SHIELD WALLET SOURCE DISTRIBUTION

This ZIP accompanies the matching shield-wallet-<version>.zip release. It contains
the extension, shared SDK sources, build scripts, public circuit assets/config,
npm lockfiles, and source/license notices for the bundled application packages
and the snarkJS dependency tree. It contains no live account vault, recovery
phrase, private deployment key, RPC credential file, browser profile or OS binary.
Integration test scripts contain the publicly known local-Anvil test key; it is
only a synthetic test fixture and must never receive real funds.
Public proving keys and verification keys are protocol artifacts, not wallet keys.

REBUILD THE EXTENSION
Use Node.js 22.13 or newer and npm. In this extracted source folder:
  cd protocol
  npm ci --ignore-scripts
  cd ../web
  npm ci --ignore-scripts
  npm run build:extension
The runtime ZIP, source ZIP, SHA-256 file and release metadata appear in
web/outputs/extension and web/public/downloads. Vite handles application bundling;
the ZIP writer fixes timestamps, order and compression settings. With identical
inputs, Node/zlib and npm dependency versions, repeated archives match byte for
byte. Updating public history or the app changes hashes; no build timestamp is
injected. SOURCE-INTEGRITY.json covers all source files except itself.

PROVER SOURCE
web/extension/vendor contains the pinned upstream snarkJS 0.7.6 source, including
build configuration, plus its source URL/checksum record. third-party/packages
contains the installed package sources, declarations and licenses for the actual
application and prover dependency inventory. Prover-tree entries include modules
used only by Node tooling; their presence does not mean they run in the wallet.
The browser runtime is copied unchanged and its hash is recorded in the inventory.
To rebuild snarkJS itself, extract its upstream source, install its dependencies
using the included upstream lockfile, and follow its package.json build commands.
Its original source and all notices are retained; snarkJS is GPL-3.0. Other
dependencies retain their declared licenses. See THIRD-PARTY-NOTICES.txt and
licenses/. Manrope is OFL-1.1; token artwork retains its upstream attribution and
respective trademarks. Source is provided for inspection and rebuilding; this
package makes no claim of third-party security certification or store review.

The full protocol contract test environment and website frontend are outside this
focused source package. The circuit source is provided for inspection. Do not
re-run a trusted setup and point it at the existing pool: a circuit/verifier change
requires a new pool and deployment, as documented by the protocol.
