@veilo/sdk-core 0.4.0 → 0.6.0

package/dist/cjs/prover.js

@@ -1,50 +1,97 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCircuitArtifacts = resolveCircuitArtifacts;
 exports.createTransactionProver = createTransactionProver;
+exports.createSwapProver = createSwapProver;
 exports.verifyProof = verifyProof;
-const proof_js_1 = require("./proof.js");
-/** Lazy-load snarkjs — works in both CJS and ESM contexts. */
-async function loadSnarkjs() {
+const formatting_js_1 = require("./proofs/formatting.js");
+const swap_js_1 = require("./proofs/swap.js");
+/**
+ * Lazy-load snarkjs — works in both CJS and ESM contexts.
+ *
+ * The import is built through `Function` so TypeScript cannot rewrite it into a
+ * `require()` in the CommonJS build, and bundlers cannot follow it into browser
+ * output. Never call `require("snarkjs")` directly here: `require` is not
+ * defined in the ESM build, so it throws ReferenceError instead of this
+ * message.
+ */
+async function loadSnarkjs(purpose = "proof generation") {
     try {
         // Dynamic import works in both CJS (Node 12+) and ESM
         return await Function('return import("snarkjs")')();
     }
     catch {
-        throw new Error("snarkjs is required for proof generation. Install it: npm install snarkjs");
+        throw new Error(`snarkjs is required for ${purpose}. Install it: npm install snarkjs`);
+    }
+}
+/** Layout produced by `npm run copy:circuits`, relative to a circuits root. */
+const ARTIFACT_LAYOUT = {
+    transaction: {
+        wasm: "transaction/transaction_js/transaction.wasm",
+        zkey: "transaction/transaction_final.zkey",
+    },
+    swap: {
+        wasm: "swap/swap_js/swap.wasm",
+        zkey: "swap/swap_final.zkey",
+    },
+};
+/**
+ * Resolve circuit artifacts from disk when the caller did not supply them.
+ *
+ * Search order, first hit wins:
+ *
+ *   1. $VEILO_CIRCUITS_DIR                  explicit override
+ *   2. <package>/circuits                   populated by `npm run copy:circuits`
+ *   3. <cwd>/circuits
+ *   4. <cwd>/node_modules/@veilo/sdk-core/circuits
+ *
+ * NODE ONLY, AND DELIBERATELY LAZY. `node:fs` is imported inside the call, not
+ * at module scope: this module is reachable from the package root export, and a
+ * top-level `node:fs` import throws at bundle time in browser builds with no
+ * Node polyfill — the same reason `random.ts` avoids `node:crypto`. Browsers
+ * must pass `CircuitArtifacts` explicitly; there is nothing to resolve there.
+ *
+ * @throws when no candidate directory holds both files, listing what it tried
+ */
+async function resolveCircuitArtifacts(circuit) {
+    let fs;
+    let path;
+    try {
+        fs = await Function('return import("node:fs")')();
+        path = await Function('return import("node:path")')();
+    }
+    catch {
+        throw new Error(`Cannot resolve ${circuit} circuit artifacts: no filesystem available. ` +
+            "Pass CircuitArtifacts explicitly (browsers must supply buffers or URLs).");
+    }
+    const layout = ARTIFACT_LAYOUT[circuit];
+    if (!layout) {
+        throw new Error(`Unknown circuit ${JSON.stringify(circuit)}. Known circuits: ` +
+            `${Object.keys(ARTIFACT_LAYOUT).join(", ")}.`);
     }
+    const cwd = typeof process !== "undefined" ? process.cwd() : ".";
+    // __dirname exists in the CJS build; the ESM build falls back to cwd-relative
+    // candidates. dist/cjs/prover.js → ../../circuits is the package root copy.
+    const packageDir = typeof __dirname !== "undefined"
+        ? path.resolve(__dirname, "..", "..", "circuits")
+        : undefined;
+    const roots = [
+        process.env?.VEILO_CIRCUITS_DIR,
+        packageDir,
+        path.resolve(cwd, "circuits"),
+        path.resolve(cwd, "node_modules", "@veilo", "sdk-core", "circuits"),
+    ].filter((root) => Boolean(root));
+    for (const root of roots) {
+        const wasmPath = path.resolve(root, layout.wasm);
+        const zkeyPath = path.resolve(root, layout.zkey);
+        if (fs.existsSync(wasmPath) && fs.existsSync(zkeyPath)) {
+            return { wasmPath, zkeyPath };
+        }
+    }
+    throw new Error(`Cannot resolve ${circuit} circuit artifacts. Looked for ${layout.wasm} ` +
+        `and ${layout.zkey} under:\n  ${roots.join("\n  ")}\n` +
+        "Run `npm run copy:circuits` in the SDK, set VEILO_CIRCUITS_DIR, or pass " +
+        "CircuitArtifacts explicitly.");
 }
 /**
  * Create a proof builder function for the transaction circuit.
@@ -73,10 +120,30 @@ async function loadSnarkjs() {
  * ```
  */
 function createTransactionProver(artifacts) {
+    // Resolved on first use, not at factory time: constructing a prover must stay
+    // free of filesystem access so browser bundles can import this module.
+    let resolved;
+    return async (inputs) => {
+        const snarkjs = await loadSnarkjs();
+        resolved ?? (resolved = artifacts
+            ? Promise.resolve(artifacts)
+            : resolveCircuitArtifacts("transaction"));
+        const { wasmPath, zkeyPath } = await resolved;
+        const formattedInputs = (0, formatting_js_1.formatInputsForSnarkjs)(inputs);
+        const { proof } = await snarkjs.groth16.fullProve(formattedInputs, wasmPath, zkeyPath);
+        return proof;
+    };
+}
+/** Create a proof builder for the current `swap.circom` witness shape. */
+function createSwapProver(artifacts) {
+    let resolved;
     return async (inputs) => {
         const snarkjs = await loadSnarkjs();
-        const formattedInputs = (0, proof_js_1.formatInputsForSnarkjs)(inputs);
-        const { proof } = await snarkjs.groth16.fullProve(formattedInputs, artifacts.wasmPath, artifacts.zkeyPath);
+        resolved ?? (resolved = artifacts
+            ? Promise.resolve(artifacts)
+            : resolveCircuitArtifacts("swap"));
+        const { wasmPath, zkeyPath } = await resolved;
+        const { proof } = await snarkjs.groth16.fullProve((0, swap_js_1.formatSwapInputsForSnarkjs)(inputs), wasmPath, zkeyPath);
         return proof;
     };
 }
@@ -91,18 +158,20 @@ function createTransactionProver(artifacts) {
  * @returns true if the proof is valid
  */
 async function verifyProof(proof, publicSignals, vkey) {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    let snarkjs;
-    try {
-        snarkjs = require("snarkjs");
-    }
-    catch {
-        throw new Error('snarkjs is required for proof verification. Install it: npm install snarkjs');
-    }
+    const snarkjs = await loadSnarkjs("proof verification");
     let vkeyObj;
     if (typeof vkey === "string") {
-        // Node.js file path — read and parse
-        const fs = await Promise.resolve().then(() => __importStar(require("fs")));
+        // Node.js file path — read and parse. Same hidden import as
+        // resolveCircuitArtifacts: a plain `await import("fs")` is followed by
+        // bundlers and breaks browser builds that have no Node polyfill.
+        let fs;
+        try {
+            fs = await Function('return import("node:fs")')();
+        }
+        catch {
+            throw new Error("Reading a verification key from a path requires Node. Pass the parsed " +
+                "verification key object instead.");
+        }
         vkeyObj = JSON.parse(fs.readFileSync(vkey, "utf-8"));
     }
     else {

package/dist/cjs/relayer/api.d.ts

@@ -0,0 +1,31 @@
+import type { CheckNullifiersResponse, ChallengeResponse, CheckUsernameResponse, DeleteUserDataResponse, MerkleRootResponse, MerkleTreeResponse, PreRegisterKeyResponse, PrivateSwapRequest, PrivateSwapResponse, PrivateTransferRequest, PrivateTransferResponse, QueryNotesRequest, QueryNotesResponse, RegisterRequest, RegisterResponse, RestoreRequest, RestoreResponse, SaveEncryptedNoteRequest, SaveEncryptedNoteResponse, VeiloPublicKeyResponse, WithdrawRequest, WithdrawResponse } from "./types.js";
+/** Request a wallet-authentication challenge from Veilo. */
+export declare function getChallenge(walletPublicKey: string): Promise<ChallengeResponse>;
+/** Register a Veilo account and receive its auth token. */
+export declare function register(data: RegisterRequest): Promise<RegisterResponse>;
+/** Restore a Veilo account and receive its auth token. */
+export declare function restore(data: RestoreRequest): Promise<RestoreResponse>;
+export declare function checkUsername(username: string): Promise<CheckUsernameResponse>;
+export declare function getVeiloPublicKey(params: {
+    username: string;
+    publicKey?: never;
+} | {
+    publicKey: string;
+    username?: never;
+}): Promise<VeiloPublicKeyResponse>;
+export declare function preRegisterKey(solanaAddress: string): Promise<PreRegisterKeyResponse>;
+export declare function saveEncryptedNote(data: SaveEncryptedNoteRequest): Promise<SaveEncryptedNoteResponse>;
+/** Query notes with an explicit per-call token; no auth state is shared. */
+export declare function queryEncryptedNotes(authToken: string, params?: QueryNotesRequest): Promise<QueryNotesResponse>;
+/** Delete the authenticated user's stored data without retaining their token. */
+export declare function deleteUserData(authToken: string): Promise<DeleteUserDataResponse>;
+/** Raw check-batch call. Prefer `checkNullifiersSpent`, which chunks for you. */
+export declare function checkNullifiers(nullifiers: string[]): Promise<CheckNullifiersResponse>;
+export declare function getMerkleRoot(mintAddress?: string, treeId?: number): Promise<MerkleRootResponse>;
+export declare function getMerkleTree(mintAddress?: string, treeId?: number): Promise<MerkleTreeResponse>;
+export declare function submitWithdraw(data: WithdrawRequest): Promise<WithdrawResponse>;
+export declare function submitPrivateTransfer(data: PrivateTransferRequest): Promise<PrivateTransferResponse>;
+export declare function submitPrivateSwap(data: PrivateSwapRequest): Promise<PrivateSwapResponse>;
+export { submitClosePosition, submitMergePositions, submitOpenPosition, } from "../positions/relayer.js";
+export { submitJperpCancelTrigger, submitJperpClose, submitJperpOpen, submitJperpRecoverNative, submitJperpRecoverSeed, submitJperpReissue, submitJperpSetTpsl, submitJperpUpdateTpsl, } from "../perps/relayer.js";
+export { submitPredictionOpen, submitPredictionReissue, } from "../predictions/relayer.js";

package/dist/cjs/relayer/api.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.submitPredictionReissue = exports.submitPredictionOpen = exports.submitJperpUpdateTpsl = exports.submitJperpSetTpsl = exports.submitJperpReissue = exports.submitJperpRecoverSeed = exports.submitJperpRecoverNative = exports.submitJperpOpen = exports.submitJperpClose = exports.submitJperpCancelTrigger = exports.submitOpenPosition = exports.submitMergePositions = exports.submitClosePosition = void 0;
+exports.getChallenge = getChallenge;
+exports.register = register;
+exports.restore = restore;
+exports.checkUsername = checkUsername;
+exports.getVeiloPublicKey = getVeiloPublicKey;
+exports.preRegisterKey = preRegisterKey;
+exports.saveEncryptedNote = saveEncryptedNote;
+exports.queryEncryptedNotes = queryEncryptedNotes;
+exports.deleteUserData = deleteUserData;
+exports.checkNullifiers = checkNullifiers;
+exports.getMerkleRoot = getMerkleRoot;
+exports.getMerkleTree = getMerkleTree;
+exports.submitWithdraw = submitWithdraw;
+exports.submitPrivateTransfer = submitPrivateTransfer;
+exports.submitPrivateSwap = submitPrivateSwap;
+const internal_js_1 = require("./internal.js");
+/** Request a wallet-authentication challenge from Veilo. */
+function getChallenge(walletPublicKey) {
+    return (0, internal_js_1.getInternalRelayerClient)().getChallenge(walletPublicKey);
+}
+/** Register a Veilo account and receive its auth token. */
+function register(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().register(data);
+}
+/** Restore a Veilo account and receive its auth token. */
+function restore(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().restore(data);
+}
+function checkUsername(username) {
+    return (0, internal_js_1.getInternalRelayerClient)().checkUsername(username);
+}
+function getVeiloPublicKey(params) {
+    return (0, internal_js_1.getInternalRelayerClient)().getVeiloPublicKey(params);
+}
+function preRegisterKey(solanaAddress) {
+    return (0, internal_js_1.getInternalRelayerClient)().preRegisterKey(solanaAddress);
+}
+function saveEncryptedNote(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().saveEncryptedNote(data);
+}
+/** Query notes with an explicit per-call token; no auth state is shared. */
+function queryEncryptedNotes(authToken, params = {}) {
+    return (0, internal_js_1.createInternalRelayerClient)({ authToken }).queryEncryptedNotes(params);
+}
+/** Delete the authenticated user's stored data without retaining their token. */
+function deleteUserData(authToken) {
+    return (0, internal_js_1.createInternalRelayerClient)({ authToken }).deleteUserData();
+}
+/** Raw check-batch call. Prefer `checkNullifiersSpent`, which chunks for you. */
+function checkNullifiers(nullifiers) {
+    return (0, internal_js_1.getInternalRelayerClient)().checkNullifiers(nullifiers);
+}
+function getMerkleRoot(mintAddress, treeId) {
+    return (0, internal_js_1.getInternalRelayerClient)().getMerkleRoot(mintAddress, treeId);
+}
+function getMerkleTree(mintAddress, treeId) {
+    return (0, internal_js_1.getInternalRelayerClient)().getMerkleTree(mintAddress, treeId);
+}
+function submitWithdraw(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().submitWithdraw(data);
+}
+function submitPrivateTransfer(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().submitPrivateTransfer(data);
+}
+function submitPrivateSwap(data) {
+    return (0, internal_js_1.getInternalRelayerClient)().submitPrivateSwap(data);
+}
+var relayer_js_1 = require("../positions/relayer.js");
+Object.defineProperty(exports, "submitClosePosition", { enumerable: true, get: function () { return relayer_js_1.submitClosePosition; } });
+Object.defineProperty(exports, "submitMergePositions", { enumerable: true, get: function () { return relayer_js_1.submitMergePositions; } });
+Object.defineProperty(exports, "submitOpenPosition", { enumerable: true, get: function () { return relayer_js_1.submitOpenPosition; } });
+var relayer_js_2 = require("../perps/relayer.js");
+Object.defineProperty(exports, "submitJperpCancelTrigger", { enumerable: true, get: function () { return relayer_js_2.submitJperpCancelTrigger; } });
+Object.defineProperty(exports, "submitJperpClose", { enumerable: true, get: function () { return relayer_js_2.submitJperpClose; } });
+Object.defineProperty(exports, "submitJperpOpen", { enumerable: true, get: function () { return relayer_js_2.submitJperpOpen; } });
+Object.defineProperty(exports, "submitJperpRecoverNative", { enumerable: true, get: function () { return relayer_js_2.submitJperpRecoverNative; } });
+Object.defineProperty(exports, "submitJperpRecoverSeed", { enumerable: true, get: function () { return relayer_js_2.submitJperpRecoverSeed; } });
+Object.defineProperty(exports, "submitJperpReissue", { enumerable: true, get: function () { return relayer_js_2.submitJperpReissue; } });
+Object.defineProperty(exports, "submitJperpSetTpsl", { enumerable: true, get: function () { return relayer_js_2.submitJperpSetTpsl; } });
+Object.defineProperty(exports, "submitJperpUpdateTpsl", { enumerable: true, get: function () { return relayer_js_2.submitJperpUpdateTpsl; } });
+var relayer_js_3 = require("../predictions/relayer.js");
+Object.defineProperty(exports, "submitPredictionOpen", { enumerable: true, get: function () { return relayer_js_3.submitPredictionOpen; } });
+Object.defineProperty(exports, "submitPredictionReissue", { enumerable: true, get: function () { return relayer_js_3.submitPredictionReissue; } });

package/dist/cjs/relayer/client.d.ts

@@ -0,0 +1,73 @@
+import type { CheckNullifiersResponse, ChallengeResponse, CheckUsernameResponse, DeleteUserDataResponse, MerkleRootResponse, MerkleTreeResponse, PreRegisterKeyResponse, PrivateSwapRequest, PrivateSwapResponse, PrivateTransferRequest, PrivateTransferResponse, QueryNotesRequest, QueryNotesResponse, RegisterRequest, RegisterResponse, RestoreRequest, RestoreResponse, RetryPolicy, SaveEncryptedNoteRequest, SaveEncryptedNoteResponse, VeiloPublicKeyResponse, WithdrawRequest, WithdrawResponse } from "./types.js";
+import { type InternalRelayerClientOptions } from "./internal-config.js";
+import type { ClosePositionRequest, ClosePositionResponse, MergePositionsRequest, MergePositionsResponse, OpenPositionRequest, OpenPositionResponse } from "../positions/types.js";
+import type { JperpCancelTriggerRequest, JperpCancelTriggerResponse, JperpCloseRequest, JperpDecreaseResponse, JperpOpenRequest, JperpOpenResponse, JperpRecoverNativeRequest, JperpRecoverNativeResponse, JperpRecoverSeedRequest, JperpRecoverSeedResponse, JperpReissueRequest, JperpReissueResponse, JperpSetTpslRequest, JperpUpdateTpslRequest } from "../perps/types.js";
+import type { PredictionOpenRequest, PredictionOpenResponse, PredictionReissueRequest, PredictionReissueResponse } from "../predictions/types.js";
+/** @internal Relayer transport behind the SDK's functional helpers. */
+export declare class VeiloRelayerClient {
+    private readonly transport;
+    private readonly relayerPubKey;
+    constructor(config?: InternalRelayerClientOptions, retry?: Partial<RetryPolicy>);
+    /** Update the auth token (e.g. after register/restore). */
+    setAuthToken(token: string): void;
+    private encryptPayload;
+    /** Request a signature challenge for wallet authentication. */
+    getChallenge(walletPublicKey: string): Promise<ChallengeResponse>;
+    /** Register a new account with a signed challenge. Returns a JWT auth token. */
+    register(data: RegisterRequest): Promise<RegisterResponse>;
+    /** Restore an existing account using a signed challenge. Returns a JWT auth token. */
+    restore(data: RestoreRequest): Promise<RestoreResponse>;
+    /** Check whether a username is available for registration. */
+    checkUsername(username: string): Promise<CheckUsernameResponse>;
+    /** Look up a user's Veilo public key by username or wallet public key. */
+    getVeiloPublicKey(params: {
+        username: string;
+        publicKey?: never;
+    } | {
+        publicKey: string;
+        username?: never;
+    }): Promise<VeiloPublicKeyResponse>;
+    /**
+     * Provision (or retrieve) the Veilo spend key paired with a Solana address.
+     * Public and idempotent; the response contains public key material only.
+     */
+    preRegisterKey(solanaAddress: string): Promise<PreRegisterKeyResponse>;
+    /** Save an encrypted note to the relayer's database. */
+    saveEncryptedNote(data: SaveEncryptedNoteRequest): Promise<SaveEncryptedNoteResponse>;
+    /** Query encrypted notes for the authenticated user. Requires auth token. */
+    queryEncryptedNotes(params?: QueryNotesRequest): Promise<QueryNotesResponse>;
+    /** Delete all stored data for the authenticated user. Requires auth token. */
+    /**
+     * Ask which of these nullifiers the relayer has seen spent.
+     *
+     * Caller must respect MAX_NULLIFIERS_PER_CHECK; `checkNullifiersSpent` in
+     * notes/spent.ts does the chunking. Unauthenticated: a nullifier reveals
+     * nothing about ownership on its own.
+     */
+    checkNullifiers(nullifiers: string[]): Promise<CheckNullifiersResponse>;
+    deleteUserData(): Promise<DeleteUserDataResponse>;
+    /** Fetch the current Merkle root for a pool, optionally filtered by mint and tree ID. */
+    getMerkleRoot(mintAddress?: string, treeId?: number): Promise<MerkleRootResponse>;
+    /** Fetch the full Merkle tree (all leaves) for a pool. */
+    getMerkleTree(mintAddress?: string, treeId?: number): Promise<MerkleTreeResponse>;
+    /** Submit an encrypted withdrawal request to the relayer. Not retried on failure. */
+    submitWithdraw(data: WithdrawRequest): Promise<WithdrawResponse>;
+    /** Submit an encrypted private transfer request. Not retried on failure. */
+    submitPrivateTransfer(data: PrivateTransferRequest): Promise<PrivateTransferResponse>;
+    /** Submit an encrypted private swap request. Not retried on failure. */
+    submitPrivateSwap(data: PrivateSwapRequest): Promise<PrivateSwapResponse>;
+    submitOpenPosition(data: OpenPositionRequest): Promise<OpenPositionResponse>;
+    submitClosePosition(data: ClosePositionRequest): Promise<ClosePositionResponse>;
+    submitMergePositions(data: MergePositionsRequest): Promise<MergePositionsResponse>;
+    submitJperpOpen(data: JperpOpenRequest): Promise<JperpOpenResponse>;
+    submitJperpClose(data: JperpCloseRequest): Promise<JperpDecreaseResponse>;
+    submitJperpSetTpsl(data: JperpSetTpslRequest): Promise<JperpDecreaseResponse>;
+    submitJperpUpdateTpsl(data: JperpUpdateTpslRequest): Promise<JperpDecreaseResponse>;
+    submitJperpCancelTrigger(data: JperpCancelTriggerRequest): Promise<JperpCancelTriggerResponse>;
+    submitJperpReissue(data: JperpReissueRequest): Promise<JperpReissueResponse>;
+    submitJperpRecoverSeed(data: JperpRecoverSeedRequest): Promise<JperpRecoverSeedResponse>;
+    submitJperpRecoverNative(data: JperpRecoverNativeRequest): Promise<JperpRecoverNativeResponse>;
+    submitPredictionOpen(data: PredictionOpenRequest): Promise<PredictionOpenResponse>;
+    submitPredictionReissue(data: PredictionReissueRequest): Promise<PredictionReissueResponse>;
+    private submitEncrypted;
+}

package/dist/cjs/relayer/client.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VeiloRelayerClient = void 0;
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const crypto_js_1 = require("./crypto.js");
+const encoding_js_1 = require("./encoding.js");
+const internal_config_js_1 = require("./internal-config.js");
+const transport_js_1 = require("./transport.js");
+// =============================================================================
+// Relayer Client
+// =============================================================================
+/** @internal Relayer transport behind the SDK's functional helpers. */
+class VeiloRelayerClient {
+    constructor(config = {}, retry) {
+        this.transport = new transport_js_1.RelayerHttpTransport(config, retry);
+        this.relayerPubKey = (0, encoding_js_1.fromBase64)(config.encryptionPublicKey ?? internal_config_js_1.VEILO_RELAYER_PUBLIC_KEY);
+    }
+    /** Update the auth token (e.g. after register/restore). */
+    setAuthToken(token) {
+        this.transport.setAuthToken(token);
+    }
+    encryptPayload(data) {
+        return (0, crypto_js_1.encryptForRelayer)({
+            ...data,
+            timestamp: Date.now(),
+            nonce: (0, encoding_js_1.toBase64)(tweetnacl_1.default.randomBytes(32)),
+        }, this.relayerPubKey);
+    }
+    // ---------------------------------------------------------------------------
+    // Auth
+    // ---------------------------------------------------------------------------
+    /** Request a signature challenge for wallet authentication. */
+    async getChallenge(walletPublicKey) {
+        return this.transport.request("POST", "/auth/challenge", {
+            body: { walletPublicKey },
+        });
+    }
+    /** Register a new account with a signed challenge. Returns a JWT auth token. */
+    async register(data) {
+        return this.transport.request("POST", "/auth/register", { body: data });
+    }
+    /** Restore an existing account using a signed challenge. Returns a JWT auth token. */
+    async restore(data) {
+        return this.transport.request("POST", "/auth/restore", { body: data });
+    }
+    /** Check whether a username is available for registration. */
+    async checkUsername(username) {
+        return this.transport.request("GET", `/auth/checkUsername?username=${encodeURIComponent(username)}`);
+    }
+    /** Look up a user's Veilo public key by username or wallet public key. */
+    async getVeiloPublicKey(params) {
+        const query = "username" in params && params.username
+            ? `username=${encodeURIComponent(params.username)}`
+            : `publicKey=${encodeURIComponent(params.publicKey)}`;
+        return this.transport.request("GET", `/auth/veiloPublicKey?${query}`);
+    }
+    /**
+     * Provision (or retrieve) the Veilo spend key paired with a Solana address.
+     * Public and idempotent; the response contains public key material only.
+     */
+    async preRegisterKey(solanaAddress) {
+        return this.transport.request("POST", "/auth/pre-register-key", {
+            body: { solanaAddress },
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // Notes
+    // ---------------------------------------------------------------------------
+    /** Save an encrypted note to the relayer's database. */
+    async saveEncryptedNote(data) {
+        return this.transport.request("POST", "/notes/save", { body: data });
+    }
+    /** Query encrypted notes for the authenticated user. Requires auth token. */
+    async queryEncryptedNotes(params = {}) {
+        return this.transport.request("POST", "/notes/query", {
+            body: params,
+            authenticated: true,
+        });
+    }
+    /** Delete all stored data for the authenticated user. Requires auth token. */
+    /**
+     * Ask which of these nullifiers the relayer has seen spent.
+     *
+     * Caller must respect MAX_NULLIFIERS_PER_CHECK; `checkNullifiersSpent` in
+     * notes/spent.ts does the chunking. Unauthenticated: a nullifier reveals
+     * nothing about ownership on its own.
+     */
+    async checkNullifiers(nullifiers) {
+        return this.transport.request("POST", "/notes/nullifiers/check-batch", {
+            body: { nullifiers },
+        });
+    }
+    async deleteUserData() {
+        return this.transport.request("POST", "/notes/delete", { authenticated: true });
+    }
+    // ---------------------------------------------------------------------------
+    // Merkle
+    // ---------------------------------------------------------------------------
+    /** Fetch the current Merkle root for a pool, optionally filtered by mint and tree ID. */
+    async getMerkleRoot(mintAddress, treeId) {
+        const params = new URLSearchParams();
+        if (mintAddress)
+            params.append("mintAddress", mintAddress);
+        if (treeId !== undefined)
+            params.append("treeId", treeId.toString());
+        const qs = params.toString();
+        return this.transport.request("GET", `/merkle/root${qs ? `?${qs}` : ""}`);
+    }
+    /** Fetch the full Merkle tree (all leaves) for a pool. */
+    async getMerkleTree(mintAddress, treeId) {
+        const params = new URLSearchParams();
+        if (mintAddress)
+            params.append("mintAddress", mintAddress);
+        if (treeId !== undefined)
+            params.append("treeId", treeId.toString());
+        const qs = params.toString();
+        return this.transport.request("GET", `/merkle/tree${qs ? `?${qs}` : ""}`);
+    }
+    // ---------------------------------------------------------------------------
+    // Transact (encrypted payloads)
+    // ---------------------------------------------------------------------------
+    /** Submit an encrypted withdrawal request to the relayer. Not retried on failure. */
+    async submitWithdraw(data) {
+        const encryptedPayload = this.encryptPayload(data);
+        return this.transport.request("POST", "/transact/withdraw", {
+            body: { encryptedPayload },
+            retryable: false,
+        });
+    }
+    /** Submit an encrypted private transfer request. Not retried on failure. */
+    async submitPrivateTransfer(data) {
+        const encryptedPayload = this.encryptPayload(data);
+        return this.transport.request("POST", "/transact/private-transfer", {
+            body: { encryptedPayload },
+            retryable: false,
+        });
+    }
+    /** Submit an encrypted private swap request. Not retried on failure. */
+    async submitPrivateSwap(data) {
+        const encryptedPayload = this.encryptPayload(data);
+        return this.transport.request("POST", "/transact/private-swap", {
+            body: { encryptedPayload },
+            retryable: false,
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // Private positions (encrypted payloads)
+    // ---------------------------------------------------------------------------
+    async submitOpenPosition(data) {
+        return this.submitEncrypted("/positions/open", data);
+    }
+    async submitClosePosition(data) {
+        return this.submitEncrypted("/positions/close", data);
+    }
+    async submitMergePositions(data) {
+        return this.submitEncrypted("/positions/merge", data);
+    }
+    // ---------------------------------------------------------------------------
+    // Private Jupiter Perps (encrypted payloads)
+    // ---------------------------------------------------------------------------
+    async submitJperpOpen(data) {
+        return this.submitEncrypted("/jperp/open", data);
+    }
+    async submitJperpClose(data) {
+        return this.submitEncrypted("/jperp/close", data);
+    }
+    async submitJperpSetTpsl(data) {
+        return this.submitEncrypted("/jperp/set-tpsl", data);
+    }
+    async submitJperpUpdateTpsl(data) {
+        return this.submitEncrypted("/jperp/update-tpsl", data);
+    }
+    async submitJperpCancelTrigger(data) {
+        return this.submitEncrypted("/jperp/cancel-trigger", data);
+    }
+    async submitJperpReissue(data) {
+        return this.submitEncrypted("/jperp/reissue", data);
+    }
+    async submitJperpRecoverSeed(data) {
+        return this.submitEncrypted("/jperp/recover-seed", data);
+    }
+    async submitJperpRecoverNative(data) {
+        return this.submitEncrypted("/jperp/recover-native", data);
+    }
+    // ---------------------------------------------------------------------------
+    // Private Jupiter Predictions (encrypted payloads)
+    // ---------------------------------------------------------------------------
+    async submitPredictionOpen(data) {
+        return this.submitEncrypted("/predictions/open", data);
+    }
+    async submitPredictionReissue(data) {
+        return this.submitEncrypted("/predictions/reissue", data);
+    }
+    submitEncrypted(route, data) {
+        const encryptedPayload = this.encryptPayload(data);
+        return this.transport.request("POST", route, {
+            body: { encryptedPayload },
+            // These endpoints can land transactions; automatic replay is unsafe.
+            retryable: false,
+        });
+    }
+}
+exports.VeiloRelayerClient = VeiloRelayerClient;

package/dist/cjs/relayer/crypto.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Encrypt a JSON-serializable payload for the relayer using NaCl box.
+ * Layout: [ephemeralPubKey (32)] [nonce (24)] [ciphertext (...)]
+ */
+export declare function encryptForRelayer(data: unknown, relayerPublicKey: Uint8Array): string;

package/dist/cjs/relayer/crypto.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptForRelayer = encryptForRelayer;
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const encoding_js_1 = require("./encoding.js");
+// =============================================================================
+// Encryption
+// =============================================================================
+/**
+ * Encrypt a JSON-serializable payload for the relayer using NaCl box.
+ * Layout: [ephemeralPubKey (32)] [nonce (24)] [ciphertext (...)]
+ */
+function encryptForRelayer(data, relayerPublicKey) {
+    const ephemeral = tweetnacl_1.default.box.keyPair();
+    const message = new TextEncoder().encode(JSON.stringify(data));
+    const nonce = tweetnacl_1.default.randomBytes(tweetnacl_1.default.box.nonceLength);
+    const ciphertext = tweetnacl_1.default.box(message, nonce, relayerPublicKey, ephemeral.secretKey);
+    const payload = new Uint8Array(ephemeral.publicKey.length + nonce.length + ciphertext.length);
+    payload.set(ephemeral.publicKey, 0);
+    payload.set(nonce, ephemeral.publicKey.length);
+    payload.set(ciphertext, ephemeral.publicKey.length + nonce.length);
+    return (0, encoding_js_1.toBase64)(payload);
+}

package/dist/cjs/relayer/encoding.d.ts

@@ -0,0 +1,2 @@
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function fromBase64(str: string): Uint8Array;

package/dist/cjs/relayer/encoding.js

@@ -0,0 +1,23 @@
+"use strict";
+// =============================================================================
+// Base64 helpers (no dependency on tweetnacl-util)
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toBase64 = toBase64;
+exports.fromBase64 = fromBase64;
+function toBase64(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
+    }
+    return btoa(String.fromCharCode(...bytes));
+}
+function fromBase64(str) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(str, "base64"));
+    }
+    const binary = atob(str);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}