@arcanetech/privacy-sdk-stellar 0.5.1 → 0.5.4

package/dist/transact/index.js

@@ -1,26 +1,8 @@
 // src/transact/pool/service.ts
 import {
-  PrivacyPoolSDK as PrivacyPoolSDK2,
-  decodeDecodedEphemeralKey,
-  randomFrDecimal253,
-  scalarHexToFrDecimal as scalarHexToFrDecimal2
+  decodeDecodedEphemeralKey
 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
-// src/transact/merkle/field-decimal.ts
-import { Buffer as Buffer2 } from "buffer";
-var BN254 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
-var MERKLE_ROOT_BYTE_LENGTH = 32;
-var DECIMAL_STRING_RADIX = 10;
-function merkleRootBufferToFrDecimal(root) {
-  if (root.length !== MERKLE_ROOT_BYTE_LENGTH) {
-    throw new Error(
-      `expected ${MERKLE_ROOT_BYTE_LENGTH}-byte merkle root, got ${root.length}`
-    );
-  }
-  const hex = Buffer2.from(root).toString("hex");
-  return (BigInt(`0x${hex}`) % BN254).toString(DECIMAL_STRING_RADIX);
-}
-
 // src/transact/private-address/codec.ts
 import {
   buildStealthAddressSignMessage,
@@ -76,18 +58,18 @@ function privateAddressSdk(sdk) {
 import { withdrawObjectFromMerkleWitness as withdrawObjectFromMerkleWitness2 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
 // src/transact/proofs/transaction-input.ts
-import { Buffer as Buffer4 } from "buffer";
+import { Buffer as Buffer3 } from "buffer";
 import { StrKey as StrKey2 } from "@stellar/stellar-sdk";
 
 // src/transact/stellar/token-contract.ts
-import { Buffer as Buffer3 } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import { StrKey } from "@stellar/stellar-sdk";
 var CONTRACT_ID_BYTE_LENGTH = 32;
 var HEX_CHARS_PER_BYTE = 2;
 var CONTRACT_ID_HEX_CHAR_LENGTH = CONTRACT_ID_BYTE_LENGTH * HEX_CHARS_PER_BYTE;
 var CONTRACT_ID_HEX = /^(?:0x)?([0-9a-f]{64})$/i;
 function encodeContractFromHex(hexPayload) {
-  return StrKey.encodeContract(Buffer3.from(hexPayload, "hex"));
+  return StrKey.encodeContract(Buffer2.from(hexPayload, "hex"));
 }
 function normalizeSorobanContractId(raw) {
   const trimmed = raw.trim();
@@ -120,14 +102,14 @@ var ZERO_PUBLIC_WITHDRAW_ADDRESS = {
 var CONTRACT_ADDRESS_HALF_BYTES = 16;
 var CONTRACT_ADDRESS_BYTES = 32;
 function bytes16ToDecimal(bytes) {
-  return BigInt(`0x${Buffer4.from(bytes).toString("hex")}`).toString();
+  return BigInt(`0x${Buffer3.from(bytes).toString("hex")}`).toString();
 }
 function decimalToBytes16(value) {
   const hex = BigInt(value).toString(16).padStart(CONTRACT_ADDRESS_HALF_BYTES * 2, "0");
   if (hex.length > CONTRACT_ADDRESS_HALF_BYTES * 2) {
     throw new Error("Asset leg does not fit into 16 bytes.");
   }
-  return Buffer4.from(hex, "hex");
+  return Buffer3.from(hex, "hex");
 }
 function tokenAddressFrParts(tokenAddress) {
   const normalized = resolveTokenContractId(tokenAddress);
@@ -169,7 +151,7 @@ function tokenAddressToAssetLeg(tokenAddress) {
   return [hi, lo];
 }
 function assetLegToTokenAddress(assetHi, assetLo) {
-  const payload = Buffer4.concat([decimalToBytes16(assetHi), decimalToBytes16(assetLo)]);
+  const payload = Buffer3.concat([decimalToBytes16(assetHi), decimalToBytes16(assetLo)]);
   return StrKey2.encodeContract(payload);
 }
 function buildZeroPublicLegs(publicNInputs = 1, publicNOutputs = 1) {
@@ -292,14 +274,144 @@ function requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl
     }
   }
 }
-function changeStroopsAfterDualTransfer(transferStroops, totalNotes) {
-  if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
-    throw new Error("Transfer amount must be positive");
+
+// src/transact/fees/quote-request-body.ts
+function presentInstructedAmount(amount) {
+  const trimmed = amount?.trim() ?? "";
+  if (!trimmed || trimmed === "0") {
+    return void 0;
+  }
+  return trimmed;
+}
+function feeQuoteRequestBody(request) {
+  const publicDepositAmount = presentInstructedAmount(request.publicDepositAmount);
+  const transferInstructedAmount = presentInstructedAmount(
+    request.transferInstructedAmount
+  );
+  const publicWithdrawalAmount = presentInstructedAmount(
+    request.publicWithdrawalAmount
+  );
+  return {
+    feeAsset: request.feeAsset,
+    spendsNotes: request.spendsNotes,
+    ...publicDepositAmount === void 0 ? {} : { publicDepositAmount },
+    ...transferInstructedAmount === void 0 ? {} : { transferInstructedAmount },
+    ...publicWithdrawalAmount === void 0 ? {} : { publicWithdrawalAmount }
+  };
+}
+
+// src/transact/fees/quote-required-fee.ts
+function quoteHeaders(inspectAuthorization) {
+  const token = inspectAuthorization?.trim();
+  return {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+}
+function parseRequiredFee(raw) {
+  const text = `${raw ?? ""}`.trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error("Fee Quote Required Fee must be an integer minor-unit string.");
+  }
+  return BigInt(text);
+}
+function requireQuoteString(raw, field) {
+  const text = `${raw ?? ""}`.trim();
+  if (!text) {
+    throw new Error(`Fee Quote is missing ${field}.`);
+  }
+  return text;
+}
+function parseQuotePayload(payload) {
+  return {
+    requiredFee: parseRequiredFee(payload.requiredFee),
+    feeAsset: requireQuoteString(payload.feeAsset, "Fee Asset"),
+    feeCollectorPrivateAddress: requireQuoteString(
+      payload.feeCollectorPrivateAddress,
+      "Fee Collector Private Address"
+    ),
+    feeRate: requireQuoteString(payload.feeRate, "Fee Rate")
+  };
+}
+async function quoteRequiredFee(input) {
+  const response = await fetch(
+    `${input.transactEnvironment.kyt.apiBaseUrl}/kyt/fees/quote`,
+    {
+      method: "POST",
+      headers: quoteHeaders(input.transactEnvironment.kyt.inspectAuthorization),
+      body: JSON.stringify(feeQuoteRequestBody(input.request))
+    }
+  );
+  const payload = await response.json();
+  if (!response.ok) {
+    throw new Error(`Fee Quote failed: ${JSON.stringify(payload)}`);
+  }
+  return parseQuotePayload(payload);
+}
+
+// src/transact/fees/should-attach-fee-output.ts
+function shouldAttachFeeOutput(input) {
+  if (input.spendSource === "escrow" && input.escrowSend !== true) {
+    return false;
+  }
+  return input.kind === "deposit" || input.kind === "transfer" || input.kind === "withdraw";
+}
+function feeOutputKindFromPrepared(prepared) {
+  return {
+    kind: prepared.kind,
+    ...prepared.transactArtifacts?.spendSource ? { spendSource: prepared.transactArtifacts.spendSource } : {},
+    ...prepared.transactArtifacts?.escrowSend ? { escrowSend: true } : {}
+  };
+}
+
+// src/transact/fees/quote-fee-output-for-prepared.ts
+function instructedMinorUnits(prepared) {
+  return prepared.intent.amount.toString();
+}
+function quoteRequestForPrepared(input) {
+  const amount = instructedMinorUnits(input.prepared);
+  if (input.prepared.kind === "deposit") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicDepositAmount: amount,
+      spendsNotes: false
+    };
+  }
+  if (input.prepared.kind === "withdraw") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicWithdrawalAmount: amount,
+      spendsNotes: true
+    };
+  }
+  return {
+    feeAsset: input.tokenAddress,
+    transferInstructedAmount: amount,
+    spendsNotes: true
+  };
+}
+async function quoteFeeOutputForPrepared(input) {
+  if (!shouldAttachFeeOutput(feeOutputKindFromPrepared(input.prepared))) {
+    return void 0;
   }
-  if (transferStroops > totalNotes) {
-    throw new Error("Transfer amount exceeds combined note value");
+  const quote = await quoteRequiredFee({
+    transactEnvironment: input.environment,
+    request: quoteRequestForPrepared(input)
+  });
+  if (quote.requiredFee <= 0n) {
+    return void 0;
+  }
+  return {
+    requiredFee: quote.requiredFee,
+    feeCollectorPrivateAddress: quote.feeCollectorPrivateAddress
+  };
+}
+function remainingAfterRequiredFee(input) {
+  const remaining = input.available - input.instructed - input.requiredFee;
+  if (remaining < 0n) {
+    throw new Error("Instructed amount and Required Fee exceed available note value");
   }
-  return totalNotes - transferStroops;
+  return remaining;
 }
 
 // src/transact/audit/parameters.ts
@@ -307,7 +419,7 @@ import {
   DEMO_AUDIT_PUBLIC_KEY,
   resolveTransactionAuditParams
 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
-import { Buffer as Buffer5 } from "buffer";
+import { Buffer as Buffer4 } from "buffer";
 var UNCOMPRESSED_PREFIX = "04";
 var UNCOMPRESSED_HEX_LENGTH = 130;
 var XY_HEX_LENGTH = 128;
@@ -334,7 +446,7 @@ function parseAuditPublicKeyFromEnvHex(raw) {
       "Audit public key must be uncompressed 65-byte hex (04 + X + Y) or 64-byte X+Y hex"
     );
   }
-  const bytes = Buffer5.from(payload, "hex");
+  const bytes = Buffer4.from(payload, "hex");
   const auditPublicKeyXDecimal = BigInt(
     `0x${bytes.subarray(0, X_OFFSET_END).toString("hex")}`
   ).toString(DECIMAL_RADIX);
@@ -356,6 +468,7 @@ function buildPoolTransactionAuditParameters(input) {
     input.nAuditSlots
   );
 }
+var DECIMAL_APPLICATION_ID = /^\d+$/u;
 function resolvePoolApplicationId(applicationId) {
   const trimmed = applicationId?.trim();
   if (!trimmed) {
@@ -363,6 +476,11 @@ function resolvePoolApplicationId(applicationId) {
       "Privacy pool applicationId is required. Pass it in client factory config."
     );
   }
+  if (!DECIMAL_APPLICATION_ID.test(trimmed)) {
+    throw new Error(
+      "Privacy pool applicationId must be association.audit_id (decimal Fr), not a UUID or foreignId."
+    );
+  }
   return trimmed;
 }
 
@@ -371,13 +489,13 @@ import { ed25519PubkeyPayloadHexToWithdrawFrDecimals } from "@arcanetech/stellar
 
 // src/transact/stellar/account.ts
 import { StrKey as StrKey3 } from "@stellar/stellar-sdk";
-import { Buffer as Buffer6 } from "buffer";
+import { Buffer as Buffer5 } from "buffer";
 var MUXED_ACCOUNT_ID_BYTE_LENGTH = 8;
 var ED25519_PUBLIC_KEY_BYTE_LENGTH = 32;
 function ed25519HexFromGAddress(trimmed) {
   try {
     const raw = StrKey3.decodeEd25519PublicKey(trimmed);
-    return Buffer6.from(raw).toString("hex");
+    return Buffer5.from(raw).toString("hex");
   } catch {
     return void 0;
   }
@@ -434,6 +552,32 @@ function privKeyScalarDecimalFromRecipientScalarHex(hexInput) {
   return canonicalBabyJubScalarFromInteger(value).toString(DECIMAL_RADIX2);
 }
 
+// src/transact/fees/append-fee-output.ts
+function feeCoinFromSlot(slot) {
+  return {
+    commitment_hex: slot.commitment_hex,
+    coin: slot.coin,
+    depositScalarHex: slot.depositScalarHex,
+    precommitementHex: slot.precommitementHex
+  };
+}
+async function appendFeeOutputSlot(input) {
+  const requiredFee = input.feeOutput?.requiredFee ?? ZERO_STROOPS;
+  const collector = input.feeOutput?.feeCollectorPrivateAddress.trim() ?? "";
+  if (requiredFee <= ZERO_STROOPS || !collector) {
+    return { deposits: input.deposits };
+  }
+  const slot = await input.buildAlignedDepositSlot({
+    privateAddressStpl1: collector,
+    amountStroops: requiredFee,
+    tokenAddress: input.tokenAddress
+  });
+  return {
+    deposits: [...input.deposits, slot.deposit],
+    feeCoin: feeCoinFromSlot(slot)
+  };
+}
+
 // src/transact/proofs/withdraw/helpers.ts
 function destinationWithdrawFrAndScalar(parameters) {
   const pkHex = ed25519PublicKeyHexFromStellarAccount(
@@ -488,14 +632,15 @@ async function resolveWithdrawChangeDeposits(parameters) {
     }
   };
 }
-function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1) {
+function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > totalNotes) {
-    throw new Error("Withdraw amount exceeds combined note value");
-  }
-  const changeStroops = totalNotes - withdrawAmountStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, changePrivateAddressStpl1);
   return changeStroops;
 }
@@ -508,11 +653,31 @@ function buildDualWithdrawPublicInput(parameters) {
     publicWithdrawalAmount: parameters.publicWithdrawalAmount
   });
 }
+async function withdrawOutputsWithOptionalFee(parameters) {
+  const { deposits: changeDeposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: changeDeposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
+  };
+}
 async function prepareDualWithdrawProofInputs(parameters) {
   const changeStroops = validateDualWithdrawAmounts(
     parameters.withdrawAmountStroops,
     BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value),
-    parameters.changePrivateAddressStpl1
+    parameters.changePrivateAddressStpl1,
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { legA, legB } = dualWithdrawLegsWithSharedRoot({
     sdk: parameters.sdk,
@@ -527,11 +692,12 @@ async function prepareDualWithdrawProofInputs(parameters) {
     ),
     applicationId: parameters.applicationId
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawOutputsWithOptionalFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildDualWithdrawPublicInput({
     destinationStellarAddress: parameters.destinationStellarAddress,
@@ -550,19 +716,55 @@ async function prepareDualWithdrawProofInputs(parameters) {
     audit,
     deposits,
     withdrawLegs: [legA.withdrawObject, legB.withdrawObject],
-    ...changeCoin ? { changeCoin } : {}
+    ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {}
+  };
+}
+
+// src/transact/proofs/withdraw/fee-deposits.ts
+async function withdrawDepositsWithFee(parameters) {
+  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
   };
 }
+function withdrawOutputApplicationIds(input) {
+  const outputIds = [];
+  if (input.hasChange) {
+    outputIds.push(input.applicationId);
+  }
+  if (input.hasFeeOutput) {
+    outputIds.push(input.applicationId);
+  }
+  if (outputIds.length === 0) {
+    outputIds.push("0");
+  }
+  return outputIds;
+}
 
 // src/transact/proofs/withdraw/transact-proof.ts
-function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops) {
+function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > noteStroops) {
-    throw new Error("Withdraw amount exceeds note value");
-  }
-  return noteStroops - withdrawAmountStroops;
+  return remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
 }
 async function proveSingleWithdrawTransaction(parameters) {
   return parameters.sdk.proveTransaction(
@@ -601,7 +803,8 @@ function buildPrimaryWithdrawForCoin(parameters) {
 async function prepareSingleWithdrawProofInputs(parameters) {
   const changeStroops = validateSingleWithdrawAmounts(
     parameters.withdrawAmountStroops,
-    BigInt(parameters.coin.value)
+    BigInt(parameters.coin.value),
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { witness, primaryWithdraw } = buildPrimaryWithdrawForCoin({
     sdk: parameters.sdk,
@@ -610,11 +813,12 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     state: parameters.state,
     privKeyScalarHex: parameters.privKeyScalarHex
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawDepositsWithFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildWithdrawPublicInput({
     stateRoot: witness.stateRoot,
@@ -627,6 +831,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     primaryWithdraw,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput,
     audit: buildPoolTransactionAuditParameters({
       applicationId: parameters.applicationId,
@@ -636,7 +841,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
   };
 }
 async function proveWithdrawTransact(parameters) {
-  const { primaryWithdraw, deposits, changeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
+  const { primaryWithdraw, deposits, changeCoin, feeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
   const proof = await proveSingleWithdrawTransaction({
     sdk: parameters.sdk,
     publicInput,
@@ -651,13 +856,17 @@ async function proveWithdrawTransact(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [parameters.applicationId],
-      outputIds: [changeCoin ? parameters.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: parameters.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
 }
 async function proveWithdrawTransactDual(parameters) {
-  const { publicInput, audit, withdrawLegs, deposits, changeCoin } = await prepareDualWithdrawProofInputs(parameters);
+  const { publicInput, audit, withdrawLegs, deposits, changeCoin, feeCoin } = await prepareDualWithdrawProofInputs(parameters);
   const proof = await parameters.sdk.proveTransaction(
     publicInput,
     padPublicLegsToLayout(
@@ -676,7 +885,11 @@ async function proveWithdrawTransactDual(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [audit.applicationId, audit.applicationId],
-      outputIds: [changeCoin ? audit.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: audit.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
@@ -700,6 +913,9 @@ var DEFAULT_ZK_CONFIG_NONCE = BINDING_ZK_NONCE;
 function resolveZkConfigNonce(transactEnvironment) {
   return transactEnvironment.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
 }
+function transactNonceFromArtifacts(artifacts, transactEnvironment) {
+  return artifacts?.zkConfigNonce ?? resolveZkConfigNonce(transactEnvironment);
+}
 
 // src/transact/zk/browser-artifact-cache.ts
 import { ZK_ARTIFACT_VERSION } from "@arcanetech/stellar-privacy-pool-zk-sdk";
@@ -952,6 +1168,122 @@ async function buildAlignedDepositSlotForSdk(sdk, applicationId, parameters) {
   };
 }
 
+// src/transact/pool/initialize-sdk.ts
+import { PrivacyPoolSDK as PrivacyPoolSDK2 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+async function initializePrivacyPoolSdk(input, nonce) {
+  const zkConfigNonce = nonce ?? input.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+  const zkCircuits = await materializeSelectedZkCircuit(
+    input.zkCircuits,
+    zkConfigNonce,
+    input.zkArtifactBaseUrl
+  );
+  return PrivacyPoolSDK2.init({
+    wasmBinary: input.assets.sdkWasm,
+    zkCircuits,
+    zkConfigNonce,
+    ...optionalZkArtifactBaseUrl(input.zkArtifactBaseUrl)
+  });
+}
+
+// src/transact/fees/zk-config-nonce-for-kind.ts
+function configuredNonceSpread(zkConfigNonce) {
+  if (zkConfigNonce === void 0) {
+    return {};
+  }
+  return { configuredNonce: zkConfigNonce };
+}
+function zkConfigNonceForFeeBearingKind(input) {
+  if (input.configuredNonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  if (input.kind === "transfer" && shouldAttachFeeOutput(input)) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  return input.configuredNonce ?? BINDING_ZK_NONCE;
+}
+
+// src/transact/pool/prepare-deposit-proof.ts
+import {
+  randomFrDecimal253,
+  scalarHexToFrDecimal as scalarHexToFrDecimal2
+} from "@arcanetech/stellar-privacy-pool-zk-sdk";
+
+// src/transact/merkle/field-decimal.ts
+import { Buffer as Buffer6 } from "buffer";
+var BN254 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var MERKLE_ROOT_BYTE_LENGTH = 32;
+var DECIMAL_STRING_RADIX = 10;
+function merkleRootBufferToFrDecimal(root) {
+  if (root.length !== MERKLE_ROOT_BYTE_LENGTH) {
+    throw new Error(
+      `expected ${MERKLE_ROOT_BYTE_LENGTH}-byte merkle root, got ${root.length}`
+    );
+  }
+  const hex = Buffer6.from(root).toString("hex");
+  return (BigInt(`0x${hex}`) % BN254).toString(DECIMAL_STRING_RADIX);
+}
+
+// src/transact/pool/prepare-deposit-proof.ts
+function userDepositSlot(input) {
+  return {
+    value: input.coin.value,
+    nullifier: input.coin.nullifier,
+    ephemeralKeyScalar: scalarHexToFrDecimal2(input.depositScalarHex),
+    asset: [input.coin.asset_hi, input.coin.asset_lo],
+    applicationId: input.applicationId,
+    recipientPublicKeys: recipientPublicKeysDecimalFromPrivateAddress(
+      input.privateAddressStpl1
+    )
+  };
+}
+function outputApplicationIds(input) {
+  if (input.hasFeeOutput) {
+    return [input.applicationId, input.applicationId];
+  }
+  return [input.applicationId];
+}
+async function proveDepositTransact(input) {
+  const publicDeposit = (input.publicDepositStroops ?? BigInt(input.coin.value)).toString();
+  const withFee = await appendFeeOutputSlot({
+    deposits: [userDepositSlot(input)],
+    tokenAddress: input.tokenAddress,
+    buildAlignedDepositSlot: input.buildAlignedDepositSlot,
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  });
+  const audit = buildPoolTransactionAuditParameters({
+    applicationId: input.applicationId,
+    nAuditSlots: input.sdk.getLayout().nAuditSlots,
+    ...input.auditPublicKey ? { auditPublicKey: input.auditPublicKey } : {}
+  });
+  const proof = await input.sdk.proveTransaction(
+    withTokenAddressPublicInputs(
+      {
+        stateRoot: merkleRootBufferToFrDecimal(input.merkleRootBytes),
+        privKeyScalar: randomFrDecimal253()
+      },
+      input.tokenAddress
+    ),
+    padPublicLegsToLayout(
+      input.sdk,
+      buildPublicDepositLegs(input.tokenAddress, publicDeposit)
+    ),
+    padWithdrawSlotsToLayout(input.sdk, []),
+    padDepositSlotsToLayout(input.sdk, withFee.deposits),
+    audit
+  );
+  return {
+    ...proof,
+    applicationIdsPlaintext: buildApplicationIdHints({
+      sdk: input.sdk,
+      inputIds: [],
+      outputIds: outputApplicationIds({
+        applicationId: input.applicationId,
+        hasFeeOutput: Boolean(withFee.feeCoin)
+      })
+    })
+  };
+}
+
 // src/transact/pool/service.ts
 var PrivacyPoolService = class {
   constructor(assets, applicationId, auditPublicKey, zkCircuits, zkConfigNonce, zkArtifactBaseUrl) {
@@ -968,42 +1300,50 @@ var PrivacyPoolService = class {
   zkCircuits;
   zkConfigNonce;
   zkArtifactBaseUrl;
-  sdk = void 0;
-  initPromise = void 0;
-  async ensureInit() {
-    if (this.sdk) {
-      return;
+  sdks = /* @__PURE__ */ new Map();
+  initPromises = /* @__PURE__ */ new Map();
+  async getInitializedSdk(nonce) {
+    const zkConfigNonce = nonce ?? this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+    const key = zkConfigNonce.toString();
+    const existing = this.sdks.get(key);
+    if (existing) {
+      return existing;
     }
-    if (this.initPromise) {
-      return this.initPromise;
+    const pending = this.initPromises.get(key);
+    if (pending) {
+      return pending;
+    }
+    const started = this.initializeSdk(zkConfigNonce);
+    this.initPromises.set(key, started);
+    try {
+      const sdk = await started;
+      this.sdks.set(key, sdk);
+      return sdk;
+    } finally {
+      this.initPromises.delete(key);
     }
-    this.initPromise = (async () => {
-      if (!this.assets) {
-        throw new Error(
-          "PrivacyPoolService requires browser ZK assets before initialization."
-        );
-      }
-      const zkConfigNonce = this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
-      const zkCircuits = await materializeSelectedZkCircuit(
-        this.zkCircuits,
-        zkConfigNonce,
-        this.zkArtifactBaseUrl
-      );
-      this.sdk = await PrivacyPoolSDK2.init({
-        wasmBinary: this.assets.sdkWasm,
-        zkCircuits,
-        zkConfigNonce,
-        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
-      });
-    })();
-    return this.initPromise;
   }
-  async getInitializedSdk() {
-    await this.ensureInit();
-    if (!this.sdk) {
-      throw new Error("SDK not initialized");
+  feeBearingZkConfigNonce(input) {
+    return zkConfigNonceForFeeBearingKind({
+      ...input,
+      ...configuredNonceSpread(this.zkConfigNonce)
+    });
+  }
+  async initializeSdk(nonce) {
+    if (!this.assets) {
+      throw new Error(
+        "PrivacyPoolService requires browser ZK assets before initialization."
+      );
     }
-    return this.sdk;
+    return initializePrivacyPoolSdk(
+      {
+        assets: this.assets,
+        ...this.zkCircuits ? { zkCircuits: this.zkCircuits } : {},
+        ...this.zkConfigNonce === void 0 ? {} : { zkConfigNonce: this.zkConfigNonce },
+        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
+      },
+      nonce
+    );
   }
   getAuditPublicKey() {
     return this.auditPublicKey;
@@ -1036,65 +1376,51 @@ var PrivacyPoolService = class {
     return { commitment_hex, coin, depositScalarHex, precommitementHex };
   }
   async prepareDepositTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
-    const stateRoot = merkleRootBufferToFrDecimal(parameters.merkleRootBytes);
-    const recipientPublicKeys = recipientPublicKeysDecimalFromPrivateAddress(
-      parameters.privateAddressStpl1
-    );
-    const applicationId = this.getApplicationId();
-    const audit = buildPoolTransactionAuditParameters({
-      applicationId,
-      nAuditSlots: sdk.getLayout().nAuditSlots,
-      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {}
-    });
-    const deposit = {
-      value: parameters.coin.value,
-      nullifier: parameters.coin.nullifier,
-      ephemeralKeyScalar: scalarHexToFrDecimal2(parameters.depositScalarHex),
-      asset: [parameters.coin.asset_hi, parameters.coin.asset_lo],
-      applicationId,
-      recipientPublicKeys
-    };
-    const publicInput = withTokenAddressPublicInputs(
-      {
-        stateRoot,
-        privKeyScalar: randomFrDecimal253()
-      },
-      parameters.tokenAddress
-    );
-    const proof = await sdk.proveTransaction(
-      publicInput,
-      padPublicLegsToLayout(
-        sdk,
-        buildPublicDepositLegs(parameters.tokenAddress, parameters.coin.value)
-      ),
-      padWithdrawSlotsToLayout(sdk, []),
-      padDepositSlotsToLayout(sdk, [deposit]),
-      audit
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "deposit" })
     );
-    const applicationIdsPlaintext = buildApplicationIdHints({
+    return proveDepositTransact({
       sdk,
-      inputIds: [],
-      outputIds: [applicationId]
+      applicationId: this.getApplicationId(),
+      privateAddressStpl1: parameters.privateAddressStpl1,
+      coin: parameters.coin,
+      depositScalarHex: parameters.depositScalarHex,
+      merkleRootBytes: parameters.merkleRootBytes,
+      tokenAddress: parameters.tokenAddress,
+      buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
+      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
+      ...parameters.publicDepositStroops === void 0 ? {} : { publicDepositStroops: parameters.publicDepositStroops },
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
-    return { ...proof, applicationIdsPlaintext };
   }
   async calculateNullifierHash(nullifier, privKeyScalar) {
     const sdk = await this.getInitializedSdk();
     return sdk.calculateNullifierHash(nullifier, privKeyScalar);
   }
   async prepareWithdrawTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransact({
       sdk,
       applicationId: this.getApplicationId(),
       buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
       ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
-      ...parameters
+      coin: parameters.coin,
+      state: parameters.state,
+      destinationStellarAddress: parameters.destinationStellarAddress,
+      privKeyScalarHex: parameters.privKeyScalarHex,
+      depositorEphemeralKey: parameters.depositorEphemeralKey,
+      withdrawAmountStroops: parameters.withdrawAmountStroops,
+      changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
   async prepareWithdrawTransactProofDual(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransactDual({
       sdk,
       applicationId: this.getApplicationId(),
@@ -1109,7 +1435,8 @@ var PrivacyPoolService = class {
       ephemeralBKey: parameters.depositorEphemeralBKey,
       withdrawAmountStroops: parameters.withdrawAmountStroops,
       changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
-      tokenAddress: parameters.tokenAddress
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
 };
@@ -1814,7 +2141,7 @@ async function requestKytPassageForPoolInteraction(input) {
   const applicationId = resolvePoolApplicationId(
     input.transactEnvironment.network.applicationId
   );
-  const zkConfigNonce = resolveZkConfigNonce(input.transactEnvironment);
+  const zkConfigNonce = input.zkConfigNonce ?? resolveZkConfigNonce(input.transactEnvironment);
   const applicationIdsPlaintext = input.applicationIdsPlaintext ?? buildApplicationIdHints2(
     applicationId,
     layoutForKnownNonce(zkConfigNonce).nAuditSlots
@@ -1927,6 +2254,7 @@ async function inspectRelayerSweepKyt(input) {
     ...input.prepared.transactArtifacts?.applicationIdsPlaintext ? {
       applicationIdsPlaintext: input.prepared.transactArtifacts.applicationIdsPlaintext
     } : {},
+    ...input.prepared.transactArtifacts?.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.prepared.transactArtifacts.zkConfigNonce },
     networkPassphrase: environment.network.networkPassphrase,
     sorobanRpcUrl: environment.network.rpcUrl,
     transactEnvironment: environment
@@ -1939,7 +2267,10 @@ async function simulateSweepAuthEntries(input) {
   const operation = new Contract(environment.network.poolContract).call(
     "transact",
     new Address3(input.relayerPublicKey).toScVal(),
-    nativeToScVal2(resolveZkConfigNonce(environment), { type: "u64" }),
+    nativeToScVal2(
+      transactNonceFromArtifacts(input.prepared.transactArtifacts, environment),
+      { type: "u64" }
+    ),
     nativeToScVal2(hexToBytes(input.artifacts.proofHex), { type: "bytes" }),
     nativeToScVal2(hexToBytes(input.artifacts.publicHex), { type: "bytes" }),
     nativeToScVal2(hexToBytes(input.artifacts.ciphertextHex ?? ""), { type: "bytes" }),
@@ -1976,6 +2307,7 @@ async function unsignedEscrowAuthorizationForSweep(input) {
   });
   const auth = await simulateSweepAuthEntries({
     artifacts,
+    prepared: input.prepared,
     transactEnvironment: input.transactEnvironment,
     relayerPublicKey,
     approval
@@ -2007,15 +2339,15 @@ async function loadDefaultStellarBrowserAssets(options) {
 }
 
 // src/transact/private-address/temporary-recipient.ts
-import { PrivacyPoolSDK as PrivacyPoolSDK3 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+import { PrivacyPoolSDK as PrivacyPoolSDK4 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 var COORDINATE_HEX_LENGTH2 = 64;
 async function generateRandomDepositScalarHex() {
   await getPrivacyPoolService().getInitializedSdk();
-  return PrivacyPoolSDK3.generateRandomScalarHex32();
+  return PrivacyPoolSDK4.generateRandomScalarHex32();
 }
 async function generateTemporaryRecipientPrivateAddress() {
   await getPrivacyPoolService().getInitializedSdk();
-  const temporaryScalarHex = PrivacyPoolSDK3.generateRandomScalarHex32();
+  const temporaryScalarHex = PrivacyPoolSDK4.generateRandomScalarHex32();
   const sdk = await getPrivacyPoolService().getInitializedSdk();
   const point = sdk.ecdhEphemeralPublicKeyFromScalarHex(temporaryScalarHex);
   const publicKeyXHex = point.x.padStart(COORDINATE_HEX_LENGTH2, "0");
@@ -2284,6 +2616,10 @@ async function submitSorobanConfidentialTransfer(input) {
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl
   });
+  const nonce = transactNonceFromArtifacts(
+    input.zkConfigNonce === void 0 ? void 0 : { zkConfigNonce: input.zkConfigNonce },
+    input.transactEnvironment
+  );
   const approval = await requestKytPassageForPoolInteraction({
     owner: input.walletPublicKey,
     poolContract: input.contractId,
@@ -2292,6 +2628,7 @@ async function submitSorobanConfidentialTransfer(input) {
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
     ...input.outputNoteEphemeralScalars ? { outputNoteEphemeralScalars: input.outputNoteEphemeralScalars } : {},
     ...input.applicationIdsPlaintext ? { applicationIdsPlaintext: input.applicationIdsPlaintext } : {},
+    ...input.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.zkConfigNonce },
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl,
     transactEnvironment: input.transactEnvironment
@@ -2300,7 +2637,7 @@ async function submitSorobanConfidentialTransfer(input) {
     contractClient: poolClient,
     contractId: input.contractId,
     from: input.walletPublicKey,
-    nonce: resolveZkConfigNonce(input.transactEnvironment),
+    nonce,
     proofHex: input.proofHex,
     publicHex: input.publicHex,
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
@@ -2322,9 +2659,6 @@ function escrowOutputFields(input) {
     recipientLo: input.escrowSend.recipientLo
   };
 }
-function paddingDepositPair(recipientDeposit) {
-  return [recipientDeposit, "dummy"];
-}
 async function buildChangeDepositPair(parameters) {
   const changeSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
     privateAddressStpl1: parameters.selfPrivateAddressStpl1ForChange.trim(),
@@ -2341,34 +2675,54 @@ async function buildChangeDepositPair(parameters) {
     }
   };
 }
+function recipientOnlyDeposits(recipientDeposit, hasFeeOutput) {
+  if (hasFeeOutput) {
+    return [recipientDeposit];
+  }
+  return [recipientDeposit, "dummy"];
+}
+async function depositsWithoutFee(input) {
+  if (input.changeStroops <= ZERO_STROOPS) {
+    return {
+      deposits: recipientOnlyDeposits(input.recipientDeposit, input.hasFeeOutput)
+    };
+  }
+  return buildChangeDepositPair({
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    changeStroops: input.changeStroops,
+    tokenAddress: input.tokenAddress,
+    recipientDeposit: input.recipientDeposit
+  });
+}
 async function buildRecipientAndOptionalChangeDeposits(parameters) {
   const escrow = {
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
     ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
   };
-  const recipientPrivateAddress = parameters.recipientPrivateAddressStpl1.trim();
   const recipientSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
-    privateAddressStpl1: recipientPrivateAddress,
+    privateAddressStpl1: parameters.recipientPrivateAddressStpl1.trim(),
     amountStroops: parameters.transferStroops,
     tokenAddress: parameters.tokenAddress,
     ...escrowOutputFields(escrow)
   });
-  if (parameters.changeStroops <= ZERO_STROOPS) {
-    return {
-      recipientSlot,
-      deposits: paddingDepositPair(recipientSlot.deposit)
-    };
-  }
-  const changeResult = await buildChangeDepositPair({
-    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+  const withoutFee = await depositsWithoutFee({
+    recipientDeposit: recipientSlot.deposit,
     changeStroops: parameters.changeStroops,
+    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+    tokenAddress: parameters.tokenAddress,
+    hasFeeOutput: (parameters.feeOutput?.requiredFee ?? ZERO_STROOPS) > ZERO_STROOPS
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: withoutFee.deposits,
     tokenAddress: parameters.tokenAddress,
-    recipientDeposit: recipientSlot.deposit
+    buildAlignedDepositSlot: (aligned) => getPrivacyPoolService().buildAlignedDepositSlot(aligned),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return {
     recipientSlot,
-    deposits: changeResult.deposits,
-    changeCoin: changeResult.changeCoin
+    deposits: withFee.deposits,
+    ..."changeCoin" in withoutFee ? { changeCoin: withoutFee.changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
   };
 }
 
@@ -2421,14 +2775,15 @@ function sweepOutputOwnerFields(parameters) {
   return { sweepOutputOwnerPubX, sweepOutputOwnerPubY };
 }
 async function buildTransferDepositsAndPublicInput(parameters) {
-  const { recipientSlot, deposits, changeCoin } = await buildRecipientAndOptionalChangeDeposits({
+  const { recipientSlot, deposits, changeCoin, feeCoin } = await buildRecipientAndOptionalChangeDeposits({
     recipientPrivateAddressStpl1: parameters.recipientPrivateAddressStpl1,
     transferStroops: parameters.transferStroops,
     changeStroops: parameters.changeStroops,
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = withTokenAddressPublicInputs(
     {
@@ -2443,6 +2798,7 @@ async function buildTransferDepositsAndPublicInput(parameters) {
     recipientSlot,
     deposits,
     ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {},
     publicInput
   };
 }
@@ -2458,7 +2814,8 @@ async function buildSenderTransferDepositsAndPublicInput(parameters) {
       parameters.senderPrivKeyScalarHex
     ),
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
 }
 
@@ -2482,11 +2839,20 @@ function stampDualWithdrawLegs(legs, parameters) {
     }
   };
 }
-function buildDualTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildDualTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId, applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 async function proveDualConfidentialTransfer(parameters) {
@@ -2506,16 +2872,24 @@ async function proveDualConfidentialTransfer(parameters) {
     audit
   );
 }
-async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+function dualTransferChangeStroops(parameters) {
   const totalNotes = BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value);
-  const changeStroops = changeStroopsAfterDualTransfer(
-    parameters.transferStroops,
-    totalNotes
-  );
+  if (parameters.transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
+    throw new Error("Transfer amount must be positive");
+  }
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: parameters.transferStroops,
+    requiredFee: parameters.feeOutput?.requiredFee ?? 0n
+  });
   requireChangeRecipientWhenPartial(
     changeStroops,
     parameters.selfPrivateAddressStpl1ForChange
   );
+  return changeStroops;
+}
+async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+  const changeStroops = dualTransferChangeStroops(parameters);
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.senderPrivKeyScalarHex
   );
@@ -2542,15 +2916,21 @@ async function buildDualTransferProofContext(parameters, applicationId, sdk) {
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     stateRoot: legA.witness.stateRoot,
-    ...confidentialEscrowFields(parameters)
+    ...confidentialEscrowFields(parameters),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return { legA, legB, applicationId, ...transferInputs };
 }
 async function prepareConfidentialTransferProofDual(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
-  const { legA, legB, recipientSlot, deposits, changeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
+  const { legA, legB, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
   const auditPublicKey = poolService.getAuditPublicKey();
   const proof = await (auditPublicKey ? proveDualConfidentialTransfer({
     sdk,
@@ -2573,7 +2953,8 @@ async function prepareConfidentialTransferProofDual(parameters) {
     applicationIdsPlaintext: buildDualTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -2581,22 +2962,32 @@ async function prepareConfidentialTransferProofDual(parameters) {
 }
 
 // src/transact/proofs/confidential/single.ts
-function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange) {
+function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange, requiredFee) {
   if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Transfer amount must be positive");
   }
-  if (transferStroops > noteStroops) {
-    throw new Error("Transfer amount exceeds note value");
-  }
-  const changeStroops = noteStroops - transferStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: transferStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl1ForChange);
   return changeStroops;
 }
-function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 function buildTransferAuditParameters(parameters) {
@@ -2622,11 +3013,25 @@ function confidentialEscrowFields2(input) {
     ...input.escrowClaimantLimbs ? { escrowClaimantLimbs: input.escrowClaimantLimbs } : {}
   };
 }
+function transferDepositInputFromProof(input, changeStroops, stateRoot) {
+  return {
+    senderPrivKeyScalarHex: input.senderPrivKeyScalarHex,
+    recipientPrivateAddressStpl1: input.recipientPrivateAddressStpl1,
+    transferStroops: input.transferStroops,
+    changeStroops,
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    tokenAddress: input.tokenAddress,
+    stateRoot,
+    ...confidentialEscrowFields2(input),
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  };
+}
 async function buildTransferProofInputs(parameters) {
   const changeStroops = validateSingleCoinTransferAmounts(
     parameters.input.transferStroops,
     parameters.noteStroops,
-    parameters.input.selfPrivateAddressStpl1ForChange
+    parameters.input.selfPrivateAddressStpl1ForChange,
+    parameters.input.feeOutput?.requiredFee ?? 0n
   );
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.input.senderPrivKeyScalarHex
@@ -2645,31 +3050,30 @@ async function buildTransferProofInputs(parameters) {
     withdrawObject,
     sweepWithdrawStamp(confidentialEscrowFields2(parameters.input))
   );
-  const { recipientSlot, deposits, changeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput({
-    senderPrivKeyScalarHex: parameters.input.senderPrivKeyScalarHex,
-    recipientPrivateAddressStpl1: parameters.input.recipientPrivateAddressStpl1,
-    transferStroops: parameters.input.transferStroops,
-    changeStroops,
-    selfPrivateAddressStpl1ForChange: parameters.input.selfPrivateAddressStpl1ForChange,
-    tokenAddress: parameters.input.tokenAddress,
-    stateRoot: witness.stateRoot,
-    ...confidentialEscrowFields2(parameters.input)
-  });
+  const { recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput(
+    transferDepositInputFromProof(parameters.input, changeStroops, witness.stateRoot)
+  );
   return {
     witness,
     withdrawObject: stampedWithdraw,
     recipientSlot,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput
   };
 }
 async function prepareConfidentialTransferProof(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
   const noteStroops = BigInt(parameters.coin.value);
-  const { withdrawObject, recipientSlot, deposits, changeCoin, publicInput } = await buildTransferProofInputs({
+  const { withdrawObject, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildTransferProofInputs({
     sdk,
     applicationId,
     input: parameters,
@@ -2692,7 +3096,8 @@ async function prepareConfidentialTransferProof(parameters) {
     applicationIdsPlaintext: buildSingleTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -2700,92 +3105,167 @@ async function prepareConfidentialTransferProof(parameters) {
 }
 
 // src/transact/merkle/fetch-contract.ts
+import { Buffer as Buffer14 } from "buffer";
+
+// src/transact/merkle/state-port.ts
+function poolMerkleStateToCachedView(state) {
+  return {
+    commitments: state.commitments,
+    updatedAt: state.updatedAt,
+    merkleRootHex: state.merkleRootHex
+  };
+}
+
+// src/transact/merkle/read-tree-leaves.ts
+import { Address as Address5, xdr as xdr6 } from "@stellar/stellar-sdk";
 import { Buffer as Buffer13 } from "buffer";
 
 // src/transact/merkle/encoding.ts
 import "buffer";
 var FR_ORDER = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001n;
-function bufferToDecimal(buf) {
+function commitmentBufferToDecimal(buf) {
   const hex = buf.toString("hex");
   const bigintFromHex = BigInt(`0x${hex}`);
   const reduced = bigintFromHex % FR_ORDER;
   return reduced.toString();
 }
-function commitmentsBuffersToDecimal(buffers) {
-  return buffers.map((bufferRow) => bufferToDecimal(bufferRow));
-}
 
-// src/transact/merkle/state-port.ts
-function poolMerkleStateToCachedView(state) {
-  return {
-    commitments: state.commitments,
-    updatedAt: state.updatedAt,
-    merkleRootHex: state.merkleRootHex
-  };
-}
-
-// src/transact/merkle/fetch-contract.ts
-function normalizeCommitmentBuffers(rawBuffers) {
-  return rawBuffers.map(
-    (bufferRow) => Buffer13.isBuffer(bufferRow) ? bufferRow : Buffer13.from(bufferRow)
+// src/transact/merkle/read-tree-leaves.ts
+var TREE_LEAF_LEDGER_BATCH_SIZE = 100;
+function treeLeafLedgerKey(contractId, leafIndex) {
+  return xdr6.LedgerKey.contractData(
+    new xdr6.LedgerKeyContractData({
+      contract: new Address5(contractId).toScAddress(),
+      key: treeLeafKeyScValue(leafIndex),
+      durability: xdr6.ContractDataDurability.persistent()
+    })
   );
 }
-function mergeContractMerkleWithCache(parameters) {
-  const cachedCount = parameters.cachedState?.commitments.length ?? 0;
-  const shouldPreferContract = parameters.contractCount > cachedCount || !parameters.cachedState || cachedCount === 0;
-  if (shouldPreferContract) {
-    const updatedAt = Date.now();
-    void parameters.poolMerkleState?.set({
-      poolContract: parameters.poolContractId,
-      commitments: parameters.contractCommitments,
-      commitmentCount: parameters.contractCount,
-      merkleRootHex: parameters.merkleRootHex,
-      updatedAt
-    });
-    return {
-      commitments: parameters.contractCommitments,
-      updatedAt,
-      merkleRootHex: parameters.merkleRootHex,
-      commitmentCount: parameters.contractCount
-    };
+function treeLeafKeyScValue(leafIndex) {
+  return xdr6.ScVal.scvVec([xdr6.ScVal.scvSymbol("Leaf"), xdr6.ScVal.scvU32(leafIndex)]);
+}
+function leafIndexFromContractDataKey(key) {
+  if (key.switch() !== xdr6.ScValType.scvVec()) {
+    return void 0;
   }
-  return {
-    commitments: parameters.cachedState.commitments,
-    updatedAt: parameters.cachedState.updatedAt,
-    merkleRootHex: parameters.cachedState.merkleRootHex ?? parameters.merkleRootHex,
-    commitmentCount: parameters.cachedState.commitments.length
-  };
+  const fields = key.vec();
+  if (!fields || fields.length !== 2) {
+    return void 0;
+  }
+  const [tag, indexValue] = fields;
+  if (!tag || tag.switch() !== xdr6.ScValType.scvSymbol()) {
+    return void 0;
+  }
+  if (tag.sym().toString() !== "Leaf") {
+    return void 0;
+  }
+  if (!indexValue || indexValue.switch() !== xdr6.ScValType.scvU32()) {
+    return void 0;
+  }
+  return indexValue.u32();
 }
-async function readCachedPoolMerkleView(poolMerkleState, poolContractId) {
-  if (!poolMerkleState) {
+function commitmentBytesFromContractDataValue(value) {
+  if (value.switch() !== xdr6.ScValType.scvBytes()) {
     return void 0;
   }
-  const cached = await poolMerkleState.get(poolContractId);
-  return cached ? poolMerkleStateToCachedView(cached) : void 0;
+  return Buffer13.from(value.bytes());
 }
+async function readTreeLeafCommitments(input) {
+  if (input.startIndex >= input.endIndex) {
+    return [];
+  }
+  const byIndex = await readLeafBuffersByIndex(input);
+  return decimalCommitmentsInRange(byIndex, input.startIndex, input.endIndex);
+}
+async function readLeafBuffersByIndex(input) {
+  const keys = ledgerKeysForRange(input.contractId, input.startIndex, input.endIndex);
+  const byIndex = /* @__PURE__ */ new Map();
+  for (const batch of chunkLedgerKeys(keys, TREE_LEAF_LEDGER_BATCH_SIZE)) {
+    const response = await input.reader.getLedgerEntries(...batch);
+    collectLeafBuffers(response.entries, byIndex);
+  }
+  return byIndex;
+}
+function ledgerKeysForRange(contractId, startIndex, endIndex) {
+  const keys = [];
+  for (let leafIndex = startIndex; leafIndex < endIndex; leafIndex += 1) {
+    keys.push(treeLeafLedgerKey(contractId, leafIndex));
+  }
+  return keys;
+}
+function chunkLedgerKeys(keys, batchSize) {
+  const batches = [];
+  for (let offset = 0; offset < keys.length; offset += batchSize) {
+    batches.push(keys.slice(offset, offset + batchSize));
+  }
+  return batches;
+}
+function collectLeafBuffers(entries, byIndex) {
+  for (const entry of entries) {
+    const contractData = entry.val.contractData();
+    const leafIndex = leafIndexFromContractDataKey(contractData.key());
+    const bytes = commitmentBytesFromContractDataValue(contractData.val());
+    if (leafIndex === void 0 || !bytes) {
+      continue;
+    }
+    byIndex.set(leafIndex, bytes);
+  }
+}
+function decimalCommitmentsInRange(byIndex, startIndex, endIndex) {
+  const commitments = [];
+  for (let leafIndex = startIndex; leafIndex < endIndex; leafIndex += 1) {
+    const bytes = byIndex.get(leafIndex);
+    if (!bytes) {
+      throw new Error(`Missing Merkle leaf ${String(leafIndex)} in pool storage.`);
+    }
+    commitments.push(commitmentBufferToDecimal(bytes));
+  }
+  return commitments;
+}
+
+// src/transact/merkle/reuse-cached-commitments.ts
+function completeCacheRootMatches(cachedState, merkleRootHex) {
+  const cachedRoot = cachedState?.merkleRootHex;
+  if (cachedRoot === void 0 || cachedRoot === "") {
+    return true;
+  }
+  return cachedRoot === merkleRootHex;
+}
+function reuseCachedCommitments(input) {
+  const cachedCommitments = input.cachedState?.commitments ?? [];
+  if (cachedCommitments.length === 0) {
+    return [];
+  }
+  if (cachedCommitments.length > input.onChainCount) {
+    return [];
+  }
+  if (cachedCommitments.length === input.onChainCount) {
+    return completeCacheRootMatches(input.cachedState, input.merkleRootHex) ? cachedCommitments : [];
+  }
+  return cachedCommitments;
+}
+
+// src/transact/merkle/fetch-contract.ts
 async function fetchAndMergeMerkleState(parameters) {
-  const client = readPoolClientFactory(parameters.transactEnvironment)({
-    contractId: parameters.poolContractId,
-    walletPublicKey: parameters.walletPublicKey,
-    networkPassphrase: parameters.transactEnvironment.network.networkPassphrase,
-    sorobanRpcUrl: parameters.transactEnvironment.network.rpcUrl
-  });
-  const commitmentsRead = await client.get_commitments();
-  const rawBuffers = commitmentsRead.result;
-  const buffers = normalizeCommitmentBuffers(rawBuffers);
-  const contractCommitments = commitmentsBuffersToDecimal(buffers);
-  const contractCount = contractCommitments.length;
+  const client = createPoolClient(parameters);
+  const countRead = await client.get_commitment_count();
+  const onChainCount = requireCommitmentCount(countRead.result);
   const rootRead = await client.get_merkle_root();
-  const merkleRootBuffer = rootRead.result;
-  const merkleRootHex = Buffer13.from(merkleRootBuffer).toString("hex");
+  const merkleRootHex = merkleRootToHex(rootRead.result);
   const cachedState = await readCachedPoolMerkleView(
     parameters.poolMerkleState,
     parameters.poolContractId
   );
-  return mergeContractMerkleWithCache({
+  const commitments = await loadCommitments({
+    cachedState,
+    onChainCount,
+    merkleRootHex,
+    rpcUrl: parameters.transactEnvironment.network.rpcUrl,
+    contractId: parameters.poolContractId
+  });
+  return persistFetchedMerkleState({
     poolContractId: parameters.poolContractId,
-    contractCommitments,
-    contractCount,
+    commitments,
     merkleRootHex,
     cachedState,
     ...parameters.poolMerkleState ? { poolMerkleState: parameters.poolMerkleState } : {}
@@ -2799,19 +3279,14 @@ async function readLeafEphemeralHex(parameters) {
   if (cached?.xHex && cached.yHex) {
     return { xHex: cached.xHex, yHex: cached.yHex };
   }
-  const client = readPoolClientFactory(parameters.transactEnvironment)({
-    contractId: parameters.poolContractId,
-    walletPublicKey: parameters.walletPublicKey,
-    networkPassphrase: parameters.transactEnvironment.network.networkPassphrase,
-    sorobanRpcUrl: parameters.transactEnvironment.network.rpcUrl
-  });
+  const client = createPoolClient(parameters);
   const read = await client.get_leaf_ephemeral({ leaf_index: parameters.leafIndex });
   const coords = read.result;
   if (!coords?.x || !coords?.y) {
     throw new Error("Missing leaf ephemeral key on contract");
   }
-  const xHex = Buffer13.from(coords.x).toString("hex");
-  const yHex = Buffer13.from(coords.y).toString("hex");
+  const xHex = Buffer14.from(coords.x).toString("hex");
+  const yHex = Buffer14.from(coords.y).toString("hex");
   await parameters.leafEphemeral?.set({
     poolContract: parameters.poolContractId,
     leafIndex: parameters.leafIndex,
@@ -2821,6 +3296,84 @@ async function readLeafEphemeralHex(parameters) {
   });
   return { xHex, yHex };
 }
+function createPoolClient(parameters) {
+  return readPoolClientFactory(parameters.transactEnvironment)({
+    contractId: parameters.poolContractId,
+    walletPublicKey: parameters.walletPublicKey,
+    networkPassphrase: parameters.transactEnvironment.network.networkPassphrase,
+    sorobanRpcUrl: parameters.transactEnvironment.network.rpcUrl
+  });
+}
+function requireCommitmentCount(result) {
+  if (typeof result === "number" && Number.isInteger(result) && result >= 0) {
+    return result;
+  }
+  throw new Error("Pool commitment count is not a non-negative integer.");
+}
+function merkleRootToHex(root) {
+  return Buffer14.from(root).toString("hex");
+}
+async function readCachedPoolMerkleView(poolMerkleState, poolContractId) {
+  if (!poolMerkleState) {
+    return void 0;
+  }
+  const cached = await poolMerkleState.get(poolContractId);
+  return cached ? poolMerkleStateToCachedView(cached) : void 0;
+}
+async function loadCommitments(input) {
+  const reused = reuseCachedCommitments({
+    cachedState: input.cachedState,
+    onChainCount: input.onChainCount,
+    merkleRootHex: input.merkleRootHex
+  });
+  if (reused.length === input.onChainCount) {
+    return reused;
+  }
+  const fetched = await readTreeLeafCommitments({
+    reader: createStellarRpcServer(input.rpcUrl),
+    contractId: input.contractId,
+    startIndex: reused.length,
+    endIndex: input.onChainCount
+  });
+  return [...reused, ...fetched];
+}
+async function persistFetchedMerkleState(input) {
+  const cachedState = input.cachedState;
+  if (cachedState && cachedMerkleUnchanged(cachedState, input.commitments, input.merkleRootHex)) {
+    return viewFromCachedMerkle(cachedState, input.merkleRootHex);
+  }
+  const updatedAt = Date.now();
+  await input.poolMerkleState?.set({
+    poolContract: input.poolContractId,
+    commitments: input.commitments,
+    commitmentCount: input.commitments.length,
+    merkleRootHex: input.merkleRootHex,
+    updatedAt
+  });
+  return {
+    commitments: input.commitments,
+    updatedAt,
+    merkleRootHex: input.merkleRootHex,
+    commitmentCount: input.commitments.length
+  };
+}
+function viewFromCachedMerkle(cachedState, merkleRootHex) {
+  return {
+    commitments: cachedState.commitments,
+    updatedAt: cachedState.updatedAt,
+    merkleRootHex: cachedState.merkleRootHex ?? merkleRootHex,
+    commitmentCount: cachedState.commitments.length
+  };
+}
+function cachedMerkleUnchanged(cachedState, commitments, merkleRootHex) {
+  if (!cachedState) {
+    return false;
+  }
+  if ((cachedState.merkleRootHex ?? merkleRootHex) !== merkleRootHex) {
+    return false;
+  }
+  return cachedState.commitments.join(",") === commitments.join(",");
+}
 
 // src/transact/encoding/fr-decimal-to-bytes.ts
 var BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
@@ -4921,10 +5474,10 @@ function readTransferFromPrivateAddress(from) {
 import { executionError, insufficientStateError as insufficientStateError2 } from "@arcanetech/privacy-sdk-core";
 
 // src/contracts/pool/pool-domain-service.ts
-import { Buffer as Buffer14 } from "buffer";
+import { Buffer as Buffer15 } from "buffer";
 function hexToBuffer(hex) {
   const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
-  return Buffer14.from(clean, "hex");
+  return Buffer15.from(clean, "hex");
 }
 async function readNullifierConsumedOnChain(input) {
   const client = input.contractContext.createPoolClient({
@@ -5109,7 +5662,12 @@ function proofEscrowFields(input) {
 }
 async function buildSingleTransferProofAtExecute(input) {
   const context = await buildSpendProofContextAtExecute(input);
-  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProof({
     coin: context.coin,
     state: { commitments: context.commitments },
@@ -5122,7 +5680,8 @@ async function buildSingleTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -5139,7 +5698,12 @@ async function buildDualTransferProofAtExecute(input) {
     commitments: context.commitments
   });
   const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = totalNotes - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
@@ -5157,7 +5721,8 @@ async function buildDualTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -5289,11 +5854,17 @@ async function runTransferFinalizeSteps(input) {
     walletPublicKey: input.walletPublicKey,
     ...recipient.escrowSend ? { escrowSendPrivateAddress: recipient.recipientPrivateAddressStpl1 } : {}
   });
-  return buildTransferFinalizeArtifacts({
-    proof,
-    context,
-    ...sweepFinalizeStamp(input.prepared, recipient)
-  });
+  return {
+    ...buildTransferFinalizeArtifacts({
+      proof,
+      context,
+      ...sweepFinalizeStamp(input.prepared, recipient)
+    }),
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      ...feeOutputKindFromPrepared(input.prepared),
+      ...configuredNonceSpread(input.environment.zkConfigNonce)
+    })
+  };
 }
 function sweepArtifactStamp(artifacts) {
   return {
@@ -5321,6 +5892,24 @@ async function finalizeTransferAtExecute(prepared, environment) {
   return runTransferFinalizeSteps({ prepared, environment, walletPublicKey });
 }
 
+// src/transact/engine/withdraw-fee.ts
+async function withdrawFeeProofFields(input) {
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: input.tokenAddress
+  });
+  const changeStroops = remainingAfterRequiredFee({
+    available: input.available,
+    instructed: input.prepared.intent.amount,
+    requiredFee: feeOutput?.requiredFee ?? 0n
+  });
+  return {
+    ...feeOutput ? { feeOutput } : {},
+    ...changeStroops > 0n ? { changePrivateAddressStpl1: input.withdrawFrom } : {}
+  };
+}
+
 // src/transact/engine/execute.ts
 function enrichWithdrawOutputRecords(prepared, proof) {
   if (!proof.changeCoin || prepared.outputRecords.length === 0) {
@@ -5336,7 +5925,7 @@ function enrichWithdrawOutputRecords(prepared, proof) {
     precommitementHex: changeCoin.precommitementHex
   }));
 }
-function buildWithdrawFinalizeArtifacts(proof, context) {
+function buildWithdrawFinalizeArtifacts(proof, context, environment) {
   return {
     proofHex: proof.proof_hex,
     publicHex: proof.public_hex,
@@ -5344,7 +5933,11 @@ function buildWithdrawFinalizeArtifacts(proof, context) {
     applicationIdsPlaintext: proof.applicationIdsPlaintext,
     tokenAddress: context.tokenAddress,
     walletPublicKey: context.walletPublicKey,
-    executeFinalizeRequired: false
+    executeFinalizeRequired: false,
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      kind: "withdraw",
+      ...configuredNonceSpread(environment.zkConfigNonce)
+    })
   };
 }
 async function finalizeSingleWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
@@ -5353,7 +5946,13 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
     environment,
     recipientPrivateAddressStpl1: withdrawFrom
   });
-  const changeStroops = BigInt(context.coin.value) - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProof({
     coin: context.coin,
     state: { commitments: context.commitments },
@@ -5364,11 +5963,24 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
       yHex: context.ephemeral.yHex
     }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
+}
+function dualWithdrawEphemeralKeys(input) {
+  return {
+    depositorEphemeralAKey: serializeEphemeralKeyString({
+      xHex: input.context.ephemeral.xHex,
+      yHex: input.context.ephemeral.yHex
+    }),
+    depositorEphemeralBKey: serializeEphemeralKeyString({
+      xHex: input.secondary.ephemeral.xHex,
+      yHex: input.secondary.ephemeral.yHex
+    })
+  };
 }
 async function finalizeDualWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
   const [, secondaryRecord] = prepared.consumedRecords;
@@ -5386,28 +5998,27 @@ async function finalizeDualWithdrawAtExecute(prepared, environment, poolService,
     walletPublicKey: context.walletPublicKey,
     commitments: context.commitments
   });
-  const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value) + BigInt(secondary.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
     state: { commitments: context.commitments },
     destinationStellarAddress: prepared.intent.to,
     privKeyScalarHex: context.senderPrivKeyScalarHex,
-    depositorEphemeralAKey: serializeEphemeralKeyString({
-      xHex: context.ephemeral.xHex,
-      yHex: context.ephemeral.yHex
-    }),
-    depositorEphemeralBKey: serializeEphemeralKeyString({
-      xHex: secondary.ephemeral.xHex,
-      yHex: secondary.ephemeral.yHex
-    }),
+    ...dualWithdrawEphemeralKeys({ context, secondary }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
 }
 async function finalizeWithdrawAtExecute(prepared, environment, poolService) {
   if (prepared.kind !== "withdraw") {
@@ -5471,7 +6082,7 @@ var RELAY_SIGNAL_INDEX_PUBLIC_DEPOSIT = 91;
 var RELAY_SIGNAL_INDEX_PUBLIC_WITHDRAWAL = 92;
 
 // src/transact/relay/signals.ts
-import { Buffer as Buffer15 } from "buffer";
+import { Buffer as Buffer16 } from "buffer";
 
 // src/transact/relay/layout-profile.ts
 var FIELD_BYTES = 32;
@@ -5551,7 +6162,7 @@ function relayLayoutProfileForNonce(nonce) {
 
 // src/transact/relay/signals.ts
 function decodePublicSignalBytes(publicSignals) {
-  return Buffer15.from(publicSignals.replace(/^0x/iu, ""), "hex");
+  return Buffer16.from(publicSignals.replace(/^0x/iu, ""), "hex");
 }
 function hasSupportedLengthPrefix(bytes, signalCount) {
   const expected = RELAY_TRANSACT_SIGNAL_PREFIX_BYTES + signalCount * RELAY_TRANSACT_FIELD_BYTES;
@@ -5578,7 +6189,7 @@ function sliceSupportedPublicSignalFields(publicSignals, zkConfigNonce = DEFAULT
   const body = hasSupportedLengthPrefix(bytes, profile.signalCount) ? bytes.subarray(RELAY_TRANSACT_SIGNAL_PREFIX_BYTES) : bytes;
   return Array.from(
     { length: profile.signalCount },
-    (_unused, index) => Buffer15.from(
+    (_unused, index) => Buffer16.from(
       body.subarray(
         index * RELAY_TRANSACT_FIELD_BYTES,
         (index + 1) * RELAY_TRANSACT_FIELD_BYTES
@@ -5633,10 +6244,11 @@ function requirePreparedArtifacts(prepared) {
   };
 }
 function prepareRelayTransactPackageFromPrepared(input) {
+  const zkConfigNonce = input.zkConfigNonce ?? input.prepared.transactArtifacts?.zkConfigNonce;
   return prepareRelayTransactPackage({
     poolSelector: input.poolSelector,
     ...requirePreparedArtifacts(input.prepared),
-    ...input.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.zkConfigNonce },
+    ...zkConfigNonce === void 0 ? {} : { zkConfigNonce },
     ...input.keyVersionHints ? { keyVersionHints: input.keyVersionHints } : {}
   });
 }
@@ -5746,6 +6358,7 @@ function requiredSubmissionMethod(prepared, zkConfigNonce = DEFAULT_ZK_CONFIG_NO
   return result.method;
 }
 export {
+  BINDING_ZK_NONCE,
   BundledZkCircuit2 as BundledZkCircuit,
   COMMITMENT_V2_ZK_NONCE,
   DEFAULT_STEALTH_SIGN_NONCE as DEFAULT_PRIVATE_ADDRESS_SIGN_NONCE,
@@ -5774,6 +6387,7 @@ export {
   RELAY_TRANSACT_PACKAGE_VERSION_V1,
   RELAY_TRANSACT_SIGNAL_PREFIX_BYTES,
   RELAY_TRANSACT_SUPPORTED_SIGNAL_COUNT,
+  SIX_BY_SIX_BINDING_ZK_NONCE,
   SIX_BY_SIX_ZK_NONCE,
   STANDARD_ZK_CONFIG_NONCE,
   SUBMISSION_METHOD,