@veilo/sdk-core 0.3.3 → 0.5.0

package/dist/esm/transactions/transfer.d.ts

@@ -0,0 +1,51 @@
+import type { Program, Idl } from "@coral-xyz/anchor";
+import { Keypair, PublicKey } from "@solana/web3.js";
+import type { TransactionProofBuilder } from "../proofs/types.js";
+import type { InputUTXO, SerializedUTXO } from "../notes/model.js";
+import { MerkleTree } from "../merkle.js";
+import { type NoteCiphers } from "../compactNote.js";
+export type TransferResult = {
+    /** Output UTXOs created by the transfer */
+    outputUTXOs: [SerializedUTXO, SerializedUTXO];
+    /** Leaf indices where the UTXOs were inserted */
+    leafIndices: [number, number];
+    /** New Merkle root after insertion */
+    root: Uint8Array;
+};
+/**
+ * Execute a private transfer within the pool.
+ *
+ * For transfers, the publicAmount is 0 (no funds enter or leave the pool).
+ * Input amounts must equal output amounts.
+ *
+ * @param inputUTXOs - The UTXOs being spent
+ * @param outputPubkeys - UTXO public keys for the recipients
+ * @param outputAmounts - Amounts for each output (must sum to input total)
+ * @param inputTreeId - The tree ID where input UTXOs are located
+ * @param outputTreeId - The tree ID where output commitments will be inserted
+ */
+export declare function privateTransfer<T extends Idl>(params: {
+    program: Program<T>;
+    relayer: Keypair;
+    mintAddress: PublicKey;
+    inputUTXOs: [InputUTXO, InputUTXO];
+    outputPubkeys: [bigint, bigint];
+    outputAmounts: [bigint, bigint];
+    root: Uint8Array;
+    inputTreeId: number;
+    outputTreeId: number;
+    tree: MerkleTree;
+    proofBuilder: TransactionProofBuilder;
+    /** Must be zero: the program rejects fees on publicAmount=0 transfers. */
+    fee?: bigint;
+    deadline?: bigint;
+    /** Public recipient account committed in ExtData (no funds are sent to it). */
+    externalRecipient?: PublicKey;
+    /** Wallet keys used to encrypt output notes for on-chain recovery. */
+    noteRecipientWallets?: [
+        PublicKey | Uint8Array | null,
+        PublicKey | Uint8Array | null
+    ];
+    /** Prebuilt note ciphers. Takes precedence over noteRecipientWallets. */
+    noteCiphers?: NoteCiphers | null;
+}): Promise<TransferResult>;

package/dist/esm/transactions/transfer.js

@@ -0,0 +1,103 @@
+import { Keypair, PublicKey, SystemProgram } from "@solana/web3.js";
+import { prepareTransactionInputs } from "../proofs/transaction.js";
+import { encodeSnarkjsProofToTransactionProof } from "../proofs/encoding.js";
+import { createUTXO } from "../notes/model.js";
+import { transact } from "./transact.js";
+import { bigIntToBytesBE } from "../poseidon.js";
+import { createNoteCiphers, } from "../compactNote.js";
+/**
+ * Execute a private transfer within the pool.
+ *
+ * For transfers, the publicAmount is 0 (no funds enter or leave the pool).
+ * Input amounts must equal output amounts.
+ *
+ * @param inputUTXOs - The UTXOs being spent
+ * @param outputPubkeys - UTXO public keys for the recipients
+ * @param outputAmounts - Amounts for each output (must sum to input total)
+ * @param inputTreeId - The tree ID where input UTXOs are located
+ * @param outputTreeId - The tree ID where output commitments will be inserted
+ */
+export async function privateTransfer(params) {
+    const { program, relayer, mintAddress, inputUTXOs, outputPubkeys, outputAmounts, root, inputTreeId, outputTreeId, tree, proofBuilder, fee = 0n, deadline = BigInt(Math.floor(Date.now() / 1000) + 600), externalRecipient = Keypair.generate().publicKey, noteRecipientWallets, noteCiphers, } = params;
+    if (fee !== 0n) {
+        throw new Error("Private transact transfers require fee=0; represent any relayer fee in the output amounts");
+    }
+    const totalInput = inputUTXOs[0].amount + inputUTXOs[1].amount;
+    const totalOutput = outputAmounts[0] + outputAmounts[1];
+    if (totalInput !== totalOutput) {
+        throw new Error(`Balance mismatch: inputs=${totalInput}, outputs=${totalOutput}`);
+    }
+    const outputUTXO0 = createUTXO({
+        amount: outputAmounts[0],
+        pubkey: outputPubkeys[0],
+        mintAddress,
+    });
+    const outputUTXO1 = createUTXO({
+        amount: outputAmounts[1],
+        pubkey: outputPubkeys[1],
+        mintAddress,
+    });
+    const outputUTXOs = [
+        outputUTXO0,
+        outputUTXO1,
+    ];
+    const extData = {
+        recipient: externalRecipient,
+        relayer: relayer.publicKey,
+        fee: 0n,
+        refund: 0n,
+        claimant: SystemProgram.programId,
+    };
+    // publicAmount is 0 for transfers
+    const publicAmount = 0n;
+    const circuitInputs = prepareTransactionInputs({
+        inputUTXOs,
+        outputUTXOs,
+        root,
+        publicAmount,
+        extData,
+        mintAddress,
+    });
+    const rawProof = await proofBuilder(circuitInputs);
+    const proof = encodeSnarkjsProofToTransactionProof(rawProof);
+    const walletBytes = (wallet) => wallet instanceof PublicKey ? wallet.toBytes() : wallet;
+    const transferNoteCiphers = noteCiphers ??
+        (noteRecipientWallets
+            ? createNoteCiphers(noteRecipientWallets[0]
+                ? {
+                    recipientWalletPubkey: walletBytes(noteRecipientWallets[0]),
+                    blinding: bigIntToBytesBE(outputUTXOs[0].blinding),
+                    amount: outputUTXOs[0].amount,
+                }
+                : null, noteRecipientWallets[1]
+                ? {
+                    recipientWalletPubkey: walletBytes(noteRecipientWallets[1]),
+                    blinding: bigIntToBytesBE(outputUTXOs[1].blinding),
+                    amount: outputUTXOs[1].amount,
+                }
+                : null)
+            : null);
+    await transact({
+        program,
+        relayer,
+        recipient: externalRecipient,
+        mintAddress,
+        root,
+        inputTreeId,
+        outputTreeId,
+        publicAmount,
+        inputNullifiers: circuitInputs.inputNullifiers,
+        outputCommitments: circuitInputs.outputCommitments,
+        extData,
+        proof,
+        deadline,
+        noteCiphers: transferNoteCiphers,
+    });
+    const { index: outIdx0 } = tree.insert(outputUTXOs[0].commitment);
+    const { index: outIdx1, root: newRoot } = tree.insert(outputUTXOs[1].commitment);
+    return {
+        outputUTXOs,
+        leafIndices: [outIdx0, outIdx1],
+        root: newRoot,
+    };
+}

package/dist/esm/transactions/withdraw.d.ts

@@ -0,0 +1,52 @@
+import type { Program, Idl } from "@coral-xyz/anchor";
+import { Keypair, PublicKey } from "@solana/web3.js";
+import type { TransactionProofBuilder } from "../proofs/types.js";
+import type { InputUTXO, SerializedUTXO } from "../notes/model.js";
+import { MerkleTree } from "../merkle.js";
+import { type NoteCiphers } from "../compactNote.js";
+export type WithdrawResult = {
+    /** Change UTXO (remaining balance) */
+    changeUTXO: SerializedUTXO;
+    /** Leaf index of the change UTXO */
+    leafIndex: number;
+    /** New Merkle root after insertion */
+    root: Uint8Array;
+};
+/**
+ * Withdraw funds from the privacy pool.
+ *
+ * For withdrawals, we spend input UTXOs and create change output UTXOs.
+ * The publicAmount is negative (funds flowing out).
+ *
+ * @param withdrawAmount - Amount to withdraw in lamports/token units
+ * @param inputUTXOs - The UTXOs being spent
+ * @param changePubkey - UTXO public key for the change output
+ * @param inputTreeId - The tree ID where input UTXOs are located
+ * @param outputTreeId - The tree ID where change outputs will be inserted
+ */
+export declare function withdraw<T extends Idl>(params: {
+    program: Program<T>;
+    relayer: Keypair;
+    recipient: PublicKey;
+    mintAddress: PublicKey;
+    inputUTXOs: [InputUTXO, InputUTXO];
+    changePubkey: bigint;
+    withdrawAmount: bigint;
+    fee: bigint;
+    refund: bigint;
+    root: Uint8Array;
+    inputTreeId: number;
+    outputTreeId: number;
+    tree: MerkleTree;
+    proofBuilder: TransactionProofBuilder;
+    /** When true, the fee is debited in addition to withdrawAmount. */
+    feeOnTop?: boolean;
+    deadline?: bigint;
+    /** Solana wallet key used to encrypt the change note for chain recovery. */
+    changeNoteRecipientWallet?: PublicKey | Uint8Array;
+    /** Prebuilt recovery payload. Takes precedence over changeNoteRecipientWallet. */
+    noteCiphers?: NoteCiphers | null;
+}): Promise<WithdrawResult>;
+/**
+ * Result of a private transfer operation.
+ */

package/dist/esm/transactions/withdraw.js

@@ -0,0 +1,101 @@
+import { PublicKey, SystemProgram } from "@solana/web3.js";
+import { prepareTransactionInputs } from "../proofs/transaction.js";
+import { encodeSnarkjsProofToTransactionProof } from "../proofs/encoding.js";
+import { createUTXO, generateKeypair } from "../notes/model.js";
+import { transact } from "./transact.js";
+import { bigIntToBytesBE } from "../poseidon.js";
+import { createNoteCiphers, } from "../compactNote.js";
+/**
+ * Withdraw funds from the privacy pool.
+ *
+ * For withdrawals, we spend input UTXOs and create change output UTXOs.
+ * The publicAmount is negative (funds flowing out).
+ *
+ * @param withdrawAmount - Amount to withdraw in lamports/token units
+ * @param inputUTXOs - The UTXOs being spent
+ * @param changePubkey - UTXO public key for the change output
+ * @param inputTreeId - The tree ID where input UTXOs are located
+ * @param outputTreeId - The tree ID where change outputs will be inserted
+ */
+export async function withdraw(params) {
+    const { program, relayer, recipient, mintAddress, inputUTXOs, changePubkey, withdrawAmount, fee, refund, root, inputTreeId, outputTreeId, tree, proofBuilder, feeOnTop = false, deadline = BigInt(Math.floor(Date.now() / 1000) + 600), changeNoteRecipientWallet, noteCiphers, } = params;
+    const totalInput = inputUTXOs[0].amount + inputUTXOs[1].amount;
+    const outflowAmount = feeOnTop ? withdrawAmount + fee : withdrawAmount;
+    const changeAmount = totalInput - outflowAmount;
+    if (withdrawAmount <= 0n) {
+        throw new Error("Withdrawal amount must be positive");
+    }
+    if (fee < 0n || refund < 0n || fee + refund > outflowAmount) {
+        throw new Error("Withdrawal fee and refund must fit within the public outflow");
+    }
+    if (changeAmount < 0n) {
+        throw new Error("Insufficient input balance for withdrawal");
+    }
+    const changeUTXO = createUTXO({
+        amount: changeAmount,
+        pubkey: changePubkey,
+        mintAddress,
+    });
+    const zeroUTXO = createUTXO({
+        amount: 0n,
+        pubkey: generateKeypair().publicKey,
+        mintAddress,
+    });
+    const outputUTXOs = [changeUTXO, zeroUTXO];
+    const extData = {
+        recipient,
+        relayer: relayer.publicKey,
+        fee,
+        refund,
+        claimant: SystemProgram.programId,
+    };
+    // publicAmount is negative for withdrawals
+    const publicAmount = -outflowAmount;
+    const circuitInputs = prepareTransactionInputs({
+        inputUTXOs,
+        outputUTXOs,
+        root,
+        publicAmount,
+        extData,
+        mintAddress,
+    });
+    const rawProof = await proofBuilder(circuitInputs);
+    const proof = encodeSnarkjsProofToTransactionProof(rawProof);
+    const withdrawNoteCiphers = noteCiphers !== undefined
+        ? noteCiphers
+        : changeNoteRecipientWallet && changeAmount > 0n
+            ? createNoteCiphers({
+                recipientWalletPubkey: changeNoteRecipientWallet instanceof PublicKey
+                    ? changeNoteRecipientWallet.toBytes()
+                    : changeNoteRecipientWallet,
+                blinding: bigIntToBytesBE(changeUTXO.blinding),
+                amount: changeAmount,
+            }, null)
+            : null;
+    await transact({
+        program,
+        relayer,
+        recipient,
+        mintAddress,
+        root,
+        inputTreeId,
+        outputTreeId,
+        publicAmount,
+        inputNullifiers: circuitInputs.inputNullifiers,
+        outputCommitments: circuitInputs.outputCommitments,
+        extData,
+        proof,
+        deadline,
+        noteCiphers: withdrawNoteCiphers,
+    });
+    const { index: changeIdx } = tree.insert(changeUTXO.commitment);
+    const { root: newRoot } = tree.insert(zeroUTXO.commitment);
+    return {
+        changeUTXO,
+        leafIndex: changeIdx,
+        root: newRoot,
+    };
+}
+/**
+ * Result of a private transfer operation.
+ */

package/dist/esm/utxo.d.ts

@@ -0,0 +1 @@
+export * from "./notes/index.js";

package/dist/esm/utxo.js

@@ -1,372 +1,2 @@
-import { randomBytes } from "crypto";
-import nacl from "tweetnacl";
-import { sha256 } from "@noble/hashes/sha256";
-import { BN254_FR_MODULUS, bigIntToBytesBE, bytesToBigIntBE, poseidon1, poseidon3, poseidon4, pubkeyToField, } from "./poseidon";
-// -----------------------------------------------------------------------------
-// Keypair Functions
-// -----------------------------------------------------------------------------
-/**
- * Generate a random keypair.
- * Private key is a random 32-byte scalar.
- * Public key is derived via Poseidon: pubkey = Poseidon(privateKey)
- */
-export function generateKeypair() {
-    const privateKeyBytes = new Uint8Array(randomBytes(32));
-    const privateKey = bytesToBigIntBE(privateKeyBytes) % BN254_FR_MODULUS;
-    const publicKey = derivePublicKey(privateKey);
-    return { privateKey, publicKey };
-}
-/**
- * Derive public key from private key.
- * Matches circuit's Keypair template: publicKey = Poseidon(privateKey)
- */
-export function derivePublicKey(privateKey) {
-    return poseidon1(privateKey);
-}
-/**
- * Create keypair from a known private key.
- */
-export function keypairFromPrivateKey(privateKey) {
-    return {
-        privateKey: privateKey % BN254_FR_MODULUS,
-        publicKey: derivePublicKey(privateKey % BN254_FR_MODULUS),
-    };
-}
-// -----------------------------------------------------------------------------
-// UTXO Commitment Functions
-// -----------------------------------------------------------------------------
-/**
- * Compute UTXO commitment.
- * Matches circuit's UTXOCommitment template:
- *   commitment = Poseidon(amount, pubkey, blinding, mintAddress)
- */
-export function commitUTXO(utxo) {
-    const commitment = poseidon4(utxo.amount, utxo.pubkey, utxo.blinding, utxo.mintAddress);
-    return bigIntToBytesBE(commitment);
-}
-/**
- * Create a random UTXO with the given parameters.
- */
-export function createUTXO(params) {
-    const blindingBytes = new Uint8Array(randomBytes(32));
-    const blinding = bytesToBigIntBE(blindingBytes) % BN254_FR_MODULUS;
-    const utxo = {
-        amount: params.amount,
-        pubkey: params.pubkey,
-        blinding,
-        mintAddress: pubkeyToField(params.mintAddress),
-    };
-    const commitment = commitUTXO(utxo);
-    return {
-        ...utxo,
-        commitment,
-    };
-}
-/**
- * Create a UTXO with a specified private key (for owned UTXOs).
- */
-export function createOwnedUTXO(params) {
-    const keypair = keypairFromPrivateKey(params.privateKey);
-    const utxo = createUTXO({
-        amount: params.amount,
-        pubkey: keypair.publicKey,
-        mintAddress: params.mintAddress,
-    });
-    return {
-        ...utxo,
-        privateKey: keypair.privateKey,
-    };
-}
-/**
- * Create a zero UTXO (for deposits where no input exists).
- * Zero UTXOs have amount=0 and are used as placeholders in 2-in-2-out transactions.
- */
-export function createZeroUTXO(pubkey, mintAddress) {
-    return createUTXO({
-        amount: 0n,
-        pubkey,
-        mintAddress,
-    });
-}
-/**
- * Create a zero UTXO with private key (for owned zero UTXOs).
- */
-export function createOwnedZeroUTXO(privateKey, mintAddress) {
-    const keypair = keypairFromPrivateKey(privateKey);
-    const utxo = createZeroUTXO(keypair.publicKey, mintAddress);
-    return {
-        ...utxo,
-        privateKey: keypair.privateKey,
-    };
-}
-// -----------------------------------------------------------------------------
-// Nullifier Functions
-// -----------------------------------------------------------------------------
-/**
- * Compute signature for nullifier derivation.
- * Matches circuit's Signature template:
- *   signature = Poseidon(privateKey, commitment, pathIndex)
- */
-export function computeSignature(privateKey, commitment, pathIndex) {
-    return poseidon3(privateKey, commitment, pathIndex);
-}
-/**
- * Derive nullifier for a UTXO.
- * Matches circuit's UTXONullifier template:
- *   signature = Poseidon(privateKey, commitment, pathIndex)
- *   nullifier = Poseidon(commitment, pathIndex, signature)
- *
- * The signature-based nullifier ensures only the private key holder can spend.
- */
-export function deriveNullifier(utxo, pathIndex, privateKey) {
-    const commitment = bytesToBigIntBE(utxo.commitment) % BN254_FR_MODULUS;
-    const pathIndexField = BigInt(pathIndex) % BN254_FR_MODULUS;
-    const signature = computeSignature(privateKey, commitment, pathIndexField);
-    const nullifier = poseidon3(commitment, pathIndexField, signature);
-    return bigIntToBytesBE(nullifier);
-}
-/**
- * Convert InputUTXO to the format expected by the circuit.
- */
-export function inputUTXOToCircuitFormat(input) {
-    return {
-        amount: input.amount,
-        pubkey: input.pubkey,
-        blinding: input.blinding,
-        pathElements: input.pathElements.map((e) => bytesToBigIntBE(e) % BN254_FR_MODULUS),
-        pathIndex: input.pathIndex,
-        privateKey: input.privateKey,
-    };
-}
-/**
- * Derive a NaCl X25519 encryption keypair from a UTXO private key.
- * The keypair is deterministic: same privateKey always yields the same pair.
- */
-export function deriveEncryptionKeypair(privateKey) {
-    const seed = sha256(bigIntToBytesBE(privateKey));
-    return nacl.box.keyPair.fromSecretKey(seed);
-}
-/**
- * Encrypt a UTXO so the recipient can recover it from on-chain events.
- *
- * Plaintext layout (72 bytes):
- *   [0..8]   amount  — 8-byte little-endian u64
- *   [8..40]  blinding — 32-byte big-endian field element
- *   [40..72] privateKey — 32-byte big-endian field element
- *
- * Uses ephemeral-key NaCl box so the sender key is single-use.
- */
-export function encryptUTXONote(utxo, recipientEncPubkey) {
-    const nonce = nacl.randomBytes(nacl.box.nonceLength); // 24 bytes
-    const ephemeral = nacl.box.keyPair();
-    const amountBuf = new Uint8Array(8);
-    let v = utxo.amount;
-    for (let i = 0; i < 8; i++) {
-        amountBuf[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    const plaintext = new Uint8Array(72);
-    plaintext.set(amountBuf, 0);
-    plaintext.set(bigIntToBytesBE(utxo.blinding), 8);
-    plaintext.set(bigIntToBytesBE(utxo.privateKey), 40);
-    const sharedKey = nacl.box.before(recipientEncPubkey, ephemeral.secretKey);
-    const ciphertext = nacl.box.after(plaintext, nonce, sharedKey);
-    return { nonce, ciphertext, senderEphemeralPubkey: ephemeral.publicKey };
-}
-/**
- * Try to decrypt an encrypted UTXO note using the recipient's private key.
- * Returns the SerializedUTXO if decryption succeeds and the commitment
- * matches, or `null` if the note was not intended for this key.
- */
-export function decryptUTXONote(note, recipientPrivateKey, commitment, mintAddress) {
-    const { secretKey } = deriveEncryptionKeypair(recipientPrivateKey);
-    const sharedKey = nacl.box.before(note.senderEphemeralPubkey, secretKey);
-    const plaintext = nacl.box.open.after(note.ciphertext, note.nonce, sharedKey);
-    if (!plaintext || plaintext.length < 72)
-        return null;
-    let amount = 0n;
-    for (let i = 7; i >= 0; i--)
-        amount = (amount << 8n) | BigInt(plaintext[i]);
-    const blinding = bytesToBigIntBE(plaintext.slice(8, 40)) % BN254_FR_MODULUS;
-    const privateKey = bytesToBigIntBE(plaintext.slice(40, 72)) % BN254_FR_MODULUS;
-    const pubkey = derivePublicKey(privateKey);
-    const utxo = {
-        amount,
-        pubkey,
-        blinding,
-        mintAddress: pubkeyToField(mintAddress),
-    };
-    const expectedCommitment = commitUTXO(utxo);
-    if (!expectedCommitment.every((b, i) => b === commitment[i]))
-        return null;
-    return { ...utxo, commitment, privateKey };
-}
-// -- Internal crypto helpers (no extra dependencies) --------------------------
-/** Derive 32-byte encryption key from a shared secret using SHA-512 truncated.
- *  Must match the production "sha256" helper which uses nacl.hash (SHA-512) [0:32]. */
-function kdfSHA512_256(secret) {
-    return nacl.hash(secret).slice(0, 32);
-}
-/** Convert an Ed25519 private seed (32 bytes) to an X25519 scalar.
- *  Equivalent to ed2curve.convertSecretKey(seed). */
-function ed25519SeedToX25519Private(seed) {
-    const h = nacl.hash(seed); // SHA-512
-    const scalar = h.slice(0, 32);
-    scalar[0] &= 248;
-    scalar[31] &= 127;
-    scalar[31] |= 64;
-    return scalar;
-}
-const P25519 = (1n << 255n) - 19n;
-function modpow25519(b, e) {
-    let r = 1n;
-    b = b % P25519;
-    while (e > 0n) {
-        if (e & 1n)
-            r = (r * b) % P25519;
-        e >>= 1n;
-        b = (b * b) % P25519;
-    }
-    return r;
-}
-/** Convert an Ed25519 compressed public key (32 bytes) to X25519.
- *  Equivalent to ed2curve.convertPublicKey(pubkey).
- *  Edwards y-coord → Montgomery u via: u = (1 + y) / (1 - y) (mod p). */
-function ed25519PublicKeyToX25519(pubkey) {
-    const pk = new Uint8Array(pubkey);
-    pk[31] &= 0x7f; // clear sign bit to get y as LE integer
-    // Decode little-endian y
-    let y = 0n;
-    for (let i = 31; i >= 0; i--)
-        y = (y << 8n) | BigInt(pk[i]);
-    // u = (1 + y) / (1 - y) mod p
-    const num = (1n + y) % P25519;
-    const den = (((1n - y) % P25519) + P25519) % P25519;
-    const u = (num * modpow25519(den, P25519 - 2n)) % P25519;
-    // Encode as 32-byte LE
-    const out = new Uint8Array(32);
-    let v = u;
-    for (let i = 0; i < 32; i++) {
-        out[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return out;
-}
-// -- Public API ---------------------------------------------------------------
-/**
- * Encrypt a UTXO note for a recipient identified by their Solana wallet public key.
- * Produces a blob the relayer will store and serve via POST /notes/save.
- *
- * @param recipientWalletPubkey  32-byte Ed25519 public key (wallet.publicKey.toBytes())
- * @param noteData               UTXO details to encrypt
- */
-export function encryptBlindMailboxNote(recipientWalletPubkey, noteData) {
-    // 1. Generate ephemeral Ed25519 keypair seed
-    const ephemeralSeed = randomBytes(32);
-    // Ed25519 public key stored by relayer; dapp recovers X25519 via ed2curve.convertPublicKey()
-    const ephemeralEdPublicKey = nacl.sign.keyPair.fromSeed(new Uint8Array(ephemeralSeed)).publicKey;
-    // X25519 scalar (ed2curve.convertSecretKey equivalent)
-    const ephemeralX25519Private = ed25519SeedToX25519Private(new Uint8Array(ephemeralSeed));
-    // X25519 public key (ed2curve.convertPublicKey equivalent)
-    const recipientX25519Public = ed25519PublicKeyToX25519(recipientWalletPubkey);
-    const sharedSecret = nacl.scalarMult(ephemeralX25519Private, recipientX25519Public);
-    const key = kdfSHA512_256(sharedSecret);
-    // JSON format matches production relayer notes schema
-    const hexArr = (b) => Array.from(b)
-        .map((x) => x.toString(16).padStart(2, "0"))
-        .join("");
-    const noteJson = JSON.stringify({
-        blinding: hexArr(noteData.blinding),
-        leafIndex: noteData.leafIndex,
-        commitment: hexArr(noteData.commitment),
-        amount: noteData.amount.toString(),
-        mintAddress: noteData.mintAddress,
-        timestamp: Date.now(),
-        treeId: noteData.treeId,
-    });
-    const nonce = nacl.randomBytes(24);
-    const plaintext = new TextEncoder().encode(noteJson);
-    const encrypted = nacl.secretbox(plaintext, nonce, key);
-    const combined = new Uint8Array(nonce.length + encrypted.length);
-    combined.set(nonce);
-    combined.set(encrypted, nonce.length);
-    const encryptedBlob = Buffer.from(combined).toString("base64");
-    // Return Ed25519 public key (dapp calls ed2curve.convertPublicKey() to recover X25519)
-    return { ephemeralPublicKey: ephemeralEdPublicKey, encryptedBlob };
-}
-/**
- * Decrypt a Blind Mailbox note using the recipient's Solana wallet private seed.
- *
- * @param walletSecretKey  Full 64-byte wallet.secretKey — the first 32 bytes are the seed
- * @param ephemeralPublicKey  32-byte raw public key stored alongside the encrypted blob.
- *                            This may be either an Ed25519 pubkey (from Keypair.generate())
- *                            or a raw X25519 pubkey — the decryption path handles both:
- *                            if it is an Ed25519 key it is converted; otherwise used directly.
- * @param encryptedBlob      Base64 string as stored by the relayer
- */
-export function decryptBlindMailboxNote(walletSecretKey, ephemeralPublicKey, encryptedBlob) {
-    // 1. Derive recipient X25519 from Ed25519 seed
-    const seed = walletSecretKey.slice(0, 32);
-    const myX25519Private = ed25519SeedToX25519Private(seed);
-    // ephemeralPublicKey may be an Ed25519 pubkey (dapp's Keypair.generate()) or raw X25519;
-    // try Ed25519→X25519 conversion first, fall back to using it directly.
-    let theirPublic;
-    try {
-        theirPublic = ed25519PublicKeyToX25519(ephemeralPublicKey);
-    }
-    catch {
-        theirPublic = ephemeralPublicKey; // already X25519
-    }
-    const sharedSecret = nacl.scalarMult(myX25519Private, theirPublic);
-    const key = kdfSHA512_256(sharedSecret);
-    const combined = Buffer.from(encryptedBlob, "base64");
-    const nonce = combined.slice(0, 24);
-    const ciphertext = combined.slice(24);
-    const decrypted = nacl.secretbox.open(new Uint8Array(ciphertext), new Uint8Array(nonce), key);
-    if (!decrypted) {
-        throw new Error("decryptBlindMailboxNote: decryption failed — wrong key or corrupted blob");
-    }
-    const parsed = JSON.parse(new TextDecoder().decode(decrypted));
-    const hexToBytes = (hex) => {
-        const out = new Uint8Array(hex.length / 2);
-        for (let i = 0; i < hex.length; i += 2)
-            out[i / 2] = parseInt(hex.slice(i, i + 2), 16);
-        return out;
-    };
-    return {
-        blinding: hexToBytes(parsed.blinding),
-        leafIndex: parsed.leafIndex,
-        commitment: hexToBytes(parsed.commitment),
-        amount: BigInt(parsed.amount),
-        timestamp: parsed.timestamp ?? 0,
-        mintAddress: parsed.mintAddress,
-        treeId: parsed.treeId,
-    };
-}
-/**
- * Fetch all encrypted notes for a wallet from the relayer's Blind Mailbox endpoint
- * and decrypt them using the wallet's secret key.
- *
- * @param walletPublicKey  Base58 wallet address used to query the relayer
- * @param walletSecretKey  Full 64-byte keypair.secretKey for decryption
- * @param relayerUrl       Relayer base URL (e.g. "https://relay.veilo.app")
- */
-export async function fetchAndDecryptNotes(walletPublicKey, walletSecretKey, relayerUrl) {
-    const resp = await fetch(`${relayerUrl}/api/notes?recipientPublicKey=${walletPublicKey}`);
-    if (!resp.ok) {
-        throw new Error(`fetchAndDecryptNotes: ${resp.status} ${resp.statusText}`);
-    }
-    const { notes } = (await resp.json());
-    const results = [];
-    for (const note of notes) {
-        try {
-            const epk = Buffer.from(note.ephemeralPublicKey, "base64");
-            const decrypted = decryptBlindMailboxNote(walletSecretKey, new Uint8Array(epk), note.encryptedBlob);
-            results.push(decrypted);
-        }
-        catch {
-            // Note not for this key or corrupted — skip silently
-        }
-    }
-    return results;
-}
+// Backward-compatible entry point. Note responsibilities live in src/notes.
+export * from "./notes/index.js";