@arcanetech/privacy-sdk-stellar 0.5.2 → 0.6.1

package/dist/transact/index.js

@@ -1,26 +1,8 @@
 // src/transact/pool/service.ts
 import {
-  PrivacyPoolSDK as PrivacyPoolSDK2,
-  decodeDecodedEphemeralKey,
-  randomFrDecimal253,
-  scalarHexToFrDecimal as scalarHexToFrDecimal2
+  decodeDecodedEphemeralKey
 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
-// src/transact/merkle/field-decimal.ts
-import { Buffer as Buffer2 } from "buffer";
-var BN254 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
-var MERKLE_ROOT_BYTE_LENGTH = 32;
-var DECIMAL_STRING_RADIX = 10;
-function merkleRootBufferToFrDecimal(root) {
-  if (root.length !== MERKLE_ROOT_BYTE_LENGTH) {
-    throw new Error(
-      `expected ${MERKLE_ROOT_BYTE_LENGTH}-byte merkle root, got ${root.length}`
-    );
-  }
-  const hex = Buffer2.from(root).toString("hex");
-  return (BigInt(`0x${hex}`) % BN254).toString(DECIMAL_STRING_RADIX);
-}
-
 // src/transact/private-address/codec.ts
 import {
   buildStealthAddressSignMessage,
@@ -76,18 +58,18 @@ function privateAddressSdk(sdk) {
 import { withdrawObjectFromMerkleWitness as withdrawObjectFromMerkleWitness2 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
 // src/transact/proofs/transaction-input.ts
-import { Buffer as Buffer4 } from "buffer";
+import { Buffer as Buffer3 } from "buffer";
 import { StrKey as StrKey2 } from "@stellar/stellar-sdk";
 
 // src/transact/stellar/token-contract.ts
-import { Buffer as Buffer3 } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import { StrKey } from "@stellar/stellar-sdk";
 var CONTRACT_ID_BYTE_LENGTH = 32;
 var HEX_CHARS_PER_BYTE = 2;
 var CONTRACT_ID_HEX_CHAR_LENGTH = CONTRACT_ID_BYTE_LENGTH * HEX_CHARS_PER_BYTE;
 var CONTRACT_ID_HEX = /^(?:0x)?([0-9a-f]{64})$/i;
 function encodeContractFromHex(hexPayload) {
-  return StrKey.encodeContract(Buffer3.from(hexPayload, "hex"));
+  return StrKey.encodeContract(Buffer2.from(hexPayload, "hex"));
 }
 function normalizeSorobanContractId(raw) {
   const trimmed = raw.trim();
@@ -120,14 +102,14 @@ var ZERO_PUBLIC_WITHDRAW_ADDRESS = {
 var CONTRACT_ADDRESS_HALF_BYTES = 16;
 var CONTRACT_ADDRESS_BYTES = 32;
 function bytes16ToDecimal(bytes) {
-  return BigInt(`0x${Buffer4.from(bytes).toString("hex")}`).toString();
+  return BigInt(`0x${Buffer3.from(bytes).toString("hex")}`).toString();
 }
 function decimalToBytes16(value) {
   const hex = BigInt(value).toString(16).padStart(CONTRACT_ADDRESS_HALF_BYTES * 2, "0");
   if (hex.length > CONTRACT_ADDRESS_HALF_BYTES * 2) {
     throw new Error("Asset leg does not fit into 16 bytes.");
   }
-  return Buffer4.from(hex, "hex");
+  return Buffer3.from(hex, "hex");
 }
 function tokenAddressFrParts(tokenAddress) {
   const normalized = resolveTokenContractId(tokenAddress);
@@ -169,7 +151,7 @@ function tokenAddressToAssetLeg(tokenAddress) {
   return [hi, lo];
 }
 function assetLegToTokenAddress(assetHi, assetLo) {
-  const payload = Buffer4.concat([decimalToBytes16(assetHi), decimalToBytes16(assetLo)]);
+  const payload = Buffer3.concat([decimalToBytes16(assetHi), decimalToBytes16(assetLo)]);
   return StrKey2.encodeContract(payload);
 }
 function buildZeroPublicLegs(publicNInputs = 1, publicNOutputs = 1) {
@@ -246,11 +228,240 @@ function uniformApplicationIdHints(applicationId, nAuditSlots) {
 
 // src/transact/proofs/confidential/helpers.ts
 import { withdrawObjectFromMerkleWitness } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+
+// src/transact/merkle/lean-imt-api.ts
+function asLeanImtSessionApi(sdk) {
+  const candidate = sdk;
+  if (typeof candidate.importLeanImtFromState !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.insertTwoLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.exportLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.dropLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.buildWithdrawMerkleWitnessFromHandle !== "function") {
+    return void 0;
+  }
+  return candidate;
+}
+
+// src/transact/merkle/field-decimal.ts
+import { Buffer as Buffer4 } from "buffer";
+var BN254 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var MERKLE_ROOT_BYTE_LENGTH = 32;
+var DECIMAL_STRING_RADIX = 10;
+function merkleRootBufferToFrDecimal(root) {
+  if (root.length !== MERKLE_ROOT_BYTE_LENGTH) {
+    throw new Error(
+      `expected ${MERKLE_ROOT_BYTE_LENGTH}-byte merkle root, got ${root.length}`
+    );
+  }
+  const hex = Buffer4.from(root).toString("hex");
+  return (BigInt(`0x${hex}`) % BN254).toString(DECIMAL_STRING_RADIX);
+}
+var MERKLE_ROOT_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
+function merkleRootHexToFrDecimal(merkleRootHex) {
+  const trimmed = merkleRootHex.trim();
+  if (!MERKLE_ROOT_HEX_PATTERN.test(trimmed)) {
+    return void 0;
+  }
+  return merkleRootBufferToFrDecimal(Buffer4.from(trimmed, "hex"));
+}
+
+// src/transact/merkle/state-file.ts
+function merkleSnapshotToStateFile(input) {
+  const root = merkleRootHexToFrDecimal(input.merkleRootHex);
+  const nodes = input.nodes;
+  if (!nodes || nodes.length === 0 || root === void 0) {
+    return { commitments: input.commitments };
+  }
+  return {
+    commitments: input.commitments,
+    nodes,
+    root
+  };
+}
+
+// src/transact/merkle/extend-snapshot.ts
+function isEvenLeafCount(count) {
+  return count % 2 === 0;
+}
+function importHandle(sdk, state) {
+  try {
+    return sdk.importLeanImtFromState(state);
+  } catch {
+    return void 0;
+  }
+}
+function insertNewPairs(input) {
+  for (let index = input.prefixLength; index < input.commitments.length; index += 2) {
+    const leafA = input.commitments.at(index);
+    const leafB = input.commitments.at(index + 1);
+    if (leafA === void 0 || leafB === void 0) {
+      return false;
+    }
+    try {
+      input.sdk.insertTwoLeanImt(input.handle, leafA, leafB);
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function snapshotNodes(sdk, handle) {
+  try {
+    return sdk.exportLeanImt(handle).nodes;
+  } catch {
+    return void 0;
+  }
+}
+function prefixSnapshotState(input) {
+  const prefixLength = input.cachedState?.nodes ? input.cachedState.commitments.length : 0;
+  return merkleSnapshotToStateFile({
+    commitments: input.commitments.slice(0, prefixLength),
+    merkleRootHex: input.cachedState?.merkleRootHex ?? input.merkleRootHex,
+    ...input.cachedState?.nodes ? { nodes: input.cachedState.nodes } : {}
+  });
+}
+function importSnapshotState(input) {
+  if (input.prefixState.nodes && input.prefixState.commitments.length > 0) {
+    return input.prefixState;
+  }
+  return merkleSnapshotToStateFile({
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex
+  });
+}
+function exportExtendedNodes(input) {
+  const inserted = input.prefixState.nodes ? insertNewPairs({
+    sdk: input.sdk,
+    handle: input.handle,
+    prefixLength: input.prefixState.commitments.length,
+    commitments: input.commitments
+  }) : true;
+  if (!inserted) {
+    input.sdk.dropLeanImt(input.handle);
+    return void 0;
+  }
+  const nodes = snapshotNodes(input.sdk, input.handle);
+  if (!nodes) {
+    input.sdk.dropLeanImt(input.handle);
+  }
+  return nodes;
+}
+function extendMerkleSnapshotNodes(input) {
+  if (!isEvenLeafCount(input.commitments.length)) {
+    return {};
+  }
+  const prefixState = prefixSnapshotState(input);
+  const handle = importHandle(
+    input.sdk,
+    importSnapshotState({ ...input, prefixState })
+  );
+  if (handle === void 0) {
+    return {};
+  }
+  const nodes = exportExtendedNodes({
+    sdk: input.sdk,
+    handle,
+    prefixState,
+    commitments: input.commitments
+  });
+  if (!nodes) {
+    return {};
+  }
+  return { nodes, handle };
+}
+
+// src/transact/merkle/tree-session.ts
+var merkleSdkHost;
+function registerMerkleSessionSdkHost(host) {
+  merkleSdkHost = host;
+}
+async function loadSessionSdk() {
+  const host = merkleSdkHost;
+  if (typeof host?.getInitializedSdk !== "function") {
+    return void 0;
+  }
+  try {
+    return asLeanImtSessionApi(await host.getInitializedSdk());
+  } catch {
+    return void 0;
+  }
+}
+var sessionsByPool = /* @__PURE__ */ new Map();
+var handlesByKey = /* @__PURE__ */ new Map();
+function merkleSessionKey(state) {
+  const root = state.root?.trim();
+  if (root) {
+    return `${state.commitments.length}:${root}`;
+  }
+  const first = state.commitments[0] ?? "";
+  const last = state.commitments.at(-1) ?? "";
+  return `${state.commitments.length}:${first}:${last}`;
+}
+function rememberHandle(poolContract, key, handle) {
+  const existing = sessionsByPool.get(poolContract);
+  if (existing && existing.handle !== handle) {
+    handlesByKey.delete(existing.key);
+  }
+  sessionsByPool.set(poolContract, { handle, key });
+  handlesByKey.set(key, handle);
+}
+function merkleTreeHandleForState(state) {
+  return handlesByKey.get(merkleSessionKey(state));
+}
+function bindImportedMerkleTree(input) {
+  rememberHandle(input.poolContract, merkleSessionKey(input.state), input.handle);
+}
+async function resolveExtendedMerkleNodes(input) {
+  const cached = input.cachedState;
+  if (cached && cached.commitments.length === input.commitments.length && cached.merkleRootHex === input.merkleRootHex) {
+    return cached.nodes;
+  }
+  const sdk = await loadSessionSdk();
+  if (!sdk) {
+    return void 0;
+  }
+  const extended = extendMerkleSnapshotNodes({
+    sdk,
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex,
+    ...cached ? { cachedState: cached } : {}
+  });
+  if (extended.handle !== void 0) {
+    bindImportedMerkleTree({
+      poolContract: input.poolContract,
+      handle: extended.handle,
+      state: merkleSnapshotToStateFile({
+        commitments: input.commitments,
+        merkleRootHex: input.merkleRootHex,
+        ...extended.nodes ? { nodes: extended.nodes } : {}
+      })
+    });
+  }
+  return extended.nodes;
+}
+function withdrawMerkleWitnessFromTree(input) {
+  const session = asLeanImtSessionApi(input.sdk);
+  const handle = merkleTreeHandleForState(input.state);
+  if (session && handle !== void 0) {
+    return session.buildWithdrawMerkleWitnessFromHandle(input.coin, handle);
+  }
+  return input.sdk.buildWithdrawMerkleWitness(input.coin, input.state);
+}
+
+// src/transact/proofs/confidential/helpers.ts
 var MIN_CONFIDENTIAL_TRANSFER_STROOPS = 1n;
 var ZERO_STROOPS = 0n;
 function withdrawWitnessForCoin(parameters) {
   const { sdk, coin, state } = parameters;
-  const witness = sdk.buildWithdrawMerkleWitness(coin, state);
+  const witness = withdrawMerkleWitnessFromTree({ sdk, coin, state });
   const withdrawApplicationId = coin.application_id ?? parameters.applicationId;
   const withdrawObject = withdrawObjectFromMerkleWitness(
     witness,
@@ -292,14 +503,144 @@ function requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl
     }
   }
 }
-function changeStroopsAfterDualTransfer(transferStroops, totalNotes) {
-  if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
-    throw new Error("Transfer amount must be positive");
+
+// src/transact/fees/quote-request-body.ts
+function presentInstructedAmount(amount) {
+  const trimmed = amount?.trim() ?? "";
+  if (!trimmed || trimmed === "0") {
+    return void 0;
   }
-  if (transferStroops > totalNotes) {
-    throw new Error("Transfer amount exceeds combined note value");
+  return trimmed;
+}
+function feeQuoteRequestBody(request) {
+  const publicDepositAmount = presentInstructedAmount(request.publicDepositAmount);
+  const transferInstructedAmount = presentInstructedAmount(
+    request.transferInstructedAmount
+  );
+  const publicWithdrawalAmount = presentInstructedAmount(
+    request.publicWithdrawalAmount
+  );
+  return {
+    feeAsset: request.feeAsset,
+    spendsNotes: request.spendsNotes,
+    ...publicDepositAmount === void 0 ? {} : { publicDepositAmount },
+    ...transferInstructedAmount === void 0 ? {} : { transferInstructedAmount },
+    ...publicWithdrawalAmount === void 0 ? {} : { publicWithdrawalAmount }
+  };
+}
+
+// src/transact/fees/quote-required-fee.ts
+function quoteHeaders(inspectAuthorization) {
+  const token = inspectAuthorization?.trim();
+  return {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+}
+function parseRequiredFee(raw) {
+  const text = `${raw ?? ""}`.trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error("Fee Quote Required Fee must be an integer minor-unit string.");
+  }
+  return BigInt(text);
+}
+function requireQuoteString(raw, field) {
+  const text = `${raw ?? ""}`.trim();
+  if (!text) {
+    throw new Error(`Fee Quote is missing ${field}.`);
+  }
+  return text;
+}
+function parseQuotePayload(payload) {
+  return {
+    requiredFee: parseRequiredFee(payload.requiredFee),
+    feeAsset: requireQuoteString(payload.feeAsset, "Fee Asset"),
+    feeCollectorPrivateAddress: requireQuoteString(
+      payload.feeCollectorPrivateAddress,
+      "Fee Collector Private Address"
+    ),
+    feeRate: requireQuoteString(payload.feeRate, "Fee Rate")
+  };
+}
+async function quoteRequiredFee(input) {
+  const response = await fetch(
+    `${input.transactEnvironment.kyt.apiBaseUrl}/kyt/fees/quote`,
+    {
+      method: "POST",
+      headers: quoteHeaders(input.transactEnvironment.kyt.inspectAuthorization),
+      body: JSON.stringify(feeQuoteRequestBody(input.request))
+    }
+  );
+  const payload = await response.json();
+  if (!response.ok) {
+    throw new Error(`Fee Quote failed: ${JSON.stringify(payload)}`);
+  }
+  return parseQuotePayload(payload);
+}
+
+// src/transact/fees/should-attach-fee-output.ts
+function shouldAttachFeeOutput(input) {
+  if (input.spendSource === "escrow" && input.escrowSend !== true) {
+    return false;
   }
-  return totalNotes - transferStroops;
+  return input.kind === "deposit" || input.kind === "transfer" || input.kind === "withdraw";
+}
+function feeOutputKindFromPrepared(prepared) {
+  return {
+    kind: prepared.kind,
+    ...prepared.transactArtifacts?.spendSource ? { spendSource: prepared.transactArtifacts.spendSource } : {},
+    ...prepared.transactArtifacts?.escrowSend ? { escrowSend: true } : {}
+  };
+}
+
+// src/transact/fees/quote-fee-output-for-prepared.ts
+function instructedMinorUnits(prepared) {
+  return prepared.intent.amount.toString();
+}
+function quoteRequestForPrepared(input) {
+  const amount = instructedMinorUnits(input.prepared);
+  if (input.prepared.kind === "deposit") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicDepositAmount: amount,
+      spendsNotes: false
+    };
+  }
+  if (input.prepared.kind === "withdraw") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicWithdrawalAmount: amount,
+      spendsNotes: true
+    };
+  }
+  return {
+    feeAsset: input.tokenAddress,
+    transferInstructedAmount: amount,
+    spendsNotes: true
+  };
+}
+async function quoteFeeOutputForPrepared(input) {
+  if (!shouldAttachFeeOutput(feeOutputKindFromPrepared(input.prepared))) {
+    return void 0;
+  }
+  const quote = await quoteRequiredFee({
+    transactEnvironment: input.environment,
+    request: quoteRequestForPrepared(input)
+  });
+  if (quote.requiredFee <= 0n) {
+    return void 0;
+  }
+  return {
+    requiredFee: quote.requiredFee,
+    feeCollectorPrivateAddress: quote.feeCollectorPrivateAddress
+  };
+}
+function remainingAfterRequiredFee(input) {
+  const remaining = input.available - input.instructed - input.requiredFee;
+  if (remaining < 0n) {
+    throw new Error("Instructed amount and Required Fee exceed available note value");
+  }
+  return remaining;
 }
 
 // src/transact/audit/parameters.ts
@@ -440,6 +781,32 @@ function privKeyScalarDecimalFromRecipientScalarHex(hexInput) {
   return canonicalBabyJubScalarFromInteger(value).toString(DECIMAL_RADIX2);
 }
 
+// src/transact/fees/append-fee-output.ts
+function feeCoinFromSlot(slot) {
+  return {
+    commitment_hex: slot.commitment_hex,
+    coin: slot.coin,
+    depositScalarHex: slot.depositScalarHex,
+    precommitementHex: slot.precommitementHex
+  };
+}
+async function appendFeeOutputSlot(input) {
+  const requiredFee = input.feeOutput?.requiredFee ?? ZERO_STROOPS;
+  const collector = input.feeOutput?.feeCollectorPrivateAddress.trim() ?? "";
+  if (requiredFee <= ZERO_STROOPS || !collector) {
+    return { deposits: input.deposits };
+  }
+  const slot = await input.buildAlignedDepositSlot({
+    privateAddressStpl1: collector,
+    amountStroops: requiredFee,
+    tokenAddress: input.tokenAddress
+  });
+  return {
+    deposits: [...input.deposits, slot.deposit],
+    feeCoin: feeCoinFromSlot(slot)
+  };
+}
+
 // src/transact/proofs/withdraw/helpers.ts
 function destinationWithdrawFrAndScalar(parameters) {
   const pkHex = ed25519PublicKeyHexFromStellarAccount(
@@ -494,14 +861,15 @@ async function resolveWithdrawChangeDeposits(parameters) {
     }
   };
 }
-function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1) {
+function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > totalNotes) {
-    throw new Error("Withdraw amount exceeds combined note value");
-  }
-  const changeStroops = totalNotes - withdrawAmountStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, changePrivateAddressStpl1);
   return changeStroops;
 }
@@ -514,11 +882,31 @@ function buildDualWithdrawPublicInput(parameters) {
     publicWithdrawalAmount: parameters.publicWithdrawalAmount
   });
 }
+async function withdrawOutputsWithOptionalFee(parameters) {
+  const { deposits: changeDeposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: changeDeposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
+  };
+}
 async function prepareDualWithdrawProofInputs(parameters) {
   const changeStroops = validateDualWithdrawAmounts(
     parameters.withdrawAmountStroops,
     BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value),
-    parameters.changePrivateAddressStpl1
+    parameters.changePrivateAddressStpl1,
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { legA, legB } = dualWithdrawLegsWithSharedRoot({
     sdk: parameters.sdk,
@@ -533,11 +921,12 @@ async function prepareDualWithdrawProofInputs(parameters) {
     ),
     applicationId: parameters.applicationId
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawOutputsWithOptionalFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildDualWithdrawPublicInput({
     destinationStellarAddress: parameters.destinationStellarAddress,
@@ -556,19 +945,55 @@ async function prepareDualWithdrawProofInputs(parameters) {
     audit,
     deposits,
     withdrawLegs: [legA.withdrawObject, legB.withdrawObject],
-    ...changeCoin ? { changeCoin } : {}
+    ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {}
   };
 }
 
+// src/transact/proofs/withdraw/fee-deposits.ts
+async function withdrawDepositsWithFee(parameters) {
+  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
+  };
+}
+function withdrawOutputApplicationIds(input) {
+  const outputIds = [];
+  if (input.hasChange) {
+    outputIds.push(input.applicationId);
+  }
+  if (input.hasFeeOutput) {
+    outputIds.push(input.applicationId);
+  }
+  if (outputIds.length === 0) {
+    outputIds.push("0");
+  }
+  return outputIds;
+}
+
 // src/transact/proofs/withdraw/transact-proof.ts
-function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops) {
+function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > noteStroops) {
-    throw new Error("Withdraw amount exceeds note value");
-  }
-  return noteStroops - withdrawAmountStroops;
+  return remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
 }
 async function proveSingleWithdrawTransaction(parameters) {
   return parameters.sdk.proveTransaction(
@@ -586,10 +1011,11 @@ async function proveSingleWithdrawTransaction(parameters) {
   );
 }
 function buildPrimaryWithdrawForCoin(parameters) {
-  const witness = parameters.sdk.buildWithdrawMerkleWitness(
-    parameters.coin,
-    parameters.state
-  );
+  const witness = withdrawMerkleWitnessFromTree({
+    sdk: parameters.sdk,
+    coin: parameters.coin,
+    state: parameters.state
+  });
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.privKeyScalarHex
   );
@@ -607,7 +1033,8 @@ function buildPrimaryWithdrawForCoin(parameters) {
 async function prepareSingleWithdrawProofInputs(parameters) {
   const changeStroops = validateSingleWithdrawAmounts(
     parameters.withdrawAmountStroops,
-    BigInt(parameters.coin.value)
+    BigInt(parameters.coin.value),
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { witness, primaryWithdraw } = buildPrimaryWithdrawForCoin({
     sdk: parameters.sdk,
@@ -616,11 +1043,12 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     state: parameters.state,
     privKeyScalarHex: parameters.privKeyScalarHex
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawDepositsWithFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildWithdrawPublicInput({
     stateRoot: witness.stateRoot,
@@ -633,6 +1061,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     primaryWithdraw,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput,
     audit: buildPoolTransactionAuditParameters({
       applicationId: parameters.applicationId,
@@ -642,7 +1071,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
   };
 }
 async function proveWithdrawTransact(parameters) {
-  const { primaryWithdraw, deposits, changeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
+  const { primaryWithdraw, deposits, changeCoin, feeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
   const proof = await proveSingleWithdrawTransaction({
     sdk: parameters.sdk,
     publicInput,
@@ -657,13 +1086,17 @@ async function proveWithdrawTransact(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [parameters.applicationId],
-      outputIds: [changeCoin ? parameters.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: parameters.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
 }
 async function proveWithdrawTransactDual(parameters) {
-  const { publicInput, audit, withdrawLegs, deposits, changeCoin } = await prepareDualWithdrawProofInputs(parameters);
+  const { publicInput, audit, withdrawLegs, deposits, changeCoin, feeCoin } = await prepareDualWithdrawProofInputs(parameters);
   const proof = await parameters.sdk.proveTransaction(
     publicInput,
     padPublicLegsToLayout(
@@ -682,7 +1115,11 @@ async function proveWithdrawTransactDual(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [audit.applicationId, audit.applicationId],
-      outputIds: [changeCoin ? audit.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: audit.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
@@ -706,6 +1143,9 @@ var DEFAULT_ZK_CONFIG_NONCE = BINDING_ZK_NONCE;
 function resolveZkConfigNonce(transactEnvironment) {
   return transactEnvironment.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
 }
+function transactNonceFromArtifacts(artifacts, transactEnvironment) {
+  return artifacts?.zkConfigNonce ?? resolveZkConfigNonce(transactEnvironment);
+}
 
 // src/transact/zk/browser-artifact-cache.ts
 import { ZK_ARTIFACT_VERSION } from "@arcanetech/stellar-privacy-pool-zk-sdk";
@@ -958,6 +1398,105 @@ async function buildAlignedDepositSlotForSdk(sdk, applicationId, parameters) {
   };
 }
 
+// src/transact/pool/initialize-sdk.ts
+import { PrivacyPoolSDK as PrivacyPoolSDK2 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+async function initializePrivacyPoolSdk(input, nonce) {
+  const zkConfigNonce = nonce ?? input.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+  const zkCircuits = await materializeSelectedZkCircuit(
+    input.zkCircuits,
+    zkConfigNonce,
+    input.zkArtifactBaseUrl
+  );
+  return PrivacyPoolSDK2.init({
+    wasmBinary: input.assets.sdkWasm,
+    zkCircuits,
+    zkConfigNonce,
+    ...optionalZkArtifactBaseUrl(input.zkArtifactBaseUrl)
+  });
+}
+
+// src/transact/fees/zk-config-nonce-for-kind.ts
+function configuredNonceSpread(zkConfigNonce) {
+  if (zkConfigNonce === void 0) {
+    return {};
+  }
+  return { configuredNonce: zkConfigNonce };
+}
+function zkConfigNonceForFeeBearingKind(input) {
+  if (input.configuredNonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  if (input.kind === "transfer" && shouldAttachFeeOutput(input)) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  return input.configuredNonce ?? BINDING_ZK_NONCE;
+}
+
+// src/transact/pool/prepare-deposit-proof.ts
+import {
+  randomFrDecimal253,
+  scalarHexToFrDecimal as scalarHexToFrDecimal2
+} from "@arcanetech/stellar-privacy-pool-zk-sdk";
+function userDepositSlot(input) {
+  return {
+    value: input.coin.value,
+    nullifier: input.coin.nullifier,
+    ephemeralKeyScalar: scalarHexToFrDecimal2(input.depositScalarHex),
+    asset: [input.coin.asset_hi, input.coin.asset_lo],
+    applicationId: input.applicationId,
+    recipientPublicKeys: recipientPublicKeysDecimalFromPrivateAddress(
+      input.privateAddressStpl1
+    )
+  };
+}
+function outputApplicationIds(input) {
+  if (input.hasFeeOutput) {
+    return [input.applicationId, input.applicationId];
+  }
+  return [input.applicationId];
+}
+async function proveDepositTransact(input) {
+  const publicDeposit = (input.publicDepositStroops ?? BigInt(input.coin.value)).toString();
+  const withFee = await appendFeeOutputSlot({
+    deposits: [userDepositSlot(input)],
+    tokenAddress: input.tokenAddress,
+    buildAlignedDepositSlot: input.buildAlignedDepositSlot,
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  });
+  const audit = buildPoolTransactionAuditParameters({
+    applicationId: input.applicationId,
+    nAuditSlots: input.sdk.getLayout().nAuditSlots,
+    ...input.auditPublicKey ? { auditPublicKey: input.auditPublicKey } : {}
+  });
+  const proof = await input.sdk.proveTransaction(
+    withTokenAddressPublicInputs(
+      {
+        stateRoot: merkleRootBufferToFrDecimal(input.merkleRootBytes),
+        privKeyScalar: randomFrDecimal253()
+      },
+      input.tokenAddress
+    ),
+    padPublicLegsToLayout(
+      input.sdk,
+      buildPublicDepositLegs(input.tokenAddress, publicDeposit)
+    ),
+    padWithdrawSlotsToLayout(input.sdk, []),
+    padDepositSlotsToLayout(input.sdk, withFee.deposits),
+    audit
+  );
+  return {
+    ...proof,
+    applicationIdsPlaintext: buildApplicationIdHints({
+      sdk: input.sdk,
+      inputIds: [],
+      outputIds: outputApplicationIds({
+        applicationId: input.applicationId,
+        hasFeeOutput: Boolean(withFee.feeCoin)
+      })
+    })
+  };
+}
+
 // src/transact/pool/service.ts
 var PrivacyPoolService = class {
   constructor(assets, applicationId, auditPublicKey, zkCircuits, zkConfigNonce, zkArtifactBaseUrl) {
@@ -974,42 +1513,50 @@ var PrivacyPoolService = class {
   zkCircuits;
   zkConfigNonce;
   zkArtifactBaseUrl;
-  sdk = void 0;
-  initPromise = void 0;
-  async ensureInit() {
-    if (this.sdk) {
-      return;
+  sdks = /* @__PURE__ */ new Map();
+  initPromises = /* @__PURE__ */ new Map();
+  async getInitializedSdk(nonce) {
+    const zkConfigNonce = nonce ?? this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+    const key = zkConfigNonce.toString();
+    const existing = this.sdks.get(key);
+    if (existing) {
+      return existing;
     }
-    if (this.initPromise) {
-      return this.initPromise;
+    const pending = this.initPromises.get(key);
+    if (pending) {
+      return pending;
     }
-    this.initPromise = (async () => {
-      if (!this.assets) {
-        throw new Error(
-          "PrivacyPoolService requires browser ZK assets before initialization."
-        );
-      }
-      const zkConfigNonce = this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
-      const zkCircuits = await materializeSelectedZkCircuit(
-        this.zkCircuits,
-        zkConfigNonce,
-        this.zkArtifactBaseUrl
-      );
-      this.sdk = await PrivacyPoolSDK2.init({
-        wasmBinary: this.assets.sdkWasm,
-        zkCircuits,
-        zkConfigNonce,
-        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
-      });
-    })();
-    return this.initPromise;
+    const started = this.initializeSdk(zkConfigNonce);
+    this.initPromises.set(key, started);
+    try {
+      const sdk = await started;
+      this.sdks.set(key, sdk);
+      return sdk;
+    } finally {
+      this.initPromises.delete(key);
+    }
+  }
+  feeBearingZkConfigNonce(input) {
+    return zkConfigNonceForFeeBearingKind({
+      ...input,
+      ...configuredNonceSpread(this.zkConfigNonce)
+    });
   }
-  async getInitializedSdk() {
-    await this.ensureInit();
-    if (!this.sdk) {
-      throw new Error("SDK not initialized");
+  async initializeSdk(nonce) {
+    if (!this.assets) {
+      throw new Error(
+        "PrivacyPoolService requires browser ZK assets before initialization."
+      );
     }
-    return this.sdk;
+    return initializePrivacyPoolSdk(
+      {
+        assets: this.assets,
+        ...this.zkCircuits ? { zkCircuits: this.zkCircuits } : {},
+        ...this.zkConfigNonce === void 0 ? {} : { zkConfigNonce: this.zkConfigNonce },
+        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
+      },
+      nonce
+    );
   }
   getAuditPublicKey() {
     return this.auditPublicKey;
@@ -1042,65 +1589,51 @@ var PrivacyPoolService = class {
     return { commitment_hex, coin, depositScalarHex, precommitementHex };
   }
   async prepareDepositTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
-    const stateRoot = merkleRootBufferToFrDecimal(parameters.merkleRootBytes);
-    const recipientPublicKeys = recipientPublicKeysDecimalFromPrivateAddress(
-      parameters.privateAddressStpl1
-    );
-    const applicationId = this.getApplicationId();
-    const audit = buildPoolTransactionAuditParameters({
-      applicationId,
-      nAuditSlots: sdk.getLayout().nAuditSlots,
-      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {}
-    });
-    const deposit = {
-      value: parameters.coin.value,
-      nullifier: parameters.coin.nullifier,
-      ephemeralKeyScalar: scalarHexToFrDecimal2(parameters.depositScalarHex),
-      asset: [parameters.coin.asset_hi, parameters.coin.asset_lo],
-      applicationId,
-      recipientPublicKeys
-    };
-    const publicInput = withTokenAddressPublicInputs(
-      {
-        stateRoot,
-        privKeyScalar: randomFrDecimal253()
-      },
-      parameters.tokenAddress
-    );
-    const proof = await sdk.proveTransaction(
-      publicInput,
-      padPublicLegsToLayout(
-        sdk,
-        buildPublicDepositLegs(parameters.tokenAddress, parameters.coin.value)
-      ),
-      padWithdrawSlotsToLayout(sdk, []),
-      padDepositSlotsToLayout(sdk, [deposit]),
-      audit
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "deposit" })
     );
-    const applicationIdsPlaintext = buildApplicationIdHints({
+    return proveDepositTransact({
       sdk,
-      inputIds: [],
-      outputIds: [applicationId]
+      applicationId: this.getApplicationId(),
+      privateAddressStpl1: parameters.privateAddressStpl1,
+      coin: parameters.coin,
+      depositScalarHex: parameters.depositScalarHex,
+      merkleRootBytes: parameters.merkleRootBytes,
+      tokenAddress: parameters.tokenAddress,
+      buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
+      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
+      ...parameters.publicDepositStroops === void 0 ? {} : { publicDepositStroops: parameters.publicDepositStroops },
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
-    return { ...proof, applicationIdsPlaintext };
   }
   async calculateNullifierHash(nullifier, privKeyScalar) {
     const sdk = await this.getInitializedSdk();
     return sdk.calculateNullifierHash(nullifier, privKeyScalar);
   }
   async prepareWithdrawTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransact({
       sdk,
       applicationId: this.getApplicationId(),
       buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
       ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
-      ...parameters
+      coin: parameters.coin,
+      state: parameters.state,
+      destinationStellarAddress: parameters.destinationStellarAddress,
+      privKeyScalarHex: parameters.privKeyScalarHex,
+      depositorEphemeralKey: parameters.depositorEphemeralKey,
+      withdrawAmountStroops: parameters.withdrawAmountStroops,
+      changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
   async prepareWithdrawTransactProofDual(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransactDual({
       sdk,
       applicationId: this.getApplicationId(),
@@ -1115,7 +1648,8 @@ var PrivacyPoolService = class {
       ephemeralBKey: parameters.depositorEphemeralBKey,
       withdrawAmountStroops: parameters.withdrawAmountStroops,
       changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
-      tokenAddress: parameters.tokenAddress
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
 };
@@ -1134,6 +1668,7 @@ function createPrivacyPoolService(input) {
 var configuredPrivacyPoolService;
 function configurePrivacyPoolService(service) {
   configuredPrivacyPoolService = service;
+  registerMerkleSessionSdkHost(service);
 }
 function getPrivacyPoolService() {
   if (!configuredPrivacyPoolService) {
@@ -1820,7 +2355,7 @@ async function requestKytPassageForPoolInteraction(input) {
   const applicationId = resolvePoolApplicationId(
     input.transactEnvironment.network.applicationId
   );
-  const zkConfigNonce = resolveZkConfigNonce(input.transactEnvironment);
+  const zkConfigNonce = input.zkConfigNonce ?? resolveZkConfigNonce(input.transactEnvironment);
   const applicationIdsPlaintext = input.applicationIdsPlaintext ?? buildApplicationIdHints2(
     applicationId,
     layoutForKnownNonce(zkConfigNonce).nAuditSlots
@@ -1933,6 +2468,7 @@ async function inspectRelayerSweepKyt(input) {
     ...input.prepared.transactArtifacts?.applicationIdsPlaintext ? {
       applicationIdsPlaintext: input.prepared.transactArtifacts.applicationIdsPlaintext
     } : {},
+    ...input.prepared.transactArtifacts?.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.prepared.transactArtifacts.zkConfigNonce },
     networkPassphrase: environment.network.networkPassphrase,
     sorobanRpcUrl: environment.network.rpcUrl,
     transactEnvironment: environment
@@ -1945,7 +2481,10 @@ async function simulateSweepAuthEntries(input) {
   const operation = new Contract(environment.network.poolContract).call(
     "transact",
     new Address3(input.relayerPublicKey).toScVal(),
-    nativeToScVal2(resolveZkConfigNonce(environment), { type: "u64" }),
+    nativeToScVal2(
+      transactNonceFromArtifacts(input.prepared.transactArtifacts, environment),
+      { type: "u64" }
+    ),
     nativeToScVal2(hexToBytes(input.artifacts.proofHex), { type: "bytes" }),
     nativeToScVal2(hexToBytes(input.artifacts.publicHex), { type: "bytes" }),
     nativeToScVal2(hexToBytes(input.artifacts.ciphertextHex ?? ""), { type: "bytes" }),
@@ -1982,6 +2521,7 @@ async function unsignedEscrowAuthorizationForSweep(input) {
   });
   const auth = await simulateSweepAuthEntries({
     artifacts,
+    prepared: input.prepared,
     transactEnvironment: input.transactEnvironment,
     relayerPublicKey,
     approval
@@ -2013,15 +2553,15 @@ async function loadDefaultStellarBrowserAssets(options) {
 }
 
 // src/transact/private-address/temporary-recipient.ts
-import { PrivacyPoolSDK as PrivacyPoolSDK3 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+import { PrivacyPoolSDK as PrivacyPoolSDK4 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 var COORDINATE_HEX_LENGTH2 = 64;
 async function generateRandomDepositScalarHex() {
   await getPrivacyPoolService().getInitializedSdk();
-  return PrivacyPoolSDK3.generateRandomScalarHex32();
+  return PrivacyPoolSDK4.generateRandomScalarHex32();
 }
 async function generateTemporaryRecipientPrivateAddress() {
   await getPrivacyPoolService().getInitializedSdk();
-  const temporaryScalarHex = PrivacyPoolSDK3.generateRandomScalarHex32();
+  const temporaryScalarHex = PrivacyPoolSDK4.generateRandomScalarHex32();
   const sdk = await getPrivacyPoolService().getInitializedSdk();
   const point = sdk.ecdhEphemeralPublicKeyFromScalarHex(temporaryScalarHex);
   const publicKeyXHex = point.x.padStart(COORDINATE_HEX_LENGTH2, "0");
@@ -2290,6 +2830,10 @@ async function submitSorobanConfidentialTransfer(input) {
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl
   });
+  const nonce = transactNonceFromArtifacts(
+    input.zkConfigNonce === void 0 ? void 0 : { zkConfigNonce: input.zkConfigNonce },
+    input.transactEnvironment
+  );
   const approval = await requestKytPassageForPoolInteraction({
     owner: input.walletPublicKey,
     poolContract: input.contractId,
@@ -2298,6 +2842,7 @@ async function submitSorobanConfidentialTransfer(input) {
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
     ...input.outputNoteEphemeralScalars ? { outputNoteEphemeralScalars: input.outputNoteEphemeralScalars } : {},
     ...input.applicationIdsPlaintext ? { applicationIdsPlaintext: input.applicationIdsPlaintext } : {},
+    ...input.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.zkConfigNonce },
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl,
     transactEnvironment: input.transactEnvironment
@@ -2306,7 +2851,7 @@ async function submitSorobanConfidentialTransfer(input) {
     contractClient: poolClient,
     contractId: input.contractId,
     from: input.walletPublicKey,
-    nonce: resolveZkConfigNonce(input.transactEnvironment),
+    nonce,
     proofHex: input.proofHex,
     publicHex: input.publicHex,
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
@@ -2328,9 +2873,6 @@ function escrowOutputFields(input) {
     recipientLo: input.escrowSend.recipientLo
   };
 }
-function paddingDepositPair(recipientDeposit) {
-  return [recipientDeposit, "dummy"];
-}
 async function buildChangeDepositPair(parameters) {
   const changeSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
     privateAddressStpl1: parameters.selfPrivateAddressStpl1ForChange.trim(),
@@ -2347,34 +2889,54 @@ async function buildChangeDepositPair(parameters) {
     }
   };
 }
+function recipientOnlyDeposits(recipientDeposit, hasFeeOutput) {
+  if (hasFeeOutput) {
+    return [recipientDeposit];
+  }
+  return [recipientDeposit, "dummy"];
+}
+async function depositsWithoutFee(input) {
+  if (input.changeStroops <= ZERO_STROOPS) {
+    return {
+      deposits: recipientOnlyDeposits(input.recipientDeposit, input.hasFeeOutput)
+    };
+  }
+  return buildChangeDepositPair({
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    changeStroops: input.changeStroops,
+    tokenAddress: input.tokenAddress,
+    recipientDeposit: input.recipientDeposit
+  });
+}
 async function buildRecipientAndOptionalChangeDeposits(parameters) {
   const escrow = {
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
     ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
   };
-  const recipientPrivateAddress = parameters.recipientPrivateAddressStpl1.trim();
   const recipientSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
-    privateAddressStpl1: recipientPrivateAddress,
+    privateAddressStpl1: parameters.recipientPrivateAddressStpl1.trim(),
     amountStroops: parameters.transferStroops,
     tokenAddress: parameters.tokenAddress,
     ...escrowOutputFields(escrow)
   });
-  if (parameters.changeStroops <= ZERO_STROOPS) {
-    return {
-      recipientSlot,
-      deposits: paddingDepositPair(recipientSlot.deposit)
-    };
-  }
-  const changeResult = await buildChangeDepositPair({
-    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+  const withoutFee = await depositsWithoutFee({
+    recipientDeposit: recipientSlot.deposit,
     changeStroops: parameters.changeStroops,
+    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+    tokenAddress: parameters.tokenAddress,
+    hasFeeOutput: (parameters.feeOutput?.requiredFee ?? ZERO_STROOPS) > ZERO_STROOPS
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: withoutFee.deposits,
     tokenAddress: parameters.tokenAddress,
-    recipientDeposit: recipientSlot.deposit
+    buildAlignedDepositSlot: (aligned) => getPrivacyPoolService().buildAlignedDepositSlot(aligned),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return {
     recipientSlot,
-    deposits: changeResult.deposits,
-    changeCoin: changeResult.changeCoin
+    deposits: withFee.deposits,
+    ..."changeCoin" in withoutFee ? { changeCoin: withoutFee.changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
   };
 }
 
@@ -2427,14 +2989,15 @@ function sweepOutputOwnerFields(parameters) {
   return { sweepOutputOwnerPubX, sweepOutputOwnerPubY };
 }
 async function buildTransferDepositsAndPublicInput(parameters) {
-  const { recipientSlot, deposits, changeCoin } = await buildRecipientAndOptionalChangeDeposits({
+  const { recipientSlot, deposits, changeCoin, feeCoin } = await buildRecipientAndOptionalChangeDeposits({
     recipientPrivateAddressStpl1: parameters.recipientPrivateAddressStpl1,
     transferStroops: parameters.transferStroops,
     changeStroops: parameters.changeStroops,
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = withTokenAddressPublicInputs(
     {
@@ -2449,6 +3012,7 @@ async function buildTransferDepositsAndPublicInput(parameters) {
     recipientSlot,
     deposits,
     ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {},
     publicInput
   };
 }
@@ -2464,7 +3028,8 @@ async function buildSenderTransferDepositsAndPublicInput(parameters) {
       parameters.senderPrivKeyScalarHex
     ),
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
 }
 
@@ -2488,11 +3053,20 @@ function stampDualWithdrawLegs(legs, parameters) {
     }
   };
 }
-function buildDualTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildDualTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId, applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 async function proveDualConfidentialTransfer(parameters) {
@@ -2512,16 +3086,24 @@ async function proveDualConfidentialTransfer(parameters) {
     audit
   );
 }
-async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+function dualTransferChangeStroops(parameters) {
   const totalNotes = BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value);
-  const changeStroops = changeStroopsAfterDualTransfer(
-    parameters.transferStroops,
-    totalNotes
-  );
+  if (parameters.transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
+    throw new Error("Transfer amount must be positive");
+  }
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: parameters.transferStroops,
+    requiredFee: parameters.feeOutput?.requiredFee ?? 0n
+  });
   requireChangeRecipientWhenPartial(
     changeStroops,
     parameters.selfPrivateAddressStpl1ForChange
   );
+  return changeStroops;
+}
+async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+  const changeStroops = dualTransferChangeStroops(parameters);
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.senderPrivKeyScalarHex
   );
@@ -2548,15 +3130,21 @@ async function buildDualTransferProofContext(parameters, applicationId, sdk) {
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     stateRoot: legA.witness.stateRoot,
-    ...confidentialEscrowFields(parameters)
+    ...confidentialEscrowFields(parameters),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return { legA, legB, applicationId, ...transferInputs };
 }
 async function prepareConfidentialTransferProofDual(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
-  const { legA, legB, recipientSlot, deposits, changeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
+  const { legA, legB, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
   const auditPublicKey = poolService.getAuditPublicKey();
   const proof = await (auditPublicKey ? proveDualConfidentialTransfer({
     sdk,
@@ -2579,7 +3167,8 @@ async function prepareConfidentialTransferProofDual(parameters) {
     applicationIdsPlaintext: buildDualTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -2587,22 +3176,32 @@ async function prepareConfidentialTransferProofDual(parameters) {
 }
 
 // src/transact/proofs/confidential/single.ts
-function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange) {
+function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange, requiredFee) {
   if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Transfer amount must be positive");
   }
-  if (transferStroops > noteStroops) {
-    throw new Error("Transfer amount exceeds note value");
-  }
-  const changeStroops = noteStroops - transferStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: transferStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl1ForChange);
   return changeStroops;
 }
-function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 function buildTransferAuditParameters(parameters) {
@@ -2628,11 +3227,25 @@ function confidentialEscrowFields2(input) {
     ...input.escrowClaimantLimbs ? { escrowClaimantLimbs: input.escrowClaimantLimbs } : {}
   };
 }
+function transferDepositInputFromProof(input, changeStroops, stateRoot) {
+  return {
+    senderPrivKeyScalarHex: input.senderPrivKeyScalarHex,
+    recipientPrivateAddressStpl1: input.recipientPrivateAddressStpl1,
+    transferStroops: input.transferStroops,
+    changeStroops,
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    tokenAddress: input.tokenAddress,
+    stateRoot,
+    ...confidentialEscrowFields2(input),
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  };
+}
 async function buildTransferProofInputs(parameters) {
   const changeStroops = validateSingleCoinTransferAmounts(
     parameters.input.transferStroops,
     parameters.noteStroops,
-    parameters.input.selfPrivateAddressStpl1ForChange
+    parameters.input.selfPrivateAddressStpl1ForChange,
+    parameters.input.feeOutput?.requiredFee ?? 0n
   );
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.input.senderPrivKeyScalarHex
@@ -2651,31 +3264,30 @@ async function buildTransferProofInputs(parameters) {
     withdrawObject,
     sweepWithdrawStamp(confidentialEscrowFields2(parameters.input))
   );
-  const { recipientSlot, deposits, changeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput({
-    senderPrivKeyScalarHex: parameters.input.senderPrivKeyScalarHex,
-    recipientPrivateAddressStpl1: parameters.input.recipientPrivateAddressStpl1,
-    transferStroops: parameters.input.transferStroops,
-    changeStroops,
-    selfPrivateAddressStpl1ForChange: parameters.input.selfPrivateAddressStpl1ForChange,
-    tokenAddress: parameters.input.tokenAddress,
-    stateRoot: witness.stateRoot,
-    ...confidentialEscrowFields2(parameters.input)
-  });
+  const { recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput(
+    transferDepositInputFromProof(parameters.input, changeStroops, witness.stateRoot)
+  );
   return {
     witness,
     withdrawObject: stampedWithdraw,
     recipientSlot,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput
   };
 }
 async function prepareConfidentialTransferProof(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
   const noteStroops = BigInt(parameters.coin.value);
-  const { withdrawObject, recipientSlot, deposits, changeCoin, publicInput } = await buildTransferProofInputs({
+  const { withdrawObject, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildTransferProofInputs({
     sdk,
     applicationId,
     input: parameters,
@@ -2698,7 +3310,8 @@ async function prepareConfidentialTransferProof(parameters) {
     applicationIdsPlaintext: buildSingleTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -2713,7 +3326,8 @@ function poolMerkleStateToCachedView(state) {
   return {
     commitments: state.commitments,
     updatedAt: state.updatedAt,
-    merkleRootHex: state.merkleRootHex
+    merkleRootHex: state.merkleRootHex,
+    ...state.nodes ? { nodes: state.nodes } : {}
   };
 }
 
@@ -2846,6 +3460,65 @@ function reuseCachedCommitments(input) {
   return cachedCommitments;
 }
 
+// src/transact/merkle/persist-fetched.ts
+function cachedMerkleUnchanged(cachedState, commitments, merkleRootHex) {
+  if (!cachedState) {
+    return false;
+  }
+  if (cachedState.commitments.length !== commitments.length) {
+    return false;
+  }
+  return cachedState.merkleRootHex === merkleRootHex;
+}
+function viewFromCachedMerkle(cachedState, merkleRootHex) {
+  return {
+    commitments: cachedState.commitments,
+    updatedAt: cachedState.updatedAt,
+    merkleRootHex: cachedState.merkleRootHex ?? merkleRootHex,
+    commitmentCount: cachedState.commitments.length,
+    ...cachedState.nodes ? { nodes: cachedState.nodes } : {}
+  };
+}
+function merkleStateForPersist(input) {
+  return {
+    poolContract: input.poolContractId,
+    commitments: input.commitments,
+    commitmentCount: input.commitments.length,
+    merkleRootHex: input.merkleRootHex,
+    updatedAt: input.updatedAt,
+    ...input.nodes ? { nodes: input.nodes } : {}
+  };
+}
+async function persistFetchedMerkleState(input) {
+  const cachedState = input.cachedState;
+  if (cachedMerkleUnchanged(cachedState, input.commitments, input.merkleRootHex) && cachedState) {
+    return viewFromCachedMerkle(cachedState, input.merkleRootHex);
+  }
+  const nodes = await resolveExtendedMerkleNodes({
+    poolContract: input.poolContractId,
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex,
+    ...cachedState ? { cachedState } : {}
+  });
+  const updatedAt = Date.now();
+  await input.poolMerkleState?.set(
+    merkleStateForPersist({
+      poolContractId: input.poolContractId,
+      commitments: input.commitments,
+      merkleRootHex: input.merkleRootHex,
+      updatedAt,
+      ...nodes ? { nodes } : {}
+    })
+  );
+  return {
+    commitments: input.commitments,
+    updatedAt,
+    merkleRootHex: input.merkleRootHex,
+    commitmentCount: input.commitments.length,
+    ...nodes ? { nodes } : {}
+  };
+}
+
 // src/transact/merkle/fetch-contract.ts
 async function fetchAndMergeMerkleState(parameters) {
   const client = createPoolClient(parameters);
@@ -2938,43 +3611,6 @@ async function loadCommitments(input) {
   });
   return [...reused, ...fetched];
 }
-async function persistFetchedMerkleState(input) {
-  const cachedState = input.cachedState;
-  if (cachedState && cachedMerkleUnchanged(cachedState, input.commitments, input.merkleRootHex)) {
-    return viewFromCachedMerkle(cachedState, input.merkleRootHex);
-  }
-  const updatedAt = Date.now();
-  await input.poolMerkleState?.set({
-    poolContract: input.poolContractId,
-    commitments: input.commitments,
-    commitmentCount: input.commitments.length,
-    merkleRootHex: input.merkleRootHex,
-    updatedAt
-  });
-  return {
-    commitments: input.commitments,
-    updatedAt,
-    merkleRootHex: input.merkleRootHex,
-    commitmentCount: input.commitments.length
-  };
-}
-function viewFromCachedMerkle(cachedState, merkleRootHex) {
-  return {
-    commitments: cachedState.commitments,
-    updatedAt: cachedState.updatedAt,
-    merkleRootHex: cachedState.merkleRootHex ?? merkleRootHex,
-    commitmentCount: cachedState.commitments.length
-  };
-}
-function cachedMerkleUnchanged(cachedState, commitments, merkleRootHex) {
-  if (!cachedState) {
-    return false;
-  }
-  if ((cachedState.merkleRootHex ?? merkleRootHex) !== merkleRootHex) {
-    return false;
-  }
-  return cachedState.commitments.join(",") === commitments.join(",");
-}
 
 // src/transact/encoding/fr-decimal-to-bytes.ts
 var BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
@@ -3087,13 +3723,19 @@ var walletPrivateAddressRecordSchema = z.object({
   privateAddress: z.string().min(1),
   createdAt: z.number()
 });
+var leanImtNodeSchema = z.object({
+  level: z.number().int().nonnegative(),
+  index: z.number().int().nonnegative(),
+  value: z.string().min(1)
+});
 var poolMerkleStateSchema = z.object({
   poolContract: z.string().min(1),
   commitments: z.array(z.string()),
   commitmentCount: z.number().int().nonnegative(),
   merkleRootHex: z.string().min(1),
   updatedAt: z.number(),
-  syncedLedger: z.number().int().optional()
+  syncedLedger: z.number().int().optional(),
+  nodes: z.array(leanImtNodeSchema).optional()
 });
 var leafEphemeralSchema = z.object({
   poolContract: z.string().min(1),
@@ -4506,6 +5148,7 @@ function createPoolMerkleService(context) {
     async appendPoolCommitments(input) {
       const current = await this.getPoolMerkleState(input.poolContract);
       const mergedCommitments = [...current?.commitments ?? [], ...input.commitments];
+      const nodes = input.nodes ?? (input.commitments.length === 0 ? current?.nodes : void 0);
       await this.setPoolMerkleState(
         withoutUndefinedFields({
           poolContract: input.poolContract,
@@ -4513,7 +5156,8 @@ function createPoolMerkleService(context) {
           commitmentCount: mergedCommitments.length,
           merkleRootHex: input.merkleRootHex,
           updatedAt: Date.now(),
-          syncedLedger: input.syncedLedger ?? current?.syncedLedger
+          syncedLedger: input.syncedLedger ?? current?.syncedLedger,
+          nodes
         })
       );
     }
@@ -5042,7 +5686,11 @@ async function loadMerkleState(environment, walletPublicKey) {
     transactEnvironment: environment,
     ...environment.poolMerkleState ? { poolMerkleState: environment.poolMerkleState } : {}
   });
-  return { commitments: merged.commitments };
+  return merkleSnapshotToStateFile({
+    commitments: merged.commitments,
+    merkleRootHex: merged.merkleRootHex,
+    ...merged.nodes ? { nodes: merged.nodes } : {}
+  });
 }
 
 // src/transact/escrow/require-escrow-spend-scalar.ts
@@ -5189,7 +5837,8 @@ async function buildSpendProofContextAtExecute(input) {
     input.prepared.intent.asset
   );
   const coin = requireCoinNoteFromRecord(primaryRecord);
-  const { commitments } = await loadMerkleState(input.environment, walletPublicKey);
+  const merkleState = await loadMerkleState(input.environment, walletPublicKey);
+  const commitments = merkleState.commitments;
   const leafIndex = findCommitmentLeafIndex(commitments, coin.commitment);
   if (leafIndex < 0) {
     throw new Error("Coin commitment not found in on-chain Merkle state.");
@@ -5206,6 +5855,7 @@ async function buildSpendProofContextAtExecute(input) {
     tokenAddress,
     coin,
     commitments,
+    merkleState,
     ephemeral,
     senderPrivKeyScalarHex,
     recipientPrivateAddressStpl1: input.recipientPrivateAddressStpl1
@@ -5263,10 +5913,15 @@ function proofEscrowFields(input) {
 }
 async function buildSingleTransferProofAtExecute(input) {
   const context = await buildSpendProofContextAtExecute(input);
-  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProof({
     coin: context.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     senderPrivKeyScalarHex: context.senderPrivKeyScalarHex,
     depositorEphemeralKey: serializeEphemeralKeyString({
       xHex: context.ephemeral.xHex,
@@ -5276,7 +5931,8 @@ async function buildSingleTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -5293,11 +5949,16 @@ async function buildDualTransferProofAtExecute(input) {
     commitments: context.commitments
   });
   const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = totalNotes - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     senderPrivKeyScalarHex: context.senderPrivKeyScalarHex,
     ephemeralAKey: serializeEphemeralKeyString({
       xHex: context.ephemeral.xHex,
@@ -5311,7 +5972,8 @@ async function buildDualTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -5443,11 +6105,17 @@ async function runTransferFinalizeSteps(input) {
     walletPublicKey: input.walletPublicKey,
     ...recipient.escrowSend ? { escrowSendPrivateAddress: recipient.recipientPrivateAddressStpl1 } : {}
   });
-  return buildTransferFinalizeArtifacts({
-    proof,
-    context,
-    ...sweepFinalizeStamp(input.prepared, recipient)
-  });
+  return {
+    ...buildTransferFinalizeArtifacts({
+      proof,
+      context,
+      ...sweepFinalizeStamp(input.prepared, recipient)
+    }),
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      ...feeOutputKindFromPrepared(input.prepared),
+      ...configuredNonceSpread(input.environment.zkConfigNonce)
+    })
+  };
 }
 function sweepArtifactStamp(artifacts) {
   return {
@@ -5475,6 +6143,24 @@ async function finalizeTransferAtExecute(prepared, environment) {
   return runTransferFinalizeSteps({ prepared, environment, walletPublicKey });
 }
 
+// src/transact/engine/withdraw-fee.ts
+async function withdrawFeeProofFields(input) {
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: input.tokenAddress
+  });
+  const changeStroops = remainingAfterRequiredFee({
+    available: input.available,
+    instructed: input.prepared.intent.amount,
+    requiredFee: feeOutput?.requiredFee ?? 0n
+  });
+  return {
+    ...feeOutput ? { feeOutput } : {},
+    ...changeStroops > 0n ? { changePrivateAddressStpl1: input.withdrawFrom } : {}
+  };
+}
+
 // src/transact/engine/execute.ts
 function enrichWithdrawOutputRecords(prepared, proof) {
   if (!proof.changeCoin || prepared.outputRecords.length === 0) {
@@ -5490,7 +6176,7 @@ function enrichWithdrawOutputRecords(prepared, proof) {
     precommitementHex: changeCoin.precommitementHex
   }));
 }
-function buildWithdrawFinalizeArtifacts(proof, context) {
+function buildWithdrawFinalizeArtifacts(proof, context, environment) {
   return {
     proofHex: proof.proof_hex,
     publicHex: proof.public_hex,
@@ -5498,7 +6184,11 @@ function buildWithdrawFinalizeArtifacts(proof, context) {
     applicationIdsPlaintext: proof.applicationIdsPlaintext,
     tokenAddress: context.tokenAddress,
     walletPublicKey: context.walletPublicKey,
-    executeFinalizeRequired: false
+    executeFinalizeRequired: false,
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      kind: "withdraw",
+      ...configuredNonceSpread(environment.zkConfigNonce)
+    })
   };
 }
 async function finalizeSingleWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
@@ -5507,10 +6197,16 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
     environment,
     recipientPrivateAddressStpl1: withdrawFrom
   });
-  const changeStroops = BigInt(context.coin.value) - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProof({
     coin: context.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     destinationStellarAddress: prepared.intent.to,
     privKeyScalarHex: context.senderPrivKeyScalarHex,
     depositorEphemeralKey: serializeEphemeralKeyString({
@@ -5518,11 +6214,24 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
       yHex: context.ephemeral.yHex
     }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
+}
+function dualWithdrawEphemeralKeys(input) {
+  return {
+    depositorEphemeralAKey: serializeEphemeralKeyString({
+      xHex: input.context.ephemeral.xHex,
+      yHex: input.context.ephemeral.yHex
+    }),
+    depositorEphemeralBKey: serializeEphemeralKeyString({
+      xHex: input.secondary.ephemeral.xHex,
+      yHex: input.secondary.ephemeral.yHex
+    })
+  };
 }
 async function finalizeDualWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
   const [, secondaryRecord] = prepared.consumedRecords;
@@ -5540,28 +6249,27 @@ async function finalizeDualWithdrawAtExecute(prepared, environment, poolService,
     walletPublicKey: context.walletPublicKey,
     commitments: context.commitments
   });
-  const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value) + BigInt(secondary.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     destinationStellarAddress: prepared.intent.to,
     privKeyScalarHex: context.senderPrivKeyScalarHex,
-    depositorEphemeralAKey: serializeEphemeralKeyString({
-      xHex: context.ephemeral.xHex,
-      yHex: context.ephemeral.yHex
-    }),
-    depositorEphemeralBKey: serializeEphemeralKeyString({
-      xHex: secondary.ephemeral.xHex,
-      yHex: secondary.ephemeral.yHex
-    }),
+    ...dualWithdrawEphemeralKeys({ context, secondary }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
 }
 async function finalizeWithdrawAtExecute(prepared, environment, poolService) {
   if (prepared.kind !== "withdraw") {
@@ -5787,10 +6495,11 @@ function requirePreparedArtifacts(prepared) {
   };
 }
 function prepareRelayTransactPackageFromPrepared(input) {
+  const zkConfigNonce = input.zkConfigNonce ?? input.prepared.transactArtifacts?.zkConfigNonce;
   return prepareRelayTransactPackage({
     poolSelector: input.poolSelector,
     ...requirePreparedArtifacts(input.prepared),
-    ...input.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.zkConfigNonce },
+    ...zkConfigNonce === void 0 ? {} : { zkConfigNonce },
     ...input.keyVersionHints ? { keyVersionHints: input.keyVersionHints } : {}
   });
 }
@@ -5900,6 +6609,7 @@ function requiredSubmissionMethod(prepared, zkConfigNonce = DEFAULT_ZK_CONFIG_NO
   return result.method;
 }
 export {
+  BINDING_ZK_NONCE,
   BundledZkCircuit2 as BundledZkCircuit,
   COMMITMENT_V2_ZK_NONCE,
   DEFAULT_STEALTH_SIGN_NONCE as DEFAULT_PRIVATE_ADDRESS_SIGN_NONCE,
@@ -5928,6 +6638,7 @@ export {
   RELAY_TRANSACT_PACKAGE_VERSION_V1,
   RELAY_TRANSACT_SIGNAL_PREFIX_BYTES,
   RELAY_TRANSACT_SUPPORTED_SIGNAL_COUNT,
+  SIX_BY_SIX_BINDING_ZK_NONCE,
   SIX_BY_SIX_ZK_NONCE,
   STANDARD_ZK_CONFIG_NONCE,
   SUBMISSION_METHOD,