> ## Documentation Index
> Fetch the complete documentation index at: https://trust-link-tsn.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# TCAP: Transfer Confidential Asset Protocol

> TCAP provides private GPRU balance transitions on Solana using blinded tip PDAs and owner-encrypted balance snapshots.

TCAP is the **Transfer Confidential Asset Protocol**. It provides private
balance accounting for governed assets on Solana. TCAP owns the blinded tip and
sequence checks. A successful V2 credit advances the tip from one commitment to
the next, and the owner maintains private balance state through locally
encrypted snapshots.

<Warning>
  The live TCAP path is credit-only. Confidential debits and exits are not live and remain proof-gated. Do not attempt to spend or exit from a TCAP tip using the current Devnet release.
</Warning>

## TCAP TIN Tip PDA

The `TCapTinTipV1` PDA is derived from `['tcap:tin-tip:v1', blindedRootCommitment]`. The account stores:

| Field                | Type         | Description                             |
| -------------------- | ------------ | --------------------------------------- |
| `current_commitment` | 32-byte hash | Current balance commitment              |
| `sequence`           | u64          | Strictly increasing transition number   |
| `policy_commitment`  | 32-byte hash | Policy binding for accepted transitions |
| `last_nullifier`     | 32-byte hash | Last consumed transition nullifier      |
| `frozen`             | bool         | Freeze flag                             |
| `version`            | u8           | Account version                         |
| `bump`               | u8           | PDA bump                                |

The tip does NOT store: TIN, privacy-receiving root, seed, plaintext balance, snapshot key, or token account.

## Privacy-safe transition: credit\_tcap\_tin\_tip\_v2

The `credit_tcap_tin_tip_v2` instruction accepts only a TSN PDA authorization
and opaque tip-transition fields. It performs the following checks:

* `previous_commitment` and `new_commitment` match the expected sequence.
* `sequence` is the next expected value.
* Token registry ID matches the asset entry.
* `policy_commitment` matches the tip.
* `gpru_scope_commitment` matches the TSN PDA authorization.
* The nullifier differs from the tip's last transition nullifier.
* Slot window is valid.
* Asset entry is active, approved, and unpaused.

If all checks pass, TCAP atomically advances the tip. The emitted event contains
only the tip PDA, sequence, compact token ID, and an opaque transition digest.
It never exposes payment intent IDs, raw TIN values, balances, or token
accounts. The legacy V1 receipt instruction is retained only for migration and
must not be used for new transfers.

## Encrypted balance snapshots

After a successful credit, the owner device constructs a canonical private balance snapshot and computes its commitment. The snapshot is encrypted using AES-GCM in an `EncryptedTCapBalanceSnapshotV1` envelope. The owner-held snapshot key and plaintext never leave the device.

To read a private balance, the owner device:

1. Fetches the public tip commitment and sequence.
2. Locates the matching encrypted snapshot ciphertext by `new_commitment`.
3. Decrypts locally with the owner snapshot key.
4. Verifies envelope bindings and commitment hash.

## Commitment binding rules

TCAP enforces a strict binding between the on-chain tip and the off-chain snapshot:

```text theme={null}
tip.current_commitment == snapshot.new_commitment
snapshot.new_commitment = SHA256(canonical snapshot record excluding new_commitment)
tip.sequence == snapshot.sequence
```

This ensures the private snapshot is an exact successor of the on-chain tip state.

## TCAP route V2 and TSN CPI

The V2 TSN CPI wrapper passes only the opaque authorization digest, validity
window, predecessor/successor commitments, policy, GPRU scope and nullifier.
It does not pass an `AcceptedIntentV1`, epoch commitment, settlement
commitment, or TCAP authorization receipt. A GPRU signature alone cannot move
custody; the approved TSN program must sign the CPI-derived authorization PDA.

## Devnet reference

The TCAP program ID on Devnet is:

```text theme={null}
TcApT4CytBqvqEDpRYVB7Wfi6aFzmtSZdWvDsq6bp9x
```

This is the current TCAP program identity. The V2 instruction source has not
been proven on Devnet until the upgraded binary is deployed and the V2
authorization proof gate is exercised. Stable-TCAP is Devnet-only, valueless,
and not USDC.

## Related pages

<CardGroup cols={2}>
  <Card title="TCAP Credits" icon="coins" href="/developers/tcap-tip-credits">
    Developer integration with tip states and credit transitions.
  </Card>

  <Card title="Confidential Settlement" icon="lock" href="/developers/confidential-settlement">
    Full TSN to TCAP authorization flow and ABI.
  </Card>

  <Card title="Epoch Treasury" icon="vault" href="/architecture/epoch-treasury">
    How settlement liability is tracked at the treasury layer.
  </Card>

  <Card title="Identity & Routing" icon="id-card" href="/architecture/identity-and-routing">
    TIN, master seed, and GPRU authorization derivation.
  </Card>
</CardGroup>