@arcanetech/privacy-sdk-stellar 0.5.2 → 0.6.1

package/dist/node.js

@@ -466,13 +466,26 @@ function buildPrivateRecordFromDeposit(input) {
   };
 }
 
-// src/transact/pool/service.ts
-import {
-  PrivacyPoolSDK as PrivacyPoolSDK2,
-  decodeDecodedEphemeralKey,
-  randomFrDecimal253,
-  scalarHexToFrDecimal as scalarHexToFrDecimal2
-} from "@arcanetech/stellar-privacy-pool-zk-sdk";
+// src/transact/merkle/lean-imt-api.ts
+function asLeanImtSessionApi(sdk) {
+  const candidate = sdk;
+  if (typeof candidate.importLeanImtFromState !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.insertTwoLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.exportLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.dropLeanImt !== "function") {
+    return void 0;
+  }
+  if (typeof candidate.buildWithdrawMerkleWitnessFromHandle !== "function") {
+    return void 0;
+  }
+  return candidate;
+}
 
 // src/transact/merkle/field-decimal.ts
 import { Buffer as Buffer4 } from "buffer";
@@ -488,6 +501,230 @@ function merkleRootBufferToFrDecimal(root) {
   const hex = Buffer4.from(root).toString("hex");
   return (BigInt(`0x${hex}`) % BN254).toString(DECIMAL_STRING_RADIX);
 }
+var MERKLE_ROOT_HEX_PATTERN = /^[0-9a-fA-F]{64}$/;
+function merkleRootHexToFrDecimal(merkleRootHex) {
+  const trimmed = merkleRootHex.trim();
+  if (!MERKLE_ROOT_HEX_PATTERN.test(trimmed)) {
+    return void 0;
+  }
+  return merkleRootBufferToFrDecimal(Buffer4.from(trimmed, "hex"));
+}
+
+// src/transact/merkle/state-file.ts
+function merkleSnapshotToStateFile(input) {
+  const root = merkleRootHexToFrDecimal(input.merkleRootHex);
+  const nodes = input.nodes;
+  if (!nodes || nodes.length === 0 || root === void 0) {
+    return { commitments: input.commitments };
+  }
+  return {
+    commitments: input.commitments,
+    nodes,
+    root
+  };
+}
+
+// src/transact/merkle/extend-snapshot.ts
+function isEvenLeafCount(count) {
+  return count % 2 === 0;
+}
+function importHandle(sdk, state) {
+  try {
+    return sdk.importLeanImtFromState(state);
+  } catch {
+    return void 0;
+  }
+}
+function insertNewPairs(input) {
+  for (let index = input.prefixLength; index < input.commitments.length; index += 2) {
+    const leafA = input.commitments.at(index);
+    const leafB = input.commitments.at(index + 1);
+    if (leafA === void 0 || leafB === void 0) {
+      return false;
+    }
+    try {
+      input.sdk.insertTwoLeanImt(input.handle, leafA, leafB);
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+function snapshotNodes(sdk, handle) {
+  try {
+    return sdk.exportLeanImt(handle).nodes;
+  } catch {
+    return void 0;
+  }
+}
+function prefixSnapshotState(input) {
+  const prefixLength = input.cachedState?.nodes ? input.cachedState.commitments.length : 0;
+  return merkleSnapshotToStateFile({
+    commitments: input.commitments.slice(0, prefixLength),
+    merkleRootHex: input.cachedState?.merkleRootHex ?? input.merkleRootHex,
+    ...input.cachedState?.nodes ? { nodes: input.cachedState.nodes } : {}
+  });
+}
+function importSnapshotState(input) {
+  if (input.prefixState.nodes && input.prefixState.commitments.length > 0) {
+    return input.prefixState;
+  }
+  return merkleSnapshotToStateFile({
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex
+  });
+}
+function exportExtendedNodes(input) {
+  const inserted = input.prefixState.nodes ? insertNewPairs({
+    sdk: input.sdk,
+    handle: input.handle,
+    prefixLength: input.prefixState.commitments.length,
+    commitments: input.commitments
+  }) : true;
+  if (!inserted) {
+    input.sdk.dropLeanImt(input.handle);
+    return void 0;
+  }
+  const nodes = snapshotNodes(input.sdk, input.handle);
+  if (!nodes) {
+    input.sdk.dropLeanImt(input.handle);
+  }
+  return nodes;
+}
+function extendMerkleSnapshotNodes(input) {
+  if (!isEvenLeafCount(input.commitments.length)) {
+    return {};
+  }
+  const prefixState = prefixSnapshotState(input);
+  const handle = importHandle(
+    input.sdk,
+    importSnapshotState({ ...input, prefixState })
+  );
+  if (handle === void 0) {
+    return {};
+  }
+  const nodes = exportExtendedNodes({
+    sdk: input.sdk,
+    handle,
+    prefixState,
+    commitments: input.commitments
+  });
+  if (!nodes) {
+    return {};
+  }
+  return { nodes, handle };
+}
+
+// src/transact/merkle/tree-session.ts
+var merkleSdkHost;
+function registerMerkleSessionSdkHost(host) {
+  merkleSdkHost = host;
+}
+async function loadSessionSdk() {
+  const host = merkleSdkHost;
+  if (typeof host?.getInitializedSdk !== "function") {
+    return void 0;
+  }
+  try {
+    return asLeanImtSessionApi(await host.getInitializedSdk());
+  } catch {
+    return void 0;
+  }
+}
+var sessionsByPool = /* @__PURE__ */ new Map();
+var handlesByKey = /* @__PURE__ */ new Map();
+function merkleSessionKey(state) {
+  const root = state.root?.trim();
+  if (root) {
+    return `${state.commitments.length}:${root}`;
+  }
+  const first = state.commitments[0] ?? "";
+  const last = state.commitments.at(-1) ?? "";
+  return `${state.commitments.length}:${first}:${last}`;
+}
+function rememberHandle(poolContract, key, handle) {
+  const existing = sessionsByPool.get(poolContract);
+  if (existing && existing.handle !== handle) {
+    handlesByKey.delete(existing.key);
+  }
+  sessionsByPool.set(poolContract, { handle, key });
+  handlesByKey.set(key, handle);
+}
+function importHandle2(sdk, state) {
+  try {
+    return sdk.importLeanImtFromState(state);
+  } catch {
+    return void 0;
+  }
+}
+function merkleTreeHandleForState(state) {
+  return handlesByKey.get(merkleSessionKey(state));
+}
+function bindImportedMerkleTree(input) {
+  rememberHandle(input.poolContract, merkleSessionKey(input.state), input.handle);
+}
+async function bindPoolMerkleTree(state) {
+  const sdk = await loadSessionSdk();
+  if (!sdk) {
+    return void 0;
+  }
+  const snapshot = merkleSnapshotToStateFile(state);
+  const key = merkleSessionKey(snapshot);
+  const existing = sessionsByPool.get(state.poolContract);
+  if (existing?.key === key) {
+    return existing.handle;
+  }
+  const handle = importHandle2(sdk, snapshot);
+  if (handle === void 0) {
+    return void 0;
+  }
+  if (existing) {
+    sdk.dropLeanImt(existing.handle);
+  }
+  rememberHandle(state.poolContract, key, handle);
+  return handle;
+}
+async function resolveExtendedMerkleNodes(input) {
+  const cached = input.cachedState;
+  if (cached && cached.commitments.length === input.commitments.length && cached.merkleRootHex === input.merkleRootHex) {
+    return cached.nodes;
+  }
+  const sdk = await loadSessionSdk();
+  if (!sdk) {
+    return void 0;
+  }
+  const extended = extendMerkleSnapshotNodes({
+    sdk,
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex,
+    ...cached ? { cachedState: cached } : {}
+  });
+  if (extended.handle !== void 0) {
+    bindImportedMerkleTree({
+      poolContract: input.poolContract,
+      handle: extended.handle,
+      state: merkleSnapshotToStateFile({
+        commitments: input.commitments,
+        merkleRootHex: input.merkleRootHex,
+        ...extended.nodes ? { nodes: extended.nodes } : {}
+      })
+    });
+  }
+  return extended.nodes;
+}
+function withdrawMerkleWitnessFromTree(input) {
+  const session = asLeanImtSessionApi(input.sdk);
+  const handle = merkleTreeHandleForState(input.state);
+  if (session && handle !== void 0) {
+    return session.buildWithdrawMerkleWitnessFromHandle(input.coin, handle);
+  }
+  return input.sdk.buildWithdrawMerkleWitness(input.coin, input.state);
+}
+
+// src/transact/pool/service.ts
+import {
+  decodeDecodedEphemeralKey
+} from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
 // src/transact/private-address/codec.ts
 import {
@@ -700,7 +937,7 @@ var MIN_CONFIDENTIAL_TRANSFER_STROOPS = 1n;
 var ZERO_STROOPS = 0n;
 function withdrawWitnessForCoin(parameters) {
   const { sdk, coin, state } = parameters;
-  const witness = sdk.buildWithdrawMerkleWitness(coin, state);
+  const witness = withdrawMerkleWitnessFromTree({ sdk, coin, state });
   const withdrawApplicationId = coin.application_id ?? parameters.applicationId;
   const withdrawObject = withdrawObjectFromMerkleWitness(
     witness,
@@ -742,14 +979,144 @@ function requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl
     }
   }
 }
-function changeStroopsAfterDualTransfer(transferStroops, totalNotes) {
-  if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
-    throw new Error("Transfer amount must be positive");
+
+// src/transact/fees/quote-request-body.ts
+function presentInstructedAmount(amount) {
+  const trimmed = amount?.trim() ?? "";
+  if (!trimmed || trimmed === "0") {
+    return void 0;
   }
-  if (transferStroops > totalNotes) {
-    throw new Error("Transfer amount exceeds combined note value");
+  return trimmed;
+}
+function feeQuoteRequestBody(request) {
+  const publicDepositAmount = presentInstructedAmount(request.publicDepositAmount);
+  const transferInstructedAmount = presentInstructedAmount(
+    request.transferInstructedAmount
+  );
+  const publicWithdrawalAmount = presentInstructedAmount(
+    request.publicWithdrawalAmount
+  );
+  return {
+    feeAsset: request.feeAsset,
+    spendsNotes: request.spendsNotes,
+    ...publicDepositAmount === void 0 ? {} : { publicDepositAmount },
+    ...transferInstructedAmount === void 0 ? {} : { transferInstructedAmount },
+    ...publicWithdrawalAmount === void 0 ? {} : { publicWithdrawalAmount }
+  };
+}
+
+// src/transact/fees/quote-required-fee.ts
+function quoteHeaders(inspectAuthorization) {
+  const token = inspectAuthorization?.trim();
+  return {
+    "content-type": "application/json",
+    ...token ? { authorization: `Bearer ${token}` } : {}
+  };
+}
+function parseRequiredFee(raw) {
+  const text = `${raw ?? ""}`.trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error("Fee Quote Required Fee must be an integer minor-unit string.");
   }
-  return totalNotes - transferStroops;
+  return BigInt(text);
+}
+function requireQuoteString(raw, field) {
+  const text = `${raw ?? ""}`.trim();
+  if (!text) {
+    throw new Error(`Fee Quote is missing ${field}.`);
+  }
+  return text;
+}
+function parseQuotePayload(payload) {
+  return {
+    requiredFee: parseRequiredFee(payload.requiredFee),
+    feeAsset: requireQuoteString(payload.feeAsset, "Fee Asset"),
+    feeCollectorPrivateAddress: requireQuoteString(
+      payload.feeCollectorPrivateAddress,
+      "Fee Collector Private Address"
+    ),
+    feeRate: requireQuoteString(payload.feeRate, "Fee Rate")
+  };
+}
+async function quoteRequiredFee(input) {
+  const response = await fetch(
+    `${input.transactEnvironment.kyt.apiBaseUrl}/kyt/fees/quote`,
+    {
+      method: "POST",
+      headers: quoteHeaders(input.transactEnvironment.kyt.inspectAuthorization),
+      body: JSON.stringify(feeQuoteRequestBody(input.request))
+    }
+  );
+  const payload = await response.json();
+  if (!response.ok) {
+    throw new Error(`Fee Quote failed: ${JSON.stringify(payload)}`);
+  }
+  return parseQuotePayload(payload);
+}
+
+// src/transact/fees/should-attach-fee-output.ts
+function shouldAttachFeeOutput(input) {
+  if (input.spendSource === "escrow" && input.escrowSend !== true) {
+    return false;
+  }
+  return input.kind === "deposit" || input.kind === "transfer" || input.kind === "withdraw";
+}
+function feeOutputKindFromPrepared(prepared) {
+  return {
+    kind: prepared.kind,
+    ...prepared.transactArtifacts?.spendSource ? { spendSource: prepared.transactArtifacts.spendSource } : {},
+    ...prepared.transactArtifacts?.escrowSend ? { escrowSend: true } : {}
+  };
+}
+
+// src/transact/fees/quote-fee-output-for-prepared.ts
+function instructedMinorUnits(prepared) {
+  return prepared.intent.amount.toString();
+}
+function quoteRequestForPrepared(input) {
+  const amount = instructedMinorUnits(input.prepared);
+  if (input.prepared.kind === "deposit") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicDepositAmount: amount,
+      spendsNotes: false
+    };
+  }
+  if (input.prepared.kind === "withdraw") {
+    return {
+      feeAsset: input.tokenAddress,
+      publicWithdrawalAmount: amount,
+      spendsNotes: true
+    };
+  }
+  return {
+    feeAsset: input.tokenAddress,
+    transferInstructedAmount: amount,
+    spendsNotes: true
+  };
+}
+async function quoteFeeOutputForPrepared(input) {
+  if (!shouldAttachFeeOutput(feeOutputKindFromPrepared(input.prepared))) {
+    return void 0;
+  }
+  const quote = await quoteRequiredFee({
+    transactEnvironment: input.environment,
+    request: quoteRequestForPrepared(input)
+  });
+  if (quote.requiredFee <= 0n) {
+    return void 0;
+  }
+  return {
+    requiredFee: quote.requiredFee,
+    feeCollectorPrivateAddress: quote.feeCollectorPrivateAddress
+  };
+}
+function remainingAfterRequiredFee(input) {
+  const remaining = input.available - input.instructed - input.requiredFee;
+  if (remaining < 0n) {
+    throw new Error("Instructed amount and Required Fee exceed available note value");
+  }
+  return remaining;
 }
 
 // src/transact/audit/parameters.ts
@@ -890,6 +1257,32 @@ function privKeyScalarDecimalFromRecipientScalarHex(hexInput) {
   return canonicalBabyJubScalarFromInteger(value).toString(DECIMAL_RADIX2);
 }
 
+// src/transact/fees/append-fee-output.ts
+function feeCoinFromSlot(slot) {
+  return {
+    commitment_hex: slot.commitment_hex,
+    coin: slot.coin,
+    depositScalarHex: slot.depositScalarHex,
+    precommitementHex: slot.precommitementHex
+  };
+}
+async function appendFeeOutputSlot(input) {
+  const requiredFee = input.feeOutput?.requiredFee ?? ZERO_STROOPS;
+  const collector = input.feeOutput?.feeCollectorPrivateAddress.trim() ?? "";
+  if (requiredFee <= ZERO_STROOPS || !collector) {
+    return { deposits: input.deposits };
+  }
+  const slot = await input.buildAlignedDepositSlot({
+    privateAddressStpl1: collector,
+    amountStroops: requiredFee,
+    tokenAddress: input.tokenAddress
+  });
+  return {
+    deposits: [...input.deposits, slot.deposit],
+    feeCoin: feeCoinFromSlot(slot)
+  };
+}
+
 // src/transact/proofs/withdraw/helpers.ts
 function destinationWithdrawFrAndScalar(parameters) {
   const pkHex = ed25519PublicKeyHexFromStellarAccount(
@@ -944,14 +1337,15 @@ async function resolveWithdrawChangeDeposits(parameters) {
     }
   };
 }
-function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1) {
+function validateDualWithdrawAmounts(withdrawAmountStroops, totalNotes, changePrivateAddressStpl1, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > totalNotes) {
-    throw new Error("Withdraw amount exceeds combined note value");
-  }
-  const changeStroops = totalNotes - withdrawAmountStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, changePrivateAddressStpl1);
   return changeStroops;
 }
@@ -964,11 +1358,31 @@ function buildDualWithdrawPublicInput(parameters) {
     publicWithdrawalAmount: parameters.publicWithdrawalAmount
   });
 }
+async function withdrawOutputsWithOptionalFee(parameters) {
+  const { deposits: changeDeposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: changeDeposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
+  };
+}
 async function prepareDualWithdrawProofInputs(parameters) {
   const changeStroops = validateDualWithdrawAmounts(
     parameters.withdrawAmountStroops,
     BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value),
-    parameters.changePrivateAddressStpl1
+    parameters.changePrivateAddressStpl1,
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { legA, legB } = dualWithdrawLegsWithSharedRoot({
     sdk: parameters.sdk,
@@ -983,11 +1397,12 @@ async function prepareDualWithdrawProofInputs(parameters) {
     ),
     applicationId: parameters.applicationId
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawOutputsWithOptionalFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildDualWithdrawPublicInput({
     destinationStellarAddress: parameters.destinationStellarAddress,
@@ -1006,19 +1421,55 @@ async function prepareDualWithdrawProofInputs(parameters) {
     audit,
     deposits,
     withdrawLegs: [legA.withdrawObject, legB.withdrawObject],
-    ...changeCoin ? { changeCoin } : {}
+    ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {}
+  };
+}
+
+// src/transact/proofs/withdraw/fee-deposits.ts
+async function withdrawDepositsWithFee(parameters) {
+  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+    changeStroops: parameters.changeStroops,
+    changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    tokenAddress: parameters.tokenAddress
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits,
+    tokenAddress: parameters.tokenAddress,
+    buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
+  });
+  return {
+    deposits: withFee.deposits,
+    ...changeCoin ? { changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
   };
 }
+function withdrawOutputApplicationIds(input) {
+  const outputIds = [];
+  if (input.hasChange) {
+    outputIds.push(input.applicationId);
+  }
+  if (input.hasFeeOutput) {
+    outputIds.push(input.applicationId);
+  }
+  if (outputIds.length === 0) {
+    outputIds.push("0");
+  }
+  return outputIds;
+}
 
 // src/transact/proofs/withdraw/transact-proof.ts
-function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops) {
+function validateSingleWithdrawAmounts(withdrawAmountStroops, noteStroops, requiredFee) {
   if (withdrawAmountStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Withdraw amount must be positive");
   }
-  if (withdrawAmountStroops > noteStroops) {
-    throw new Error("Withdraw amount exceeds note value");
-  }
-  return noteStroops - withdrawAmountStroops;
+  return remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: withdrawAmountStroops,
+    requiredFee
+  });
 }
 async function proveSingleWithdrawTransaction(parameters) {
   return parameters.sdk.proveTransaction(
@@ -1036,10 +1487,11 @@ async function proveSingleWithdrawTransaction(parameters) {
   );
 }
 function buildPrimaryWithdrawForCoin(parameters) {
-  const witness = parameters.sdk.buildWithdrawMerkleWitness(
-    parameters.coin,
-    parameters.state
-  );
+  const witness = withdrawMerkleWitnessFromTree({
+    sdk: parameters.sdk,
+    coin: parameters.coin,
+    state: parameters.state
+  });
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.privKeyScalarHex
   );
@@ -1057,7 +1509,8 @@ function buildPrimaryWithdrawForCoin(parameters) {
 async function prepareSingleWithdrawProofInputs(parameters) {
   const changeStroops = validateSingleWithdrawAmounts(
     parameters.withdrawAmountStroops,
-    BigInt(parameters.coin.value)
+    BigInt(parameters.coin.value),
+    parameters.feeOutput?.requiredFee ?? 0n
   );
   const { witness, primaryWithdraw } = buildPrimaryWithdrawForCoin({
     sdk: parameters.sdk,
@@ -1066,11 +1519,12 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     state: parameters.state,
     privKeyScalarHex: parameters.privKeyScalarHex
   });
-  const { deposits, changeCoin } = await resolveWithdrawChangeDeposits({
+  const { deposits, changeCoin, feeCoin } = await withdrawDepositsWithFee({
     changeStroops,
     changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
     buildAlignedDepositSlot: parameters.buildAlignedDepositSlot,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = buildWithdrawPublicInput({
     stateRoot: witness.stateRoot,
@@ -1083,6 +1537,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
     primaryWithdraw,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput,
     audit: buildPoolTransactionAuditParameters({
       applicationId: parameters.applicationId,
@@ -1092,7 +1547,7 @@ async function prepareSingleWithdrawProofInputs(parameters) {
   };
 }
 async function proveWithdrawTransact(parameters) {
-  const { primaryWithdraw, deposits, changeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
+  const { primaryWithdraw, deposits, changeCoin, feeCoin, publicInput, audit } = await prepareSingleWithdrawProofInputs(parameters);
   const proof = await proveSingleWithdrawTransaction({
     sdk: parameters.sdk,
     publicInput,
@@ -1107,13 +1562,17 @@ async function proveWithdrawTransact(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [parameters.applicationId],
-      outputIds: [changeCoin ? parameters.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: parameters.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
 }
 async function proveWithdrawTransactDual(parameters) {
-  const { publicInput, audit, withdrawLegs, deposits, changeCoin } = await prepareDualWithdrawProofInputs(parameters);
+  const { publicInput, audit, withdrawLegs, deposits, changeCoin, feeCoin } = await prepareDualWithdrawProofInputs(parameters);
   const proof = await parameters.sdk.proveTransaction(
     publicInput,
     padPublicLegsToLayout(
@@ -1132,7 +1591,11 @@ async function proveWithdrawTransactDual(parameters) {
     applicationIdsPlaintext: buildApplicationIdHints({
       sdk: parameters.sdk,
       inputIds: [audit.applicationId, audit.applicationId],
-      outputIds: [changeCoin ? audit.applicationId : "0"]
+      outputIds: withdrawOutputApplicationIds({
+        applicationId: audit.applicationId,
+        hasChange: Boolean(changeCoin),
+        hasFeeOutput: Boolean(feeCoin)
+      })
     }),
     ...changeCoin ? { changeCoin } : {}
   };
@@ -1153,6 +1616,9 @@ var DEFAULT_ZK_CONFIG_NONCE = BINDING_ZK_NONCE;
 function resolveZkConfigNonce(transactEnvironment) {
   return transactEnvironment.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
 }
+function transactNonceFromArtifacts(artifacts, transactEnvironment) {
+  return artifacts?.zkConfigNonce ?? resolveZkConfigNonce(transactEnvironment);
+}
 
 // src/transact/zk/browser-artifact-cache.ts
 import { ZK_ARTIFACT_VERSION } from "@arcanetech/stellar-privacy-pool-zk-sdk";
@@ -1387,21 +1853,120 @@ async function buildAlignedDepositSlotForSdk(sdk, applicationId, parameters) {
   const recipientPublicKeys = recipientPublicKeysDecimalFromPrivateAddress(
     parameters.privateAddressStpl1
   );
-  const deposit = {
-    value: generated.coin.value,
-    nullifier: generated.coin.nullifier,
-    ephemeralKeyScalar: scalarHexToFrDecimal(scalarHex),
-    asset: [generated.coin.asset_hi, generated.coin.asset_lo],
-    applicationId: resolvedApplicationId,
-    recipientPublicKeys,
-    ...escrowDepositFields(parameters)
-  };
+  const deposit = {
+    value: generated.coin.value,
+    nullifier: generated.coin.nullifier,
+    ephemeralKeyScalar: scalarHexToFrDecimal(scalarHex),
+    asset: [generated.coin.asset_hi, generated.coin.asset_lo],
+    applicationId: resolvedApplicationId,
+    recipientPublicKeys,
+    ...escrowDepositFields(parameters)
+  };
+  return {
+    deposit,
+    commitment_hex: generated.commitment_hex,
+    coin: generated.coin,
+    depositScalarHex: scalarHex,
+    precommitementHex: generated.precommitementHex
+  };
+}
+
+// src/transact/pool/initialize-sdk.ts
+import { PrivacyPoolSDK as PrivacyPoolSDK2 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+async function initializePrivacyPoolSdk(input, nonce) {
+  const zkConfigNonce = nonce ?? input.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+  const zkCircuits = await materializeSelectedZkCircuit(
+    input.zkCircuits,
+    zkConfigNonce,
+    input.zkArtifactBaseUrl
+  );
+  return PrivacyPoolSDK2.init({
+    wasmBinary: input.assets.sdkWasm,
+    zkCircuits,
+    zkConfigNonce,
+    ...optionalZkArtifactBaseUrl(input.zkArtifactBaseUrl)
+  });
+}
+
+// src/transact/fees/zk-config-nonce-for-kind.ts
+function configuredNonceSpread(zkConfigNonce) {
+  if (zkConfigNonce === void 0) {
+    return {};
+  }
+  return { configuredNonce: zkConfigNonce };
+}
+function zkConfigNonceForFeeBearingKind(input) {
+  if (input.configuredNonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  if (input.kind === "transfer" && shouldAttachFeeOutput(input)) {
+    return SIX_BY_SIX_BINDING_ZK_NONCE;
+  }
+  return input.configuredNonce ?? BINDING_ZK_NONCE;
+}
+
+// src/transact/pool/prepare-deposit-proof.ts
+import {
+  randomFrDecimal253,
+  scalarHexToFrDecimal as scalarHexToFrDecimal2
+} from "@arcanetech/stellar-privacy-pool-zk-sdk";
+function userDepositSlot(input) {
+  return {
+    value: input.coin.value,
+    nullifier: input.coin.nullifier,
+    ephemeralKeyScalar: scalarHexToFrDecimal2(input.depositScalarHex),
+    asset: [input.coin.asset_hi, input.coin.asset_lo],
+    applicationId: input.applicationId,
+    recipientPublicKeys: recipientPublicKeysDecimalFromPrivateAddress(
+      input.privateAddressStpl1
+    )
+  };
+}
+function outputApplicationIds(input) {
+  if (input.hasFeeOutput) {
+    return [input.applicationId, input.applicationId];
+  }
+  return [input.applicationId];
+}
+async function proveDepositTransact(input) {
+  const publicDeposit = (input.publicDepositStroops ?? BigInt(input.coin.value)).toString();
+  const withFee = await appendFeeOutputSlot({
+    deposits: [userDepositSlot(input)],
+    tokenAddress: input.tokenAddress,
+    buildAlignedDepositSlot: input.buildAlignedDepositSlot,
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  });
+  const audit = buildPoolTransactionAuditParameters({
+    applicationId: input.applicationId,
+    nAuditSlots: input.sdk.getLayout().nAuditSlots,
+    ...input.auditPublicKey ? { auditPublicKey: input.auditPublicKey } : {}
+  });
+  const proof = await input.sdk.proveTransaction(
+    withTokenAddressPublicInputs(
+      {
+        stateRoot: merkleRootBufferToFrDecimal(input.merkleRootBytes),
+        privKeyScalar: randomFrDecimal253()
+      },
+      input.tokenAddress
+    ),
+    padPublicLegsToLayout(
+      input.sdk,
+      buildPublicDepositLegs(input.tokenAddress, publicDeposit)
+    ),
+    padWithdrawSlotsToLayout(input.sdk, []),
+    padDepositSlotsToLayout(input.sdk, withFee.deposits),
+    audit
+  );
   return {
-    deposit,
-    commitment_hex: generated.commitment_hex,
-    coin: generated.coin,
-    depositScalarHex: scalarHex,
-    precommitementHex: generated.precommitementHex
+    ...proof,
+    applicationIdsPlaintext: buildApplicationIdHints({
+      sdk: input.sdk,
+      inputIds: [],
+      outputIds: outputApplicationIds({
+        applicationId: input.applicationId,
+        hasFeeOutput: Boolean(withFee.feeCoin)
+      })
+    })
   };
 }
 
@@ -1421,42 +1986,50 @@ var PrivacyPoolService = class {
   zkCircuits;
   zkConfigNonce;
   zkArtifactBaseUrl;
-  sdk = void 0;
-  initPromise = void 0;
-  async ensureInit() {
-    if (this.sdk) {
-      return;
+  sdks = /* @__PURE__ */ new Map();
+  initPromises = /* @__PURE__ */ new Map();
+  async getInitializedSdk(nonce) {
+    const zkConfigNonce = nonce ?? this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+    const key = zkConfigNonce.toString();
+    const existing = this.sdks.get(key);
+    if (existing) {
+      return existing;
     }
-    if (this.initPromise) {
-      return this.initPromise;
+    const pending = this.initPromises.get(key);
+    if (pending) {
+      return pending;
     }
-    this.initPromise = (async () => {
-      if (!this.assets) {
-        throw new Error(
-          "PrivacyPoolService requires browser ZK assets before initialization."
-        );
-      }
-      const zkConfigNonce = this.zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
-      const zkCircuits = await materializeSelectedZkCircuit(
-        this.zkCircuits,
-        zkConfigNonce,
-        this.zkArtifactBaseUrl
-      );
-      this.sdk = await PrivacyPoolSDK2.init({
-        wasmBinary: this.assets.sdkWasm,
-        zkCircuits,
-        zkConfigNonce,
-        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
-      });
-    })();
-    return this.initPromise;
+    const started = this.initializeSdk(zkConfigNonce);
+    this.initPromises.set(key, started);
+    try {
+      const sdk = await started;
+      this.sdks.set(key, sdk);
+      return sdk;
+    } finally {
+      this.initPromises.delete(key);
+    }
+  }
+  feeBearingZkConfigNonce(input) {
+    return zkConfigNonceForFeeBearingKind({
+      ...input,
+      ...configuredNonceSpread(this.zkConfigNonce)
+    });
   }
-  async getInitializedSdk() {
-    await this.ensureInit();
-    if (!this.sdk) {
-      throw new Error("SDK not initialized");
+  async initializeSdk(nonce) {
+    if (!this.assets) {
+      throw new Error(
+        "PrivacyPoolService requires browser ZK assets before initialization."
+      );
     }
-    return this.sdk;
+    return initializePrivacyPoolSdk(
+      {
+        assets: this.assets,
+        ...this.zkCircuits ? { zkCircuits: this.zkCircuits } : {},
+        ...this.zkConfigNonce === void 0 ? {} : { zkConfigNonce: this.zkConfigNonce },
+        ...optionalZkArtifactBaseUrl(this.zkArtifactBaseUrl)
+      },
+      nonce
+    );
   }
   getAuditPublicKey() {
     return this.auditPublicKey;
@@ -1489,65 +2062,51 @@ var PrivacyPoolService = class {
     return { commitment_hex, coin, depositScalarHex, precommitementHex };
   }
   async prepareDepositTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
-    const stateRoot = merkleRootBufferToFrDecimal(parameters.merkleRootBytes);
-    const recipientPublicKeys = recipientPublicKeysDecimalFromPrivateAddress(
-      parameters.privateAddressStpl1
-    );
-    const applicationId = this.getApplicationId();
-    const audit = buildPoolTransactionAuditParameters({
-      applicationId,
-      nAuditSlots: sdk.getLayout().nAuditSlots,
-      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {}
-    });
-    const deposit = {
-      value: parameters.coin.value,
-      nullifier: parameters.coin.nullifier,
-      ephemeralKeyScalar: scalarHexToFrDecimal2(parameters.depositScalarHex),
-      asset: [parameters.coin.asset_hi, parameters.coin.asset_lo],
-      applicationId,
-      recipientPublicKeys
-    };
-    const publicInput = withTokenAddressPublicInputs(
-      {
-        stateRoot,
-        privKeyScalar: randomFrDecimal253()
-      },
-      parameters.tokenAddress
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "deposit" })
     );
-    const proof = await sdk.proveTransaction(
-      publicInput,
-      padPublicLegsToLayout(
-        sdk,
-        buildPublicDepositLegs(parameters.tokenAddress, parameters.coin.value)
-      ),
-      padWithdrawSlotsToLayout(sdk, []),
-      padDepositSlotsToLayout(sdk, [deposit]),
-      audit
-    );
-    const applicationIdsPlaintext = buildApplicationIdHints({
+    return proveDepositTransact({
       sdk,
-      inputIds: [],
-      outputIds: [applicationId]
+      applicationId: this.getApplicationId(),
+      privateAddressStpl1: parameters.privateAddressStpl1,
+      coin: parameters.coin,
+      depositScalarHex: parameters.depositScalarHex,
+      merkleRootBytes: parameters.merkleRootBytes,
+      tokenAddress: parameters.tokenAddress,
+      buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
+      ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
+      ...parameters.publicDepositStroops === void 0 ? {} : { publicDepositStroops: parameters.publicDepositStroops },
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
-    return { ...proof, applicationIdsPlaintext };
   }
   async calculateNullifierHash(nullifier, privKeyScalar) {
     const sdk = await this.getInitializedSdk();
     return sdk.calculateNullifierHash(nullifier, privKeyScalar);
   }
   async prepareWithdrawTransactProof(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransact({
       sdk,
       applicationId: this.getApplicationId(),
       buildAlignedDepositSlot: (input) => this.buildAlignedDepositSlot(input),
       ...this.auditPublicKey ? { auditPublicKey: this.auditPublicKey } : {},
-      ...parameters
+      coin: parameters.coin,
+      state: parameters.state,
+      destinationStellarAddress: parameters.destinationStellarAddress,
+      privKeyScalarHex: parameters.privKeyScalarHex,
+      depositorEphemeralKey: parameters.depositorEphemeralKey,
+      withdrawAmountStroops: parameters.withdrawAmountStroops,
+      changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
   async prepareWithdrawTransactProofDual(parameters) {
-    const sdk = await this.getInitializedSdk();
+    const sdk = await this.getInitializedSdk(
+      this.feeBearingZkConfigNonce({ kind: "withdraw" })
+    );
     return proveWithdrawTransactDual({
       sdk,
       applicationId: this.getApplicationId(),
@@ -1562,7 +2121,8 @@ var PrivacyPoolService = class {
       ephemeralBKey: parameters.depositorEphemeralBKey,
       withdrawAmountStroops: parameters.withdrawAmountStroops,
       changePrivateAddressStpl1: parameters.changePrivateAddressStpl1,
-      tokenAddress: parameters.tokenAddress
+      tokenAddress: parameters.tokenAddress,
+      ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
     });
   }
 };
@@ -1581,6 +2141,7 @@ function createPrivacyPoolService(input) {
 var configuredPrivacyPoolService;
 function configurePrivacyPoolService(service) {
   configuredPrivacyPoolService = service;
+  registerMerkleSessionSdkHost(service);
 }
 function getPrivacyPoolService() {
   if (!configuredPrivacyPoolService) {
@@ -1599,7 +2160,8 @@ function poolMerkleStateToCachedView(state) {
   return {
     commitments: state.commitments,
     updatedAt: state.updatedAt,
-    merkleRootHex: state.merkleRootHex
+    merkleRootHex: state.merkleRootHex,
+    ...state.nodes ? { nodes: state.nodes } : {}
   };
 }
 
@@ -1732,6 +2294,65 @@ function reuseCachedCommitments(input) {
   return cachedCommitments;
 }
 
+// src/transact/merkle/persist-fetched.ts
+function cachedMerkleUnchanged(cachedState, commitments, merkleRootHex) {
+  if (!cachedState) {
+    return false;
+  }
+  if (cachedState.commitments.length !== commitments.length) {
+    return false;
+  }
+  return cachedState.merkleRootHex === merkleRootHex;
+}
+function viewFromCachedMerkle(cachedState, merkleRootHex) {
+  return {
+    commitments: cachedState.commitments,
+    updatedAt: cachedState.updatedAt,
+    merkleRootHex: cachedState.merkleRootHex ?? merkleRootHex,
+    commitmentCount: cachedState.commitments.length,
+    ...cachedState.nodes ? { nodes: cachedState.nodes } : {}
+  };
+}
+function merkleStateForPersist(input) {
+  return {
+    poolContract: input.poolContractId,
+    commitments: input.commitments,
+    commitmentCount: input.commitments.length,
+    merkleRootHex: input.merkleRootHex,
+    updatedAt: input.updatedAt,
+    ...input.nodes ? { nodes: input.nodes } : {}
+  };
+}
+async function persistFetchedMerkleState(input) {
+  const cachedState = input.cachedState;
+  if (cachedMerkleUnchanged(cachedState, input.commitments, input.merkleRootHex) && cachedState) {
+    return viewFromCachedMerkle(cachedState, input.merkleRootHex);
+  }
+  const nodes = await resolveExtendedMerkleNodes({
+    poolContract: input.poolContractId,
+    commitments: input.commitments,
+    merkleRootHex: input.merkleRootHex,
+    ...cachedState ? { cachedState } : {}
+  });
+  const updatedAt = Date.now();
+  await input.poolMerkleState?.set(
+    merkleStateForPersist({
+      poolContractId: input.poolContractId,
+      commitments: input.commitments,
+      merkleRootHex: input.merkleRootHex,
+      updatedAt,
+      ...nodes ? { nodes } : {}
+    })
+  );
+  return {
+    commitments: input.commitments,
+    updatedAt,
+    merkleRootHex: input.merkleRootHex,
+    commitmentCount: input.commitments.length,
+    ...nodes ? { nodes } : {}
+  };
+}
+
 // src/transact/merkle/fetch-contract.ts
 async function fetchAndMergeMerkleState(parameters) {
   const client = createPoolClient(parameters);
@@ -1824,43 +2445,6 @@ async function loadCommitments(input) {
   });
   return [...reused, ...fetched];
 }
-async function persistFetchedMerkleState(input) {
-  const cachedState = input.cachedState;
-  if (cachedState && cachedMerkleUnchanged(cachedState, input.commitments, input.merkleRootHex)) {
-    return viewFromCachedMerkle(cachedState, input.merkleRootHex);
-  }
-  const updatedAt = Date.now();
-  await input.poolMerkleState?.set({
-    poolContract: input.poolContractId,
-    commitments: input.commitments,
-    commitmentCount: input.commitments.length,
-    merkleRootHex: input.merkleRootHex,
-    updatedAt
-  });
-  return {
-    commitments: input.commitments,
-    updatedAt,
-    merkleRootHex: input.merkleRootHex,
-    commitmentCount: input.commitments.length
-  };
-}
-function viewFromCachedMerkle(cachedState, merkleRootHex) {
-  return {
-    commitments: cachedState.commitments,
-    updatedAt: cachedState.updatedAt,
-    merkleRootHex: cachedState.merkleRootHex ?? merkleRootHex,
-    commitmentCount: cachedState.commitments.length
-  };
-}
-function cachedMerkleUnchanged(cachedState, commitments, merkleRootHex) {
-  if (!cachedState) {
-    return false;
-  }
-  if ((cachedState.merkleRootHex ?? merkleRootHex) !== merkleRootHex) {
-    return false;
-  }
-  return cachedState.commitments.join(",") === commitments.join(",");
-}
 
 // src/transact/engine/prepare/shared.ts
 async function resolveTokenContractId2(environment, assetId) {
@@ -1935,7 +2519,11 @@ async function loadMerkleState(environment, walletPublicKey) {
     transactEnvironment: environment,
     ...environment.poolMerkleState ? { poolMerkleState: environment.poolMerkleState } : {}
   });
-  return { commitments: merged.commitments };
+  return merkleSnapshotToStateFile({
+    commitments: merged.commitments,
+    merkleRootHex: merged.merkleRootHex,
+    ...merged.nodes ? { nodes: merged.nodes } : {}
+  });
 }
 function enrichPreparedOperation(prepared, outputRecords, artifacts) {
   return {
@@ -2150,6 +2738,13 @@ async function filterUnspentPrivateRecords(input) {
   }
   return unspent;
 }
+function spendAmountCoveringProtocolFee(amount) {
+  if (amount <= 0n) {
+    return amount;
+  }
+  const hundredths = (amount + 99n) / 100n;
+  return amount + (hundredths === 0n ? 1n : hundredths);
+}
 function pickRecordsForSpendAmount(input) {
   let selectedTotal = 0n;
   const selected = [];
@@ -2203,7 +2798,7 @@ async function selectPrivateRecords(input) {
   return pickRecordsForSpendAmount({
     available,
     kind: input.kind,
-    amount: input.intent.amount
+    amount: spendAmountCoveringProtocolFee(input.intent.amount)
   });
 }
 function sumRecordAmounts(records) {
@@ -2437,13 +3032,19 @@ var walletPrivateAddressRecordSchema = z.object({
   privateAddress: z.string().min(1),
   createdAt: z.number()
 });
+var leanImtNodeSchema = z.object({
+  level: z.number().int().nonnegative(),
+  index: z.number().int().nonnegative(),
+  value: z.string().min(1)
+});
 var poolMerkleStateSchema = z.object({
   poolContract: z.string().min(1),
   commitments: z.array(z.string()),
   commitmentCount: z.number().int().nonnegative(),
   merkleRootHex: z.string().min(1),
   updatedAt: z.number(),
-  syncedLedger: z.number().int().optional()
+  syncedLedger: z.number().int().optional(),
+  nodes: z.array(leanImtNodeSchema).optional()
 });
 var leafEphemeralSchema = z.object({
   poolContract: z.string().min(1),
@@ -3856,6 +4457,7 @@ function createPoolMerkleService(context) {
     async appendPoolCommitments(input) {
       const current = await this.getPoolMerkleState(input.poolContract);
       const mergedCommitments = [...current?.commitments ?? [], ...input.commitments];
+      const nodes = input.nodes ?? (input.commitments.length === 0 ? current?.nodes : void 0);
       await this.setPoolMerkleState(
         withoutUndefinedFields({
           poolContract: input.poolContract,
@@ -3863,7 +4465,8 @@ function createPoolMerkleService(context) {
           commitmentCount: mergedCommitments.length,
           merkleRootHex: input.merkleRootHex,
           updatedAt: Date.now(),
-          syncedLedger: input.syncedLedger ?? current?.syncedLedger
+          syncedLedger: input.syncedLedger ?? current?.syncedLedger,
+          nodes
         })
       );
     }
@@ -5133,12 +5736,46 @@ function createDeliveriesStateDelegates(state) {
   };
 }
 
+// src/transact/merkle/write-snapshot.ts
+async function writePoolMerkleState(input) {
+  await input.setPoolMerkleState(input.state);
+  await bindPoolMerkleTree(input.state);
+}
+async function appendPoolMerkleCommitments(input) {
+  const current = await input.getPoolMerkleState(input.payload.poolContract);
+  const merged = [...current?.commitments ?? [], ...input.payload.commitments];
+  const nodes = input.payload.nodes ?? await resolveExtendedMerkleNodes({
+    poolContract: input.payload.poolContract,
+    commitments: merged,
+    merkleRootHex: input.payload.merkleRootHex,
+    ...current ? { cachedState: poolMerkleStateToCachedView(current) } : {}
+  });
+  await input.appendPoolCommitments({
+    poolContract: input.payload.poolContract,
+    commitments: input.payload.commitments,
+    merkleRootHex: input.payload.merkleRootHex,
+    ...input.payload.syncedLedger === void 0 ? {} : { syncedLedger: input.payload.syncedLedger },
+    ...nodes ? { nodes } : {}
+  });
+  const written = await input.getPoolMerkleState(input.payload.poolContract);
+  if (written) {
+    await bindPoolMerkleTree(written);
+  }
+}
+
 // src/client/state-delegates/pool.ts
 function createPoolStateDelegates(state) {
   return {
     getPoolMerkleState: (poolContract) => state.getPoolMerkleState(poolContract),
-    setPoolMerkleState: (poolState) => state.setPoolMerkleState(poolState),
-    appendPoolCommitments: (input) => state.appendPoolCommitments(input),
+    setPoolMerkleState: (poolState) => writePoolMerkleState({
+      setPoolMerkleState: (next) => state.setPoolMerkleState(next),
+      state: poolState
+    }),
+    appendPoolCommitments: (input) => appendPoolMerkleCommitments({
+      getPoolMerkleState: (poolContract) => state.getPoolMerkleState(poolContract),
+      appendPoolCommitments: (payload) => state.appendPoolCommitments(payload),
+      payload: input
+    }),
     getLeafEphemeral: (input) => state.getLeafEphemeral(input),
     setLeafEphemeral: (ephemeral) => state.setLeafEphemeral(ephemeral)
   };
@@ -5191,12 +5828,42 @@ function createStateDelegates(state) {
   };
 }
 
+// src/client/hydrate-state.ts
+async function hydratePoolMerkleStates(client, states) {
+  for (const poolState of states ?? []) {
+    await client.setPoolMerkleState(poolState);
+  }
+}
+async function hydrateWalletAddresses(client, snapshot) {
+  for (const record of snapshot.walletPrivateAddressRecords ?? []) {
+    await client.saveWalletPrivateAddressRecord(record);
+  }
+  for (const scalar of snapshot.walletPrivateAddressScalars ?? []) {
+    await client.saveWalletPrivateAddressScalar(scalar);
+  }
+  for (const entry of snapshot.walletDefaultPrivateAddressNonces ?? []) {
+    await client.setWalletDefaultPrivateAddressNonce(entry);
+  }
+}
+async function hydrateStellarPrivacyState(client, snapshot) {
+  if (snapshot.assets && snapshot.assets.length > 0) {
+    await client.replaceAssets(snapshot.assets);
+  }
+  await hydratePoolMerkleStates(client, snapshot.poolMerkleStates);
+  if (snapshot.privateRecords && snapshot.privateRecords.length > 0) {
+    await client.upsertPrivateRecords(snapshot.privateRecords);
+  }
+  await hydrateWalletAddresses(client, snapshot);
+}
+
 // src/client/client.ts
 function createStellarPrivacyClientInstance(config) {
   const composed = composeStellarPrivacyClient(config);
+  const stateDelegates = createStateDelegates(composed.state);
   return {
     state: composed.state,
-    ...createStateDelegates(composed.state),
+    ...stateDelegates,
+    hydrateState: (snapshot) => hydrateStellarPrivacyState(stateDelegates, snapshot),
     deposit: (intent) => composed.operations.deposit(intent),
     transfer: (intent) => composed.operations.transfer(intent),
     withdraw: (intent) => composed.operations.withdraw(intent),
@@ -5312,7 +5979,7 @@ function createStellarPrivacyClientFromResolvedConfig(config) {
 }
 
 // src/transact/engine/default-factory.ts
-import { PrivacyPoolSDK as PrivacyPoolSDK3 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
+import { PrivacyPoolSDK as PrivacyPoolSDK4 } from "@arcanetech/stellar-privacy-pool-zk-sdk";
 
 // src/transact/pool/proof-types.ts
 function ciphertextArtifactsFromProof(proof) {
@@ -5327,9 +5994,15 @@ function ciphertextArtifactsFromProof(proof) {
 // src/transact/engine/prepare/deposit.ts
 var STROOPS_PER_UNIT = 10000000n;
 async function createAlignedDepositWithProof(parameters) {
+  const feeOutput = await quoteFeeOutputForPrepared(parameters);
+  const instructed = parameters.prepared.intent.amount;
+  const userAmount = instructed - (feeOutput?.requiredFee ?? 0n);
+  if (userAmount <= 0n) {
+    throw new Error("Required Fee leaves no spendable deposit note");
+  }
   const aligned = await parameters.poolService.createAlignedShieldCoinData({
     privateAddressStpl1: parameters.prepared.intent.to,
-    amountStroops: parameters.prepared.intent.amount,
+    amountStroops: userAmount,
     tokenAddress: parameters.tokenAddress
   });
   const poolClient = readPoolClientFactory(parameters.environment)({
@@ -5344,7 +6017,9 @@ async function createAlignedDepositWithProof(parameters) {
     coin: aligned.coin,
     depositScalarHex: aligned.depositScalarHex,
     merkleRootBytes: merkleTx.result,
-    tokenAddress: parameters.tokenAddress
+    tokenAddress: parameters.tokenAddress,
+    publicDepositStroops: instructed,
+    ...feeOutput ? { feeOutput } : {}
   });
   return { ...aligned, proof };
 }
@@ -5363,8 +6038,8 @@ async function prepareDepositOperation(prepared, environment, poolService) {
     privateAddress: prepared.intent.to,
     assetId: prepared.intent.asset,
     poolContract: environment.network.poolContract,
-    amount: prepared.intent.amount,
-    amountDisplay: Number(prepared.intent.amount) / Number(STROOPS_PER_UNIT),
+    amount: BigInt(depositProof.coin.value),
+    amountDisplay: Number(depositProof.coin.value) / Number(STROOPS_PER_UNIT),
     commitmentHex: depositProof.commitment_hex,
     coin: depositProof.coin,
     depositScalarHex: depositProof.depositScalarHex,
@@ -5380,7 +6055,11 @@ async function prepareDepositOperation(prepared, environment, poolService) {
     depositScalarHex: depositProof.depositScalarHex,
     precommitementHex: depositProof.precommitementHex,
     commitmentHex: depositProof.commitment_hex,
-    walletPublicKey
+    walletPublicKey,
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      kind: "deposit",
+      ...configuredNonceSpread(environment.zkConfigNonce)
+    })
   });
 }
 
@@ -5505,7 +6184,8 @@ async function buildSpendProofContextAtExecute(input) {
     input.prepared.intent.asset
   );
   const coin = requireCoinNoteFromRecord(primaryRecord);
-  const { commitments } = await loadMerkleState(input.environment, walletPublicKey);
+  const merkleState = await loadMerkleState(input.environment, walletPublicKey);
+  const commitments = merkleState.commitments;
   const leafIndex = findCommitmentLeafIndex(commitments, coin.commitment);
   if (leafIndex < 0) {
     throw new Error("Coin commitment not found in on-chain Merkle state.");
@@ -5522,6 +6202,7 @@ async function buildSpendProofContextAtExecute(input) {
     tokenAddress,
     coin,
     commitments,
+    merkleState,
     ephemeral,
     senderPrivKeyScalarHex,
     recipientPrivateAddressStpl1: input.recipientPrivateAddressStpl1
@@ -5554,9 +6235,6 @@ function escrowOutputFields(input) {
     recipientLo: input.escrowSend.recipientLo
   };
 }
-function paddingDepositPair(recipientDeposit) {
-  return [recipientDeposit, "dummy"];
-}
 async function buildChangeDepositPair(parameters) {
   const changeSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
     privateAddressStpl1: parameters.selfPrivateAddressStpl1ForChange.trim(),
@@ -5573,34 +6251,54 @@ async function buildChangeDepositPair(parameters) {
     }
   };
 }
+function recipientOnlyDeposits(recipientDeposit, hasFeeOutput) {
+  if (hasFeeOutput) {
+    return [recipientDeposit];
+  }
+  return [recipientDeposit, "dummy"];
+}
+async function depositsWithoutFee(input) {
+  if (input.changeStroops <= ZERO_STROOPS) {
+    return {
+      deposits: recipientOnlyDeposits(input.recipientDeposit, input.hasFeeOutput)
+    };
+  }
+  return buildChangeDepositPair({
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    changeStroops: input.changeStroops,
+    tokenAddress: input.tokenAddress,
+    recipientDeposit: input.recipientDeposit
+  });
+}
 async function buildRecipientAndOptionalChangeDeposits(parameters) {
   const escrow = {
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
     ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
   };
-  const recipientPrivateAddress = parameters.recipientPrivateAddressStpl1.trim();
   const recipientSlot = await getPrivacyPoolService().buildAlignedDepositSlot({
-    privateAddressStpl1: recipientPrivateAddress,
+    privateAddressStpl1: parameters.recipientPrivateAddressStpl1.trim(),
     amountStroops: parameters.transferStroops,
     tokenAddress: parameters.tokenAddress,
     ...escrowOutputFields(escrow)
   });
-  if (parameters.changeStroops <= ZERO_STROOPS) {
-    return {
-      recipientSlot,
-      deposits: paddingDepositPair(recipientSlot.deposit)
-    };
-  }
-  const changeResult = await buildChangeDepositPair({
-    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+  const withoutFee = await depositsWithoutFee({
+    recipientDeposit: recipientSlot.deposit,
     changeStroops: parameters.changeStroops,
+    selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
+    tokenAddress: parameters.tokenAddress,
+    hasFeeOutput: (parameters.feeOutput?.requiredFee ?? ZERO_STROOPS) > ZERO_STROOPS
+  });
+  const withFee = await appendFeeOutputSlot({
+    deposits: withoutFee.deposits,
     tokenAddress: parameters.tokenAddress,
-    recipientDeposit: recipientSlot.deposit
+    buildAlignedDepositSlot: (aligned) => getPrivacyPoolService().buildAlignedDepositSlot(aligned),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return {
     recipientSlot,
-    deposits: changeResult.deposits,
-    changeCoin: changeResult.changeCoin
+    deposits: withFee.deposits,
+    ..."changeCoin" in withoutFee ? { changeCoin: withoutFee.changeCoin } : {},
+    ...withFee.feeCoin ? { feeCoin: withFee.feeCoin } : {}
   };
 }
 
@@ -5653,14 +6351,15 @@ function sweepOutputOwnerFields(parameters) {
   return { sweepOutputOwnerPubX, sweepOutputOwnerPubY };
 }
 async function buildTransferDepositsAndPublicInput(parameters) {
-  const { recipientSlot, deposits, changeCoin } = await buildRecipientAndOptionalChangeDeposits({
+  const { recipientSlot, deposits, changeCoin, feeCoin } = await buildRecipientAndOptionalChangeDeposits({
     recipientPrivateAddressStpl1: parameters.recipientPrivateAddressStpl1,
     transferStroops: parameters.transferStroops,
     changeStroops: parameters.changeStroops,
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   const publicInput = withTokenAddressPublicInputs(
     {
@@ -5675,6 +6374,7 @@ async function buildTransferDepositsAndPublicInput(parameters) {
     recipientSlot,
     deposits,
     ...changeCoin ? { changeCoin } : {},
+    ...feeCoin ? { feeCoin } : {},
     publicInput
   };
 }
@@ -5690,7 +6390,8 @@ async function buildSenderTransferDepositsAndPublicInput(parameters) {
       parameters.senderPrivKeyScalarHex
     ),
     ...parameters.escrowSend ? { escrowSend: parameters.escrowSend } : {},
-    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {}
+    ...parameters.escrowClaimantLimbs ? { escrowClaimantLimbs: parameters.escrowClaimantLimbs } : {},
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
 }
 
@@ -5714,11 +6415,20 @@ function stampDualWithdrawLegs(legs, parameters) {
     }
   };
 }
-function buildDualTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildDualTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId, applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 async function proveDualConfidentialTransfer(parameters) {
@@ -5738,16 +6448,24 @@ async function proveDualConfidentialTransfer(parameters) {
     audit
   );
 }
-async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+function dualTransferChangeStroops(parameters) {
   const totalNotes = BigInt(parameters.coinA.value) + BigInt(parameters.coinB.value);
-  const changeStroops = changeStroopsAfterDualTransfer(
-    parameters.transferStroops,
-    totalNotes
-  );
+  if (parameters.transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
+    throw new Error("Transfer amount must be positive");
+  }
+  const changeStroops = remainingAfterRequiredFee({
+    available: totalNotes,
+    instructed: parameters.transferStroops,
+    requiredFee: parameters.feeOutput?.requiredFee ?? 0n
+  });
   requireChangeRecipientWhenPartial(
     changeStroops,
     parameters.selfPrivateAddressStpl1ForChange
   );
+  return changeStroops;
+}
+async function buildDualTransferProofContext(parameters, applicationId, sdk) {
+  const changeStroops = dualTransferChangeStroops(parameters);
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.senderPrivKeyScalarHex
   );
@@ -5774,15 +6492,21 @@ async function buildDualTransferProofContext(parameters, applicationId, sdk) {
     selfPrivateAddressStpl1ForChange: parameters.selfPrivateAddressStpl1ForChange,
     tokenAddress: parameters.tokenAddress,
     stateRoot: legA.witness.stateRoot,
-    ...confidentialEscrowFields(parameters)
+    ...confidentialEscrowFields(parameters),
+    ...parameters.feeOutput ? { feeOutput: parameters.feeOutput } : {}
   });
   return { legA, legB, applicationId, ...transferInputs };
 }
 async function prepareConfidentialTransferProofDual(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
-  const { legA, legB, recipientSlot, deposits, changeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
+  const { legA, legB, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildDualTransferProofContext(parameters, applicationId, sdk);
   const auditPublicKey = poolService.getAuditPublicKey();
   const proof = await (auditPublicKey ? proveDualConfidentialTransfer({
     sdk,
@@ -5805,7 +6529,8 @@ async function prepareConfidentialTransferProofDual(parameters) {
     applicationIdsPlaintext: buildDualTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -5813,22 +6538,32 @@ async function prepareConfidentialTransferProofDual(parameters) {
 }
 
 // src/transact/proofs/confidential/single.ts
-function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange) {
+function validateSingleCoinTransferAmounts(transferStroops, noteStroops, selfPrivateAddressStpl1ForChange, requiredFee) {
   if (transferStroops < MIN_CONFIDENTIAL_TRANSFER_STROOPS) {
     throw new Error("Transfer amount must be positive");
   }
-  if (transferStroops > noteStroops) {
-    throw new Error("Transfer amount exceeds note value");
-  }
-  const changeStroops = noteStroops - transferStroops;
+  const changeStroops = remainingAfterRequiredFee({
+    available: noteStroops,
+    instructed: transferStroops,
+    requiredFee
+  });
   requireChangeRecipientWhenPartial(changeStroops, selfPrivateAddressStpl1ForChange);
   return changeStroops;
 }
-function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin) {
+function buildSingleTransferApplicationIds(sdk, applicationId, changeCoin, feeCoin) {
+  const outputIds = [applicationId];
+  if (changeCoin) {
+    outputIds.push(applicationId);
+  } else if (!feeCoin) {
+    outputIds.push("0");
+  }
+  if (feeCoin) {
+    outputIds.push(applicationId);
+  }
   return buildApplicationIdHints({
     sdk,
     inputIds: [applicationId],
-    outputIds: [applicationId, changeCoin ? applicationId : "0"]
+    outputIds
   });
 }
 function buildTransferAuditParameters(parameters) {
@@ -5854,11 +6589,25 @@ function confidentialEscrowFields2(input) {
     ...input.escrowClaimantLimbs ? { escrowClaimantLimbs: input.escrowClaimantLimbs } : {}
   };
 }
+function transferDepositInputFromProof(input, changeStroops, stateRoot) {
+  return {
+    senderPrivKeyScalarHex: input.senderPrivKeyScalarHex,
+    recipientPrivateAddressStpl1: input.recipientPrivateAddressStpl1,
+    transferStroops: input.transferStroops,
+    changeStroops,
+    selfPrivateAddressStpl1ForChange: input.selfPrivateAddressStpl1ForChange,
+    tokenAddress: input.tokenAddress,
+    stateRoot,
+    ...confidentialEscrowFields2(input),
+    ...input.feeOutput ? { feeOutput: input.feeOutput } : {}
+  };
+}
 async function buildTransferProofInputs(parameters) {
   const changeStroops = validateSingleCoinTransferAmounts(
     parameters.input.transferStroops,
     parameters.noteStroops,
-    parameters.input.selfPrivateAddressStpl1ForChange
+    parameters.input.selfPrivateAddressStpl1ForChange,
+    parameters.input.feeOutput?.requiredFee ?? 0n
   );
   const privKeyScalar = privKeyScalarDecimalFromRecipientScalarHex(
     parameters.input.senderPrivKeyScalarHex
@@ -5877,31 +6626,30 @@ async function buildTransferProofInputs(parameters) {
     withdrawObject,
     sweepWithdrawStamp(confidentialEscrowFields2(parameters.input))
   );
-  const { recipientSlot, deposits, changeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput({
-    senderPrivKeyScalarHex: parameters.input.senderPrivKeyScalarHex,
-    recipientPrivateAddressStpl1: parameters.input.recipientPrivateAddressStpl1,
-    transferStroops: parameters.input.transferStroops,
-    changeStroops,
-    selfPrivateAddressStpl1ForChange: parameters.input.selfPrivateAddressStpl1ForChange,
-    tokenAddress: parameters.input.tokenAddress,
-    stateRoot: witness.stateRoot,
-    ...confidentialEscrowFields2(parameters.input)
-  });
+  const { recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildSenderTransferDepositsAndPublicInput(
+    transferDepositInputFromProof(parameters.input, changeStroops, witness.stateRoot)
+  );
   return {
     witness,
     withdrawObject: stampedWithdraw,
     recipientSlot,
     deposits,
     changeCoin,
+    feeCoin,
     publicInput
   };
 }
 async function prepareConfidentialTransferProof(parameters) {
   const poolService = getPrivacyPoolService();
-  const sdk = await poolService.getInitializedSdk();
+  const sdk = await poolService.getInitializedSdk(
+    poolService.feeBearingZkConfigNonce({
+      kind: "transfer",
+      ...parameters.escrowClaimantLimbs ? { spendSource: "escrow" } : {}
+    })
+  );
   const applicationId = poolService.getApplicationId();
   const noteStroops = BigInt(parameters.coin.value);
-  const { withdrawObject, recipientSlot, deposits, changeCoin, publicInput } = await buildTransferProofInputs({
+  const { withdrawObject, recipientSlot, deposits, changeCoin, feeCoin, publicInput } = await buildTransferProofInputs({
     sdk,
     applicationId,
     input: parameters,
@@ -5924,7 +6672,8 @@ async function prepareConfidentialTransferProof(parameters) {
     applicationIdsPlaintext: buildSingleTransferApplicationIds(
       sdk,
       applicationId,
-      changeCoin
+      changeCoin,
+      feeCoin
     ),
     recipientCoin: generatedOutputCoinFromSlot(recipientSlot),
     ...changeCoin ? { changeCoin } : {}
@@ -5947,10 +6696,15 @@ function proofEscrowFields(input) {
 }
 async function buildSingleTransferProofAtExecute(input) {
   const context = await buildSpendProofContextAtExecute(input);
-  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = BigInt(context.coin.value) - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProof({
     coin: context.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     senderPrivKeyScalarHex: context.senderPrivKeyScalarHex,
     depositorEphemeralKey: serializeEphemeralKeyString({
       xHex: context.ephemeral.xHex,
@@ -5960,7 +6714,8 @@ async function buildSingleTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -5977,11 +6732,16 @@ async function buildDualTransferProofAtExecute(input) {
     commitments: context.commitments
   });
   const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - input.prepared.intent.amount;
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: context.tokenAddress
+  });
+  const changeStroops = totalNotes - input.prepared.intent.amount - (feeOutput?.requiredFee ?? 0n);
   const proof = await prepareConfidentialTransferProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     senderPrivKeyScalarHex: context.senderPrivKeyScalarHex,
     ephemeralAKey: serializeEphemeralKeyString({
       xHex: context.ephemeral.xHex,
@@ -5995,7 +6755,8 @@ async function buildDualTransferProofAtExecute(input) {
     recipientPrivateAddressStpl1: context.recipientPrivateAddressStpl1,
     selfPrivateAddressStpl1ForChange: readChangeRecipient(input, changeStroops),
     tokenAddress: context.tokenAddress,
-    ...proofEscrowFields(input)
+    ...proofEscrowFields(input),
+    ...feeOutput ? { feeOutput } : {}
   });
   return { context, proof };
 }
@@ -6127,11 +6888,17 @@ async function runTransferFinalizeSteps(input) {
     walletPublicKey: input.walletPublicKey,
     ...recipient.escrowSend ? { escrowSendPrivateAddress: recipient.recipientPrivateAddressStpl1 } : {}
   });
-  return buildTransferFinalizeArtifacts({
-    proof,
-    context,
-    ...sweepFinalizeStamp(input.prepared, recipient)
-  });
+  return {
+    ...buildTransferFinalizeArtifacts({
+      proof,
+      context,
+      ...sweepFinalizeStamp(input.prepared, recipient)
+    }),
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      ...feeOutputKindFromPrepared(input.prepared),
+      ...configuredNonceSpread(input.environment.zkConfigNonce)
+    })
+  };
 }
 function sweepArtifactStamp(artifacts) {
   return {
@@ -6159,6 +6926,24 @@ async function finalizeTransferAtExecute(prepared, environment) {
   return runTransferFinalizeSteps({ prepared, environment, walletPublicKey });
 }
 
+// src/transact/engine/withdraw-fee.ts
+async function withdrawFeeProofFields(input) {
+  const feeOutput = await quoteFeeOutputForPrepared({
+    prepared: input.prepared,
+    environment: input.environment,
+    tokenAddress: input.tokenAddress
+  });
+  const changeStroops = remainingAfterRequiredFee({
+    available: input.available,
+    instructed: input.prepared.intent.amount,
+    requiredFee: feeOutput?.requiredFee ?? 0n
+  });
+  return {
+    ...feeOutput ? { feeOutput } : {},
+    ...changeStroops > 0n ? { changePrivateAddressStpl1: input.withdrawFrom } : {}
+  };
+}
+
 // src/transact/engine/execute.ts
 function enrichWithdrawOutputRecords(prepared, proof) {
   if (!proof.changeCoin || prepared.outputRecords.length === 0) {
@@ -6174,7 +6959,7 @@ function enrichWithdrawOutputRecords(prepared, proof) {
     precommitementHex: changeCoin.precommitementHex
   }));
 }
-function buildWithdrawFinalizeArtifacts(proof, context) {
+function buildWithdrawFinalizeArtifacts(proof, context, environment) {
   return {
     proofHex: proof.proof_hex,
     publicHex: proof.public_hex,
@@ -6182,7 +6967,11 @@ function buildWithdrawFinalizeArtifacts(proof, context) {
     applicationIdsPlaintext: proof.applicationIdsPlaintext,
     tokenAddress: context.tokenAddress,
     walletPublicKey: context.walletPublicKey,
-    executeFinalizeRequired: false
+    executeFinalizeRequired: false,
+    zkConfigNonce: zkConfigNonceForFeeBearingKind({
+      kind: "withdraw",
+      ...configuredNonceSpread(environment.zkConfigNonce)
+    })
   };
 }
 async function finalizeSingleWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
@@ -6191,10 +6980,16 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
     environment,
     recipientPrivateAddressStpl1: withdrawFrom
   });
-  const changeStroops = BigInt(context.coin.value) - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProof({
     coin: context.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     destinationStellarAddress: prepared.intent.to,
     privKeyScalarHex: context.senderPrivKeyScalarHex,
     depositorEphemeralKey: serializeEphemeralKeyString({
@@ -6202,11 +6997,24 @@ async function finalizeSingleWithdrawAtExecute(prepared, environment, poolServic
       yHex: context.ephemeral.yHex
     }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
+}
+function dualWithdrawEphemeralKeys(input) {
+  return {
+    depositorEphemeralAKey: serializeEphemeralKeyString({
+      xHex: input.context.ephemeral.xHex,
+      yHex: input.context.ephemeral.yHex
+    }),
+    depositorEphemeralBKey: serializeEphemeralKeyString({
+      xHex: input.secondary.ephemeral.xHex,
+      yHex: input.secondary.ephemeral.yHex
+    })
+  };
 }
 async function finalizeDualWithdrawAtExecute(prepared, environment, poolService, withdrawFrom) {
   const [, secondaryRecord] = prepared.consumedRecords;
@@ -6224,28 +7032,27 @@ async function finalizeDualWithdrawAtExecute(prepared, environment, poolService,
     walletPublicKey: context.walletPublicKey,
     commitments: context.commitments
   });
-  const totalNotes = BigInt(context.coin.value) + BigInt(secondary.coin.value);
-  const changeStroops = totalNotes - prepared.intent.amount;
+  const feeFields = await withdrawFeeProofFields({
+    prepared,
+    environment,
+    tokenAddress: context.tokenAddress,
+    available: BigInt(context.coin.value) + BigInt(secondary.coin.value),
+    withdrawFrom
+  });
   const proof = await poolService.prepareWithdrawTransactProofDual({
     coinA: context.coin,
     coinB: secondary.coin,
-    state: { commitments: context.commitments },
+    state: context.merkleState,
     destinationStellarAddress: prepared.intent.to,
     privKeyScalarHex: context.senderPrivKeyScalarHex,
-    depositorEphemeralAKey: serializeEphemeralKeyString({
-      xHex: context.ephemeral.xHex,
-      yHex: context.ephemeral.yHex
-    }),
-    depositorEphemeralBKey: serializeEphemeralKeyString({
-      xHex: secondary.ephemeral.xHex,
-      yHex: secondary.ephemeral.yHex
-    }),
+    ...dualWithdrawEphemeralKeys({ context, secondary }),
     withdrawAmountStroops: prepared.intent.amount,
-    changePrivateAddressStpl1: changeStroops > 0n ? withdrawFrom : void 0,
-    tokenAddress: context.tokenAddress
+    changePrivateAddressStpl1: feeFields.changePrivateAddressStpl1,
+    tokenAddress: context.tokenAddress,
+    ...feeFields.feeOutput ? { feeOutput: feeFields.feeOutput } : {}
   });
   enrichWithdrawOutputRecords(prepared, proof);
-  return buildWithdrawFinalizeArtifacts(proof, context);
+  return buildWithdrawFinalizeArtifacts(proof, context, environment);
 }
 async function finalizeWithdrawAtExecute(prepared, environment, poolService) {
   if (prepared.kind !== "withdraw") {
@@ -6507,7 +7314,7 @@ async function requestKytPassageForPoolInteraction(input) {
   const applicationId = resolvePoolApplicationId(
     input.transactEnvironment.network.applicationId
   );
-  const zkConfigNonce = resolveZkConfigNonce(input.transactEnvironment);
+  const zkConfigNonce = input.zkConfigNonce ?? resolveZkConfigNonce(input.transactEnvironment);
   const applicationIdsPlaintext = input.applicationIdsPlaintext ?? buildApplicationIdHints2(
     applicationId,
     layoutForKnownNonce(zkConfigNonce).nAuditSlots
@@ -6679,6 +7486,10 @@ async function submitSorobanConfidentialTransfer(input) {
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl
   });
+  const nonce = transactNonceFromArtifacts(
+    input.zkConfigNonce === void 0 ? void 0 : { zkConfigNonce: input.zkConfigNonce },
+    input.transactEnvironment
+  );
   const approval = await requestKytPassageForPoolInteraction({
     owner: input.walletPublicKey,
     poolContract: input.contractId,
@@ -6687,6 +7498,7 @@ async function submitSorobanConfidentialTransfer(input) {
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
     ...input.outputNoteEphemeralScalars ? { outputNoteEphemeralScalars: input.outputNoteEphemeralScalars } : {},
     ...input.applicationIdsPlaintext ? { applicationIdsPlaintext: input.applicationIdsPlaintext } : {},
+    ...input.zkConfigNonce === void 0 ? {} : { zkConfigNonce: input.zkConfigNonce },
     networkPassphrase: input.networkPassphrase,
     sorobanRpcUrl: input.sorobanRpcUrl,
     transactEnvironment: input.transactEnvironment
@@ -6695,7 +7507,7 @@ async function submitSorobanConfidentialTransfer(input) {
     contractClient: poolClient,
     contractId: input.contractId,
     from: input.walletPublicKey,
-    nonce: resolveZkConfigNonce(input.transactEnvironment),
+    nonce,
     proofHex: input.proofHex,
     publicHex: input.publicHex,
     ...input.ciphertextHex ? { ciphertextHex: input.ciphertextHex } : {},
@@ -6726,12 +7538,14 @@ async function submitPreparedDeposit(prepared, environment) {
     networkPassphrase: environment.network.networkPassphrase,
     sorobanRpcUrl: environment.network.rpcUrl
   });
+  const nonce = transactNonceFromArtifacts(artifacts, environment);
   const approval = await requestKytPassageForPoolInteraction({
     owner: artifacts.walletPublicKey,
     poolContract: environment.network.poolContract,
     proofHex: artifacts.proofHex,
     publicHex: artifacts.publicHex,
     ...optionalInspectCiphertext(artifacts),
+    ...artifacts.zkConfigNonce === void 0 ? {} : { zkConfigNonce: artifacts.zkConfigNonce },
     networkPassphrase: environment.network.networkPassphrase,
     sorobanRpcUrl: environment.network.rpcUrl,
     transactEnvironment: environment
@@ -6740,7 +7554,7 @@ async function submitPreparedDeposit(prepared, environment) {
     contractClient: poolClient,
     contractId: environment.network.poolContract,
     from: artifacts.walletPublicKey,
-    nonce: resolveZkConfigNonce(environment),
+    nonce,
     proofHex: artifacts.proofHex,
     publicHex: artifacts.publicHex,
     ...artifacts.ciphertextHex ? { ciphertextHex: artifacts.ciphertextHex } : {},
@@ -6761,6 +7575,7 @@ async function submitPreparedPoolTransact(prepared, environment) {
     proofHex: artifacts.proofHex,
     publicHex: artifacts.publicHex,
     ...optionalInspectCiphertext(artifacts),
+    ...artifacts.zkConfigNonce === void 0 ? {} : { zkConfigNonce: artifacts.zkConfigNonce },
     networkPassphrase: environment.network.networkPassphrase,
     sorobanRpcUrl: environment.network.rpcUrl,
     transactEnvironment: environment
@@ -6816,7 +7631,7 @@ async function privacyPoolInitOptions(assets, transactEnvironment) {
   };
 }
 async function createDefaultTransactEngine(assets, transactEnvironment) {
-  await PrivacyPoolSDK3.init(await privacyPoolInitOptions(assets, transactEnvironment));
+  await PrivacyPoolSDK4.init(await privacyPoolInitOptions(assets, transactEnvironment));
   if (transactEnvironment) {
     configurePrivacyPoolService(
       createPrivacyPoolService({