (positive = deposit, negative = withdrawal) */
+    publicAmount: bigint;
+    /** Hash of external data (recipient, relayer, fee, refund) */
+    extDataHash: Uint8Array;
+    /** Token mint address */
+    mintAddress: PublicKey;
+    /** Nullifiers for the two input UTXOs */
+    inputNullifiers: [Uint8Array, Uint8Array];
+    /** Commitments for the two output UTXOs */
+    outputCommitments: [Uint8Array, Uint8Array];
+    inAmount: [bigint, bigint];
+    inPubkey: [bigint, bigint];
+    inBlinding: [bigint, bigint];
+    inPathIndex: [number, number];
+    inPathElements: [bigint[], bigint[]];
+    inPrivateKey: [bigint, bigint];
+    outAmount: [bigint, bigint];
+    outPubkey: [bigint, bigint];
+    outBlinding: [bigint, bigint];
+};
+/**
+ * Proof structure matching the on-chain TransactionProof struct.
+ * Total size: 256 bytes (64 + 128 + 64)
+ */
+export type TransactionProofStruct = {
+    /** G1 point A (64 bytes) */
+    proofA: number[];
+    /** G2 point B (128 bytes) */
+    proofB: number[];
+    /** G1 point C (64 bytes) */
+    proofC: number[];
+};
+/**
+ * Shape of a Groth16 proof produced by snarkjs.
+ */
+export type RawProof = {
+    pi_a: [string, string, string];
+    pi_b: [[string, string], [string, string], [string, string]];
+    pi_c: [string, string, string];
+    protocol: string;
+    curve: string;
+};
+/**
+ * Proof builder function type - takes circuit inputs and returns a raw snarkjs proof.
+ */
+export type TransactionProofBuilder = (inputs: TransactionCircuitInputs) => Promise<RawProof>;

package/dist/esm/proofs/types.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/prover.d.ts

@@ -0,0 +1,57 @@
+import type { TransactionProofBuilder, RawProof } from "./proofs/types.js";
+import { type SwapProofBuilder } from "./proofs/swap.js";
+/**
+ * Circuit artifact paths required by snarkjs.
+ *
+ * These files are large (10-100 MB) and should NOT be bundled in npm.
+ * Host them on GitHub Releases, IPFS, or a CDN and download at runtime.
+ *
+ * For Node.js: pass file system paths (e.g. "./circuits/transaction.wasm").
+ * For browsers: pass Uint8Array buffers or URLs that fetch returns as ArrayBuffer.
+ */
+export interface CircuitArtifacts {
+    /** Path or buffer for the compiled WASM witness generator */
+    wasmPath: string | Uint8Array;
+    /** Path or buffer for the Groth16 proving key (.zkey) */
+    zkeyPath: string | Uint8Array;
+}
+/**
+ * Create a proof builder function for the transaction circuit.
+ *
+ * Uses dynamic `import("snarkjs")` so the dependency is only loaded when
+ * proof generation is actually called. Install snarkjs as a peer dependency:
+ *
+ * ```
+ * npm install snarkjs
+ * ```
+ *
+ * @param artifacts  Paths or buffers to the circuit WASM and zkey files
+ * @returns A `TransactionProofBuilder` callback compatible with the SDK's client functions
+ *
+ * @example
+ * ```ts
+ * import { createTransactionProver } from "@veilo/sdk-core";
+ *
+ * const prover = createTransactionProver({
+ *   wasmPath: "./circuits/transaction.wasm",
+ *   zkeyPath: "./circuits/transaction_final.zkey",
+ * });
+ *
+ * // Pass to SDK functions that accept a TransactionProofBuilder
+ * const proof = await prover(circuitInputs);
+ * ```
+ */
+export declare function createTransactionProver(artifacts: CircuitArtifacts): TransactionProofBuilder;
+/** Create a proof builder for the current `swap.circom` witness shape. */
+export declare function createSwapProver(artifacts: CircuitArtifacts): SwapProofBuilder;
+/**
+ * Verify a Groth16 proof against public signals and a verification key.
+ *
+ * Useful for local verification before submitting to the relayer.
+ *
+ * @param proof       The raw snarkjs proof
+ * @param publicSignals  Array of public signal strings
+ * @param vkeyPath    Path to the verification key JSON file, or the parsed JSON object
+ * @returns true if the proof is valid
+ */
+export declare function verifyProof(proof: RawProof, publicSignals: string[], vkey: string | object): Promise<boolean>;

package/dist/esm/prover.js

@@ -1,4 +1,5 @@
-import { formatInputsForSnarkjs, } from "./proof";
+import { formatInputsForSnarkjs } from "./proofs/formatting.js";
+import { formatSwapInputsForSnarkjs, } from "./proofs/swap.js";
 /** Lazy-load snarkjs — works in both CJS and ESM contexts. */
 async function loadSnarkjs() {
     try {
@@ -43,6 +44,14 @@ export function createTransactionProver(artifacts) {
         return proof;
     };
 }
+/** Create a proof builder for the current `swap.circom` witness shape. */
+export function createSwapProver(artifacts) {
+    return async (inputs) => {
+        const snarkjs = await loadSnarkjs();
+        const { proof } = await snarkjs.groth16.fullProve(formatSwapInputsForSnarkjs(inputs), artifacts.wasmPath, artifacts.zkeyPath);
+        return proof;
+    };
+}
 /**
  * Verify a Groth16 proof against public signals and a verification key.
  *

package/dist/esm/random.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Cross-platform CSPRNG.
+ *
+ * Deliberately backed by `nacl.randomBytes` rather than Node's `crypto.randomBytes`:
+ * tweetnacl resolves to `crypto.getRandomValues` in browsers and to Node's CSPRNG
+ * under Node, so this module carries no `node:crypto` import. That matters because
+ * every deposit path reaches this code via `createUTXO`/`generateKeypair`, and a
+ * bare `import { randomBytes } from "crypto"` throws at bundle time in browser
+ * builds that have no Node polyfill.
+ *
+ * tweetnacl is already a hard dependency, so this adds no install weight.
+ */
+/** `length` cryptographically-secure random bytes. */
+export declare function randomBytes(length: number): Uint8Array;
+/** 32 cryptographically-secure random bytes — the common case for blindings and seeds. */
+export declare function randomBytes32(): Uint8Array;

package/dist/esm/random.js

@@ -0,0 +1,21 @@
+import nacl from "tweetnacl";
+/**
+ * Cross-platform CSPRNG.
+ *
+ * Deliberately backed by `nacl.randomBytes` rather than Node's `crypto.randomBytes`:
+ * tweetnacl resolves to `crypto.getRandomValues` in browsers and to Node's CSPRNG
+ * under Node, so this module carries no `node:crypto` import. That matters because
+ * every deposit path reaches this code via `createUTXO`/`generateKeypair`, and a
+ * bare `import { randomBytes } from "crypto"` throws at bundle time in browser
+ * builds that have no Node polyfill.
+ *
+ * tweetnacl is already a hard dependency, so this adds no install weight.
+ */
+/** `length` cryptographically-secure random bytes. */
+export function randomBytes(length) {
+    return nacl.randomBytes(length);
+}
+/** 32 cryptographically-secure random bytes — the common case for blindings and seeds. */
+export function randomBytes32() {
+    return nacl.randomBytes(32);
+}