stellar-shade 0.0.1

package/dist/index.js

@@ -0,0 +1,817 @@
+import { randomBytes } from '@noble/hashes/utils';
+import { bytesToNumberLE, numberToBytesLE } from '@noble/curves/abstract/utils';
+import { sha256 } from '@noble/hashes/sha256';
+import { ed25519 } from '@noble/curves/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { generateMnemonic as generateMnemonic$1, validateMnemonic, mnemonicToSeedSync } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+import * as StellarSdk from '@stellar/stellar-sdk';
+import { Keypair, Contract, TransactionBuilder, nativeToScVal, StrKey, Networks, Asset } from '@stellar/stellar-sdk';
+
+// ../crypto/src/errors.ts
+var PointAtInfinity = class extends Error {
+  constructor(operation) {
+    super(`Point at infinity encountered in ${operation}`);
+    this.name = "PointAtInfinity";
+  }
+};
+var InvalidPublicKey = class extends Error {
+  constructor(message = "Invalid public key: not on curve") {
+    super(message);
+    this.name = "InvalidPublicKey";
+  }
+};
+var InvalidScalar = class extends Error {
+  constructor(message = "Invalid scalar value") {
+    super(message);
+    this.name = "InvalidScalar";
+  }
+};
+var InvalidMetaAddress = class extends Error {
+  constructor(message = "Invalid meta-address format") {
+    super(message);
+    this.name = "InvalidMetaAddress";
+  }
+};
+var L = 2n ** 252n + 27742317777372353535851937790883648493n;
+function validatePoint(point) {
+  if (point.length !== 32) {
+    throw new InvalidPublicKey("Invalid point length");
+  }
+  try {
+    ed25519.ExtendedPoint.fromHex(point);
+    return true;
+  } catch (e) {
+    if (e instanceof InvalidPublicKey) throw e;
+    throw new InvalidPublicKey("Point not on curve");
+  }
+}
+function pointAdd(p1, p2) {
+  if (p1.length !== 32) throw new InvalidPublicKey("Invalid p1 length");
+  if (p2.length !== 32) throw new InvalidPublicKey("Invalid p2 length");
+  validatePoint(p1);
+  validatePoint(p2);
+  const point1 = ed25519.ExtendedPoint.fromHex(p1);
+  const point2 = ed25519.ExtendedPoint.fromHex(p2);
+  const result = point1.add(point2);
+  if (result.equals(ed25519.ExtendedPoint.ZERO)) {
+    throw new PointAtInfinity("pointAdd");
+  }
+  return result.toRawBytes();
+}
+function scalarMultBase(scalar, allowZero = false) {
+  if (scalar.length !== 32) throw new InvalidScalar("Invalid scalar length");
+  const s = bytesToNumberLE(scalar) % L;
+  if (s === 0n) {
+    if (!allowZero) {
+      throw new InvalidScalar("Zero scalar not allowed");
+    }
+    return ed25519.ExtendedPoint.ZERO.toRawBytes();
+  }
+  const result = ed25519.ExtendedPoint.BASE.multiply(s);
+  return result.toRawBytes();
+}
+function scalarMult(scalar, point, allowZero = false) {
+  if (scalar.length !== 32) throw new InvalidScalar("Invalid scalar length");
+  if (point.length !== 32) throw new InvalidPublicKey("Invalid point length");
+  validatePoint(point);
+  const s = bytesToNumberLE(scalar) % L;
+  if (s === 0n) {
+    if (!allowZero) {
+      throw new InvalidScalar("Zero scalar not allowed");
+    }
+    return ed25519.ExtendedPoint.ZERO.toRawBytes();
+  }
+  const p = ed25519.ExtendedPoint.fromHex(point);
+  const result = p.multiply(s);
+  if (result.equals(ed25519.ExtendedPoint.ZERO)) {
+    throw new PointAtInfinity("scalarMult");
+  }
+  return result.toRawBytes();
+}
+function scalarAdd(s1, s2) {
+  if (s1.length !== 32) throw new InvalidScalar("Invalid s1 length");
+  if (s2.length !== 32) throw new InvalidScalar("Invalid s2 length");
+  const a = bytesToNumberLE(s1) % L;
+  const b = bytesToNumberLE(s2) % L;
+  const result = (a + b) % L;
+  return numberToBytesLE(result, 32);
+}
+
+// ../crypto/src/keys.ts
+function generateMetaAddress() {
+  const spendPrivKey = generateRandomScalar();
+  const viewPrivKey = generateRandomScalar();
+  const spendPubKey = scalarMultBase(spendPrivKey);
+  const viewPubKey = scalarMultBase(viewPrivKey);
+  return {
+    spendPrivKey,
+    viewPrivKey,
+    metaAddress: {
+      spendPubKey,
+      viewPubKey
+    }
+  };
+}
+function generateRandomScalar() {
+  const bytes = randomBytes(32);
+  const scalar = bytesToNumberLE(bytes) % L;
+  return numberToBytesLE(scalar, 32);
+}
+function encodeMetaAddress(meta) {
+  if (meta.spendPubKey.length !== 32) {
+    throw new InvalidMetaAddress("Invalid spend public key length");
+  }
+  if (meta.viewPubKey.length !== 32) {
+    throw new InvalidMetaAddress("Invalid view public key length");
+  }
+  try {
+    validatePoint(meta.spendPubKey);
+    validatePoint(meta.viewPubKey);
+  } catch (e) {
+    if (e instanceof InvalidPublicKey) {
+      throw new InvalidMetaAddress(`Invalid public key: ${e.message}`);
+    }
+    throw e;
+  }
+  const payload = new Uint8Array(64);
+  payload.set(meta.spendPubKey, 0);
+  payload.set(meta.viewPubKey, 32);
+  const hash = sha256(payload);
+  const checksum = hash.slice(28, 32);
+  const combined = new Uint8Array(68);
+  combined.set(payload, 0);
+  combined.set(checksum, 64);
+  const hex = Array.from(combined).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `st:stellar:${hex}`;
+}
+function decodeMetaAddress(encoded) {
+  if (!encoded.startsWith("st:stellar:")) {
+    throw new InvalidMetaAddress("Invalid meta-address prefix");
+  }
+  const hex = encoded.slice(11);
+  if (hex.length !== 136) {
+    throw new InvalidMetaAddress("Invalid meta-address length");
+  }
+  const combined = new Uint8Array(68);
+  for (let i = 0; i < 68; i++) {
+    const byte = parseInt(hex.substr(i * 2, 2), 16);
+    if (isNaN(byte)) {
+      throw new InvalidMetaAddress("Invalid hex encoding");
+    }
+    combined[i] = byte;
+  }
+  const payload = combined.slice(0, 64);
+  const checksum = combined.slice(64, 68);
+  const hash = sha256(payload);
+  const expectedChecksum = hash.slice(28, 32);
+  let checksumValid = true;
+  for (let i = 0; i < 4; i++) {
+    if (checksum[i] !== expectedChecksum[i]) {
+      checksumValid = false;
+      break;
+    }
+  }
+  if (!checksumValid) {
+    throw new InvalidMetaAddress("Invalid checksum");
+  }
+  const spendPubKey = payload.slice(0, 32);
+  const viewPubKey = payload.slice(32, 64);
+  try {
+    validatePoint(spendPubKey);
+    validatePoint(viewPubKey);
+  } catch (e) {
+    if (e instanceof InvalidPublicKey) {
+      throw new InvalidMetaAddress(`Invalid public key in meta-address: ${e.message}`);
+    }
+    throw e;
+  }
+  return {
+    spendPubKey,
+    viewPubKey
+  };
+}
+function hashToScalar(data) {
+  const hash = sha256(data);
+  const scalar = bytesToNumberLE(hash) % L;
+  if (scalar === 0n) {
+    throw new InvalidScalar("Hash produced zero scalar");
+  }
+  return numberToBytesLE(scalar, 32);
+}
+function viewTag(sharedSecret) {
+  if (sharedSecret.length !== 32) {
+    throw new Error("Invalid shared secret length");
+  }
+  const hash = sha256(sharedSecret);
+  return hash[0];
+}
+
+// ../crypto/src/stellar-keys.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var VERSION_BYTE_PUBLIC_KEY = 6 << 3;
+function crc16XModem(data) {
+  let crc = 0;
+  for (let i = 0; i < data.length; i++) {
+    crc ^= data[i] << 8;
+    for (let j = 0; j < 8; j++) {
+      if (crc & 32768) {
+        crc = crc << 1 ^ 4129;
+      } else {
+        crc = crc << 1;
+      }
+    }
+  }
+  return crc & 65535;
+}
+function base32Encode(data) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (let i = 0; i < data.length; i++) {
+    value = value << 8 | data[i];
+    bits += 8;
+    while (bits >= 5) {
+      output += ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function encodePublicKey(pubKey) {
+  if (pubKey.length !== 32) {
+    throw new Error("Public key must be 32 bytes");
+  }
+  const versionedPayload = new Uint8Array(33);
+  versionedPayload[0] = VERSION_BYTE_PUBLIC_KEY;
+  versionedPayload.set(pubKey, 1);
+  const checksum = crc16XModem(versionedPayload);
+  const checksumBytes = new Uint8Array(2);
+  checksumBytes[0] = checksum & 255;
+  checksumBytes[1] = checksum >>> 8 & 255;
+  const fullPayload = new Uint8Array(35);
+  fullPayload.set(versionedPayload, 0);
+  fullPayload.set(checksumBytes, 33);
+  return base32Encode(fullPayload);
+}
+
+// ../crypto/src/scan.ts
+function checkViewTag(viewPrivKey, ephemeralPubKey, expectedTag) {
+  if (viewPrivKey.length !== 32) {
+    throw new Error("Invalid view private key length");
+  }
+  if (ephemeralPubKey.length !== 32) {
+    throw new Error("Invalid ephemeral public key length");
+  }
+  if (expectedTag < 0 || expectedTag > 255) {
+    throw new Error("Invalid view tag");
+  }
+  const S = scalarMult(viewPrivKey, ephemeralPubKey);
+  const computedTag = viewTag(S);
+  if (computedTag === expectedTag) {
+    return { matches: true, sharedSecret: S };
+  }
+  return { matches: false };
+}
+function scanAnnouncements(viewPrivKey, spendPubKey, announcements) {
+  if (viewPrivKey.length !== 32) {
+    throw new Error("Invalid view private key length");
+  }
+  if (spendPubKey.length !== 32) {
+    throw new Error("Invalid spend public key length");
+  }
+  const results = [];
+  const tagMatches = [];
+  for (const announcement of announcements) {
+    const tagResult = checkViewTag(viewPrivKey, announcement.ephemeralPubKey, announcement.viewTag);
+    if (tagResult.matches && tagResult.sharedSecret) {
+      tagMatches.push({ announcement, sharedSecret: tagResult.sharedSecret });
+    }
+  }
+  for (const { announcement, sharedSecret } of tagMatches) {
+    const s = hashToScalar(sharedSecret);
+    const sG = scalarMultBase(s);
+    const P = pointAdd(spendPubKey, sG);
+    const computedAddress = encodePublicKey(P);
+    if (computedAddress === announcement.stealthAddress) {
+      results.push({
+        publicKey: P,
+        address: computedAddress
+      });
+    }
+  }
+  return results;
+}
+
+// ../crypto/src/recover.ts
+function recoverStealthPrivateKey(spendPrivKey, viewPrivKey, ephemeralPubKey) {
+  if (spendPrivKey.length !== 32) {
+    throw new Error("Invalid spend private key length");
+  }
+  if (viewPrivKey.length !== 32) {
+    throw new Error("Invalid view private key length");
+  }
+  if (ephemeralPubKey.length !== 32) {
+    throw new Error("Invalid ephemeral public key length");
+  }
+  const S = scalarMult(viewPrivKey, ephemeralPubKey);
+  const s = hashToScalar(S);
+  const stealthPrivKey = scalarAdd(spendPrivKey, s);
+  return stealthPrivKey;
+}
+function signWithStealthKey(message, privateScalar) {
+  if (privateScalar.length !== 32) {
+    throw new Error("Invalid stealth private key length");
+  }
+  if (message.length === 0) {
+    throw new Error("Message cannot be empty");
+  }
+  const a = bytesToNumberLE(privateScalar) % L;
+  const pubKeyBytes = scalarMultBase(privateScalar);
+  const nonceInput = new Uint8Array(32 + message.length);
+  nonceInput.set(privateScalar, 0);
+  nonceInput.set(message, 32);
+  const r = bytesToNumberLE(sha512(nonceInput)) % L;
+  const R = ed25519.ExtendedPoint.BASE.multiply(r);
+  const Rbytes = R.toRawBytes();
+  const challengeInput = new Uint8Array(32 + 32 + message.length);
+  challengeInput.set(Rbytes, 0);
+  challengeInput.set(pubKeyBytes, 32);
+  challengeInput.set(message, 64);
+  const k = bytesToNumberLE(sha512(challengeInput)) % L;
+  const S = (r + k * a) % L;
+  const sig = new Uint8Array(64);
+  sig.set(Rbytes, 0);
+  sig.set(numberToBytesLE(S, 32), 32);
+  return sig;
+}
+function deriveStealthAddressWithSecret(spendPubKey, viewPubKey, ephemeralPrivKey) {
+  const R = scalarMultBase(ephemeralPrivKey);
+  const S = scalarMult(ephemeralPrivKey, viewPubKey);
+  const s = hashToScalar(S);
+  const sG = scalarMultBase(s);
+  const P = pointAdd(spendPubKey, sG);
+  const tag = viewTag(S);
+  return {
+    stealthPubKey: P,
+    stealthAddress: encodePublicKey(P),
+    ephemeralPubKey: R,
+    viewTag: tag,
+    ephemeralPrivKey,
+    sharedSecret: S
+  };
+}
+var textEncoder = new TextEncoder();
+function generateMnemonic() {
+  return generateMnemonic$1(wordlist);
+}
+function mnemonicToStealthKeys(mnemonic, passphrase) {
+  if (!validateMnemonic(mnemonic, wordlist)) {
+    throw new Error("Invalid mnemonic phrase");
+  }
+  const seed = mnemonicToSeedSync(mnemonic, "");
+  const spendTag = textEncoder.encode("stealth-spend");
+  const viewTag2 = textEncoder.encode("stealth-view");
+  const spendInput = new Uint8Array(spendTag.length + seed.length);
+  spendInput.set(spendTag, 0);
+  spendInput.set(seed, spendTag.length);
+  const viewInput = new Uint8Array(viewTag2.length + seed.length);
+  viewInput.set(viewTag2, 0);
+  viewInput.set(seed, viewTag2.length);
+  const spendPrivKey = hashToScalar(spendInput);
+  const viewPrivKey = hashToScalar(viewInput);
+  seed.fill(0);
+  spendInput.fill(0);
+  viewInput.fill(0);
+  const spendPubKey = scalarMultBase(spendPrivKey);
+  const viewPubKey = scalarMultBase(viewPrivKey);
+  return {
+    spendPrivKey,
+    viewPrivKey,
+    metaAddress: { spendPubKey, viewPubKey }
+  };
+}
+function getNetworkConfig(network) {
+  const networkPassphrase = network === "local" ? Networks.STANDALONE : Networks.TESTNET;
+  const rpcUrl = network === "local" ? "http://localhost:8000/soroban/rpc" : "https://soroban-testnet.stellar.org";
+  const server = new StellarSdk.rpc.Server(rpcUrl, {
+    allowHttp: network === "local"
+  });
+  return { networkPassphrase, rpcUrl, server };
+}
+function createSimulationTx(operation, networkPassphrase) {
+  return new TransactionBuilder(
+    new StellarSdk.Account("GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF", "0"),
+    { fee: "100", networkPassphrase }
+  ).addOperation(operation).setTimeout(30).build();
+}
+async function simulateReadOnly(contractId, method, args, server, networkPassphrase) {
+  const contract = new Contract(contractId);
+  const op = contract.call(method, ...args);
+  const sim = await server.simulateTransaction(
+    createSimulationTx(op, networkPassphrase)
+  );
+  if (StellarSdk.rpc.Api.isSimulationSuccess(sim) && sim.result?.retval) {
+    return StellarSdk.scValToNative(sim.result.retval);
+  }
+  return null;
+}
+function resolveTokenAddress(assetArg, networkPassphrase) {
+  if (!assetArg || assetArg === "native" || assetArg === "XLM") {
+    return Asset.native().contractId(networkPassphrase);
+  }
+  const parts = assetArg.split(":");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new Error('Invalid asset format. Use CODE:ISSUER or "native"');
+  }
+  return new Asset(parts[0], parts[1]).contractId(networkPassphrase);
+}
+async function waitForTransaction(server, hash) {
+  let attempts = 0;
+  while (attempts < 30) {
+    await new Promise((resolve) => setTimeout(resolve, 1e3));
+    try {
+      const result = await server.getTransaction(hash);
+      if (result.status === "SUCCESS") return;
+      if (result.status === "FAILED") throw new Error("Transaction failed on-chain");
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      if (msg === "Transaction failed on-chain") throw e;
+    }
+    attempts++;
+  }
+  throw new Error("Transaction confirmation timed out");
+}
+async function fetchAnnouncements(contractId, server, networkPassphrase) {
+  const result = await simulateReadOnly(
+    contractId,
+    "get_announcements",
+    [nativeToScVal(0, { type: "u64" }), nativeToScVal(1e3, { type: "u64" })],
+    server,
+    networkPassphrase
+  );
+  if (!result || !Array.isArray(result)) return [];
+  return result.map((ann) => {
+    const a = ann;
+    const stealthPk = new Uint8Array(a.stealth_pk);
+    return {
+      ephemeralPubKey: new Uint8Array(a.ephemeral_pk),
+      viewTag: a.view_tag,
+      stealthPubKey: stealthPk,
+      stealthAddress: StrKey.encodeEd25519PublicKey(Buffer.from(stealthPk)),
+      token: a.token?.toString?.() || "unknown",
+      amount: BigInt(a.amount || 0)
+    };
+  });
+}
+async function queryBalance(contractId, stealthPk, tokenAddress, server, networkPassphrase) {
+  const result = await simulateReadOnly(
+    contractId,
+    "get_balance",
+    [nativeToScVal(Buffer.from(stealthPk)), new StellarSdk.Address(tokenAddress).toScVal()],
+    server,
+    networkPassphrase
+  );
+  if (result !== null) return BigInt(result);
+  return 0n;
+}
+async function queryNonce(contractId, stealthPk, server, networkPassphrase) {
+  const result = await simulateReadOnly(
+    contractId,
+    "get_nonce",
+    [nativeToScVal(Buffer.from(stealthPk))],
+    server,
+    networkPassphrase
+  );
+  if (result !== null) return BigInt(result);
+  return 0n;
+}
+function i128ToBigEndian(value) {
+  const buf = new Uint8Array(16);
+  const dv = new DataView(buf.buffer);
+  dv.setBigInt64(0, value >> 64n);
+  dv.setBigUint64(8, value & 0xFFFFFFFFFFFFFFFFn);
+  return buf;
+}
+function u64ToBigEndian(value) {
+  const buf = new Uint8Array(8);
+  const dv = new DataView(buf.buffer);
+  dv.setBigUint64(0, value);
+  return buf;
+}
+function buildWithdrawMessage(stealthPk, tokenAddress, amount, destination, nonce) {
+  const tokenBytes = Buffer.from(tokenAddress, "utf-8");
+  const destBytes = Buffer.from(destination, "utf-8");
+  if (tokenBytes.length !== 56) throw new Error(`Token address must be 56 bytes StrKey, got ${tokenBytes.length}`);
+  if (destBytes.length !== 56) throw new Error(`Destination must be 56 bytes StrKey, got ${destBytes.length}`);
+  const amountBytes = i128ToBigEndian(amount);
+  const nonceBytes = u64ToBigEndian(nonce);
+  const msg = new Uint8Array(32 + 56 + 16 + 56 + 8);
+  let offset = 0;
+  msg.set(stealthPk, offset);
+  offset += 32;
+  msg.set(tokenBytes, offset);
+  offset += 56;
+  msg.set(amountBytes, offset);
+  offset += 16;
+  msg.set(destBytes, offset);
+  offset += 56;
+  msg.set(nonceBytes, offset);
+  return sha256(msg);
+}
+
+// src/client.ts
+var DEFAULT_CONTRACTS = {
+  local: "CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGABAX"
+};
+var StealthClient = class {
+  contractId;
+  networkPassphrase;
+  server;
+  constructor(config) {
+    this.contractId = config.contractId || DEFAULT_CONTRACTS[config.network] || "";
+    const netConfig = getNetworkConfig(config.network);
+    this.networkPassphrase = netConfig.networkPassphrase;
+    this.server = netConfig.server;
+  }
+  /**
+   * Generate a new random stealth key pair.
+   * No network connection needed.
+   */
+  static keygen() {
+    const keys = generateMetaAddress();
+    const metaAddress = encodeMetaAddress(keys.metaAddress);
+    return {
+      metaAddress,
+      spendPubKey: Buffer.from(keys.metaAddress.spendPubKey).toString("hex"),
+      spendPrivKey: Buffer.from(keys.spendPrivKey).toString("hex"),
+      viewPubKey: Buffer.from(keys.metaAddress.viewPubKey).toString("hex"),
+      viewPrivKey: Buffer.from(keys.viewPrivKey).toString("hex")
+    };
+  }
+  /**
+   * Generate stealth keys from a BIP-39 mnemonic.
+   * Returns the mnemonic alongside the keys for backup.
+   * No network connection needed.
+   */
+  static fromMnemonic(mnemonic) {
+    const phrase = mnemonic || generateMnemonic();
+    const keys = mnemonicToStealthKeys(phrase);
+    const metaAddress = encodeMetaAddress(keys.metaAddress);
+    return {
+      mnemonic: phrase,
+      metaAddress,
+      spendPubKey: Buffer.from(keys.metaAddress.spendPubKey).toString("hex"),
+      spendPrivKey: Buffer.from(keys.spendPrivKey).toString("hex"),
+      viewPubKey: Buffer.from(keys.metaAddress.viewPubKey).toString("hex"),
+      viewPrivKey: Buffer.from(keys.viewPrivKey).toString("hex")
+    };
+  }
+  /**
+   * Send tokens to a stealth address.
+   *
+   * Derives a one-time stealth address from the recipient's meta-address,
+   * deposits tokens into the pool contract, and records the announcement.
+   *
+   * @param metaAddress - Recipient's meta-address (st:stellar:... format)
+   * @param amount - Amount in whole units (e.g. 100 = 100 XLM)
+   * @param senderSecret - Sender's Stellar secret key
+   * @param opts - Optional: asset to send
+   */
+  async send(metaAddress, amount, senderSecret, opts) {
+    if (amount <= 0) throw new Error("Amount must be positive");
+    const { spendPubKey, viewPubKey } = decodeMetaAddress(metaAddress);
+    const senderKeypair = Keypair.fromSecret(senderSecret);
+    const tokenAddress = resolveTokenAddress(opts?.asset, this.networkPassphrase);
+    const stroops = BigInt(Math.round(amount * 1e7));
+    const ephemeralPrivKey = new Uint8Array(randomBytes(32));
+    const stealth = deriveStealthAddressWithSecret(
+      spendPubKey,
+      viewPubKey,
+      ephemeralPrivKey
+    );
+    const contract = new Contract(this.contractId);
+    const account = await this.server.getAccount(senderKeypair.publicKey());
+    const depositTx = new TransactionBuilder(account, {
+      fee: "100",
+      networkPassphrase: this.networkPassphrase
+    }).addOperation(
+      contract.call(
+        "deposit",
+        new StellarSdk.Address(senderKeypair.publicKey()).toScVal(),
+        new StellarSdk.Address(tokenAddress).toScVal(),
+        nativeToScVal(stroops, { type: "i128" }),
+        nativeToScVal(Buffer.from(stealth.stealthPubKey)),
+        nativeToScVal(Buffer.from(stealth.ephemeralPubKey)),
+        nativeToScVal(stealth.viewTag, { type: "u32" })
+      )
+    ).setTimeout(30).build();
+    const prepared = await this.server.prepareTransaction(depositTx);
+    prepared.sign(senderKeypair);
+    const result = await this.server.sendTransaction(prepared);
+    if (result.status === "ERROR") {
+      throw new Error("Transaction submission failed");
+    }
+    if (result.status === "PENDING") {
+      await waitForTransaction(this.server, result.hash);
+    }
+    return {
+      stealthAddress: stealth.stealthAddress,
+      txHash: result.hash
+    };
+  }
+  /**
+   * Scan for stealth payments you received.
+   *
+   * Uses the view key to detect which announcements are yours,
+   * then queries the contract for current balances.
+   *
+   * @param keys - Your stealth keys (needs viewPrivKey + spendPubKey)
+   */
+  async scan(keys) {
+    const viewPrivKey = Buffer.from(keys.viewPrivKey, "hex");
+    const spendPubKey = Buffer.from(keys.spendPubKey, "hex");
+    const announcements = await fetchAnnouncements(
+      this.contractId,
+      this.server,
+      this.networkPassphrase
+    );
+    if (announcements.length === 0) return [];
+    const matches = scanAnnouncements(
+      viewPrivKey,
+      spendPubKey,
+      announcements.map((a) => ({
+        ephemeralPubKey: a.ephemeralPubKey,
+        viewTag: a.viewTag,
+        stealthAddress: a.stealthAddress
+      }))
+    );
+    const payments = [];
+    for (const match of matches) {
+      if (!match) continue;
+      const ann = announcements.find((a) => a.stealthAddress === match.address);
+      if (!ann) continue;
+      const balance = await queryBalance(
+        this.contractId,
+        ann.stealthPubKey,
+        ann.token,
+        this.server,
+        this.networkPassphrase
+      );
+      if (balance <= 0n) continue;
+      payments.push({
+        stealthAddress: ann.stealthAddress,
+        ephemeralPubKey: Buffer.from(ann.ephemeralPubKey).toString("hex"),
+        token: ann.token,
+        amount: Number(balance) / 1e7
+      });
+    }
+    return payments;
+  }
+  /**
+   * Get balances for all your stealth addresses in the pool.
+   *
+   * @param keys - Your stealth keys (needs viewPrivKey + spendPubKey)
+   */
+  async balance(keys) {
+    const payments = await this.scan(keys);
+    return payments.map((p) => ({
+      stealthAddress: p.stealthAddress,
+      token: p.token,
+      amount: p.amount
+    }));
+  }
+  /**
+   * Withdraw tokens from the stealth pool.
+   *
+   * Recovers the stealth private key, signs a withdraw message,
+   * and submits the transaction. Use `opts.relay` for privacy-preserving
+   * withdrawal via a relayer.
+   *
+   * @param stealthAddress - The stealth address to withdraw from
+   * @param destination - Destination Stellar address (G...)
+   * @param opts - Withdraw options (keys, feePayer, optional relay/asset/amount)
+   */
+  async withdraw(stealthAddress, destination, opts) {
+    if (!StrKey.isValidEd25519PublicKey(stealthAddress)) {
+      throw new Error("Invalid stealth address");
+    }
+    if (!StrKey.isValidEd25519PublicKey(destination)) {
+      throw new Error("Invalid destination address");
+    }
+    const viewPrivKey = Buffer.from(opts.keys.viewPrivKey, "hex");
+    const spendPrivKey = Buffer.from(opts.keys.spendPrivKey, "hex");
+    const spendPubKey = Buffer.from(opts.keys.spendPubKey, "hex");
+    const tokenAddress = resolveTokenAddress(opts.asset, this.networkPassphrase);
+    const announcements = await fetchAnnouncements(
+      this.contractId,
+      this.server,
+      this.networkPassphrase
+    );
+    const allMatches = scanAnnouncements(
+      viewPrivKey,
+      spendPubKey,
+      announcements.map((a) => ({
+        ephemeralPubKey: a.ephemeralPubKey,
+        viewTag: a.viewTag,
+        stealthAddress: a.stealthAddress
+      }))
+    );
+    const matchedAnn = announcements.find((a) => {
+      if (a.stealthAddress !== stealthAddress) return false;
+      return allMatches.some((m) => m?.address === stealthAddress);
+    });
+    if (!matchedAnn) {
+      throw new Error("Could not find announcement for this stealth address");
+    }
+    const stealthPrivKey = recoverStealthPrivateKey(
+      spendPrivKey,
+      viewPrivKey,
+      matchedAnn.ephemeralPubKey
+    );
+    const balance = await queryBalance(
+      this.contractId,
+      matchedAnn.stealthPubKey,
+      tokenAddress,
+      this.server,
+      this.networkPassphrase
+    );
+    if (balance <= 0n) throw new Error("Stealth address has no balance in the pool");
+    let withdrawAmount;
+    if (opts.amount !== void 0) {
+      withdrawAmount = BigInt(Math.round(opts.amount * 1e7));
+      if (withdrawAmount > balance) {
+        throw new Error(`Requested ${opts.amount} but balance is ${Number(balance) / 1e7}`);
+      }
+    } else {
+      withdrawAmount = balance;
+    }
+    const currentNonce = await queryNonce(
+      this.contractId,
+      matchedAnn.stealthPubKey,
+      this.server,
+      this.networkPassphrase
+    );
+    const nonce = currentNonce + 1n;
+    const messageHash = buildWithdrawMessage(
+      matchedAnn.stealthPubKey,
+      tokenAddress,
+      withdrawAmount,
+      destination,
+      nonce
+    );
+    const signature = signWithStealthKey(messageHash, stealthPrivKey);
+    const feePayerKeypair = Keypair.fromSecret(opts.feePayer);
+    const contract = new Contract(this.contractId);
+    const feePayerAccount = await this.server.getAccount(feePayerKeypair.publicKey());
+    const withdrawTx = new TransactionBuilder(feePayerAccount, {
+      fee: "100",
+      networkPassphrase: this.networkPassphrase
+    }).addOperation(
+      contract.call(
+        "withdraw",
+        nativeToScVal(Buffer.from(matchedAnn.stealthPubKey)),
+        new StellarSdk.Address(tokenAddress).toScVal(),
+        nativeToScVal(withdrawAmount, { type: "i128" }),
+        new StellarSdk.Address(destination).toScVal(),
+        nativeToScVal(nonce, { type: "u64" }),
+        nativeToScVal(Buffer.from(signature))
+      )
+    ).setTimeout(30).build();
+    const prepared = await this.server.prepareTransaction(withdrawTx);
+    prepared.sign(feePayerKeypair);
+    let txHash;
+    if (opts.relay) {
+      const url = opts.relay.endsWith("/relay") ? opts.relay : `${opts.relay}/relay`;
+      const res = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ xdr: prepared.toEnvelope().toXDR("base64") })
+      });
+      if (!res.ok) {
+        const err = await res.json();
+        throw new Error(`Relay error: ${err.error || "unknown"}`);
+      }
+      const data = await res.json();
+      txHash = data.txHash;
+    } else {
+      const result = await this.server.sendTransaction(prepared);
+      if (result.status === "ERROR") throw new Error("Transaction submission failed");
+      if (result.status === "PENDING") {
+        await waitForTransaction(this.server, result.hash);
+      }
+      txHash = result.hash;
+    }
+    return {
+      txHash,
+      amount: Number(withdrawAmount) / 1e7
+    };
+  }
+};
+
+export { StealthClient };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map