@zga/client 0.0.0-stage → 0.1.1

package/dist/observer.js

@@ -0,0 +1,255 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AvailabilityLog = void 0;
+exports.ed25519Sign = ed25519Sign;
+exports.ed25519Verify = ed25519Verify;
+exports.envelopeHeaders = envelopeHeaders;
+exports.availabilityAcceptable = availabilityAcceptable;
+exports.probeGuild = probeGuild;
+exports.fetchPendingReceipts = fetchPendingReceipts;
+exports.postAttestation = postAttestation;
+exports.checkUsageReceipt = checkUsageReceipt;
+exports.attestPendingReceipts = attestPendingReceipts;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const web3_js_1 = require("@solana/web3.js");
+const anchor_1 = require("@coral-xyz/anchor");
+const addresses_1 = require("./addresses");
+const billing_1 = require("./billing");
+const explorer_1 = require("./explorer");
+const bs58 = anchor_1.utils.bytes.bs58;
+const ED25519_PKCS8 = Buffer.from('302e020100300506032b657004220420', 'hex');
+const ED25519_SPKI = Buffer.from('302a300506032b6570032100', 'hex');
+function ed25519Sign(secretKey, message) {
+    const key = (0, crypto_1.createPrivateKey)({ key: Buffer.concat([ED25519_PKCS8, Buffer.from(secretKey.subarray(0, 32))]), format: 'der', type: 'pkcs8' });
+    return new Uint8Array((0, crypto_1.sign)(null, Buffer.from(message), key));
+}
+function ed25519Verify(publicKey, message, signature) {
+    try {
+        const key = (0, crypto_1.createPublicKey)({ key: Buffer.concat([ED25519_SPKI, Buffer.from(publicKey)]), format: 'der', type: 'spki' });
+        return (0, crypto_1.verify)(null, Buffer.from(message), key, Buffer.from(signature));
+    }
+    catch {
+        return false;
+    }
+}
+function envelopeHeaders(secretKey, publicKey, id, nowSeconds = Math.floor(Date.now() / 1000)) {
+    return {
+        'x-zga-sender': publicKey.toBase58(),
+        'x-zga-timestamp': String(nowSeconds),
+        'x-zga-signature': bs58.encode(ed25519Sign(secretKey, Buffer.from(`${nowSeconds}:${id}`))),
+    };
+}
+class AvailabilityLog {
+    constructor(path = null, keepMs = 14 * 24 * 60 * 60 * 1000) {
+        this.path = path;
+        this.keepMs = keepMs;
+        this.samples = new Map();
+        if (path && fs.existsSync(path)) {
+            const raw = JSON.parse(fs.readFileSync(path, 'utf8'));
+            for (const [key, list] of Object.entries(raw))
+                this.samples.set(key, list);
+        }
+    }
+    record(key, up, atMs = Date.now()) {
+        const list = this.samples.get(key) ?? [];
+        list.push([atMs, up ? 1 : 0]);
+        const cutoff = atMs - this.keepMs;
+        while (list.length > 0 && list[0][0] < cutoff)
+            list.shift();
+        this.samples.set(key, list);
+    }
+    count(key) {
+        return this.samples.get(key)?.length ?? 0;
+    }
+    save() {
+        if (!this.path)
+            return;
+        const out = {};
+        for (const [key, list] of this.samples)
+            out[key] = list;
+        fs.writeFileSync(this.path, JSON.stringify(out));
+    }
+    coverage(key, fromMs, toMs, intervalMs) {
+        const inside = (this.samples.get(key) ?? []).filter(([at]) => at >= fromMs && at < toMs);
+        return { expected: Math.floor((toMs - fromMs) / intervalMs), samples: inside.length, up: inside.filter(([, ok]) => ok === 1).length };
+    }
+}
+exports.AvailabilityLog = AvailabilityLog;
+function availabilityAcceptable(c, minCoverage = 0.9, minUp = 0.9) {
+    return c.expected > 0 && c.samples >= minCoverage * c.expected && c.up >= minUp * c.samples;
+}
+const anyUrl = async (url) => new URL(url);
+async function guarded(guard, url, init = {}) {
+    const target = await guard(url);
+    return fetch(target, { redirect: 'manual', signal: AbortSignal.timeout(20000), ...init });
+}
+async function probeGuild(base, guard = anyUrl) {
+    try {
+        return (await guarded(guard, `${base}/v1/health`, { signal: AbortSignal.timeout(8000) })).ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchPendingReceipts(base, secretKey, publicKey, guard = anyUrl) {
+    const res = await guarded(guard, `${base}/v1/billing/pending`, { headers: envelopeHeaders(secretKey, publicKey, 'billing') });
+    if (!res.ok)
+        throw new Error(`the guild answered ${res.status}`);
+    return (await res.json());
+}
+async function postAttestation(base, secretKey, publicKey, hashHex, signature, guard = anyUrl) {
+    const res = await guarded(guard, `${base}/v1/billing/${hashHex}/attestation`, {
+        method: 'POST',
+        headers: { ...envelopeHeaders(secretKey, publicKey, hashHex), 'content-type': 'application/json' },
+        body: JSON.stringify({ signature: bs58.encode(signature) }),
+    });
+    return res.ok;
+}
+async function checkUsageReceipt(program, receipt, currentSlot, terms = billing_1.DEFAULT_BILLING_TERMS) {
+    const session = await program.account.session.fetch(receipt.session);
+    if (Object.keys(session.state)[0] !== 'active')
+        return 'the session is not active';
+    const guild = await program.account.guildAccount.fetch(session.guild);
+    if (Object.keys(guild.state)[0] !== 'active')
+        return 'the host guild is not active';
+    const addr = new addresses_1.Addresses(program.programId);
+    const manifest = await program.account.gameManifest.fetch(addr.gameManifest(Uint8Array.from(session.gameId)));
+    const hourlyRate = BigInt(manifest.hourlyRate.toString());
+    if (Object.keys(manifest.sessionDuration)[0] !== 'persistent' || hourlyRate === 0n)
+        return 'the game is not billed by the hour';
+    const subscriptionKey = (0, billing_1.subscriptionAddress)(program.programId, receipt.session, receipt.player);
+    let subscription;
+    try {
+        subscription = await program.account.subscription.fetch(subscriptionKey);
+    }
+    catch {
+        return 'the player has no subscription to the session';
+    }
+    if (BigInt(subscription.billedThroughSlot.toString()) !== receipt.fromSlot)
+        return 'the receipt does not start where billing stopped';
+    if (receipt.hours < 1 || receipt.hours > terms.maxHoursPerBill)
+        return 'the receipt bills too many hours';
+    if (receipt.toSlot <= receipt.fromSlot || receipt.toSlot > currentSlot)
+        return 'the receipt reaches a slot that is not yet past';
+    if (BigInt(receipt.hours) * terms.slotsPerHour > receipt.toSlot - receipt.fromSlot)
+        return 'the receipt bills more hours than its stretch holds';
+    const subscriptionRate = BigInt(subscription.rate.toString());
+    const rate = subscriptionRate < hourlyRate ? subscriptionRate : hourlyRate;
+    const vault = await program.provider.connection.getTokenAccountBalance((0, billing_1.subscriptionVaultAddress)(program.programId, subscriptionKey));
+    if (BigInt(vault.value.amount) < rate * BigInt(receipt.hours))
+        return 'the subscription does not hold the credit';
+    return null;
+}
+async function blockTimeNear(connection, slot) {
+    for (let s = slot; s < slot + 8; s++) {
+        try {
+            const time = await connection.getBlockTime(s);
+            if (time !== null)
+                return time;
+        }
+        catch {
+        }
+    }
+    return null;
+}
+const answered = new Set();
+async function attestPendingReceipts(env, guildKey, base) {
+    const { program, connection } = env;
+    const terms = env.terms ?? billing_1.DEFAULT_BILLING_TERMS;
+    const out = { attested: [], declined: [] };
+    const pending = await fetchPendingReceipts(base, env.secretKey, env.publicKey, env.guard);
+    const guild = await program.account.guildAccount.fetch(guildKey);
+    const refusal = env.explorer ? await (0, explorer_1.explorerGate)(env.explorer, guildKey.toBase58(), base, env.guard) : null;
+    for (const p of pending) {
+        if (answered.has(p.hashHex))
+            continue;
+        const decline = (reason) => out.declined.push({ hashHex: p.hashHex, reason });
+        try {
+            const receipt = {
+                session: new web3_js_1.PublicKey(p.session), player: new web3_js_1.PublicKey(p.player), hours: p.hours, fromSlot: BigInt(p.fromSlot), toSlot: BigInt(p.toSlot),
+            };
+            const hash = (0, billing_1.usageReceiptHash)(receipt);
+            if (Buffer.from(hash).toString('hex') !== p.hashHex) {
+                decline('the hash is not the receipt\'s');
+                continue;
+            }
+            const session = await program.account.session.fetch(receipt.session);
+            if (!session.guild.equals(guildKey)) {
+                decline('the session is not hosted by this guild');
+                continue;
+            }
+            const observers = [session.assignedWitnesses[0], session.assignedWitnesses[1], session.observerNop];
+            if (!observers.some((o) => !o.equals(web3_js_1.PublicKey.default) && o.equals(env.publicKey)))
+                continue;
+            if (!ed25519Verify(Uint8Array.from(guild.enclavePubkey), hash, bs58.decode(p.guildSignature))) {
+                decline('the guild signature does not verify');
+                continue;
+            }
+            if (refusal) {
+                decline(refusal);
+                continue;
+            }
+            const reason = await checkUsageReceipt(program, receipt, BigInt(await connection.getSlot()), terms);
+            if (reason) {
+                decline(reason);
+                continue;
+            }
+            const fromTime = await blockTimeNear(connection, Number(receipt.fromSlot));
+            const toTime = await blockTimeNear(connection, Number(receipt.toSlot));
+            if (fromTime === null || toTime === null) {
+                decline('the times of the stretch are not known');
+                continue;
+            }
+            const coverage = env.log.coverage(guildKey.toBase58(), fromTime * 1000, toTime * 1000, env.probeIntervalMs ?? 300000);
+            if (!availabilityAcceptable(coverage, env.minCoverage, env.minUp)) {
+                decline(`the guild was seen up in ${coverage.up} of ${coverage.samples} probes, ${coverage.expected} expected`);
+                continue;
+            }
+            if (await postAttestation(base, env.secretKey, env.publicKey, p.hashHex, ed25519Sign(env.secretKey, hash), env.guard)) {
+                answered.add(p.hashHex);
+                out.attested.push(p.hashHex);
+            }
+            else {
+                decline('the guild did not take the attestation');
+            }
+        }
+        catch (e) {
+            decline(String(e?.message ?? e).slice(0, 120));
+        }
+    }
+    return out;
+}

package/dist/receipt.d.ts

@@ -0,0 +1,30 @@
+import { PublicKey } from '@solana/web3.js';
+export interface Receipt {
+    sessionId: Uint8Array;
+    guild: PublicKey;
+    host: PublicKey;
+    entryFees: bigint;
+    prizePool: bigint;
+    guildFee: bigint;
+    hostRoyalty: bigint;
+    protocolTax: bigint;
+    timestamp: bigint;
+    winner: PublicKey | null;
+    second: PublicKey | null;
+    third: PublicKey | null;
+    logRoot: Uint8Array | null;
+}
+export declare function receiptHash(r: Receipt): Buffer;
+export interface Terms {
+    protocolTax: bigint;
+    guildFee: bigint;
+    hostRoyalty: bigint;
+    prizePool: bigint;
+}
+export declare function settlementTerms(p: {
+    entryFees: bigint;
+    protocolTaxBps: bigint;
+    guildFeeBps: bigint;
+    royaltyBps: bigint;
+    draw: boolean;
+}): Terms;

package/dist/receipt.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.receiptHash = receiptHash;
+exports.settlementTerms = settlementTerms;
+const crypto_1 = require("crypto");
+const u64le = (v) => { const b = Buffer.alloc(8); b.writeBigUInt64LE(v); return b; };
+const i64le = (v) => { const b = Buffer.alloc(8); b.writeBigInt64LE(v); return b; };
+const key32 = (k) => (k ? Buffer.from(k.toBytes()) : Buffer.alloc(32));
+function receiptHash(r) {
+    const base = (0, crypto_1.createHash)('sha256').update(Buffer.concat([
+        Buffer.from(r.sessionId), Buffer.from(r.guild.toBytes()), Buffer.from(r.host.toBytes()),
+        u64le(r.entryFees), u64le(r.prizePool), u64le(r.guildFee), u64le(r.hostRoyalty), u64le(r.protocolTax), i64le(r.timestamp),
+        key32(r.winner), key32(r.second), key32(r.third),
+    ])).digest();
+    if (!r.logRoot)
+        return base;
+    return (0, crypto_1.createHash)('sha256').update(Buffer.concat([base, Buffer.from(r.logRoot)])).digest();
+}
+function settlementTerms(p) {
+    const protocolTax = (p.entryFees * p.protocolTaxBps) / 10000n;
+    const net = p.entryFees - protocolTax;
+    if (p.draw)
+        return { protocolTax, guildFee: 0n, hostRoyalty: 0n, prizePool: net };
+    const guildFee = (net * p.guildFeeBps) / 10000n;
+    const hostRoyalty = (net * p.royaltyBps) / 10000n;
+    return { protocolTax, guildFee, hostRoyalty, prizePool: net - guildFee - hostRoyalty };
+}

package/dist/relayer/chain.d.ts

@@ -0,0 +1,35 @@
+import { Connection, Keypair } from '@solana/web3.js';
+import { RelayerInfo, RelayerUnshieldRequest } from '@zga/shielded-sdk/dist/relayer';
+import { ShieldedRelayerChain } from './relayer';
+import { RelayerSettings } from './settings';
+export declare class SolanaShieldedRelayerChain implements ShieldedRelayerChain {
+    private readonly program;
+    private readonly connection;
+    private readonly relayer;
+    private readonly settings;
+    private readonly log;
+    private cached;
+    private tables;
+    private readonly atas;
+    private readonly operator;
+    constructor(program: any, connection: Connection, relayer: Keypair, settings: RelayerSettings, log?: (message: string) => void);
+    private get pid();
+    private seed;
+    private poolPda;
+    private vkPda;
+    private assetPda;
+    private vaultPda;
+    private nopPda;
+    private feesPda;
+    private nullifierPda;
+    private directoryPda;
+    private fetchAccount;
+    prepare(): Promise<RelayerInfo>;
+    info(): RelayerInfo;
+    currentPool(): Promise<number>;
+    anySpent(nullifiers: string[]): Promise<boolean>;
+    lowBalance(): Promise<boolean>;
+    submit(req: RelayerUnshieldRequest, currentPool: number): Promise<{
+        signature: string;
+    }>;
+}

package/dist/relayer/chain.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SolanaShieldedRelayerChain = void 0;
+const web3_js_1 = require("@solana/web3.js");
+const anchor_1 = require("@coral-xyz/anchor");
+const relayer_1 = require("@zga/shielded-sdk/dist/relayer");
+const chain_1 = require("../chain");
+const token_1 = require("../token");
+const errors_1 = require("./errors");
+const ASSOCIATED_TOKEN_PROGRAM_ID = new web3_js_1.PublicKey('ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL');
+function createAssociatedTokenAccountIdempotent(payer, ata, owner, mint) {
+    return new web3_js_1.TransactionInstruction({
+        programId: ASSOCIATED_TOKEN_PROGRAM_ID,
+        keys: [
+            { pubkey: payer, isSigner: true, isWritable: true },
+            { pubkey: ata, isSigner: false, isWritable: true },
+            { pubkey: owner, isSigner: false, isWritable: false },
+            { pubkey: mint, isSigner: false, isWritable: false },
+            { pubkey: web3_js_1.SystemProgram.programId, isSigner: false, isWritable: false },
+            { pubkey: token_1.TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
+        ],
+        data: Buffer.from([1]),
+    });
+}
+class SolanaShieldedRelayerChain {
+    constructor(program, connection, relayer, settings, log = () => { }) {
+        this.program = program;
+        this.connection = connection;
+        this.relayer = relayer;
+        this.settings = settings;
+        this.log = log;
+        this.cached = null;
+        this.tables = [];
+        this.atas = new Map();
+        this.poolPda = (i) => (0, chain_1.pda)(this.pid, this.seed('shielded_pool'), Buffer.from([i]));
+        this.vkPda = (i) => (0, chain_1.pda)(this.pid, this.seed('shield_vk'), Buffer.from([i]));
+        this.assetPda = (id) => (0, chain_1.pda)(this.pid, this.seed('shield_asset'), Buffer.from([id]));
+        this.vaultPda = (id) => (0, chain_1.pda)(this.pid, this.seed('shield_vault'), Buffer.from([id]));
+        this.nopPda = () => (0, chain_1.pda)(this.pid, this.seed('nop'), this.operator.toBuffer());
+        this.feesPda = (id) => (0, chain_1.pda)(this.pid, this.seed('nop_shield_fees'), this.operator.toBuffer(), Buffer.from([id]));
+        this.nullifierPda = (n) => (0, chain_1.pda)(this.pid, this.seed('nullifier'), Buffer.from(n));
+        this.directoryPda = () => (0, chain_1.pda)(this.pid, this.seed('shield_directory'));
+        this.operator = settings.operator ? new web3_js_1.PublicKey(settings.operator) : relayer.publicKey;
+    }
+    get pid() {
+        return this.program.programId;
+    }
+    seed(s) {
+        return Buffer.from(s);
+    }
+    async fetchAccount(name, address) {
+        const info = await this.connection.getAccountInfo(address);
+        return info ? (0, chain_1.decodeAccount)(this.program, name, info.data) : null;
+    }
+    async prepare() {
+        const nop = await this.fetchAccount('NopAccount', this.nopPda());
+        if (!nop || Object.keys(nop.state)[0] !== 'active')
+            throw new Error(`${this.operator.toBase58()} is not an active NOP: only a NOP or a bonded agent may take a fee`);
+        if (!this.operator.equals(this.relayer.publicKey) && !new web3_js_1.PublicKey(nop.relayer).equals(this.relayer.publicKey)) {
+            throw new Error(`the NOP ${this.operator.toBase58()} has not named ${this.relayer.publicKey.toBase58()} as its relayer key: its operator names it with set_nop_relayer`);
+        }
+        this.tables = [];
+        for (const address of this.settings.lookupTables) {
+            const table = (await this.connection.getAddressLookupTable(new web3_js_1.PublicKey(address))).value;
+            if (!table)
+                throw new Error(`the lookup table ${address} does not exist on this cluster`);
+            this.tables.push(table);
+        }
+        const assets = [];
+        for (const s of this.settings.assets) {
+            const config = await this.fetchAccount('ShieldAssetConfig', this.assetPda(s.assetId));
+            if (!config)
+                throw new Error(`asset ${s.assetId} has no place in the shielded pool`);
+            const mint = config.mint;
+            const ata = (0, token_1.associatedTokenAddress)(mint, this.operator);
+            if (!(await this.connection.getAccountInfo(ata))) {
+                await (0, web3_js_1.sendAndConfirmTransaction)(this.connection, new web3_js_1.Transaction().add(createAssociatedTokenAccountIdempotent(this.relayer.publicKey, ata, this.operator, mint)), [this.relayer]);
+                this.log(`made the NOP's token account for asset ${s.assetId}`);
+            }
+            this.atas.set(s.assetId, ata);
+            if (!(await this.fetchAccount('NopShieldFees', this.feesPda(s.assetId)))) {
+                if (!this.operator.equals(this.relayer.publicKey))
+                    throw new Error(`the NOP has no tax account for asset ${s.assetId}: its operator opens it once with init_nop_shield_fees`);
+                const open = await this.program.methods.initNopShieldFees(s.assetId).accounts({
+                    fees: this.feesPda(s.assetId), nop: this.nopPda(), assetConfig: this.assetPda(s.assetId), operator: this.relayer.publicKey, systemProgram: web3_js_1.SystemProgram.programId,
+                }).instruction();
+                await (0, web3_js_1.sendAndConfirmTransaction)(this.connection, new web3_js_1.Transaction().add(open), [this.relayer]);
+                this.log(`opened the NOP tax account for asset ${s.assetId}`);
+            }
+            assets.push({ assetId: s.assetId, relayerTokenAccount: ata.toBase58(), minFee: s.minFee, feeBps: s.feeBps });
+        }
+        this.cached = {
+            version: 1,
+            relayer: this.relayer.publicKey.toBase58(),
+            programId: this.pid.toBase58(),
+            lookupTables: this.settings.lookupTables,
+            assets,
+        };
+        return this.cached;
+    }
+    info() {
+        if (!this.cached)
+            throw new Error('the relayer has not been prepared');
+        return this.cached;
+    }
+    async currentPool() {
+        return Number((await this.fetchAccount('ShieldDirectory', this.directoryPda())).current);
+    }
+    async anySpent(nullifiers) {
+        const infos = await this.connection.getMultipleAccountsInfo(nullifiers.map((n) => this.nullifierPda(Buffer.from(n, 'hex'))));
+        return infos.some((i) => i !== null);
+    }
+    async lowBalance() {
+        return (await this.connection.getBalance(this.relayer.publicKey)) < this.settings.minBalanceLamports;
+    }
+    async submit(req, currentPool) {
+        const a = (0, relayer_1.toUnshieldArgs)(req);
+        const args = {
+            proof: { a: Array.from(a.proof.a), b: Array.from(a.proof.b), c: Array.from(a.proof.c) },
+            root: Array.from(a.root),
+            withdrawAmount: new anchor_1.BN(a.withdrawAmount.toString()),
+            fee: new anchor_1.BN(a.fee.toString()),
+            nullifiers: a.nullifiers.map((n) => Array.from(n)),
+            commitments: a.commitments.map((c) => Array.from(c)),
+            encrypted: a.encrypted.map((e) => Buffer.from(e)),
+        };
+        const relayerAta = this.atas.get(req.assetId);
+        if (!relayerAta)
+            throw new errors_1.RelayRefused('asset', `this relayer does not take asset ${req.assetId}`);
+        const method = a.dropOutputs ? 'unshieldDrop' : 'unshield';
+        const ix = await this.program.methods[method](req.assetId, args).accountsPartial({
+            pool: this.poolPda(req.pool),
+            vk: this.vkPda(req.pool),
+            targetPool: a.dropOutputs || req.pool === currentPool ? null : this.poolPda(currentPool),
+            assetConfig: this.assetPda(req.assetId),
+            vault: this.vaultPda(req.assetId),
+            recipientTokenAccount: new web3_js_1.PublicKey(req.recipientTokenAccount),
+            relayerTokenAccount: relayerAta,
+            nullifier0: this.nullifierPda(a.nullifiers[0]),
+            nullifier1: this.nullifierPda(a.nullifiers[1]),
+            protocolConfig: (0, chain_1.pda)(this.pid, this.seed('config')),
+            relayer: this.relayer.publicKey,
+            relayerNop: this.nopPda(),
+            relayerAgentBond: null,
+            relayerFees: this.feesPda(req.assetId),
+            tokenProgram: token_1.TOKEN_PROGRAM_ID,
+            systemProgram: web3_js_1.SystemProgram.programId,
+        }).instruction();
+        const instructions = [web3_js_1.ComputeBudgetProgram.setComputeUnitLimit({ units: this.settings.computeUnitLimit })];
+        if (this.settings.priorityMicroLamports > 0)
+            instructions.push(web3_js_1.ComputeBudgetProgram.setComputeUnitPrice({ microLamports: this.settings.priorityMicroLamports }));
+        instructions.push(ix);
+        const latest = await this.connection.getLatestBlockhash('confirmed');
+        const message = new web3_js_1.TransactionMessage({ payerKey: this.relayer.publicKey, recentBlockhash: latest.blockhash, instructions }).compileToV0Message(this.tables);
+        const tx = new web3_js_1.VersionedTransaction(message);
+        const sim = await this.connection.simulateTransaction(tx, { sigVerify: false, replaceRecentBlockhash: true, commitment: 'confirmed' });
+        if (sim.value.err) {
+            const f = (0, errors_1.explainRelayFailure)((sim.value.logs ?? []).join('\n') + JSON.stringify(sim.value.err));
+            throw new errors_1.RelayRefused(f.code, f.message);
+        }
+        tx.sign([this.relayer]);
+        const signature = await this.connection.sendRawTransaction(tx.serialize(), { skipPreflight: true, maxRetries: 3 });
+        const done = await this.connection.confirmTransaction({ signature, blockhash: latest.blockhash, lastValidBlockHeight: latest.lastValidBlockHeight }, 'confirmed');
+        if (done.value.err) {
+            const f = (0, errors_1.explainRelayFailure)(JSON.stringify(done.value.err));
+            throw new errors_1.RelayRefused(f.code === 'rejected' ? 'submission_failed' : f.code, f.message);
+        }
+        return { signature };
+    }
+}
+exports.SolanaShieldedRelayerChain = SolanaShieldedRelayerChain;

package/dist/relayer/errors.d.ts

@@ -0,0 +1,8 @@
+export declare class RelayRefused extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function explainRelayFailure(text: string): {
+    code: string;
+    message: string;
+};

package/dist/relayer/errors.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RelayRefused = void 0;
+exports.explainRelayFailure = explainRelayFailure;
+class RelayRefused extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RelayRefused';
+    }
+}
+exports.RelayRefused = RelayRefused;
+const RULES = [
+    [/UnknownRoot/, 'unknown_root', 'the proof was made against a root the pool no longer holds: build it again from the current tree'],
+    [/InvalidProof/, 'invalid_proof', 'the pool did not accept the proof'],
+    [/already in use|AccountAlreadyInitialized/, 'already_spent', 'a note that this transaction spends has been spent'],
+    [/ShieldDailyCapExceeded/, 'daily_cap', 'the day\'s withdrawal cap for this asset is reached: try again later'],
+    [/ShieldAssetNotLive/, 'asset_not_live', 'the shielded pool is not live for this asset'],
+    [/ShieldInsufficientNotes/, 'insufficient_notes', 'the pool does not hold that much of the asset'],
+    [/NotAnAuthorizedRelayer/, 'relayer_not_authorized', 'this relayer cannot take a fee'],
+    [/ShieldPoolNotCurrent|ShieldPoolKeyMismatch/, 'pool', 'the notes are in a pool whose new notes cannot go to the current pool'],
+    [/Paused/, 'paused', 'the protocol is paused'],
+];
+function explainRelayFailure(text) {
+    for (const [pattern, code, message] of RULES)
+        if (pattern.test(text))
+            return { code, message };
+    return { code: 'rejected', message: 'the pool refused the transaction' };
+}

package/dist/relayer/limits.d.ts

@@ -0,0 +1,15 @@
+export declare class RelayerRateLimiter {
+    private readonly perMinute;
+    private readonly now;
+    private readonly buckets;
+    constructor(perMinute: number, now?: () => number);
+    allow(key: string): boolean;
+    private prune;
+}
+export declare class RelayerInFlight {
+    readonly max: number;
+    private readonly active;
+    constructor(max: number);
+    tryEnter(key: string): 'ok' | 'busy' | 'duplicate';
+    leave(key: string): void;
+}

package/dist/relayer/limits.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RelayerInFlight = exports.RelayerRateLimiter = void 0;
+class RelayerRateLimiter {
+    constructor(perMinute, now = Date.now) {
+        this.perMinute = perMinute;
+        this.now = now;
+        this.buckets = new Map();
+    }
+    allow(key) {
+        const t = this.now();
+        const b = this.buckets.get(key) ?? { tokens: this.perMinute, at: t };
+        b.tokens = Math.min(this.perMinute, b.tokens + ((t - b.at) * this.perMinute) / 60000);
+        b.at = t;
+        const ok = b.tokens >= 1;
+        if (ok)
+            b.tokens -= 1;
+        this.buckets.set(key, b);
+        if (this.buckets.size > 10000)
+            this.prune(t);
+        return ok;
+    }
+    prune(t) {
+        for (const [k, b] of this.buckets)
+            if (b.tokens + ((t - b.at) * this.perMinute) / 60000 >= this.perMinute)
+                this.buckets.delete(k);
+    }
+}
+exports.RelayerRateLimiter = RelayerRateLimiter;
+class RelayerInFlight {
+    constructor(max) {
+        this.max = max;
+        this.active = new Set();
+    }
+    tryEnter(key) {
+        if (this.active.has(key))
+            return 'duplicate';
+        if (this.active.size >= this.max)
+            return 'busy';
+        this.active.add(key);
+        return 'ok';
+    }
+    leave(key) {
+        this.active.delete(key);
+    }
+}
+exports.RelayerInFlight = RelayerInFlight;

package/dist/relayer/relayer.d.ts

@@ -0,0 +1,25 @@
+import { RelayerInfo, RelayerUnshieldRequest } from '@zga/shielded-sdk/dist/relayer';
+import { RelayerInFlight, RelayerRateLimiter } from './limits';
+export interface Reply {
+    status: number;
+    body: any;
+}
+export declare const refuse: (status: number, code: string, message: string) => Reply;
+export interface ShieldedRelayerChain {
+    info(): RelayerInfo;
+    currentPool(): Promise<number>;
+    anySpent(nullifiers: string[]): Promise<boolean>;
+    lowBalance(): Promise<boolean>;
+    submit(req: RelayerUnshieldRequest, currentPool: number): Promise<{
+        signature: string;
+    }>;
+}
+export declare class ShieldedRelayer {
+    private readonly chain;
+    private readonly rate;
+    private readonly inflight;
+    private readonly log;
+    constructor(chain: ShieldedRelayerChain, rate: RelayerRateLimiter, inflight: RelayerInFlight, log?: (message: string) => void);
+    info(): Reply;
+    unshield(raw: unknown, clientKey: string): Promise<Reply>;
+}