@arcanetech/stellar-privacy-pool-zk-sdk 0.9.1-rc.0

package/dist/index.mjs

@@ -0,0 +1,3875 @@
+import { StrKey, Address, Keypair, rpc, TransactionBuilder, Operation, xdr, nativeToScVal, authorizeEntry } from '@stellar/stellar-sdk';
+import { buildBabyjub, buildMimc7, buildPoseidon } from 'circomlibjs';
+
+/* @ts-self-types="./client_sdk_wasm.d.ts" */
+
+/**
+ * Merkle root, path, and coin field strings for the first withdraw leg (JSON → JSON).
+ * @param {string} coin_json
+ * @param {string} state_json
+ * @returns {string}
+ */
+function buildWithdrawMerkleWitness(coin_json, state_json) {
+    let deferred4_0;
+    let deferred4_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(coin_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(state_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.buildWithdrawMerkleWitness(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
+            ptr3 = 0; len3 = 0;
+            throw takeObject(r2);
+        }
+        deferred4_0 = ptr3;
+        deferred4_1 = len3;
+        return getStringFromWasm0(ptr3, len3);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * Calculate owner-bound nullifier hash from nullifier and spend-scalar decimal strings.
+ * Returns hex string (0x...)
+ * @param {string} nullifier_decimal
+ * @param {string} priv_key_scalar_decimal
+ * @returns {string}
+ */
+function calculateNullifierHash(nullifier_decimal, priv_key_scalar_decimal) {
+    let deferred4_0;
+    let deferred4_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(nullifier_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(priv_key_scalar_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.calculateNullifierHash(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
+            ptr3 = 0; len3 = 0;
+            throw takeObject(r2);
+        }
+        deferred4_0 = ptr3;
+        deferred4_1 = len3;
+        return getStringFromWasm0(ptr3, len3);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * `R = Poseidon255(2)(hi, lo)`; `scalar` is the raw Poseidon hash when it is
+ * already in `(0, BabyJub subgroup order)`. Out-of-range hashes fail so the
+ * caller can rejection-sample a new nonce.
+ * @param {string} nonce_decimal
+ * @param {string} recipient_hi_decimal
+ * @param {string} recipient_lo_decimal
+ * @returns {any}
+ */
+function derivedEscrowKey$1(nonce_decimal, recipient_hi_decimal, recipient_lo_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(nonce_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(recipient_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(recipient_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.derivedEscrowKey(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * UTF-8 seed → `SHA256` → scalar → BabyJubJub `BASE8 * r` (circom `ECDHEphemeralKey`).
+ * `x` and `y` are lowercase hex (no `0x`). Bech32 / stealth string: TypeScript `encodeStealthAddress`.
+ * @param {string} seed
+ * @returns {any}
+ */
+function ecdhEphemeralPublicKey(seed) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(seed, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.ecdhEphemeralPublicKey(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * 32-byte scalar as 64 hex chars (optional `0x`) → `ecdh_ephemeral_public_key` (no UTF-8 seed hash).
+ * @param {string} scalar_hex
+ * @returns {any}
+ */
+function ecdhEphemeralPublicKeyFromScalarHex(scalar_hex) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.ecdhEphemeralPublicKeyFromScalarHex(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Circuit `ECDH`: `priv * (pub_x, pub_y)` → shared key (`key[0], key[1]` hex).
+ * @param {string} priv_hex
+ * @param {string} pub_x_hex
+ * @param {string} pub_y_hex
+ * @returns {any}
+ */
+function ecdhSharedKey(priv_hex, pub_x_hex, pub_y_hex) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(priv_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(pub_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(pub_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.ecdhSharedKey(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Generate a new coin with random nullifier, secret, and owner public-key field elements.
+ * `amount_decimal` is an arbitrary-precision decimal field element (never JS `number`).
+ * `asset_hi_decimal` / `asset_lo_decimal` are decimal Fr strings for the Stellar asset contract id (two limbs).
+ * Returns JSON: { coin: { value, nullifier, secret, commitment, asset_hi, asset_lo }, commitment_hex, precommitement_hex }
+ * @param {string} amount_decimal
+ * @param {string} asset_hi_decimal
+ * @param {string} asset_lo_decimal
+ * @param {string} application_id_decimal
+ * @returns {any}
+ */
+function generateCoin(amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.generateCoin(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * `Poseidon₁(scalar)` secret + recipient owner public key (hex), matching an aligned deposit witness.
+ * @param {string} scalar_hex
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
+ * @param {string} asset_hi_decimal
+ * @param {string} asset_lo_decimal
+ * @param {string} application_id_decimal
+ * @returns {any}
+ */
+function generateCoinForDepositWithOwnerPubHex(scalar_hex, owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        const ptr4 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        const ptr5 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len5 = WASM_VECTOR_LEN;
+        const ptr6 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len6 = WASM_VECTOR_LEN;
+        wasm.generateCoinForDepositWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * `secret` in coin = `Poseidon255(1)(scalar)` per `deposit.circom`; scalar is 32-byte hex (64 chars, optional `0x`).
+ * @param {string} scalar_hex
+ * @param {string} amount_decimal
+ * @param {string} asset_hi_decimal
+ * @param {string} asset_lo_decimal
+ * @param {string} application_id_decimal
+ * @returns {any}
+ */
+function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        const ptr4 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        wasm.generateCoinFromDepositEphemeralScalarHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Same as `generateCoin`, but commitment uses the given owner public key (64-char hex coords).
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
+ * @param {string} asset_hi_decimal
+ * @param {string} asset_lo_decimal
+ * @param {string} application_id_decimal
+ * @returns {any}
+ */
+function generateCoinWithOwnerPubHex(owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        const ptr4 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        const ptr5 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len5 = WASM_VECTOR_LEN;
+        wasm.generateCoinWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Convert snarkjs proof JSON to hex bytes for Soroban contract.
+ * @param {string} proof_json
+ * @returns {string}
+ */
+function proofToHex(proof_json) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(proof_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.proofToHex(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        deferred2_0 = r0;
+        deferred2_1 = r1;
+        return getStringFromWasm0(r0, r1);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * Graph witness + arkworks Groth16 prove. Returns `{ proof_hex, public_hex }`.
+ * @param {Uint8Array} graph
+ * @param {Uint8Array} proving_key
+ * @param {Uint8Array} r1cs
+ * @param {string} inputs_json
+ * @returns {any}
+ */
+function proveGroth16(graph, proving_key, r1cs, inputs_json) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(graph, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(proving_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(r1cs, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(inputs_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.proveGroth16(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+/**
+ * Convert snarkjs public signals JSON to hex bytes for Soroban contract.
+ * @param {string} public_json
+ * @returns {string}
+ */
+function publicToHex(public_json) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(public_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.publicToHex(retptr, ptr0, len0);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        deferred2_0 = r0;
+        deferred2_1 = r1;
+        return getStringFromWasm0(r0, r1);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred2_0, deferred2_1, 1);
+    }
+}
+
+function __wbg_get_imports() {
+    const import0 = {
+        __proto__: null,
+        __wbg_String_8564e559799eccda: function(arg0, arg1) {
+            const ret = String(getObject(arg1));
+            const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+            const len1 = WASM_VECTOR_LEN;
+            getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
+        },
+        __wbg___wbindgen_is_function_3c846841762788c1: function(arg0) {
+            const ret = typeof(getObject(arg0)) === 'function';
+            return ret;
+        },
+        __wbg___wbindgen_is_object_781bc9f159099513: function(arg0) {
+            const val = getObject(arg0);
+            const ret = typeof(val) === 'object' && val !== null;
+            return ret;
+        },
+        __wbg___wbindgen_is_string_7ef6b97b02428fae: function(arg0) {
+            const ret = typeof(getObject(arg0)) === 'string';
+            return ret;
+        },
+        __wbg___wbindgen_is_undefined_52709e72fb9f179c: function(arg0) {
+            const ret = getObject(arg0) === undefined;
+            return ret;
+        },
+        __wbg___wbindgen_throw_6ddd609b62940d55: function(arg0, arg1) {
+            throw new Error(getStringFromWasm0(arg0, arg1));
+        },
+        __wbg_call_2d781c1f4d5c0ef8: function() { return handleError(function (arg0, arg1, arg2) {
+            const ret = getObject(arg0).call(getObject(arg1), getObject(arg2));
+            return addHeapObject(ret);
+        }, arguments); },
+        __wbg_crypto_38df2bab126b63dc: function(arg0) {
+            const ret = getObject(arg0).crypto;
+            return addHeapObject(ret);
+        },
+        __wbg_getRandomValues_c44a50d8cfdaebeb: function() { return handleError(function (arg0, arg1) {
+            getObject(arg0).getRandomValues(getObject(arg1));
+        }, arguments); },
+        __wbg_length_ea16607d7b61445b: function(arg0) {
+            const ret = getObject(arg0).length;
+            return ret;
+        },
+        __wbg_msCrypto_bd5a034af96bcba6: function(arg0) {
+            const ret = getObject(arg0).msCrypto;
+            return addHeapObject(ret);
+        },
+        __wbg_new_ab79df5bd7c26067: function() {
+            const ret = new Object();
+            return addHeapObject(ret);
+        },
+        __wbg_new_with_length_825018a1616e9e55: function(arg0) {
+            const ret = new Uint8Array(arg0 >>> 0);
+            return addHeapObject(ret);
+        },
+        __wbg_node_84ea875411254db1: function(arg0) {
+            const ret = getObject(arg0).node;
+            return addHeapObject(ret);
+        },
+        __wbg_process_44c7a14e11e9f69e: function(arg0) {
+            const ret = getObject(arg0).process;
+            return addHeapObject(ret);
+        },
+        __wbg_prototypesetcall_d62e5099504357e6: function(arg0, arg1, arg2) {
+            Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), getObject(arg2));
+        },
+        __wbg_randomFillSync_6c25eac9869eb53c: function() { return handleError(function (arg0, arg1) {
+            getObject(arg0).randomFillSync(takeObject(arg1));
+        }, arguments); },
+        __wbg_require_b4edbdcf3e2a1ef0: function() { return handleError(function () {
+            const ret = module.require;
+            return addHeapObject(ret);
+        }, arguments); },
+        __wbg_set_6be42768c690e380: function(arg0, arg1, arg2) {
+            getObject(arg0)[takeObject(arg1)] = takeObject(arg2);
+        },
+        __wbg_static_accessor_GLOBAL_8adb955bd33fac2f: function() {
+            const ret = typeof global === 'undefined' ? null : global;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_GLOBAL_THIS_ad356e0db91c7913: function() {
+            const ret = typeof globalThis === 'undefined' ? null : globalThis;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_SELF_f207c857566db248: function() {
+            const ret = typeof self === 'undefined' ? null : self;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_WINDOW_bb9f1ba69d61b386: function() {
+            const ret = typeof window === 'undefined' ? null : window;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_subarray_a068d24e39478a8a: function(arg0, arg1, arg2) {
+            const ret = getObject(arg0).subarray(arg1 >>> 0, arg2 >>> 0);
+            return addHeapObject(ret);
+        },
+        __wbg_versions_276b2795b1c6a219: function(arg0) {
+            const ret = getObject(arg0).versions;
+            return addHeapObject(ret);
+        },
+        __wbindgen_cast_0000000000000001: function(arg0, arg1) {
+            // Cast intrinsic for `Ref(Slice(U8)) -> NamedExternref("Uint8Array")`.
+            const ret = getArrayU8FromWasm0(arg0, arg1);
+            return addHeapObject(ret);
+        },
+        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+            // Cast intrinsic for `Ref(String) -> Externref`.
+            const ret = getStringFromWasm0(arg0, arg1);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_clone_ref: function(arg0) {
+            const ret = getObject(arg0);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_drop_ref: function(arg0) {
+            takeObject(arg0);
+        },
+    };
+    return {
+        __proto__: null,
+        "./client_sdk_wasm_bg.js": import0,
+    };
+}
+
+function addHeapObject(obj) {
+    if (heap_next === heap.length) heap.push(heap.length + 1);
+    const idx = heap_next;
+    heap_next = heap[idx];
+
+    heap[idx] = obj;
+    return idx;
+}
+
+function dropObject(idx) {
+    if (idx < 1028) return;
+    heap[idx] = heap_next;
+    heap_next = idx;
+}
+
+function getArrayU8FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+
+let cachedDataViewMemory0 = null;
+function getDataViewMemory0() {
+    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+    }
+    return cachedDataViewMemory0;
+}
+
+function getStringFromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return decodeText(ptr, len);
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function getObject(idx) { return heap[idx]; }
+
+function handleError(f, args) {
+    try {
+        return f.apply(this, args);
+    } catch (e) {
+        wasm.__wbindgen_export3(addHeapObject(e));
+    }
+}
+
+let heap = new Array(1024).fill(undefined);
+heap.push(undefined, null, true, false);
+
+let heap_next = heap.length;
+
+function isLikeNone(x) {
+    return x === undefined || x === null;
+}
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeObject(idx) {
+    const ret = getObject(idx);
+    dropObject(idx);
+    return ret;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+cachedTextDecoder.decode();
+const MAX_SAFARI_DECODE_BYTES = 2146435072;
+let numBytesDecoded = 0;
+function decodeText(ptr, len) {
+    numBytesDecoded += len;
+    if (numBytesDecoded >= MAX_SAFARI_DECODE_BYTES) {
+        cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+        cachedTextDecoder.decode();
+        numBytesDecoded = len;
+    }
+    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+let wasm;
+function __wbg_finalize_init(instance, module) {
+    wasm = instance.exports;
+    cachedDataViewMemory0 = null;
+    cachedUint8ArrayMemory0 = null;
+    return wasm;
+}
+
+async function __wbg_load(module, imports) {
+    if (typeof Response === 'function' && module instanceof Response) {
+        if (typeof WebAssembly.instantiateStreaming === 'function') {
+            try {
+                return await WebAssembly.instantiateStreaming(module, imports);
+            } catch (e) {
+                const validResponse = module.ok && expectedResponseType(module.type);
+
+                if (validResponse && module.headers.get('Content-Type') !== 'application/wasm') {
+                    console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+
+                } else { throw e; }
+            }
+        }
+
+        const bytes = await module.arrayBuffer();
+        return await WebAssembly.instantiate(bytes, imports);
+    } else {
+        const instance = await WebAssembly.instantiate(module, imports);
+
+        if (instance instanceof WebAssembly.Instance) {
+            return { instance, module };
+        } else {
+            return instance;
+        }
+    }
+
+    function expectedResponseType(type) {
+        switch (type) {
+            case 'basic': case 'cors': case 'default': return true;
+        }
+        return false;
+    }
+}
+
+function initSync(module) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module !== undefined) {
+        if (Object.getPrototypeOf(module) === Object.prototype) {
+            ({module} = module);
+        } else {
+            console.warn('using deprecated parameters for `initSync()`; pass a single object instead');
+        }
+    }
+
+    const imports = __wbg_get_imports();
+    if (!(module instanceof WebAssembly.Module)) {
+        module = new WebAssembly.Module(module);
+    }
+    const instance = new WebAssembly.Instance(module, imports);
+    return __wbg_finalize_init(instance);
+}
+
+async function __wbg_init(module_or_path) {
+    if (wasm !== undefined) return wasm;
+
+
+    if (module_or_path !== undefined) {
+        if (Object.getPrototypeOf(module_or_path) === Object.prototype) {
+            ({module_or_path} = module_or_path);
+        } else {
+            console.warn('using deprecated parameters for the initialization function; pass a single object instead');
+        }
+    }
+
+    if (module_or_path === undefined) {
+        module_or_path = new URL('client_sdk_wasm_bg.wasm', import.meta.url);
+    }
+    const imports = __wbg_get_imports();
+
+    if (typeof module_or_path === 'string' || (typeof Request === 'function' && module_or_path instanceof Request) || (typeof URL === 'function' && module_or_path instanceof URL)) {
+        module_or_path = fetch(module_or_path);
+    }
+
+    const { instance, module } = await __wbg_load(await module_or_path, imports);
+
+    return __wbg_finalize_init(instance);
+}
+
+var wasmBindings = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    buildWithdrawMerkleWitness: buildWithdrawMerkleWitness,
+    calculateNullifierHash: calculateNullifierHash,
+    default: __wbg_init,
+    derivedEscrowKey: derivedEscrowKey$1,
+    ecdhEphemeralPublicKey: ecdhEphemeralPublicKey,
+    ecdhEphemeralPublicKeyFromScalarHex: ecdhEphemeralPublicKeyFromScalarHex,
+    ecdhSharedKey: ecdhSharedKey,
+    generateCoin: generateCoin,
+    generateCoinForDepositWithOwnerPubHex: generateCoinForDepositWithOwnerPubHex,
+    generateCoinFromDepositEphemeralScalarHex: generateCoinFromDepositEphemeralScalarHex,
+    generateCoinWithOwnerPubHex: generateCoinWithOwnerPubHex,
+    initSync: initSync,
+    proofToHex: proofToHex,
+    proveGroth16: proveGroth16,
+    publicToHex: publicToHex
+});
+
+const isNode$1 = typeof process !== 'undefined' && !!process.versions?.node;
+let wasmModule = null;
+async function loadWasm(wasmBinary) {
+    if (wasmModule)
+        return wasmModule;
+    if (isNode$1) {
+        if (wasmBinary) {
+            initSync({ module: wasmBinary });
+        }
+        else {
+            const path = await import('path');
+            const { fileURLToPath } = await import('url');
+            const fs = await import('fs');
+            const dir = path.dirname(fileURLToPath(import.meta.url));
+            const wasmPath = path.resolve(dir, '..', 'pkg', 'client_sdk_wasm_bg.wasm');
+            const buffer = fs.readFileSync(wasmPath);
+            initSync({ module: buffer });
+        }
+        wasmModule = wasmBindings;
+    }
+    else {
+        if (wasmBinary) {
+            initSync({ module: wasmBinary });
+        }
+        else {
+            await __wbg_init();
+        }
+        wasmModule = wasmBindings;
+    }
+    return wasmModule;
+}
+
+/** Off-chain ZK layout table. Must stay byte-identical to `libs/zk::ZkLayoutParams`. */
+const LEGACY_ZK_NONCE = 0n;
+const COMMITMENT_V2_ZK_NONCE = 2n;
+const BINDING_ZK_NONCE = 3n;
+const SIX_BY_SIX_ZK_NONCE = 6n;
+const SIX_BY_SIX_BINDING_ZK_NONCE = 7n;
+const LEGACY_PUBLIC_INPUT_PREFIX_LEN = 5;
+const V2_PUBLIC_INPUT_PREFIX_LEN = 7;
+const NOTE_AUDIT_LEN$3 = 12;
+const NOTE_OUTPUT_LEN$2 = 6;
+var BundledZkCircuit;
+(function (BundledZkCircuit) {
+    BundledZkCircuit["TwoByTwo"] = "2x2";
+    BundledZkCircuit["SixBySix"] = "6x6";
+})(BundledZkCircuit || (BundledZkCircuit = {}));
+function isDevZkCircuitConfig(config) {
+    return !('circuit' in config);
+}
+const DEFAULT_ZK_CONFIG_NONCE = BINDING_ZK_NONCE;
+const DEFAULT_ZK_CIRCUITS = {
+    [BINDING_ZK_NONCE.toString()]: {
+        nIns: 2,
+        nOuts: 2,
+        publicNInputs: 1,
+        publicNOutputs: 1,
+        circuit: BundledZkCircuit.TwoByTwo,
+    },
+    [SIX_BY_SIX_BINDING_ZK_NONCE.toString()]: {
+        nIns: 6,
+        nOuts: 6,
+        publicNInputs: 1,
+        publicNOutputs: 1,
+        circuit: BundledZkCircuit.SixBySix,
+    },
+};
+function layoutFromCircuitConfig(config) {
+    return zkLayoutFromShapeBinding(config.nIns, config.nOuts, config.publicNInputs, config.publicNOutputs, config.nIns + config.nOuts, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function resolveZkCircuitConfig(zkCircuits, zkConfigNonce) {
+    const nonce = zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+    const circuits = zkCircuits ?? DEFAULT_ZK_CIRCUITS;
+    const config = circuits[nonce.toString()];
+    if (!config) {
+        throw new Error(`no zk circuit configured for nonce ${nonce.toString()}`);
+    }
+    return { nonce, config };
+}
+function bundledCircuitFileNames(circuit) {
+    if (circuit === BundledZkCircuit.SixBySix) {
+        return {
+            graphFileName: 'main_6x6.graph.bin',
+            r1csFileName: 'main_6x6.r1cs.gz',
+            provingKeyFileName: 'main_6x6_proving_key.bin',
+            verificationKeyFileName: 'main_6x6_verification_key.json',
+            zkeyFileName: 'main_6x6_final.zkey',
+        };
+    }
+    return {
+        graphFileName: 'main.graph.bin',
+        r1csFileName: 'main.r1cs.gz',
+        provingKeyFileName: 'main_proving_key.bin',
+        verificationKeyFileName: 'main_verification_key.json',
+        zkeyFileName: 'main_final.zkey',
+    };
+}
+function zkLayoutFromShape(nIns, nOuts, publicNInputs, publicNOutputs, nAuditSlots, noteAuditLen, noteOutputLen, publicInputPrefixLen = LEGACY_PUBLIC_INPUT_PREFIX_LEN) {
+    const auditOffset = nIns + nOuts + nOuts * 2;
+    const outputNoteOffset = auditOffset + nAuditSlots * 2 + nAuditSlots * noteAuditLen + nAuditSlots;
+    return {
+        nIns,
+        nOuts,
+        publicNInputs,
+        publicNOutputs,
+        nAuditSlots,
+        noteAuditLen,
+        noteOutputLen,
+        publicInputPrefixLen,
+        auditOffset,
+        outputNoteOffset,
+    };
+}
+function zkLayoutFromShapeBinding(nIns, nOuts, publicNInputs, publicNOutputs, nAuditSlots, noteAuditLen, noteOutputLen) {
+    const auditOffset = nIns + nOuts + nOuts * 2;
+    const outputNoteOffset = auditOffset + 2 + nAuditSlots;
+    return {
+        nIns,
+        nOuts,
+        publicNInputs,
+        publicNOutputs,
+        nAuditSlots,
+        noteAuditLen,
+        noteOutputLen,
+        publicInputPrefixLen: V2_PUBLIC_INPUT_PREFIX_LEN,
+        auditOffset,
+        outputNoteOffset,
+    };
+}
+function ciphertextsInPublicSignals(layout) {
+    const withCiphertext = layout.auditOffset +
+        layout.nAuditSlots * 2 +
+        layout.nAuditSlots * layout.noteAuditLen +
+        layout.nAuditSlots;
+    return layout.outputNoteOffset === withCiphertext;
+}
+function ciphertextFieldCount(layout) {
+    return layout.nAuditSlots * layout.noteAuditLen + layout.nOuts * layout.noteOutputLen;
+}
+function auditEphemeralPublicKeyCount(layout) {
+    return ciphertextsInPublicSignals(layout) ? layout.nAuditSlots : 1;
+}
+function indexAuditTags(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return (layout.auditOffset +
+            layout.nAuditSlots * 2 +
+            layout.nAuditSlots * layout.noteAuditLen);
+    }
+    return layout.auditOffset + auditEphemeralPublicKeyCount(layout) * 2;
+}
+function indexOutputNoteTags(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return layout.outputNoteOffset + layout.nOuts * layout.noteOutputLen;
+    }
+    return layout.outputNoteOffset;
+}
+function publicOutputsLen(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return layout.outputNoteOffset + layout.nOuts * layout.noteOutputLen + layout.nOuts;
+    }
+    return layout.outputNoteOffset + layout.nOuts;
+}
+function totalPublicSignals(layout) {
+    return (publicOutputsLen(layout) +
+        layout.publicInputPrefixLen +
+        2 * layout.publicNInputs +
+        2 * layout.publicNOutputs +
+        layout.publicNInputs +
+        layout.publicNOutputs);
+}
+function stateRootIndex(layout) {
+    return publicOutputsLen(layout);
+}
+function legacyOwnerBoundLayout() {
+    return zkLayoutFromShape(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function standardLayout() {
+    return zkLayoutFromShape(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2, V2_PUBLIC_INPUT_PREFIX_LEN);
+}
+function sixBySixLayout() {
+    return zkLayoutFromShape(6, 6, 1, 1, 12, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2, V2_PUBLIC_INPUT_PREFIX_LEN);
+}
+function standardBindingLayout() {
+    return zkLayoutFromShapeBinding(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function sixBySixBindingLayout() {
+    return zkLayoutFromShapeBinding(6, 6, 1, 1, 12, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function layoutForKnownNonce(nonce) {
+    if (nonce === LEGACY_ZK_NONCE) {
+        return legacyOwnerBoundLayout();
+    }
+    if (nonce === COMMITMENT_V2_ZK_NONCE) {
+        return standardLayout();
+    }
+    if (nonce === BINDING_ZK_NONCE) {
+        return standardBindingLayout();
+    }
+    if (nonce === SIX_BY_SIX_ZK_NONCE) {
+        return sixBySixLayout();
+    }
+    if (nonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+        return sixBySixBindingLayout();
+    }
+    throw new Error(`unknown zk config nonce ${nonce.toString()}`);
+}
+function circuitProfileFromName(name) {
+    const normalized = name.trim().toLowerCase();
+    if (normalized === '6x6' || normalized === 'six' || normalized === '6') {
+        return {
+            name: '6x6',
+            nonce: SIX_BY_SIX_BINDING_ZK_NONCE,
+            layout: sixBySixBindingLayout(),
+            wasmFileName: 'main_6x6.wasm',
+            zkeyFileName: 'main_6x6_final.zkey',
+        };
+    }
+    if (normalized === '2x2' || normalized === 'standard' || normalized === '2') {
+        return {
+            name: '2x2',
+            nonce: BINDING_ZK_NONCE,
+            layout: standardBindingLayout(),
+            wasmFileName: 'main.wasm',
+            zkeyFileName: 'main_final.zkey',
+        };
+    }
+    throw new Error(`unknown circuit profile ${name}`);
+}
+function circuitProfileFromNonce(nonce) {
+    if (nonce === SIX_BY_SIX_ZK_NONCE ||
+        nonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+        return circuitProfileFromName('6x6');
+    }
+    return circuitProfileFromName('2x2');
+}
+
+const ZK_ARTIFACT_GITHUB_REPO = "Polynom-Labs/stellar-privacy-layer-contracts";
+const ZK_SDK_PACKAGE_VERSION = "0.8.0";
+function defaultZkArtifactBaseUrl(version = ZK_SDK_PACKAGE_VERSION) {
+    const tag = version.startsWith("v") ? version.slice(1) : version;
+    return `https://github.com/${ZK_ARTIFACT_GITHUB_REPO}/releases/download/v${tag}`;
+}
+function trimArtifactBaseUrl(value) {
+    let trimmed = value.trim();
+    while (trimmed.endsWith("/")) {
+        trimmed = trimmed.slice(0, -1);
+    }
+    return trimmed;
+}
+
+const isNode = typeof process !== 'undefined' && !!process.versions?.node;
+function toUint8Array(src) {
+    if (src instanceof Uint8Array) {
+        return src;
+    }
+    if (src instanceof ArrayBuffer) {
+        return new Uint8Array(src);
+    }
+    return new Uint8Array(src.buffer, src.byteOffset, src.byteLength);
+}
+function nodeEnvArtifactBaseUrl() {
+    if (!isNode) {
+        return undefined;
+    }
+    const fromEnv = process.env.ZK_ARTIFACT_BASE_URL?.trim();
+    return fromEnv ? trimArtifactBaseUrl(fromEnv) : undefined;
+}
+function resolveZkArtifactBaseUrl(explicit) {
+    const trimmed = explicit?.trim();
+    if (trimmed) {
+        return trimArtifactBaseUrl(trimmed);
+    }
+    return nodeEnvArtifactBaseUrl() ?? defaultZkArtifactBaseUrl();
+}
+function isHttpUrl(value) {
+    return /^https?:\/\//i.test(value) || value.startsWith('file:');
+}
+async function readNodeAssetFile(filePath) {
+    const fs = await import('fs');
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Circuit artifact not found at ${filePath}. Set zkArtifactBaseUrl or ZK_ARTIFACT_BASE_URL.`);
+    }
+    return fs.readFileSync(filePath);
+}
+async function fetchArtifact(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch ${url}: ${String(response.status)}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+}
+function remoteArtifactHref(base, fileName) {
+    const withSlash = `${trimArtifactBaseUrl(base)}/`;
+    if (isHttpUrl(withSlash)) {
+        return new URL(fileName, withSlash).href;
+    }
+    if (typeof window !== 'undefined') {
+        return new URL(fileName, new URL(withSlash, window.location.href)).href;
+    }
+    return `${withSlash}${fileName}`;
+}
+async function loadNamedArtifact(base, fileName) {
+    if (isNode && !isHttpUrl(base)) {
+        const nodePath = await import('path');
+        return readNodeAssetFile(nodePath.resolve(base, fileName));
+    }
+    return fetchArtifact(remoteArtifactHref(base, fileName));
+}
+async function loadBundledCircuitArtifacts(circuit, artifactBaseUrl) {
+    const base = resolveZkArtifactBaseUrl(artifactBaseUrl);
+    const names = bundledCircuitFileNames(circuit);
+    const [graph, r1cs, provingKey] = await Promise.all([
+        loadNamedArtifact(base, names.graphFileName),
+        loadNamedArtifact(base, names.r1csFileName),
+        loadNamedArtifact(base, names.provingKeyFileName),
+    ]);
+    return { graph, r1cs, provingKey };
+}
+async function resolveCircuitArtifacts(config, artifactBaseUrl) {
+    if (isDevZkCircuitConfig(config)) {
+        return {
+            graph: toUint8Array(config.circuitGraph),
+            r1cs: toUint8Array(config.r1cs),
+            provingKey: toUint8Array(config.provingKey),
+        };
+    }
+    return loadBundledCircuitArtifacts(config.circuit, artifactBaseUrl);
+}
+
+var dist = {};
+
+Object.defineProperty(dist, "__esModule", { value: true });
+dist.bech32m = bech32 = dist.bech32 = void 0;
+const ALPHABET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';
+const ALPHABET_MAP = {};
+for (let z = 0; z < ALPHABET.length; z++) {
+    const x = ALPHABET.charAt(z);
+    ALPHABET_MAP[x] = z;
+}
+function polymodStep(pre) {
+    const b = pre >> 25;
+    return (((pre & 0x1ffffff) << 5) ^
+        (-((b >> 0) & 1) & 0x3b6a57b2) ^
+        (-((b >> 1) & 1) & 0x26508e6d) ^
+        (-((b >> 2) & 1) & 0x1ea119fa) ^
+        (-((b >> 3) & 1) & 0x3d4233dd) ^
+        (-((b >> 4) & 1) & 0x2a1462b3));
+}
+function prefixChk(prefix) {
+    let chk = 1;
+    for (let i = 0; i < prefix.length; ++i) {
+        const c = prefix.charCodeAt(i);
+        if (c < 33 || c > 126)
+            return 'Invalid prefix (' + prefix + ')';
+        chk = polymodStep(chk) ^ (c >> 5);
+    }
+    chk = polymodStep(chk);
+    for (let i = 0; i < prefix.length; ++i) {
+        const v = prefix.charCodeAt(i);
+        chk = polymodStep(chk) ^ (v & 0x1f);
+    }
+    return chk;
+}
+function convert(data, inBits, outBits, pad) {
+    let value = 0;
+    let bits = 0;
+    const maxV = (1 << outBits) - 1;
+    const result = [];
+    for (let i = 0; i < data.length; ++i) {
+        value = (value << inBits) | data[i];
+        bits += inBits;
+        while (bits >= outBits) {
+            bits -= outBits;
+            result.push((value >> bits) & maxV);
+        }
+    }
+    if (pad) {
+        if (bits > 0) {
+            result.push((value << (outBits - bits)) & maxV);
+        }
+    }
+    else {
+        if (bits >= inBits)
+            return 'Excess padding';
+        if ((value << (outBits - bits)) & maxV)
+            return 'Non-zero padding';
+    }
+    return result;
+}
+function toWords(bytes) {
+    return convert(bytes, 8, 5, true);
+}
+function fromWordsUnsafe(words) {
+    const res = convert(words, 5, 8, false);
+    if (Array.isArray(res))
+        return res;
+}
+function fromWords(words) {
+    const res = convert(words, 5, 8, false);
+    if (Array.isArray(res))
+        return res;
+    throw new Error(res);
+}
+function getLibraryFromEncoding(encoding) {
+    let ENCODING_CONST;
+    if (encoding === 'bech32') {
+        ENCODING_CONST = 1;
+    }
+    else {
+        ENCODING_CONST = 0x2bc830a3;
+    }
+    function encode(prefix, words, LIMIT) {
+        LIMIT = LIMIT || 90;
+        if (prefix.length + 7 + words.length > LIMIT)
+            throw new TypeError('Exceeds length limit');
+        prefix = prefix.toLowerCase();
+        // determine chk mod
+        let chk = prefixChk(prefix);
+        if (typeof chk === 'string')
+            throw new Error(chk);
+        let result = prefix + '1';
+        for (let i = 0; i < words.length; ++i) {
+            const x = words[i];
+            if (x >> 5 !== 0)
+                throw new Error('Non 5-bit word');
+            chk = polymodStep(chk) ^ x;
+            result += ALPHABET.charAt(x);
+        }
+        for (let i = 0; i < 6; ++i) {
+            chk = polymodStep(chk);
+        }
+        chk ^= ENCODING_CONST;
+        for (let i = 0; i < 6; ++i) {
+            const v = (chk >> ((5 - i) * 5)) & 0x1f;
+            result += ALPHABET.charAt(v);
+        }
+        return result;
+    }
+    function __decode(str, LIMIT) {
+        LIMIT = LIMIT || 90;
+        if (str.length < 8)
+            return str + ' too short';
+        if (str.length > LIMIT)
+            return 'Exceeds length limit';
+        // don't allow mixed case
+        const lowered = str.toLowerCase();
+        const uppered = str.toUpperCase();
+        if (str !== lowered && str !== uppered)
+            return 'Mixed-case string ' + str;
+        str = lowered;
+        const split = str.lastIndexOf('1');
+        if (split === -1)
+            return 'No separator character for ' + str;
+        if (split === 0)
+            return 'Missing prefix for ' + str;
+        const prefix = str.slice(0, split);
+        const wordChars = str.slice(split + 1);
+        if (wordChars.length < 6)
+            return 'Data too short';
+        let chk = prefixChk(prefix);
+        if (typeof chk === 'string')
+            return chk;
+        const words = [];
+        for (let i = 0; i < wordChars.length; ++i) {
+            const c = wordChars.charAt(i);
+            const v = ALPHABET_MAP[c];
+            if (v === undefined)
+                return 'Unknown character ' + c;
+            chk = polymodStep(chk) ^ v;
+            // not in the checksum?
+            if (i + 6 >= wordChars.length)
+                continue;
+            words.push(v);
+        }
+        if (chk !== ENCODING_CONST)
+            return 'Invalid checksum for ' + str;
+        return { prefix, words };
+    }
+    function decodeUnsafe(str, LIMIT) {
+        const res = __decode(str, LIMIT);
+        if (typeof res === 'object')
+            return res;
+    }
+    function decode(str, LIMIT) {
+        const res = __decode(str, LIMIT);
+        if (typeof res === 'object')
+            return res;
+        throw new Error(res);
+    }
+    return {
+        decodeUnsafe,
+        decode,
+        encode,
+        toWords,
+        fromWordsUnsafe,
+        fromWords,
+    };
+}
+var bech32 = dist.bech32 = getLibraryFromEncoding('bech32');
+dist.bech32m = getLibraryFromEncoding('bech32m');
+
+/** Bech32 HRP for {@link DecodedEphemeralKey} only (`x ‖ y`, 64 bytes). */
+const DECODED_EPHEMERAL_HRP = 'epk1';
+/** Bech32 HRP for {@link DecodedDepositorSharedSecretPreimage} (96 bytes). */
+const DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP = 'epk_dep_pre1';
+const FIELD_BYTES$1 = 32;
+const EPK_POINT_PAYLOAD = FIELD_BYTES$1 * 2;
+const EPK_DEP_PRE_PAYLOAD = FIELD_BYTES$1 * 3;
+const BECH32_LONG_LIMIT = 1023;
+function normalizeHex$3(hex) {
+    const s = hex.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]*$/.test(s)) {
+        throw new Error('ephemeral-key: hex must contain only 0-9, a-f');
+    }
+    return s.length % 2 === 0 ? s : `0${s}`;
+}
+function hexToBytes$2(hex) {
+    const norm = normalizeHex$3(hex);
+    const out = new Uint8Array(norm.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(norm.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function bytesToHex$2(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++) {
+        s += bytes[i].toString(16).padStart(2, '0');
+    }
+    return s;
+}
+function concat2(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+function concat3(a, b, c) {
+    const out = new Uint8Array(a.length + b.length + c.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    out.set(c, a.length + b.length);
+    return out;
+}
+function require32(label, bytes) {
+    if (bytes.length !== FIELD_BYTES$1) {
+        throw new Error(`ephemeral-key: ${label} must encode exactly ${FIELD_BYTES$1} bytes, got ${bytes.length}`);
+    }
+}
+/**
+ * 32-byte big-endian integer as hex (64 chars), **< 2^253**, so BabyJub ECDH matches
+ * `circuits/encryption.circom` `Num2Bits(253)` and `libs/cryptography` `scalar_mul_253`.
+ */
+function generateRandomScalarHex32() {
+    const g = globalThis.crypto;
+    if (!g?.getRandomValues) {
+        throw new Error('ephemeral-key: crypto.getRandomValues is required');
+    }
+    const max = 1n << 253n;
+    for (let attempt = 0; attempt < 65536; attempt++) {
+        const b = new Uint8Array(32);
+        g.getRandomValues(b);
+        const hex = bytesToHex$2(b);
+        if (BigInt(`0x${hex}`) < max) {
+            return hex;
+        }
+    }
+    throw new Error('ephemeral-key: failed to sample scalar < 2^253');
+}
+/** Bech32 `epk1`: encodes `x ‖ y` (64 bytes). */
+function encodeDecodedEphemeralKey(decoded) {
+    const xb = hexToBytes$2(decoded.x);
+    const yb = hexToBytes$2(decoded.y);
+    require32('x', xb);
+    require32('y', yb);
+    const payload = concat2(xb, yb);
+    const words = bech32.toWords(payload);
+    return bech32.encode(DECODED_EPHEMERAL_HRP, words, BECH32_LONG_LIMIT);
+}
+function decodeDecodedEphemeralKey(encoded) {
+    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
+    if (prefix !== DECODED_EPHEMERAL_HRP) {
+        throw new Error(`ephemeral-key: expected HRP ${DECODED_EPHEMERAL_HRP}, got ${JSON.stringify(prefix)}`);
+    }
+    const bytes = new Uint8Array(bech32.fromWords(words));
+    if (bytes.length !== EPK_POINT_PAYLOAD) {
+        throw new Error(`ephemeral-key: epk1 payload must be ${EPK_POINT_PAYLOAD} bytes, got ${bytes.length}`);
+    }
+    return {
+        x: bytesToHex$2(bytes.subarray(0, FIELD_BYTES$1)),
+        y: bytesToHex$2(bytes.subarray(FIELD_BYTES$1)),
+    };
+}
+/** Bech32 `epk_dep_pre1`: `randomNonceScalar ‖ recipient.x ‖ recipient.y`. */
+function encodeDepositorSharedSecretPreimage(decoded) {
+    const sb = hexToBytes$2(decoded.randomNonceScalar);
+    const xb = hexToBytes$2(decoded.recipientStealthAddress.x);
+    const yb = hexToBytes$2(decoded.recipientStealthAddress.y);
+    require32('randomNonceScalar', sb);
+    require32('recipientStealthAddress.x', xb);
+    require32('recipientStealthAddress.y', yb);
+    const payload = concat3(sb, xb, yb);
+    const words = bech32.toWords(payload);
+    return bech32.encode(DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, words, BECH32_LONG_LIMIT);
+}
+function decodeDepositorSharedSecretPreimage(encoded) {
+    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
+    if (prefix !== DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP) {
+        throw new Error(`ephemeral-key: expected HRP ${DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP}, got ${JSON.stringify(prefix)}`);
+    }
+    const bytes = new Uint8Array(bech32.fromWords(words));
+    if (bytes.length !== EPK_DEP_PRE_PAYLOAD) {
+        throw new Error(`ephemeral-key: epk_dep_pre1 payload must be ${EPK_DEP_PRE_PAYLOAD} bytes, got ${bytes.length}`);
+    }
+    return {
+        randomNonceScalar: bytesToHex$2(bytes.subarray(0, FIELD_BYTES$1)),
+        recipientStealthAddress: {
+            x: bytesToHex$2(bytes.subarray(FIELD_BYTES$1, FIELD_BYTES$1 * 2)),
+            y: bytesToHex$2(bytes.subarray(FIELD_BYTES$1 * 2)),
+        },
+    };
+}
+
+/**
+ * Depositor: `randomNonceScalar * recipientStealthPoint` (same as circom `ECDH` with depositor scalar).
+ */
+function sharedSecretFromDepositorPreimage(ecdhShared, preimage) {
+    const out = ecdhShared(preimage.randomNonceScalar, preimage.recipientStealthAddress.x, preimage.recipientStealthAddress.y);
+    return { x: out.x, y: out.y };
+}
+/**
+ * Recipient: `recipientScalar * ephemeralKey` (same shared point as depositor path when keys match).
+ */
+function sharedSecretFromRecipientPreimage(ecdhShared, preimage) {
+    const out = ecdhShared(preimage.recipientScalar, preimage.ephemeralKey.x, preimage.ephemeralKey.y);
+    return { x: out.x, y: out.y };
+}
+
+const STEALTH_ADDRESS_HRP = 'stpl1';
+/** BIP-173 default 90 is too small for 64-byte payload (32+32 field coords) after 8→5 bit conversion. */
+const BECH32_STEALTH_LIMIT = 1023;
+function normalizeHex$2(hex) {
+    const s = hex.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]*$/.test(s)) {
+        throw new Error('stealth-address: hex must contain only 0-9, a-f');
+    }
+    return s.length % 2 === 0 ? s : `0${s}`;
+}
+function hexToBytes$1(hex) {
+    const norm = normalizeHex$2(hex);
+    const out = new Uint8Array(norm.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(norm.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function bytesToHex$1(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++) {
+        s += bytes[i].toString(16).padStart(2, '0');
+    }
+    return s;
+}
+function concatBytes$1(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+/**
+ * Encodes `x || y` as Bech32 (BIP-173) with human-readable part {@link STEALTH_ADDRESS_HRP} (`stpl1`).
+ * `x` and `y` must have the same byte length so decoding can split the payload in half.
+ */
+function encodeStealthAddress(decoded) {
+    const xb = hexToBytes$1(decoded.x);
+    const yb = hexToBytes$1(decoded.y);
+    if (xb.length !== yb.length) {
+        throw new Error('stealth-address: x and y must encode the same number of bytes for a reversible address');
+    }
+    const payload = concatBytes$1(xb, yb);
+    const words = bech32.toWords(payload);
+    return bech32.encode(STEALTH_ADDRESS_HRP, words, BECH32_STEALTH_LIMIT);
+}
+/**
+ * Decodes a `stpl1` Bech32 stealth address into `x` and `y` (each half of the payload, as lowercase hex).
+ */
+function decodeStealthAddress(address) {
+    const { prefix, words } = bech32.decode(address, BECH32_STEALTH_LIMIT);
+    if (prefix !== STEALTH_ADDRESS_HRP) {
+        throw new Error(`stealth-address: expected HRP ${STEALTH_ADDRESS_HRP}, got ${JSON.stringify(prefix)}`);
+    }
+    const bytes = new Uint8Array(bech32.fromWords(words));
+    if (bytes.length === 0 || bytes.length % 2 !== 0) {
+        throw new Error('stealth-address: payload length must be positive and even');
+    }
+    const mid = bytes.length / 2;
+    return {
+        x: bytesToHex$1(bytes.subarray(0, mid)),
+        y: bytesToHex$1(bytes.subarray(mid)),
+    };
+}
+
+/** Default nonce when deriving the wallet sign-in message. */
+const DEFAULT_STEALTH_SIGN_NONCE = 'main address';
+/** Domain tag mixed into the spend-scalar digest (H6). */
+const SPEND_SCALAR_DOMAIN_TAG = 'privacy-pool-spend-scalar-v1';
+/** Schema version bound into the spend-scalar message and digest. */
+const OWNER_BOUND_NOTE_SCHEMA_VERSION = 1;
+function resolveSpendScalarSchemaVersion(domain) {
+    return domain.schemaVersion ?? OWNER_BOUND_NOTE_SCHEMA_VERSION;
+}
+/**
+ * Plaintext for Stellar wallet message signing (spend-key derivation).
+ * Sign the exact bytes of this string (UTF-8) with the stellar account key.
+ *
+ * The derived scalar is the owner-bound spend key for notes in this environment.
+ */
+function buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+    const schemaVersion = resolveSpendScalarSchemaVersion(domain);
+    return [
+        'Arcane privacy layer: derive your private-note spend key.',
+        '',
+        `Wallet: ${address}`,
+        `Network: ${domain.networkPassphrase}`,
+        `Pool: ${domain.poolContract}`,
+        `Registry: ${domain.registryContract}`,
+        `Schema: owner-bound-note-v${schemaVersion}`,
+        `Nonce: ${nonce}`,
+        '',
+        'This signature derives the key that authorizes spending your private notes in this environment.',
+    ].join('\n');
+}
+
+const DOM_PADDING = 1347436868n;
+const DOM_NULLIFIER = 1346917708n;
+const DOM_ESCROW = 1346720579n;
+const DOM_ENC = 1346719299n;
+const DOM_AUDIT_TAG = 1346458695n;
+const DOM_OUTPUT_NOTE_TAG = 1347310663n;
+const BABYJUB_SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+/**
+ * Map any integer into `(0, l)` so it satisfies circom `LessThan(252)` vs
+ * `BABYJUB_SUBGROUP_ORDER` and `BabyPbk`. Values already in range are unchanged.
+ */
+function canonicalBabyJubScalarFromInteger(value) {
+    if (value > 0n && value < BABYJUB_SUBGROUP_ORDER) {
+        return value;
+    }
+    return (value % (BABYJUB_SUBGROUP_ORDER - 1n)) + 1n;
+}
+
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Base64 → bytes via `atob` (browsers; Node 16+). No Node `Buffer`. */
+function decodeBase64ToBytes(s) {
+    const t = s.replace(/\s/g, '');
+    if (typeof atob !== 'function') {
+        throw new Error('Base64 decoding requires atob (browser or Node 16+)');
+    }
+    try {
+        const binary = atob(t);
+        const out = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            out[i] = binary.charCodeAt(i);
+        }
+        return out;
+    }
+    catch {
+        throw new Error('Invalid base64 signature');
+    }
+}
+/**
+ * Ed25519 signature as **128 hex chars** (optional `0x`) or **base64** (typically 88 chars for 64 bytes, whitespace ignored).
+ */
+function parseStellarEd25519SignatureRaw(input) {
+    const trimmed = input.trim();
+    const no0x = trimmed.replace(/^0x/i, '');
+    if (/^[0-9a-fA-F]+$/.test(no0x) && no0x.length === 128) {
+        return hexToBytes(no0x.toLowerCase());
+    }
+    const fromB64 = decodeBase64ToBytes(trimmed);
+    if (fromB64.length !== 64) {
+        throw new Error(`Decoded signature must be 64 bytes (Ed25519); got ${fromB64.length} from base64`);
+    }
+    return fromB64;
+}
+/** SHA-256 via Web Crypto only (`crypto.subtle`) — works in browsers and Node 19+ (global `crypto`). */
+async function sha256$1(data) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('SHA-256 requires crypto.subtle (HTTPS or localhost in browsers, or Node.js 19+).');
+    }
+    const copy = new Uint8Array(data.length);
+    copy.set(data);
+    return new Uint8Array(await subtle.digest('SHA-256', copy));
+}
+function appendU32BE$1(parts, value) {
+    const buf = new Uint8Array(4);
+    new DataView(buf.buffer).setUint32(0, value >>> 0, false);
+    parts.push(buf);
+}
+function appendUtf8Prefixed(parts, text) {
+    const bytes = new TextEncoder().encode(text);
+    appendU32BE$1(parts, bytes.length);
+    parts.push(bytes);
+}
+function concatBytes(parts) {
+    const total = parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+/**
+ * Domain-separated spend-scalar digest: SHA-256(
+ *   SPEND_SCALAR_DOMAIN_TAG || network || pool || registry || schemaVersion || signature
+ * ).
+ */
+async function spendScalarDigestFromStellarSignature(signature, domain) {
+    const raw = parseStellarEd25519SignatureRaw(signature);
+    const parts = [new TextEncoder().encode(SPEND_SCALAR_DOMAIN_TAG)];
+    appendUtf8Prefixed(parts, domain.networkPassphrase);
+    appendUtf8Prefixed(parts, domain.poolContract);
+    appendUtf8Prefixed(parts, domain.registryContract);
+    appendU32BE$1(parts, resolveSpendScalarSchemaVersion(domain));
+    parts.push(raw);
+    return sha256$1(concatBytes(parts));
+}
+function digestToCanonicalScalar(digest) {
+    let v = 0n;
+    for (let i = 0; i < digest.length; i++) {
+        v = (v << 8n) + BigInt(digest[i]);
+    }
+    return canonicalBabyJubScalarFromInteger(v);
+}
+function canonicalScalarHex(scalar) {
+    return scalar.toString(16).padStart(64, '0');
+}
+async function spendScalarHexFromStellarSignature(signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    return canonicalScalarHex(digestToCanonicalScalar(digest));
+}
+/**
+ * Stellar Ed25519 signature (hex or base64) → domain-separated SHA-256 → scalar → WASM ECDH.
+ */
+async function stealthAddressFromStellarSignature(ecdhFromScalarHex, encodeStealth, signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    const decoded = ecdhFromScalarHex(canonicalScalarHex(digestToCanonicalScalar(digest)));
+    return encodeStealth(decoded);
+}
+/**
+ * Domain-separated SHA-256(signature, network, pool, registry, schema) reduced into
+ * `(0, BabyJub subgroup order)` so `privKeyScalar` matches `BabyPbk` and circom `LessThan(l)`.
+ */
+async function privKeyScalarDecimalFromStellarSignature(signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    return digestToCanonicalScalar(digest).toString(10);
+}
+
+const TRANSACTION_N_AUDIT_SLOTS = 4;
+const DEFAULT_APPLICATION_ID = '101';
+/** BabyJub audit public key (decimal Fr) used in BDD / local demo when env is unset. */
+const DEMO_AUDIT_PUBLIC_KEY = [
+    '21605515851820432880964235241069234202284600780825340516808373216881770219365',
+    '18856460861531942120859708048677603751294231190189224157283439874962410808705',
+];
+function isActiveWithdraw(slot) {
+    return slot.value !== '0';
+}
+function isActiveDeposit(slot) {
+    return slot.value !== '0';
+}
+function resolveWithdrawSlot(slot) {
+    if (slot === 'dummy') {
+        return null;
+    }
+    return slot;
+}
+function resolveDepositSlot(slot) {
+    if (slot === 'dummy') {
+        return null;
+    }
+    return slot;
+}
+function buildUniformAuditParams(applicationId = DEFAULT_APPLICATION_ID, auditPublicKey, _nAuditSlots = TRANSACTION_N_AUDIT_SLOTS) {
+    return {
+        applicationId,
+        noteAuditPublicKey: auditPublicKey,
+        auditEphemeralScalar: randomFrDecimal253(),
+    };
+}
+function resolveSlotApplicationIds(audit, withdrawSlots, depositSlots) {
+    return {
+        inputApplicationIds: withdrawSlots.map((slot) => {
+            const resolved = resolveWithdrawSlot(slot);
+            return resolved && isActiveWithdraw(resolved) ? audit.applicationId : '0';
+        }),
+        outputApplicationIds: depositSlots.map((slot) => {
+            const resolved = resolveDepositSlot(slot);
+            return resolved && isActiveDeposit(resolved) ? audit.applicationId : '0';
+        }),
+    };
+}
+function withApplicationIdOnDeposit(deposit, applicationId) {
+    return { ...deposit, applicationId };
+}
+function withApplicationIdOnWithdraw(withdraw, applicationId) {
+    return { ...withdraw, applicationId };
+}
+/**
+ * Prefer an explicit key, then `NOTE_AUDIT_PUBLIC_KEY_X`/`_Y` env (decimal Fr),
+ * then the built-in demo key. Used by CLI/`demo.sh` for per-app audit pubkeys.
+ */
+function resolveAuditPublicKeyFromEnv(auditPublicKey) {
+    if (auditPublicKey) {
+        return auditPublicKey;
+    }
+    const x = process.env.NOTE_AUDIT_PUBLIC_KEY_X?.trim();
+    const y = process.env.NOTE_AUDIT_PUBLIC_KEY_Y?.trim();
+    if (x && y) {
+        return [x, y];
+    }
+    return DEMO_AUDIT_PUBLIC_KEY;
+}
+function resolveTransactionAuditParams(applicationId, auditPublicKey, nAuditSlots = TRANSACTION_N_AUDIT_SLOTS) {
+    return buildUniformAuditParams(applicationId, resolveAuditPublicKeyFromEnv(auditPublicKey), nAuditSlots);
+}
+
+/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 12, 6)` in `circuits/main.circom`. */
+const TRANSACTION_TREE_DEPTH = 20;
+const TRANSACTION_N_INS = 2;
+const TRANSACTION_N_OUTS = 2;
+const NOTE_AUDIT_LEN$2 = 12;
+const NOTE_OUTPUT_LEN$1 = 6;
+/** Must match `Transaction(..., publicNInputs, publicNOutputs)` and contract `get_public_slot_config`. */
+const TRANSACTION_PUBLIC_N_INPUTS = 1;
+const TRANSACTION_PUBLIC_N_OUTPUTS = 1;
+/** BN254 scalar field modulus (ark `Fr`, circom signals). */
+const BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+/**
+ * BabyJub ECDH in `circuits/encryption.circom` uses `Num2Bits(253)`; scalars must be < 2^253
+ * (matches `libs/cryptography` `scalar_mul_253`).
+ */
+const BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE = 1n << 253n;
+function padPublicLegs(legs, publicNInputs, publicNOutputs) {
+    const padPairs = (values, expected, label) => {
+        if (values.length > expected) {
+            throw new Error(`withdrawal-transaction-input: expected at most ${expected} ${label}`);
+        }
+        return [
+            ...values,
+            ...Array.from({ length: expected - values.length }, () => ['0', '0']),
+        ];
+    };
+    const padAmounts = (values, expected, label) => {
+        if (values.length > expected) {
+            throw new Error(`withdrawal-transaction-input: expected at most ${expected} ${label}`);
+        }
+        return [...values, ...Array.from({ length: expected - values.length }, () => '0')];
+    };
+    return {
+        publicWithdrawnAssets: padPairs(legs.publicWithdrawnAssets, publicNOutputs, 'public withdrawn assets'),
+        publicDepositedAssets: padPairs(legs.publicDepositedAssets, publicNInputs, 'public deposited assets'),
+        publicDeposits: padAmounts(legs.publicDeposits, publicNInputs, 'public deposits'),
+        publicWithdrawals: padAmounts(legs.publicWithdrawals, publicNOutputs, 'public withdrawals'),
+    };
+}
+function normalizeHex$1(hex) {
+    const s = hex.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]*$/.test(s)) {
+        throw new Error('withdrawal-transaction-input: invalid hex');
+    }
+    return s.length % 2 === 0 ? s : `0${s}`;
+}
+/** 32-byte field coordinate (hex, no 0x) → decimal string mod BN254 scalar field. */
+function coordHexToDecimal(hex) {
+    const h = normalizeHex$1(hex);
+    if (h.length > 64) {
+        throw new Error('withdrawal-transaction-input: coordinate hex too long');
+    }
+    const v = BigInt(`0x${h}`);
+    return (v % BN254_SCALAR_MOD).toString(10);
+}
+/**
+ * 32-byte big-endian scalar hex → decimal for circom `ephemeralKeyScalar` / ECDH `priv`.
+ * Integer must be < 2^253 (not reduced mod r — values ≥ 2^253 are rejected).
+ */
+function scalarHexToFrDecimal(hex) {
+    const h = normalizeHex$1(hex);
+    if (h.length > 64) {
+        throw new Error('withdrawal-transaction-input: scalar hex too long');
+    }
+    const v = BigInt(`0x${h.padStart(64, '0').slice(-64)}`);
+    if (v >= BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE) {
+        throw new Error('depositor ephemeral scalar must be < 2^253 (BabyJub Num2Bits); resample with random-scalar');
+    }
+    return v.toString(10);
+}
+/**
+ * Stellar G-address Ed25519 payload (32 bytes as 64 hex, optional 0x) → two circom public decimals
+ * (`withdrawAddressHi` / `withdrawAddressLo`). No mod-r; each half fits in 128 bits.
+ */
+function ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex) {
+    const h = normalizeHex$1(hex).padStart(64, '0').slice(-64);
+    const hi = BigInt(`0x${h.slice(0, 32)}`);
+    const lo = BigInt(`0x${h.slice(32, 64)}`);
+    return { hi: hi.toString(10), lo: lo.toString(10) };
+}
+/**
+ * Stellar contract id (`C…`) → two circom field decimals for `asset[0]`, `asset[1]` (same 32-byte split as accounts).
+ */
+function stellarContractAddressToAssetFrDecimals(address) {
+    const raw = StrKey.decodeContract(address);
+    const hex = Buffer.from(raw).toString('hex');
+    const { hi, lo } = ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex);
+    return [hi, lo];
+}
+/** Uniform random `Fr` as decimal (32 random bytes, mod r). For Poseidon-only inputs (e.g. nullifiers). */
+function randomFrDecimal() {
+    const hex = generateRandomScalarHex32();
+    const v = BigInt(`0x${normalizeHex$1(hex)}`);
+    return (v % BN254_SCALAR_MOD).toString(10);
+}
+/** Random scalar < 2^253 for BabyJub ECDH / `Num2Bits(253)` (uses {@link generateRandomScalarHex32}). */
+function randomFrDecimal253() {
+    const hex = generateRandomScalarHex32();
+    return BigInt(`0x${normalizeHex$1(hex)}`).toString(10);
+}
+/** Spend-scalar hex in `(0, BabyJub subgroup order)` so dummy withdraws satisfy `LessThan(l)`. */
+function randomCanonicalBabyJubScalarHex() {
+    const hex = generateRandomScalarHex32();
+    const reduced = canonicalBabyJubScalarFromInteger(BigInt(`0x${normalizeHex$1(hex)}`));
+    return reduced.toString(16).padStart(64, '0');
+}
+function zerosTreeSiblings() {
+    return Array(TRANSACTION_TREE_DEPTH).fill('0');
+}
+function dummyWithdraw(wasm) {
+    const nullifier = randomFrDecimal();
+    const secretHex = generateRandomScalarHex32();
+    const secret = (BigInt(`0x${normalizeHex$1(secretHex)}`) % BN254_SCALAR_MOD).toString(10);
+    const scalarHex = randomCanonicalBabyJubScalarHex();
+    const privKeyScalar = scalarHexToFrDecimal(scalarHex);
+    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(scalarHex);
+    return {
+        value: '0',
+        nullifier,
+        secret,
+        asset: ['0', '0'],
+        applicationId: '0',
+        ownerPub: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+        stateSiblings: zerosTreeSiblings(),
+        stateIndex: '0',
+    };
+}
+function dummyDeposit(wasm) {
+    const nullifier = randomFrDecimal();
+    const ephemeralKeyScalar = randomFrDecimal253();
+    const skHex = generateRandomScalarHex32();
+    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(skHex);
+    return {
+        value: '0',
+        nullifier,
+        ephemeralKeyScalar,
+        asset: ['0', '0'],
+        applicationId: '0',
+        recipientPublicKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+    };
+}
+function resolveWithdraw(slot, wasm) {
+    return slot === 'dummy' ? dummyWithdraw(wasm) : slot;
+}
+function resolveDeposit(slot, wasm) {
+    return slot === 'dummy' ? dummyDeposit(wasm) : slot;
+}
+function resolveDepositsForWitness(depositSlots, wasm) {
+    return [
+        resolveDeposit(depositSlots[0], wasm),
+        resolveDeposit(depositSlots[1], wasm),
+    ];
+}
+function padWithdrawSlots(slots, nIns) {
+    if (slots.length > nIns) {
+        throw new Error(`withdrawal-transaction-input: expected at most ${nIns} withdraw slots`);
+    }
+    return [...slots, ...Array.from({ length: nIns - slots.length }, () => 'dummy')];
+}
+function padDepositSlots(slots, nOuts) {
+    if (slots.length > nOuts) {
+        throw new Error(`withdrawal-transaction-input: expected at most ${nOuts} deposit slots`);
+    }
+    return [...slots, ...Array.from({ length: nOuts - slots.length }, () => 'dummy')];
+}
+function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, depositSlots, audit, wasm, dims = {}) {
+    const nIns = dims.nIns ?? TRANSACTION_N_INS;
+    const nOuts = dims.nOuts ?? TRANSACTION_N_OUTS;
+    const publicNInputs = dims.publicNInputs ?? TRANSACTION_PUBLIC_N_INPUTS;
+    const publicNOutputs = dims.publicNOutputs ?? TRANSACTION_PUBLIC_N_OUTPUTS;
+    const paddedWithdraws = padWithdrawSlots(withdrawSlots, nIns);
+    const paddedDeposits = padDepositSlots(depositSlots, nOuts);
+    const paddedLegs = padPublicLegs(publicLegs, publicNInputs, publicNOutputs);
+    const withdraws = paddedWithdraws.map((slot) => resolveWithdraw(slot, wasm));
+    const deposits = paddedDeposits.map((slot) => resolveDeposit(slot, wasm));
+    const appIds = resolveSlotApplicationIds(audit, paddedWithdraws, paddedDeposits);
+    return {
+        stateRoot: publicParams.stateRoot,
+        withdrawAddressHi: publicParams.withdrawAddressHi,
+        withdrawAddressLo: publicParams.withdrawAddressLo,
+        escrowRecipientHi: publicParams.escrowRecipientHi ?? '0',
+        escrowRecipientLo: publicParams.escrowRecipientLo ?? '0',
+        sweepOutputOwnerPubX: publicParams.sweepOutputOwnerPubX ?? '0',
+        sweepOutputOwnerPubY: publicParams.sweepOutputOwnerPubY ?? '0',
+        privKeyScalars: withdraws.map((w) => w.privKeyScalar),
+        ownerPubs: withdraws.map((w) => w.ownerPub),
+        paddingRandoms: withdraws.map((w) => w.paddingRandom),
+        withdrawnValues: withdraws.map((w) => w.value),
+        withdrawnNullifiers: withdraws.map((w) => w.nullifier),
+        withdrawnSecrets: withdraws.map((w) => w.secret),
+        withdrawnAssets: withdraws.map((w) => w.asset),
+        withdrawnEscrowNonces: withdraws.map((w) => w.escrowNonce),
+        inputRecipientStellar: withdraws.map((w) => w.recipientStellar),
+        stateSiblings: withdraws.map((w) => w.stateSiblings),
+        stateIndex: withdraws.map((w) => w.stateIndex),
+        depositedValues: deposits.map((d) => d.value),
+        depositedNullifiers: deposits.map((d) => d.nullifier),
+        depositedAssets: deposits.map((d) => d.asset),
+        depositedEphemeralKeyScalars: deposits.map((d) => d.ephemeralKeyScalar),
+        depositedRecipientPublicKeys: deposits.map((d) => d.recipientPublicKeys),
+        depositedEscrowNonces: deposits.map((d) => d.escrowNonce ?? '0'),
+        outputRecipientStellar: deposits.map((d) => d.recipientStellar ?? ['0', '0']),
+        inputApplicationIds: appIds.inputApplicationIds,
+        outputApplicationIds: appIds.outputApplicationIds,
+        auditEphemeralScalar: audit.auditEphemeralScalar,
+        noteAuditPublicKey: audit.noteAuditPublicKey,
+        publicWithdrawnAssets: paddedLegs.publicWithdrawnAssets,
+        publicDepositedAssets: paddedLegs.publicDepositedAssets,
+        publicDeposits: paddedLegs.publicDeposits,
+        publicWithdrawals: paddedLegs.publicWithdrawals,
+    };
+}
+/** `stpl1…` stealth address → `[x, y]` as decimal field strings for `depositedRecipientPublicKeys`. */
+function recipientPublicKeysDecimalFromStealthAddress(stealthAddress) {
+    const { x, y } = decodeStealthAddress(stealthAddress);
+    return [coordHexToDecimal(x), coordHexToDecimal(y)];
+}
+/** First withdraw leg: Merkle witness + owner public key (hex) and matching scalar. */
+function withdrawObjectFromMerkleWitness(witness, ownerPubHex, applicationId, privKeyScalar) {
+    return {
+        value: witness.value,
+        nullifier: witness.nullifier,
+        secret: witness.secret,
+        asset: witness.withdrawnAsset,
+        applicationId,
+        ownerPub: [coordHexToDecimal(ownerPubHex.x), coordHexToDecimal(ownerPubHex.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+        stateSiblings: witness.stateSiblings,
+        stateIndex: witness.stateIndex,
+    };
+}
+
+const FR_SIZE$1 = 32;
+const CIPHERTEXT_BLOB_HEADER_BYTES = 4;
+const FR_MODULUS$1 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+function moduleFr$1(value) {
+    const reduced = value % FR_MODULUS$1;
+    return reduced >= 0n ? reduced : reduced + FR_MODULUS$1;
+}
+function fieldToBytes(value) {
+    let remaining = moduleFr$1(value);
+    const buf = Buffer.alloc(FR_SIZE$1);
+    for (let index = FR_SIZE$1 - 1; index >= 0; index -= 1) {
+        buf[index] = Number(remaining & 0xffn);
+        remaining >>= 8n;
+    }
+    return buf;
+}
+function decimalOrHexToBigint(value) {
+    const trimmed = value.trim();
+    if (/^0x/i.test(trimmed) || /^[0-9a-f]{64}$/i.test(trimmed)) {
+        return BigInt(`0x${trimmed.replace(/^0x/i, '')}`);
+    }
+    return BigInt(trimmed);
+}
+function encodeCiphertextBlob(fields) {
+    const prefix = Buffer.alloc(CIPHERTEXT_BLOB_HEADER_BYTES);
+    prefix.writeUInt32BE(fields.length);
+    return Buffer.concat([
+        prefix,
+        ...fields.map((field) => fieldToBytes(decimalOrHexToBigint(field))),
+    ]);
+}
+function decodeCiphertextBlob(blob) {
+    if (blob.length < CIPHERTEXT_BLOB_HEADER_BYTES) {
+        throw new Error('ciphertext_bytes too short');
+    }
+    const count = blob.readUInt32BE(0);
+    const need = CIPHERTEXT_BLOB_HEADER_BYTES + count * FR_SIZE$1;
+    if (blob.length < need) {
+        throw new Error('ciphertext_bytes truncated');
+    }
+    const fields = [];
+    let offset = CIPHERTEXT_BLOB_HEADER_BYTES;
+    for (let index = 0; index < count; index += 1) {
+        fields.push(blob.subarray(offset, offset + FR_SIZE$1).toString('hex'));
+        offset += FR_SIZE$1;
+    }
+    return fields;
+}
+function encodeTransactionCiphertextBlob(parameters) {
+    const expected = ciphertextFieldCount(parameters.layout);
+    const fields = [];
+    for (const slot of parameters.auditCiphertexts) {
+        fields.push(...slot);
+    }
+    for (const note of parameters.outputNoteCiphertexts) {
+        fields.push(...note);
+    }
+    if (fields.length !== expected) {
+        throw new Error(`ciphertext blob expected ${String(expected)} fields, got ${String(fields.length)}`);
+    }
+    return encodeCiphertextBlob(fields);
+}
+function splitCiphertextBlob(parameters) {
+    const fields = decodeCiphertextBlob(parameters.blob);
+    const expected = ciphertextFieldCount(parameters.layout);
+    if (fields.length !== expected) {
+        throw new Error(`ciphertext blob expected ${String(expected)} fields, got ${String(fields.length)}`);
+    }
+    const { nAuditSlots, noteAuditLen, nOuts, noteOutputLen } = parameters.layout;
+    const auditCiphertexts = [];
+    let offset = 0;
+    for (let slot = 0; slot < nAuditSlots; slot += 1) {
+        auditCiphertexts.push(fields.slice(offset, offset + noteAuditLen));
+        offset += noteAuditLen;
+    }
+    const outputNoteCiphertexts = [];
+    for (let note = 0; note < nOuts; note += 1) {
+        outputNoteCiphertexts.push(fields.slice(offset, offset + noteOutputLen));
+        offset += noteOutputLen;
+    }
+    return { auditCiphertexts, outputNoteCiphertexts };
+}
+
+const NOTE_OUTPUT_LEN = 6;
+const NOTE_AUDIT_LEN$1 = 12;
+const STREAM_DOMAIN = 1n;
+const FR_SIZE = 32;
+const FR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const ONE = 1n;
+const ZERO = 0n;
+const BABYJUB_SCALAR_BITS = 253n;
+const SCALAR_253_MASK = (ONE << BABYJUB_SCALAR_BITS) - ONE;
+let primitivesPromise;
+function primitives() {
+    primitivesPromise ?? (primitivesPromise = Promise.all([
+        buildBabyjub(),
+        buildMimc7(),
+        buildPoseidon(),
+    ]).then(([babyJub, mimc7, poseidon]) => ({ babyJub, mimc7, poseidon })));
+    return primitivesPromise;
+}
+function normalizeHex(value) {
+    return value.trim().replace(/^0x/i, '').padStart(FR_SIZE * 2, '0');
+}
+function bigintFromHex(value) {
+    return BigInt(`0x${normalizeHex(value)}`);
+}
+function bigintFromDecimal(value) {
+    const parsed = BigInt(value);
+    return parsed % FR_MODULUS;
+}
+function bigintToFrHex(value) {
+    let v = moduleFr(value);
+    const buf = Buffer.alloc(FR_SIZE);
+    for (let index = FR_SIZE - 1; index >= 0; index -= 1) {
+        buf[index] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return buf.toString('hex');
+}
+function frDecimalToHex(value) {
+    return bigintToFrHex(bigintFromDecimal(value));
+}
+function frDecimalFromBigint(value) {
+    const reduced = value >= ZERO ? value % FR_MODULUS : (value % FR_MODULUS) + FR_MODULUS;
+    return reduced.toString(10);
+}
+function fieldBigint(field, value) {
+    return BigInt(field.toString(value));
+}
+function moduleFr(value) {
+    const reduced = value % FR_MODULUS;
+    return reduced >= ZERO ? reduced : reduced + FR_MODULUS;
+}
+function mimcHash(parameters) {
+    return fieldBigint(parameters.mimc7.F, parameters.mimc7.hash(parameters.mimc7.F.e(parameters.message), parameters.mimc7.F.e(parameters.key)));
+}
+function poseidonHash(poseidon, inputs) {
+    return fieldBigint(poseidon.F, poseidon(inputs.map((input) => poseidon.F.e(input))));
+}
+function deriveEncCipherKey(poseidon, sharedX) {
+    return poseidonHash(poseidon, [DOM_ENC, sharedX]);
+}
+function sharedKeyFromDepositor(parameters) {
+    const scalarHex = frDecimalToHex(parameters.ephemeralKeyScalarDecimal);
+    const shared = parameters.ecdhShared(scalarHex, frDecimalToHex(parameters.recipientPublicKey[0]), frDecimalToHex(parameters.recipientPublicKey[1]));
+    return [bigintFromHex(shared.x), bigintFromHex(shared.y)];
+}
+function sharedKeyFromRecipient(parameters) {
+    const { babyJub, recipientScalarHex, ephemeralPublicKey } = parameters;
+    const point = [
+        babyJub.F.e(bigintFromHex(ephemeralPublicKey[0])),
+        babyJub.F.e(bigintFromHex(ephemeralPublicKey[1])),
+    ];
+    if (!babyJub.inCurve(point)) {
+        throw new Error('Created ephemeral public key is not on BabyJubJub curve');
+    }
+    const product = babyJub.mulPointEscalar(point, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
+    return [
+        fieldBigint(babyJub.F, product[0]),
+        fieldBigint(babyJub.F, product[1]),
+    ];
+}
+function poseidonMacTag(parameters) {
+    return poseidonHash(parameters.poseidon, [
+        parameters.domain,
+        parameters.key,
+        parameters.nonce,
+        ...parameters.message,
+    ]);
+}
+function outputNoteTag(parameters) {
+    return poseidonMacTag({
+        poseidon: parameters.poseidon,
+        domain: DOM_OUTPUT_NOTE_TAG,
+        key: parameters.key,
+        nonce: parameters.nonce,
+        message: parameters.plaintext,
+    });
+}
+function encryptFields(parameters) {
+    return parameters.plaintext.map((field, index) => {
+        const seed = poseidonHash(parameters.poseidon, [
+            parameters.nonce,
+            STREAM_DOMAIN,
+            BigInt(index),
+        ]);
+        const stream = mimcHash({
+            mimc7: parameters.mimc7,
+            message: seed,
+            key: parameters.key,
+        });
+        return moduleFr(field + stream);
+    });
+}
+function decryptFields(parameters) {
+    return parameters.ciphertext.map((field, index) => {
+        const seed = poseidonHash(parameters.poseidon, [
+            parameters.nonce,
+            STREAM_DOMAIN,
+            BigInt(index),
+        ]);
+        const stream = mimcHash({
+            mimc7: parameters.mimc7,
+            message: seed,
+            key: parameters.key,
+        });
+        return moduleFr(bigintFromHex(field) - stream);
+    });
+}
+function plaintextBigints(plaintext) {
+    return [
+        bigintFromDecimal(plaintext.value),
+        bigintFromDecimal(plaintext.assetHi),
+        bigintFromDecimal(plaintext.assetLo),
+        bigintFromDecimal(plaintext.nullifier),
+        bigintFromDecimal(plaintext.secret),
+        bigintFromDecimal(plaintext.applicationId),
+    ];
+}
+function plaintextFromBigints(fields) {
+    return {
+        value: frDecimalFromBigint(fields[0] ?? ZERO),
+        assetHi: frDecimalFromBigint(fields[1] ?? ZERO),
+        assetLo: frDecimalFromBigint(fields[2] ?? ZERO),
+        nullifier: frDecimalFromBigint(fields[3] ?? ZERO),
+        secret: frDecimalFromBigint(fields[4] ?? ZERO),
+        applicationId: frDecimalFromBigint(fields[5] ?? ZERO),
+    };
+}
+async function secretFromDepositEphemeralScalarDecimal(ephemeralKeyScalarDecimal) {
+    const { poseidon } = await primitives();
+    const secret = poseidonHash(poseidon, [bigintFromDecimal(ephemeralKeyScalarDecimal)]);
+    return frDecimalFromBigint(secret);
+}
+async function encryptOutputNoteForDeposit(parameters) {
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const secret = await secretFromDepositEphemeralScalarDecimal(parameters.deposit.ephemeralKeyScalar);
+    const plaintext = {
+        value: parameters.deposit.value,
+        assetHi: parameters.deposit.asset[0],
+        assetLo: parameters.deposit.asset[1],
+        nullifier: parameters.deposit.nullifier,
+        secret,
+        applicationId: parameters.deposit.applicationId,
+    };
+    const [sharedX, sharedY] = sharedKeyFromDepositor({
+        babyJub,
+        ecdhShared: parameters.ecdhShared,
+        ephemeralKeyScalarDecimal: parameters.deposit.ephemeralKeyScalar,
+        recipientPublicKey: parameters.deposit.recipientPublicKeys,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const message = plaintextBigints(plaintext);
+    const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
+    const tag = outputNoteTag({ poseidon, key, nonce, plaintext: message });
+    return {
+        ciphertext: ciphertext.map((field) => frDecimalFromBigint(field)),
+        tag: frDecimalFromBigint(tag),
+    };
+}
+function ownerPubFromRecipientScalar(babyJub, recipientScalarHex) {
+    const product = babyJub.mulPointEscalar(babyJub.Base8, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
+    return [
+        fieldBigint(babyJub.F, product[0]),
+        fieldBigint(babyJub.F, product[1]),
+    ];
+}
+function commitmentFromPlaintextAndOwnerPub(parameters) {
+    const commitment = poseidonHash(parameters.poseidon, [
+        bigintFromDecimal(parameters.plaintext.value),
+        bigintFromDecimal(parameters.plaintext.secret),
+        bigintFromDecimal(parameters.plaintext.nullifier),
+        parameters.ownerPub[0],
+        parameters.ownerPub[1],
+        parameters.ownerMode,
+        bigintFromDecimal(parameters.plaintext.assetHi),
+        bigintFromDecimal(parameters.plaintext.assetLo),
+        bigintFromDecimal(parameters.plaintext.applicationId),
+    ]);
+    return normalizeHex(commitment.toString(16));
+}
+async function decryptOutputNoteEvent(input) {
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const [sharedX, sharedY] = sharedKeyFromRecipient({
+        babyJub,
+        recipientScalarHex: input.recipientScalarHex,
+        ephemeralPublicKey: input.createdEphemeralKey,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const decrypted = decryptFields({
+        mimc7,
+        poseidon,
+        key,
+        nonce,
+        ciphertext: input.ciphertext,
+    });
+    const expectedTag = outputNoteTag({
+        poseidon,
+        key,
+        nonce,
+        plaintext: decrypted,
+    });
+    if (expectedTag !== bigintFromHex(input.tag)) {
+        throw new Error('Output note tag verification failed');
+    }
+    const plaintext = plaintextFromBigints(decrypted);
+    const commitmentHex = commitmentFromPlaintextAndOwnerPub({
+        poseidon,
+        plaintext,
+        ownerPub: ownerPubFromRecipientScalar(babyJub, input.recipientScalarHex),
+        ownerMode: input.ownerMode ?? 0n,
+    });
+    const commitmentMatches = normalizeHex(input.commitmentHashHex) === commitmentHex;
+    if (!commitmentMatches) {
+        throw new Error('Output note commitment checksum mismatch');
+    }
+    return {
+        ...plaintext,
+        commitmentHex,
+        commitmentMatches,
+    };
+}
+function ownerModeFromEscrowNonce(escrowNonce) {
+    return bigintFromDecimal(escrowNonce) === ZERO ? ZERO : ONE;
+}
+function emptyFlagFromValue(value) {
+    return bigintFromDecimal(value) === ZERO ? ONE : ZERO;
+}
+function precommitmentFromOpening(parameters) {
+    const ownerKeyHash = poseidonHash(parameters.poseidon, [
+        parameters.ownerPub[0],
+        parameters.ownerPub[1],
+    ]);
+    return poseidonHash(parameters.poseidon, [
+        parameters.secret,
+        parameters.ownerMode,
+        ownerKeyHash,
+    ]);
+}
+async function encryptNoteAuditSlot(parameters) {
+    if (parameters.plaintext.length !== NOTE_AUDIT_LEN$1) {
+        throw new Error(`encryptNoteAuditSlot: expected ${String(NOTE_AUDIT_LEN$1)} limbs`);
+    }
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const [sharedX, sharedY] = sharedKeyFromDepositor({
+        babyJub,
+        ecdhShared: parameters.ecdhShared,
+        ephemeralKeyScalarDecimal: parameters.auditEphemeralScalar,
+        recipientPublicKey: parameters.auditPublicKey,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const message = parameters.plaintext.map((field) => bigintFromDecimal(field));
+    const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
+    const tag = poseidonMacTag({
+        poseidon,
+        domain: DOM_AUDIT_TAG,
+        key,
+        nonce,
+        message,
+    });
+    return {
+        ciphertext: ciphertext.map((field) => frDecimalFromBigint(field)),
+        tag: frDecimalFromBigint(tag),
+    };
+}
+function auditPlaintextForWithdraw(parameters) {
+    const value = parameters.witness.withdrawnValues[parameters.index] ?? '0';
+    const ownerPub = parameters.witness.ownerPubs[parameters.index] ?? ['0', '0'];
+    const escrowNonce = parameters.witness.withdrawnEscrowNonces[parameters.index] ?? '0';
+    const secret = bigintFromDecimal(parameters.witness.withdrawnSecrets[parameters.index] ?? '0');
+    const ownerMode = ownerModeFromEscrowNonce(escrowNonce);
+    const precommitment = precommitmentFromOpening({
+        poseidon: parameters.poseidon,
+        secret,
+        ownerMode,
+        ownerPub: [bigintFromDecimal(ownerPub[0]), bigintFromDecimal(ownerPub[1])],
+    });
+    const asset = parameters.witness.withdrawnAssets[parameters.index] ?? ['0', '0'];
+    const stellar = parameters.witness.inputRecipientStellar[parameters.index] ?? ['0', '0'];
+    return [
+        frDecimalFromBigint(emptyFlagFromValue(value)),
+        value,
+        asset[0],
+        asset[1],
+        frDecimalFromBigint(precommitment),
+        parameters.witness.withdrawnNullifiers[parameters.index] ?? '0',
+        ownerPub[0],
+        ownerPub[1],
+        parameters.witness.inputApplicationIds[parameters.index] ?? '0',
+        stellar[0],
+        stellar[1],
+        escrowNonce,
+    ];
+}
+async function auditPlaintextForDeposit(parameters) {
+    const value = parameters.witness.depositedValues[parameters.index] ?? '0';
+    const ownerPub = parameters.witness.depositedRecipientPublicKeys[parameters.index] ?? ['0', '0'];
+    const escrowNonce = parameters.witness.depositedEscrowNonces[parameters.index] ?? '0';
+    const secret = poseidonHash(parameters.poseidon, [
+        bigintFromDecimal(parameters.witness.depositedEphemeralKeyScalars[parameters.index] ?? '0'),
+    ]);
+    const ownerMode = ownerModeFromEscrowNonce(escrowNonce);
+    const precommitment = precommitmentFromOpening({
+        poseidon: parameters.poseidon,
+        secret,
+        ownerMode,
+        ownerPub: [bigintFromDecimal(ownerPub[0]), bigintFromDecimal(ownerPub[1])],
+    });
+    const asset = parameters.witness.depositedAssets[parameters.index] ?? ['0', '0'];
+    const stellar = parameters.witness.outputRecipientStellar[parameters.index] ?? ['0', '0'];
+    return [
+        frDecimalFromBigint(emptyFlagFromValue(value)),
+        value,
+        asset[0],
+        asset[1],
+        frDecimalFromBigint(precommitment),
+        parameters.witness.depositedNullifiers[parameters.index] ?? '0',
+        ownerPub[0],
+        ownerPub[1],
+        parameters.witness.outputApplicationIds[parameters.index] ?? '0',
+        stellar[0],
+        stellar[1],
+        escrowNonce,
+    ];
+}
+async function encryptTransactionCiphertextBlob(parameters) {
+    const { poseidon } = await primitives();
+    const nIns = parameters.witness.withdrawnValues.length;
+    const nOuts = parameters.witness.depositedValues.length;
+    const nAuditSlots = parameters.layout.nAuditSlots;
+    const auditCiphertexts = [];
+    for (let slot = 0; slot < nAuditSlots; slot += 1) {
+        const plaintext = slot < nIns
+            ? auditPlaintextForWithdraw({
+                poseidon,
+                witness: parameters.witness,
+                index: slot,
+            })
+            : await auditPlaintextForDeposit({
+                poseidon,
+                witness: parameters.witness,
+                index: slot - nIns,
+            });
+        const encrypted = await encryptNoteAuditSlot({
+            auditPublicKey: parameters.witness.noteAuditPublicKey,
+            auditEphemeralScalar: parameters.witness.auditEphemeralScalar,
+            plaintext,
+            ecdhShared: parameters.ecdhShared,
+        });
+        auditCiphertexts.push(encrypted.ciphertext);
+    }
+    const outputNoteCiphertexts = [];
+    for (let index = 0; index < nOuts; index += 1) {
+        const deposit = {
+            value: parameters.witness.depositedValues[index] ?? '0',
+            nullifier: parameters.witness.depositedNullifiers[index] ?? '0',
+            ephemeralKeyScalar: parameters.witness.depositedEphemeralKeyScalars[index] ?? '0',
+            asset: parameters.witness.depositedAssets[index] ?? ['0', '0'],
+            applicationId: parameters.witness.outputApplicationIds[index] ?? '0',
+            recipientPublicKeys: parameters.witness.depositedRecipientPublicKeys[index] ?? ['0', '0'],
+        };
+        const encrypted = await encryptOutputNoteForDeposit({
+            deposit,
+            ecdhShared: parameters.ecdhShared,
+        });
+        outputNoteCiphertexts.push([...encrypted.ciphertext]);
+    }
+    const blob = encodeTransactionCiphertextBlob({
+        layout: parameters.layout,
+        auditCiphertexts,
+        outputNoteCiphertexts,
+    });
+    return {
+        ciphertextHex: blob.toString('hex'),
+        auditCiphertexts,
+        outputNoteCiphertexts,
+    };
+}
+
+/** Stroops amount as a decimal field string. Reject JS `number` so 18-decimal values cannot silently narrow. */
+function coinValueDecimal(amount) {
+    if (typeof amount === "number") {
+        throw new TypeError("coin value must be bigint or decimal string, not number");
+    }
+    if (typeof amount === "bigint") {
+        if (amount < 0n) {
+            throw new RangeError("amount must be a non-negative integer");
+        }
+        return amount.toString(10);
+    }
+    if (typeof amount !== "string") {
+        throw new TypeError("coin value must be bigint or decimal string, not number");
+    }
+    const trimmed = amount.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+        throw new TypeError("coin value decimal string must be a non-negative integer");
+    }
+    return trimmed;
+}
+function generatedCoinFromWasm(value) {
+    const raw = value;
+    const precommitementHex = raw.precommitementHex ?? raw.precommitement_hex;
+    if (!precommitementHex) {
+        throw new Error("generated coin missing precommitement hex");
+    }
+    return {
+        coin: raw.coin,
+        commitment_hex: raw.commitment_hex,
+        precommitement_hex: precommitementHex,
+        precommitementHex,
+    };
+}
+class PrivacyPoolSDK {
+    constructor(wasm, options, resolved) {
+        this.wasm = wasm;
+        this.options = options;
+        this.zkConfigNonce = resolved.nonce;
+        this.circuitConfig = resolved.config;
+        this.layout = layoutFromCircuitConfig(resolved.config);
+    }
+    getZkConfigNonce() {
+        return this.zkConfigNonce;
+    }
+    getLayout() {
+        return this.layout;
+    }
+    /**
+     * Initialize the SDK by loading WASM modules.
+     *
+     * In Node.js, proving artifacts load from `zkArtifactBaseUrl` or
+     * `ZK_ARTIFACT_BASE_URL`, defaulting to this package's GitHub release.
+     * In browser, pass pre-loaded WASM via options:
+     * ```ts
+     * const sdk = await PrivacyPoolSDK.init({
+     *   wasmBinary: await fetch('/pkg/client_sdk_wasm_bg.wasm').then(r => r.arrayBuffer()),
+     *   zkArtifactBaseUrl: 'https://github.com/Polynom-Labs/stellar-privacy-layer-contracts/releases/download/v0.8.0',
+     * });
+     * ```
+     */
+    static async init(options) {
+        const opts = options ?? {};
+        const wasm = await loadWasm(opts.wasmBinary);
+        const resolved = resolveZkCircuitConfig(opts.zkCircuits, opts.zkConfigNonce);
+        const sdk = new PrivacyPoolSDK(wasm, opts, resolved);
+        sdk.circuitArtifacts = await resolveCircuitArtifacts(resolved.config, opts.zkArtifactBaseUrl);
+        return sdk;
+    }
+    /**
+     * Uniform 32-byte scalar as lowercase hex (Web Crypto). Same in browser and Node 19+.
+     */
+    static generateRandomScalarHex32() {
+        return generateRandomScalarHex32();
+    }
+    /**
+     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
+     * The message binds network, pool, registry, and schema version (H6).
+     */
+    static buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+        return buildStealthAddressSignMessage(address, domain, nonce);
+    }
+    /**
+     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
+     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
+     * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
+     */
+    generateCoin(amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoin(coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinWithOwnerPub(ownerPub, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinWithOwnerPubHex(ownerPub.x, ownerPub.y, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinFromDepositEphemeralScalarHex(scalarHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
+     */
+    buildWithdrawMerkleWitness(coin, state) {
+        const coinJson = JSON.stringify(coin);
+        const stateJson = JSON.stringify(state);
+        const resultJson = this.wasm.buildWithdrawMerkleWitness(coinJson, stateJson);
+        return JSON.parse(resultJson);
+    }
+    /**
+     * Full `Transaction(20,2,2)` withdrawal proof: one real withdraw + dummies, using coin/state and depositor ECDH point (hex).
+     *
+     * Optional **partial public withdraw**: spend the full coin commitment `coin.value` (V), send `publicWithdrawStroops` (W) to the
+     * Stellar receiver, and re-deposit the remainder (V−W) as a new private note to `changeRecipientStealthAddress` (same circuit balance).
+     */
+    async proveWithdrawal(coin, state, params) {
+        const witness = this.buildWithdrawMerkleWitness(coin, state);
+        const ownerPubHex = this.ecdhEphemeralPublicKeyFromScalarHex(BigInt(params.privKeyScalar).toString(16).padStart(64, "0"));
+        const w0 = withdrawObjectFromMerkleWitness(witness, ownerPubHex, params.applicationId ?? coin.application_id ?? "0", params.privKeyScalar);
+        const fullV = BigInt(coin.value);
+        let publicWithdrawals;
+        let deposits;
+        if (params.publicWithdrawStroops !== undefined) {
+            const W = params.publicWithdrawStroops;
+            if (params.changeRecipientStealthAddress === undefined) {
+                throw new Error("proveWithdrawal: changeRecipientStealthAddress is required when publicWithdrawStroops is set");
+            }
+            if (W <= 0n || W >= fullV) {
+                throw new Error("proveWithdrawal: publicWithdrawStroops must be strictly between 0 and coin.value");
+            }
+            const change = fullV - W;
+            publicWithdrawals = [W.toString()];
+            const changeDeposit = {
+                value: change.toString(),
+                nullifier: randomFrDecimal(),
+                ephemeralKeyScalar: randomFrDecimal253(),
+                asset: [coin.asset_hi, coin.asset_lo],
+                applicationId: params.applicationId ?? "0",
+                recipientPublicKeys: recipientPublicKeysDecimalFromStealthAddress(params.changeRecipientStealthAddress),
+            };
+            deposits = [changeDeposit];
+        }
+        else {
+            publicWithdrawals = [coin.value];
+            deposits = [];
+        }
+        // On-chain `transact` sends `publicWithdrawals` / `publicWithdrawnAssets` to the withdraw account.
+        const publicLegs = {
+            publicWithdrawnAssets: [[coin.asset_hi, coin.asset_lo]],
+            publicDepositedAssets: [["0", "0"]],
+            publicDeposits: ["0"],
+            publicWithdrawals,
+        };
+        return this.proveTransactionSlots({
+            stateRoot: witness.stateRoot,
+            withdrawAddressHi: params.withdrawAddressHi,
+            withdrawAddressLo: params.withdrawAddressLo,
+            privKeyScalar: params.privKeyScalar,
+        }, publicLegs, [w0], deposits, params.audit ??
+            resolveTransactionAuditParams(params.applicationId ?? coin.application_id ?? DEFAULT_APPLICATION_ID, DEMO_AUDIT_PUBLIC_KEY, this.layout.nAuditSlots));
+    }
+    /**
+     * Convert a snarkjs proof JSON to hex bytes for Soroban.
+     */
+    proofToHex(proof) {
+        return this.wasm.proofToHex(JSON.stringify(proof));
+    }
+    /**
+     * Convert snarkjs public signals to hex bytes for Soroban.
+     */
+    publicToHex(publicSignals) {
+        return this.wasm.publicToHex(JSON.stringify(publicSignals));
+    }
+    /**
+     * BabyJubJub ephemeral point from a 32-byte scalar (hex). For custom {@link WithdrawObject} / tests.
+     */
+    ecdhEphemeralPublicKeyFromScalarHex(scalarHex) {
+        return this.wasm.ecdhEphemeralPublicKeyFromScalarHex(scalarHex);
+    }
+    /** Circuit `ECDH`: scalar (32-byte hex) × recipient BabyJub point → shared key hex coords. */
+    ecdhSharedKey(scalarHex, recipientPubXHex, recipientPubYHex) {
+        return this.wasm.ecdhSharedKey(scalarHex, recipientPubXHex, recipientPubYHex);
+    }
+    /**
+     * `Transaction(20,nIns,nOuts)` proof from high-level legs: maps to witness input (incl. `"dummy"` ECDH via WASM), then Groth16 → Soroban hex.
+     * Slots are padded to the selected ZK config layout (bundled 2×2 or 6×6).
+     */
+    async proveTransaction(publicParams, publicLegs, withdraws, deposits, audit) {
+        return this.proveTransactionSlots(publicParams, publicLegs, withdraws, deposits, audit);
+    }
+    async proveTransactionSlots(publicParams, publicLegs, withdraws, deposits, audit) {
+        const wasmEcdh = {
+            ecdhEphemeralPublicKeyFromScalarHex: (h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h),
+        };
+        const { nIns, nOuts, publicNInputs, publicNOutputs } = this.layout;
+        const witnessInput = buildTransactionWitnessInput(publicParams, publicLegs, withdraws, deposits, audit, wasmEcdh, { nIns, nOuts, publicNInputs, publicNOutputs });
+        const artifacts = this.circuitArtifacts;
+        if (!artifacts) {
+            throw new Error("PrivacyPoolSDK circuit artifacts are not loaded");
+        }
+        const proved = this.wasm.proveGroth16(artifacts.graph, artifacts.provingKey, artifacts.r1cs, JSON.stringify(witnessInput));
+        const encrypted = await encryptTransactionCiphertextBlob({
+            witness: witnessInput,
+            layout: this.layout,
+            ecdhShared: (priv, pubX, pubY) => this.wasm.ecdhSharedKey(priv, pubX, pubY),
+        });
+        return {
+            proof_hex: proved.proof_hex,
+            public_hex: proved.public_hex,
+            ciphertext_hex: encrypted.ciphertextHex,
+            output_note_ephemeral_scalars: witnessInput.depositedEphemeralKeyScalars,
+        };
+    }
+    /**
+     * Calculate owner-bound nullifier hash: Poseidon(DOM_NULLIFIER, nullifier, privKeyScalar)
+     * @param nullifier Nullifier decimal string from coin data
+     * @param privKeyScalar Spend scalar decimal string
+     * @returns Hex string (0x...) of the hash bytes
+     */
+    calculateNullifierHash(nullifier, privKeyScalar) {
+        return this.wasm.calculateNullifierHash(nullifier, privKeyScalar);
+    }
+    /**
+     * Ed25519 signature from signing {@link buildStealthAddressSignMessage}: **128 hex chars** (optional `0x`)
+     * or **base64** (64 raw bytes after decode). Domain-separated SHA-256 → scalar → ECDH → `stpl1` Bech32.
+     */
+    async generateStealthAddressFromStellarSignature(signature, domain) {
+        return stealthAddressFromStellarSignature((h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h), encodeStealthAddress, signature, domain);
+    }
+    encodeDecodedEphemeralKey(decoded) {
+        return encodeDecodedEphemeralKey(decoded);
+    }
+    decodeDecodedEphemeralKey(encoded) {
+        return decodeDecodedEphemeralKey(encoded);
+    }
+    encodeDepositorSharedSecretPreimage(decoded) {
+        return encodeDepositorSharedSecretPreimage(decoded);
+    }
+    decodeDepositorSharedSecretPreimage(encoded) {
+        return decodeDepositorSharedSecretPreimage(encoded);
+    }
+    sharedSecretFromDepositorPreimage(preimage) {
+        return sharedSecretFromDepositorPreimage((a, b, c) => this.wasm.ecdhSharedKey(a, b, c), preimage);
+    }
+    sharedSecretFromRecipientPreimage(preimage) {
+        return sharedSecretFromRecipientPreimage((a, b, c) => this.wasm.ecdhSharedKey(a, b, c), preimage);
+    }
+}
+
+/** @deprecated Witness generation is in the main SDK WASM (`proveGroth16`). */
+async function generateWitness(_input, _circuitWasm, _wasmFileName) {
+    throw new Error('generateWitness is removed. Call PrivacyPoolSDK.proveTransaction (graph witness + Groth16 in sdk.wasm).');
+}
+
+/** Pool Merkle tree depth (matches `coin::TREE_DEPTH` / `Transaction` circuit). */
+const POOL_MERKLE_TREE_DEPTH = 20;
+/** Default coin value in stroops (1 XLM); matches Rust `coin::COIN_VALUE`. */
+const COIN_VALUE_STROOPS = 1000000000;
+
+/**
+ * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+ * @param a - value to test
+ * @returns `true` when the value is a Uint8Array-compatible view.
+ * @example
+ * Check whether a value is a Uint8Array-compatible view.
+ * ```ts
+ * isBytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function isBytes(a) {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
+    // The fallback still requires a real ArrayBuffer view, so plain
+    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
+    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            'BYTES_PER_ELEMENT' in a &&
+            a.BYTES_PER_ELEMENT === 1));
+}
+/**
+ * Asserts something is Uint8Array.
+ * @param value - value to validate
+ * @param length - optional exact length constraint
+ * @param title - label included in thrown errors
+ * @returns The validated byte array.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate that a value is a byte array.
+ * ```ts
+ * abytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function abytes(value, length, title = '') {
+    const bytes = isBytes(value);
+    const len = value?.length;
+    const needsLen = length !== undefined;
+    if (!bytes || (needsLen)) {
+        const prefix = title && `"${title}" `;
+        const ofLen = '';
+        const got = bytes ? `length=${len}` : `type=${typeof value}`;
+        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
+        if (!bytes)
+            throw new TypeError(message);
+        throw new RangeError(message);
+    }
+    return value;
+}
+/**
+ * Asserts a hash instance has not been destroyed or finished.
+ * @param instance - hash instance to validate
+ * @param checkFinished - whether to reject finalized instances
+ * @throws If the hash instance has already been destroyed or finalized. {@link Error}
+ * @example
+ * Validate that a hash instance is still usable.
+ * ```ts
+ * import { aexists } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aexists(hash);
+ * ```
+ */
+function aexists(instance, checkFinished = true) {
+    if (instance.destroyed)
+        throw new Error('Hash instance has been destroyed');
+    if (checkFinished && instance.finished)
+        throw new Error('Hash#digest() has already been called');
+}
+/**
+ * Asserts output is a sufficiently-sized byte array.
+ * @param out - destination buffer
+ * @param instance - hash instance providing output length
+ * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a caller-provided digest buffer.
+ * ```ts
+ * import { aoutput } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aoutput(new Uint8Array(hash.outputLen), hash);
+ * ```
+ */
+function aoutput(out, instance) {
+    abytes(out, undefined, 'digestInto() output');
+    const min = instance.outputLen;
+    if (out.length < min) {
+        throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+    }
+}
+/**
+ * Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+ * @param arrays - arrays to overwrite with zeros
+ * @example
+ * Zeroize sensitive buffers in place.
+ * ```ts
+ * clean(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function clean(...arrays) {
+    for (let i = 0; i < arrays.length; i++) {
+        arrays[i].fill(0);
+    }
+}
+/**
+ * Creates a DataView for byte-level manipulation.
+ * @param arr - source typed array
+ * @returns DataView over the same buffer region.
+ * @example
+ * Create a DataView over an existing buffer.
+ * ```ts
+ * createView(new Uint8Array(4));
+ * ```
+ */
+function createView(arr) {
+    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/**
+ * Rotate-right operation for uint32 values.
+ * @param word - source word
+ * @param shift - shift amount in bits
+ * @returns Rotated word.
+ * @example
+ * Rotate a 32-bit word to the right.
+ * ```ts
+ * rotr(0x12345678, 8);
+ * ```
+ */
+function rotr(word, shift) {
+    return (word << (32 - shift)) | (word >>> shift);
+}
+// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex
+const hasHexBuiltin = /* @__PURE__ */ (() => 
+// @ts-ignore
+typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();
+// Array where index 0xf0 (240) is mapped to string 'f0'
+const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
+/**
+ * Convert byte array to hex string.
+ * Uses the built-in function when available and assumes it matches the tested
+ * fallback semantics.
+ * @param bytes - bytes to encode
+ * @returns Lowercase hexadecimal string.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Convert bytes to lowercase hexadecimal.
+ * ```ts
+ * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
+ * ```
+ */
+function bytesToHex(bytes) {
+    abytes(bytes);
+    // @ts-ignore
+    if (hasHexBuiltin)
+        return bytes.toHex();
+    // pre-caching improves the speed 6x
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++) {
+        hex += hexes[bytes[i]];
+    }
+    return hex;
+}
+/**
+ * Creates a callable hash function from a stateful class constructor.
+ * @param hashCons - hash constructor or factory
+ * @param info - optional metadata such as DER OID
+ * @returns Frozen callable hash wrapper with `.create()`.
+ *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+ *   `outputLen` / `blockLen`, so constructor side effects happen at module
+ *   init time.
+ * @example
+ * Wrap a stateful hash constructor into a callable helper.
+ * ```ts
+ * import { createHasher } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+ * wrapped(new Uint8Array([1]));
+ * ```
+ */
+function createHasher(hashCons, info = {}) {
+    const hashC = (msg, opts) => hashCons(opts)
+        .update(msg)
+        .digest();
+    const tmp = hashCons(undefined);
+    hashC.outputLen = tmp.outputLen;
+    hashC.blockLen = tmp.blockLen;
+    hashC.canXOF = tmp.canXOF;
+    hashC.create = (opts) => hashCons(opts);
+    Object.assign(hashC, info);
+    return Object.freeze(hashC);
+}
+/**
+ * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+ * @param suffix - final OID byte for the selected hash.
+ *   The helper accepts any byte even though only the documented NIST hash
+ *   suffixes are meaningful downstream.
+ * @returns Object containing the DER-encoded OID.
+ * @example
+ * Build OID metadata for a NIST hash.
+ * ```ts
+ * oidNist(0x01);
+ * ```
+ */
+const oidNist = (suffix) => ({
+    // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+    // Larger suffix values would need base-128 OID encoding and a different length byte.
+    oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),
+});
+
+/**
+ * Internal Merkle-Damgard hash utils.
+ * @module
+ */
+/**
+ * Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+ * Returns bits from `b` when `a` is set, otherwise from `c`.
+ * The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+ * set the same bit.
+ * @param a - selector word
+ * @param b - word chosen when selector bit is set
+ * @param c - word chosen when selector bit is clear
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit choice primitive.
+ * ```ts
+ * Chi(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+function Chi(a, b, c) {
+    return (a & b) ^ (~a & c);
+}
+/**
+ * Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+ * Returns bits shared by at least two inputs.
+ * @param a - first input word
+ * @param b - second input word
+ * @param c - third input word
+ * @returns Mixed 32-bit word.
+ * @example
+ * Combine three words with the shared 32-bit majority primitive.
+ * ```ts
+ * Maj(0xffffffff, 0x12345678, 0x87654321);
+ * ```
+ */
+function Maj(a, b, c) {
+    return (a & b) ^ (a & c) ^ (b & c);
+}
+/**
+ * Merkle-Damgard hash construction base class.
+ * Could be used to create MD5, RIPEMD, SHA1, SHA2.
+ * Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+ * strings with partial-byte tails.
+ * @param blockLen - internal block size in bytes
+ * @param outputLen - digest size in bytes
+ * @param padOffset - trailing length field size in bytes
+ * @param isLE - whether length and state words are encoded in little-endian
+ * @example
+ * Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+ * ```ts
+ * import { _SHA1 } from '@noble/hashes/legacy.js';
+ * const hash = new _SHA1();
+ * hash.update(new Uint8Array([97, 98, 99]));
+ * hash.digest();
+ * ```
+ */
+class HashMD {
+    blockLen;
+    outputLen;
+    canXOF = false;
+    padOffset;
+    isLE;
+    // For partial updates less than block size
+    buffer;
+    view;
+    finished = false;
+    length = 0;
+    pos = 0;
+    destroyed = false;
+    constructor(blockLen, outputLen, padOffset, isLE) {
+        this.blockLen = blockLen;
+        this.outputLen = outputLen;
+        this.padOffset = padOffset;
+        this.isLE = isLE;
+        this.buffer = new Uint8Array(blockLen);
+        this.view = createView(this.buffer);
+    }
+    update(data) {
+        aexists(this);
+        abytes(data);
+        const { view, buffer, blockLen } = this;
+        const len = data.length;
+        for (let pos = 0; pos < len;) {
+            const take = Math.min(blockLen - this.pos, len - pos);
+            // Fast path only when there is no buffered partial block: `take === blockLen` implies
+            // `this.pos === 0`, so we can process full blocks directly from the input view.
+            if (take === blockLen) {
+                const dataView = createView(data);
+                for (; blockLen <= len - pos; pos += blockLen)
+                    this.process(dataView, pos);
+                continue;
+            }
+            buffer.set(data.subarray(pos, pos + take), this.pos);
+            this.pos += take;
+            pos += take;
+            if (this.pos === blockLen) {
+                this.process(view, 0);
+                this.pos = 0;
+            }
+        }
+        this.length += data.length;
+        this.roundClean();
+        return this;
+    }
+    digestInto(out) {
+        aexists(this);
+        aoutput(out, this);
+        this.finished = true;
+        // Padding
+        // We can avoid allocation of buffer for padding completely if it
+        // was previously not allocated here. But it won't change performance.
+        const { buffer, view, blockLen, isLE } = this;
+        let { pos } = this;
+        // append the bit '1' to the message
+        buffer[pos++] = 0b10000000;
+        clean(this.buffer.subarray(pos));
+        // we have less than padOffset left in buffer, so we cannot put length in
+        // current block, need process it and pad again
+        if (this.padOffset > blockLen - pos) {
+            this.process(view, 0);
+            pos = 0;
+        }
+        // Pad until full block byte with zeros
+        for (let i = pos; i < blockLen; i++)
+            buffer[i] = 0;
+        // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
+        // the padding fill above, and JS will overflow before user input can make that half non-zero.
+        // So we only need to write the low 64 bits here.
+        view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+        this.process(view, 0);
+        const oview = createView(out);
+        const len = this.outputLen;
+        // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
+        if (len % 4)
+            throw new Error('_sha2: outputLen must be aligned to 32bit');
+        const outLen = len / 4;
+        const state = this.get();
+        if (outLen > state.length)
+            throw new Error('_sha2: outputLen bigger than state');
+        for (let i = 0; i < outLen; i++)
+            oview.setUint32(4 * i, state[i], isLE);
+    }
+    digest() {
+        const { buffer, outputLen } = this;
+        this.digestInto(buffer);
+        // Copy before destroy(): subclasses wipe `buffer` during cleanup, but `digest()` must return
+        // fresh bytes to the caller.
+        const res = buffer.slice(0, outputLen);
+        this.destroy();
+        return res;
+    }
+    _cloneInto(to) {
+        to ||= new this.constructor();
+        to.set(...this.get());
+        const { blockLen, buffer, length, finished, destroyed, pos } = this;
+        to.destroyed = destroyed;
+        to.finished = finished;
+        to.length = length;
+        to.pos = pos;
+        // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
+        // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
+        if (length % blockLen)
+            to.buffer.set(buffer);
+        return to;
+    }
+    clone() {
+        return this._cloneInto();
+    }
+}
+/**
+ * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
+ * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
+ */
+/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+ * square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+ * it as read-only because constructors copy words from it by index. */
+const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+]);
+
+/**
+ * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+ * SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+ * Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+ * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
+ * @module
+ */
+/**
+ * SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+ * of the cube roots of the first 64 primes (2..311).
+ */
+// prettier-ignore
+const SHA256_K = /* @__PURE__ */ Uint32Array.from([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+]);
+/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
+const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+class SHA2_32B extends HashMD {
+    constructor(outputLen) {
+        super(64, outputLen, 8, false);
+    }
+    get() {
+        const { A, B, C, D, E, F, G, H } = this;
+        return [A, B, C, D, E, F, G, H];
+    }
+    // prettier-ignore
+    set(A, B, C, D, E, F, G, H) {
+        this.A = A | 0;
+        this.B = B | 0;
+        this.C = C | 0;
+        this.D = D | 0;
+        this.E = E | 0;
+        this.F = F | 0;
+        this.G = G | 0;
+        this.H = H | 0;
+    }
+    process(view, offset) {
+        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
+        for (let i = 0; i < 16; i++, offset += 4)
+            SHA256_W[i] = view.getUint32(offset, false);
+        for (let i = 16; i < 64; i++) {
+            const W15 = SHA256_W[i - 15];
+            const W2 = SHA256_W[i - 2];
+            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);
+            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);
+            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;
+        }
+        // Compression function main loop, 64 rounds
+        let { A, B, C, D, E, F, G, H } = this;
+        for (let i = 0; i < 64; i++) {
+            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
+            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+            const T2 = (sigma0 + Maj(A, B, C)) | 0;
+            H = G;
+            G = F;
+            F = E;
+            E = (D + T1) | 0;
+            D = C;
+            C = B;
+            B = A;
+            A = (T1 + T2) | 0;
+        }
+        // Add the compressed chunk to the current hash value
+        A = (A + this.A) | 0;
+        B = (B + this.B) | 0;
+        C = (C + this.C) | 0;
+        D = (D + this.D) | 0;
+        E = (E + this.E) | 0;
+        F = (F + this.F) | 0;
+        G = (G + this.G) | 0;
+        H = (H + this.H) | 0;
+        this.set(A, B, C, D, E, F, G, H);
+    }
+    roundClean() {
+        clean(SHA256_W);
+    }
+    destroy() {
+        // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
+        // update()/digest() callable on reused instances.
+        this.destroyed = true;
+        this.set(0, 0, 0, 0, 0, 0, 0, 0);
+        clean(this.buffer);
+    }
+}
+/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+class _SHA256 extends SHA2_32B {
+    // We cannot use array here since array allows indexing by variable
+    // which means optimizer/compiler cannot use registers.
+    A = SHA256_IV[0] | 0;
+    B = SHA256_IV[1] | 0;
+    C = SHA256_IV[2] | 0;
+    D = SHA256_IV[3] | 0;
+    E = SHA256_IV[4] | 0;
+    F = SHA256_IV[5] | 0;
+    G = SHA256_IV[6] | 0;
+    H = SHA256_IV[7] | 0;
+    constructor() {
+        super(32);
+    }
+}
+/**
+ * SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
+ *
+ * - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+ * - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+ * - Each sha256 hash is executing 2^18 bit operations.
+ * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+ * @param msg - message bytes to hash
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with SHA2-256.
+ * ```ts
+ * sha256(new Uint8Array([97, 98, 99]));
+ * ```
+ */
+const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), 
+/* @__PURE__ */ oidNist(0x01));
+
+const KYT_PASSAGE_AUTH_DOMAIN = 'privacy-pool-kyt-passage-v1';
+const PUBLIC_LEG_CONTEXT_DOMAIN = 'privacy-pool-public-leg-context-v1';
+const PASSAGE_ID_DOMAIN = 'privacy-pool-passage-id-v3';
+const PASSAGE_ID_DOMAIN_V2 = 'privacy-pool-passage-id-v2';
+const PASSAGE_ID_DOMAIN_V1 = 'privacy-pool-passage-id-v1';
+const NOTE_AUDIT_LEN = 12;
+const TOTAL_PUBLIC_SIGNALS = 93;
+const NOTE_AUDIT_PLAINTEXT_LEN = 12;
+const FIELD_BYTES = 32;
+const LENGTH_PREFIX_BYTES = 4;
+function sha256Hex(data) {
+    return bytesToHex(sha256(data));
+}
+function publicSignalsBuffer(publicSignalsBytes) {
+    return typeof publicSignalsBytes === 'string'
+        ? Buffer.from(publicSignalsBytes.replace(/^0x/, ''), 'hex')
+        : publicSignalsBytes;
+}
+function expectedSignalCountForNonce(zkConfigNonce = 0n) {
+    return totalPublicSignals(layoutForKnownNonce(zkConfigNonce));
+}
+function stateRootIndexForNonce(zkConfigNonce = 0n) {
+    return stateRootIndex(layoutForKnownNonce(zkConfigNonce));
+}
+function parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce = 0n) {
+    const expectedCount = expectedSignalCountForNonce(zkConfigNonce);
+    const buf = publicSignalsBuffer(publicSignalsBytes);
+    let offset = 0;
+    let hasLengthPrefix = false;
+    if (buf.length >= LENGTH_PREFIX_BYTES) {
+        const len = buf.readUInt32BE(0);
+        if (buf.length === LENGTH_PREFIX_BYTES + len * FIELD_BYTES) {
+            offset = LENGTH_PREFIX_BYTES;
+            hasLengthPrefix = true;
+        }
+    }
+    const signalBytes = buf.subarray(offset);
+    if (signalBytes.length !== expectedCount * FIELD_BYTES) {
+        throw new Error(`expected ${expectedCount} public signals`);
+    }
+    return {
+        fields: Array.from({ length: expectedCount }, (_, index) => Buffer.from(signalBytes.subarray(index * FIELD_BYTES, (index + 1) * FIELD_BYTES))),
+        hasLengthPrefix,
+    };
+}
+function encodePublicSignalsBytes(fields, hasLengthPrefix) {
+    const body = Buffer.concat(fields);
+    if (!hasLengthPrefix) {
+        return body;
+    }
+    const prefix = Buffer.alloc(LENGTH_PREFIX_BYTES);
+    prefix.writeUInt32BE(fields.length);
+    return Buffer.concat([prefix, body]);
+}
+function appendBytes(parts, chunk) {
+    parts.push(chunk);
+}
+function appendU8(parts, value) {
+    parts.push(Buffer.from([value & 0xff]));
+}
+function appendU32BE(parts, value) {
+    const buf = Buffer.alloc(4);
+    buf.writeUInt32BE(value >>> 0);
+    parts.push(buf);
+}
+function appendU64BE(parts, value) {
+    const buf = Buffer.alloc(8);
+    buf.writeBigUInt64BE(BigInt(value));
+    parts.push(buf);
+}
+function appendU128BE(parts, value) {
+    const buf = Buffer.alloc(16);
+    buf.writeBigUInt64BE(value >> 64n, 0);
+    buf.writeBigUInt64BE(value & ((1n << 64n) - 1n), 8);
+    parts.push(buf);
+}
+function appendAddressStrkey(parts, address) {
+    const bytes = Buffer.from(address.trim(), 'utf8');
+    appendU32BE(parts, bytes.length);
+    parts.push(bytes);
+}
+/** Canonical zero-address sentinel for absent public-leg slots: `u32_be(0)` with no XDR bytes. */
+function zeroAddressSentinelBuffer() {
+    return Buffer.alloc(4);
+}
+function addressToCanonicalXdr(address) {
+    return Address.fromString(address.trim()).toScVal().toXDR();
+}
+function appendAddressXdr(parts, address) {
+    const xdr = addressToCanonicalXdr(address);
+    appendU32BE(parts, xdr.length);
+    parts.push(xdr);
+}
+function appendBytes32(parts, hex) {
+    parts.push(Buffer.from(hex.replace(/^0x/, ''), 'hex'));
+}
+function frToBuffer32(decimal) {
+    let value = BigInt(decimal);
+    const buf = Buffer.alloc(32);
+    for (let i = 31; i >= 0; i -= 1) {
+        buf[i] = Number(value & 0xffn);
+        value >>= 8n;
+    }
+    return buf;
+}
+function isPositiveFr(decimal) {
+    try {
+        return BigInt(decimal) > 0n;
+    }
+    catch {
+        return false;
+    }
+}
+function zeroFrBuffer() {
+    return Buffer.alloc(32, 0);
+}
+function zeroAddressBuffer() {
+    return zeroAddressSentinelBuffer();
+}
+function encodeLegSlot(parts, kind, slot, isPresent, assetHi, assetLo, amount, address) {
+    appendU8(parts, kind);
+    appendU32BE(parts, slot);
+    appendU8(parts, isPresent ? 1 : 0);
+    if (isPresent && address) {
+        parts.push(frToBuffer32(assetHi));
+        parts.push(frToBuffer32(assetLo));
+        appendU128BE(parts, BigInt(amount));
+        appendAddressXdr(parts, address);
+    }
+    else {
+        parts.push(zeroFrBuffer());
+        parts.push(zeroFrBuffer());
+        appendU128BE(parts, 0n);
+        parts.push(zeroAddressBuffer());
+    }
+}
+function hashPublicSignalBytes(publicSignalsBytes, zkConfigNonce = 0n) {
+    const parsed = parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce);
+    parsed.fields[stateRootIndexForNonce(zkConfigNonce)] = Buffer.alloc(FIELD_BYTES);
+    return sha256Hex(encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix));
+}
+function hashPublicLegContext(layout, input) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PUBLIC_LEG_CONTEXT_DOMAIN, 'utf8'));
+    appendU32BE(parts, layout.publicNOutputs);
+    appendU32BE(parts, layout.publicNInputs);
+    for (let i = 0; i < layout.publicNOutputs; i += 1) {
+        const amount = input.publicDeposits[i] ?? '0';
+        const present = isPositiveFr(amount);
+        const asset = input.publicDepositedAssets[i] ?? ['0', '0'];
+        encodeLegSlot(parts, 1, i, present, present ? asset[0] : '0', present ? asset[1] : '0', amount, present ? input.owner : undefined);
+    }
+    for (let j = 0; j < layout.publicNInputs; j += 1) {
+        const amount = input.publicWithdrawals[j] ?? '0';
+        const present = isPositiveFr(amount);
+        const asset = input.publicWithdrawnAssets[j] ?? ['0', '0'];
+        encodeLegSlot(parts, 2, j, present, present ? asset[0] : '0', present ? asset[1] : '0', amount, present ? input.withdrawAddress : undefined);
+    }
+    return sha256Hex(Buffer.concat(parts));
+}
+function derivePassageId(owner, nonce, publicSignalHash, publicLegContextHash, ciphertextHash) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN, 'utf8'));
+    appendAddressStrkey(parts, owner);
+    appendU64BE(parts, nonce);
+    appendBytes32(parts, publicSignalHash);
+    appendBytes32(parts, publicLegContextHash);
+    appendBytes32(parts, ciphertextHash);
+    return sha256Hex(Buffer.concat(parts));
+}
+function derivePassageIdV2(owner, nonce, publicSignalHash, publicLegContextHash) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN_V2, 'utf8'));
+    appendAddressStrkey(parts, owner);
+    appendU64BE(parts, nonce);
+    appendBytes32(parts, publicSignalHash);
+    appendBytes32(parts, publicLegContextHash);
+    return sha256Hex(Buffer.concat(parts));
+}
+function derivePassageIdV1(owner, nonce, publicSignalHash, publicLegContextHash, onboardingHash) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN_V1, 'utf8'));
+    appendAddressStrkey(parts, owner);
+    appendU64BE(parts, nonce);
+    appendBytes32(parts, publicSignalHash);
+    appendBytes32(parts, publicLegContextHash);
+    appendBytes32(parts, onboardingHash);
+    return sha256Hex(Buffer.concat(parts));
+}
+function buildKytPassageAuthorization(input) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(KYT_PASSAGE_AUTH_DOMAIN, 'utf8'));
+    appendAddressStrkey(parts, input.poolContract);
+    appendAddressStrkey(parts, input.kytRegistry);
+    appendBytes32(parts, input.passageId);
+    appendU32BE(parts, input.expiresAtLedger);
+    const authorizationHash = sha256Hex(Buffer.concat(parts));
+    return {
+        authorizationHash,
+        poolContract: input.poolContract,
+        kytRegistry: input.kytRegistry,
+        passageId: input.passageId,
+        expiresAtLedger: input.expiresAtLedger,
+    };
+}
+function derivePassageFromTransactContext(input) {
+    const layout = input.layout ?? { publicNInputs: 1, publicNOutputs: 1 };
+    const nonce = BigInt(input.nonce ?? 0);
+    const publicSignalHash = hashPublicSignalBytes(input.publicSignalsBytes, nonce);
+    const publicLegContextHash = hashPublicLegContext(layout, input.publicLegContext);
+    const zkLayout = layoutForKnownNonce(nonce);
+    const passageId = ciphertextsInPublicSignals(zkLayout)
+        ? derivePassageIdV2(input.owner, nonce, publicSignalHash, publicLegContextHash)
+        : derivePassageId(input.owner, nonce, publicSignalHash, publicLegContextHash, hashCiphertextBytes(input.ciphertextBytes ?? Buffer.alloc(0)));
+    return {
+        publicSignalHash,
+        publicLegContextHash,
+        passageId,
+    };
+}
+function hashCiphertextBytes(ciphertextBytes) {
+    const buffer = typeof ciphertextBytes === 'string'
+        ? Buffer.from(ciphertextBytes.replace(/^0x/i, ''), 'hex')
+        : ciphertextBytes;
+    return sha256Hex(buffer);
+}
+function zeroBindingTagsInPublicSignals(publicSignalsBytes, zkConfigNonce = 0n) {
+    const layout = layoutForKnownNonce(zkConfigNonce);
+    if (ciphertextsInPublicSignals(layout)) {
+        return publicSignalsBuffer(publicSignalsBytes);
+    }
+    const parsed = parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce);
+    const zero = Buffer.alloc(FIELD_BYTES);
+    const auditStart = indexAuditTags(layout);
+    for (let slot = 0; slot < layout.nAuditSlots; slot += 1) {
+        parsed.fields[auditStart + slot] = Buffer.from(zero);
+    }
+    const outputStart = indexOutputNoteTags(layout);
+    for (let note = 0; note < layout.nOuts; note += 1) {
+        parsed.fields[outputStart + note] = Buffer.from(zero);
+    }
+    return encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix);
+}
+function spliceBindingTagsIntoPublicSignals(parameters) {
+    const layout = layoutForKnownNonce(parameters.zkConfigNonce);
+    const parsed = parsePublicSignalsBytes(parameters.publicSignalsBytes, parameters.zkConfigNonce);
+    const auditStart = indexAuditTags(layout);
+    for (let slot = 0; slot < layout.nAuditSlots; slot += 1) {
+        const tag = parameters.auditTags[slot];
+        if (tag !== undefined) {
+            parsed.fields[auditStart + slot] = fieldElementBuffer(tag);
+        }
+    }
+    const outputStart = indexOutputNoteTags(layout);
+    for (let note = 0; note < layout.nOuts; note += 1) {
+        const tag = parameters.outputNoteTags[note];
+        if (tag !== undefined) {
+            parsed.fields[outputStart + note] = fieldElementBuffer(tag);
+        }
+    }
+    return encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix);
+}
+function fieldElementBuffer(value) {
+    const trimmed = value.trim().replace(/^0x/i, '');
+    const asBigint = /^[0-9]+$/.test(trimmed)
+        ? BigInt(trimmed)
+        : BigInt(`0x${trimmed}`);
+    const buf = Buffer.alloc(FIELD_BYTES);
+    let remaining = asBigint;
+    for (let index = FIELD_BYTES - 1; index >= 0; index -= 1) {
+        buf[index] = Number(remaining & 0xffn);
+        remaining >>= 8n;
+    }
+    return buf;
+}
+async function inspectKytPassage(backendUrl, request) {
+    const nonce = BigInt(request.zkConfigNonce ?? 0);
+    const body = {
+        ...request,
+        publicSignalsBytes: zeroBindingTagsInPublicSignals(request.publicSignalsBytes, nonce).toString('hex'),
+    };
+    const response = await fetch(`${backendUrl.replace(/\/$/, '')}/api/kyt/passages/inspect`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw new Error(`KYT inspect failed: ${response.status} ${await response.text()}`);
+    }
+    const payload = await response.json();
+    if (payload.status !== 'approved') {
+        throw new Error(`KYT inspect rejected: ${JSON.stringify(payload)}`);
+    }
+    return payload;
+}
+function signatureBase64ToBytes(signature) {
+    const value = signature.trim();
+    if (/^(0x)?[0-9a-fA-F]{128}$/.test(value)) {
+        return Buffer.from(value.replace(/^0x/i, ''), 'hex');
+    }
+    return Buffer.from(value, 'base64');
+}
+
+var kytPassage = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    KYT_PASSAGE_AUTH_DOMAIN: KYT_PASSAGE_AUTH_DOMAIN,
+    NOTE_AUDIT_LEN: NOTE_AUDIT_LEN,
+    NOTE_AUDIT_PLAINTEXT_LEN: NOTE_AUDIT_PLAINTEXT_LEN,
+    PASSAGE_ID_DOMAIN: PASSAGE_ID_DOMAIN,
+    PASSAGE_ID_DOMAIN_V1: PASSAGE_ID_DOMAIN_V1,
+    PASSAGE_ID_DOMAIN_V2: PASSAGE_ID_DOMAIN_V2,
+    PUBLIC_LEG_CONTEXT_DOMAIN: PUBLIC_LEG_CONTEXT_DOMAIN,
+    TOTAL_PUBLIC_SIGNALS: TOTAL_PUBLIC_SIGNALS,
+    addressToCanonicalXdr: addressToCanonicalXdr,
+    buildKytPassageAuthorization: buildKytPassageAuthorization,
+    derivePassageFromTransactContext: derivePassageFromTransactContext,
+    derivePassageId: derivePassageId,
+    derivePassageIdV1: derivePassageIdV1,
+    derivePassageIdV2: derivePassageIdV2,
+    hashCiphertextBytes: hashCiphertextBytes,
+    hashPublicLegContext: hashPublicLegContext,
+    hashPublicSignalBytes: hashPublicSignalBytes,
+    inspectKytPassage: inspectKytPassage,
+    signatureBase64ToBytes: signatureBase64ToBytes,
+    spliceBindingTagsIntoPublicSignals: spliceBindingTagsIntoPublicSignals,
+    zeroAddressSentinelBuffer: zeroAddressSentinelBuffer,
+    zeroBindingTagsInPublicSignals: zeroBindingTagsInPublicSignals
+});
+
+function addressToScVal(address) {
+    return nativeToScVal(address, { type: 'address' });
+}
+function passageIdHexToScVal(passageIdHex) {
+    const bytes = Buffer.from(passageIdHex.replace(/^0x/, ''), 'hex');
+    return xdr.ScVal.scvBytes(bytes);
+}
+function signatureToScVal(signature) {
+    return xdr.ScVal.scvBytes(signature);
+}
+function kytAuthorizationOptionToScVal(authorization) {
+    if (authorization === null || authorization === undefined) {
+        return xdr.ScVal.scvVoid();
+    }
+    return nativeToScVal({
+        expiration_ledger: authorization.expirationLedger,
+        signature: authorization.signature,
+    });
+}
+function registerPassageOperation(kytRegistryId, passageId, expiresAtLedger, signature) {
+    return Operation.invokeContractFunction({
+        contract: kytRegistryId,
+        function: 'register_passage',
+        args: [
+            passageIdHexToScVal(passageId),
+            xdr.ScVal.scvU32(expiresAtLedger),
+            signatureToScVal(signatureBase64ToBytes(signature)),
+        ],
+    });
+}
+function poolTransactOperation(params) {
+    return Operation.invokeContractFunction({
+        contract: params.poolContract,
+        function: 'transact',
+        args: [
+            addressToScVal(params.owner),
+            nativeToScVal(params.nonce, { type: 'u64' }),
+            xdr.ScVal.scvBytes(params.proofBytes),
+            xdr.ScVal.scvBytes(params.publicSignalsBytes),
+            xdr.ScVal.scvBytes(params.ciphertextBytes ?? Buffer.alloc(0)),
+            kytAuthorizationOptionToScVal(params.kytAuthorization),
+        ],
+    });
+}
+function helperSubmitWithPassageOperation(helperContractId, params, passageId, expiresAtLedger, signature) {
+    return Operation.invokeContractFunction({
+        contract: helperContractId,
+        function: 'submit_with_passage',
+        args: [
+            addressToScVal(params.owner),
+            nativeToScVal(params.nonce, { type: 'u64' }),
+            xdr.ScVal.scvBytes(params.proofBytes),
+            xdr.ScVal.scvBytes(params.publicSignalsBytes),
+            passageIdHexToScVal(passageId),
+            xdr.ScVal.scvU32(expiresAtLedger),
+            signatureToScVal(signatureBase64ToBytes(signature)),
+        ],
+    });
+}
+async function submitTransaction(params) {
+    const server = new rpc.Server(params.rpcUrl);
+    const sourceAccount = await server.getAccount(params.source.publicKey());
+    let builder = new TransactionBuilder(sourceAccount, {
+        fee: params.fee,
+        networkPassphrase: params.networkPassphrase,
+    });
+    for (const operation of params.operations) {
+        builder = builder.addOperation(operation);
+    }
+    const tx = builder.setTimeout(300).build();
+    const prepared = params.allowNonRootAuth
+        ? await prepareTransactionAllowingNonRootAuth(server, params.rpcUrl, tx, params.source, params.networkPassphrase)
+        : await server.prepareTransaction(tx);
+    prepared.sign(params.source);
+    const result = await server.sendTransaction(prepared);
+    const status = String(result.status);
+    if (status !== 'PENDING' && status !== 'SUCCESS') {
+        throw new Error(`transaction submit failed: ${status}`);
+    }
+    await waitForTransaction(server, result.hash);
+    return result.hash;
+}
+async function prepareTransactionAllowingNonRootAuth(server, rpcUrl, tx, source, networkPassphrase) {
+    const recording = await simulateTransactionRecordingNonRoot(rpcUrl, tx.toXDR());
+    const validUntilLedgerSeq = recording.latestLedger + 1000;
+    const signedAuth = await Promise.all(recording.auth.map((entry) => {
+        if (entry.credentials().switch()
+            === xdr.SorobanCredentialsType.sorobanCredentialsSourceAccount()) {
+            return entry;
+        }
+        return authorizeEntry(entry, source, validUntilLedgerSeq, networkPassphrase);
+    }));
+    const invokeOp = tx.operations[0];
+    if (tx.operations.length !== 1 || invokeOp.type !== 'invokeHostFunction') {
+        throw new Error('Soroban transactions must contain exactly one invokeHostFunction operation');
+    }
+    const sourceAccount = await server.getAccount(source.publicKey());
+    const signedTx = new TransactionBuilder(sourceAccount, {
+        fee: tx.fee,
+        networkPassphrase,
+    })
+        .addOperation(Operation.invokeHostFunction({
+        func: invokeOp.func,
+        auth: signedAuth,
+        source: invokeOp.source,
+    }))
+        .setTimeout(300)
+        .build();
+    const enforcedSimulation = await server.simulateTransaction(signedTx);
+    if (rpc.Api.isSimulationError(enforcedSimulation)) {
+        throw new Error(`signed authorization simulation failed: ${enforcedSimulation.error}`);
+    }
+    return rpc.assembleTransaction(signedTx, enforcedSimulation).build();
+}
+async function simulateTransactionRecordingNonRoot(rpcUrl, transactionXdr) {
+    const response = await fetch(rpcUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'simulateTransaction',
+            params: {
+                transaction: transactionXdr,
+                authMode: 'record_allow_nonroot',
+            },
+        }),
+    });
+    const body = await response.json();
+    if (!response.ok || body.error) {
+        throw new Error(`transaction simulation failed: ${body.error?.message ?? response.statusText}`);
+    }
+    if (!body.result) {
+        throw new Error('transaction simulation failed: missing RPC result');
+    }
+    if (body.result.error) {
+        throw new Error(`transaction simulation failed: ${body.result.error}`);
+    }
+    const latestLedger = Number(body.result.latestLedger);
+    if (!Number.isFinite(latestLedger)) {
+        throw new Error('transaction simulation failed: missing latest ledger');
+    }
+    return {
+        latestLedger,
+        auth: (body.result.results?.[0]?.auth ?? []).map((entry) => xdr.SorobanAuthorizationEntry.fromXDR(entry, 'base64')),
+    };
+}
+async function waitForTransaction(server, hash) {
+    for (let attempt = 0; attempt < 60; attempt++) {
+        const result = await server.getTransaction(hash);
+        const status = String(result.status);
+        if (status === 'SUCCESS') {
+            return;
+        }
+        if (status === 'FAILED') {
+            throw new Error(`transaction failed: ${hash}`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+    throw new Error(`transaction did not confirm in time: ${hash}`);
+}
+function planKytSubmit(registerFirst, helperAvailable = false) {
+    if (registerFirst) {
+        if (helperAvailable) {
+            return {
+                atomic: true,
+                operations: ['helper.submit_with_passage'],
+            };
+        }
+        return {
+            atomic: false,
+            operations: ['register_passage', 'pool.transact'],
+        };
+    }
+    return {
+        atomic: true,
+        operations: ['pool.transact'],
+    };
+}
+async function registerKytPassage(params) {
+    const derivation = derivePassageFromTransactContext({
+        owner: params.owner,
+        nonce: params.nonce,
+        publicSignalsBytes: params.publicSignalsBytes,
+        ciphertextBytes: params.ciphertextBytes,
+        publicLegContext: params.publicLegContext,
+    });
+    await submitTransaction({
+        source: params.source,
+        networkPassphrase: params.networkPassphrase,
+        rpcUrl: params.rpcUrl,
+        fee: '1000000',
+        operations: [
+            registerPassageOperation(params.kytRegistryId, derivation.passageId, params.expiresAtLedger, params.signature),
+        ],
+    });
+    return derivation.passageId;
+}
+async function submitPoolTransact(params) {
+    return submitTransaction({
+        source: params.source,
+        networkPassphrase: params.networkPassphrase,
+        rpcUrl: params.rpcUrl,
+        fee: '10000000',
+        operations: [poolTransactOperation(params)],
+    });
+}
+async function submitApprovedKytPassage(params) {
+    if (params.source.publicKey() !== params.owner) {
+        throw new Error('KYT submit source keypair must match pool transact owner');
+    }
+    return submitTransaction({
+        source: params.source,
+        networkPassphrase: params.networkPassphrase,
+        rpcUrl: params.rpcUrl,
+        fee: '12000000',
+        allowNonRootAuth: true,
+        operations: [
+            helperSubmitWithPassageOperation(params.kytSubmitHelperId, params, params.passageId, params.expiresAtLedger, params.signature),
+        ],
+    });
+}
+async function submitWithKytPassage(params) {
+    const inspect = params.inspectFn
+        ?? (async (request) => {
+            const { inspectKytPassage } = await Promise.resolve().then(function () { return kytPassage; });
+            const approved = await inspectKytPassage('', request);
+            return approved;
+        });
+    const approved = await inspect(params.inspectRequest);
+    const derivation = derivePassageFromTransactContext({
+        owner: params.owner,
+        nonce: params.nonce,
+        publicSignalsBytes: params.publicSignalsBytes,
+        ciphertextBytes: params.ciphertextBytes,
+        publicLegContext: params.publicLegContext,
+    });
+    if (approved.passageId.replace(/^0x/, '') !== derivation.passageId) {
+        throw new Error('KYT approval passageId does not match local transaction context');
+    }
+    if (params.kytSubmitHelperId) {
+        return submitApprovedKytPassage({
+            source: params.source,
+            networkPassphrase: params.networkPassphrase,
+            rpcUrl: params.rpcUrl,
+            poolContract: params.poolContract,
+            owner: params.owner,
+            nonce: params.nonce,
+            proofBytes: params.proofBytes,
+            publicSignalsBytes: params.publicSignalsBytes,
+            kytSubmitHelperId: params.kytSubmitHelperId,
+            passageId: derivation.passageId,
+            expiresAtLedger: approved.expiresAtLedger,
+            signature: approved.signature,
+        });
+    }
+    await submitTransaction({
+        source: params.source,
+        networkPassphrase: params.networkPassphrase,
+        rpcUrl: params.rpcUrl,
+        fee: '1000000',
+        operations: [
+            registerPassageOperation(params.kytRegistryId, derivation.passageId, approved.expiresAtLedger, approved.signature),
+        ],
+    });
+    return submitPoolTransact(params);
+}
+function localSignKytPassageAuthorization(secretSeed, authorization) {
+    const signer = Keypair.fromSecret(secretSeed);
+    const sig = signer.sign(Buffer.from(authorization.authorizationHash, 'hex'));
+    return sig.toString('base64');
+}
+
+const SCALAR_HEX_LENGTH = 64;
+const OUT_OF_RANGE_MESSAGE = 'derived escrow hash is outside BabyJub subgroup; retry nonce';
+function hexFromCanonicalScalar(value) {
+    return value.toString(16).padStart(SCALAR_HEX_LENGTH, '0');
+}
+function assertCanonicalBabyJubScalar(scalar) {
+    if (!(scalar > 0n && scalar < BABYJUB_SUBGROUP_ORDER)) {
+        throw new Error(OUT_OF_RANGE_MESSAGE);
+    }
+}
+async function derivedEscrowKey(nonce, recipientHi, recipientLo) {
+    const wasm = await loadWasm();
+    const out = wasm.derivedEscrowKey(nonce.toString(), recipientHi.toString(), recipientLo.toString());
+    const scalar = BigInt(`0x${out.scalarHex}`);
+    assertCanonicalBabyJubScalar(scalar);
+    return {
+        scalarHex: hexFromCanonicalScalar(scalar),
+        pointXHex: out.pointXHex,
+        pointYHex: out.pointYHex,
+    };
+}
+async function sampleDerivedEscrowKey(recipientHi, recipientLo, startNonce = 1n, window = 1024n) {
+    for (let offset = 0n; offset < window; offset += 1n) {
+        const nonce = startNonce + offset;
+        try {
+            const key = await derivedEscrowKey(nonce, recipientHi, recipientLo);
+            return { nonce, key };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!message.includes('outside BabyJub subgroup')) {
+                throw error;
+            }
+        }
+    }
+    throw new Error(OUT_OF_RANGE_MESSAGE);
+}
+
+export { BABYJUB_SUBGROUP_ORDER, BINDING_ZK_NONCE, BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE, BN254_SCALAR_MOD, BundledZkCircuit, COIN_VALUE_STROOPS, COMMITMENT_V2_ZK_NONCE, DECODED_EPHEMERAL_HRP, DEFAULT_APPLICATION_ID, DEFAULT_STEALTH_SIGN_NONCE, DEFAULT_ZK_CIRCUITS, DEFAULT_ZK_CONFIG_NONCE, DEMO_AUDIT_PUBLIC_KEY, DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, DOM_ENC, DOM_ESCROW, DOM_NULLIFIER, DOM_PADDING, NOTE_AUDIT_LEN as KYT_NOTE_AUDIT_LEN, LEGACY_ZK_NONCE, NOTE_AUDIT_LEN$2 as NOTE_AUDIT_LEN, NOTE_AUDIT_PLAINTEXT_LEN, NOTE_OUTPUT_LEN$1 as NOTE_OUTPUT_LEN, NOTE_OUTPUT_LEN as OUTPUT_NOTE_LEN, OWNER_BOUND_NOTE_SCHEMA_VERSION, POOL_MERKLE_TREE_DEPTH, PrivacyPoolSDK, SIX_BY_SIX_BINDING_ZK_NONCE, SIX_BY_SIX_ZK_NONCE, SPEND_SCALAR_DOMAIN_TAG, STEALTH_ADDRESS_HRP, TOTAL_PUBLIC_SIGNALS, TRANSACTION_N_AUDIT_SLOTS, TRANSACTION_N_INS, TRANSACTION_N_OUTS, TRANSACTION_TREE_DEPTH, ZK_ARTIFACT_GITHUB_REPO, ZK_SDK_PACKAGE_VERSION, addressToCanonicalXdr, auditEphemeralPublicKeyCount, buildKytPassageAuthorization, buildStealthAddressSignMessage, buildTransactionWitnessInput, buildUniformAuditParams, bundledCircuitFileNames, canonicalBabyJubScalarFromInteger, ciphertextFieldCount, ciphertextsInPublicSignals, circuitProfileFromName, circuitProfileFromNonce, coordHexToDecimal, decodeCiphertextBlob, decodeDecodedEphemeralKey, decodeDepositorSharedSecretPreimage, decodeStealthAddress, decryptOutputNoteEvent, defaultZkArtifactBaseUrl, derivePassageFromTransactContext, derivePassageId, derivePassageIdV1, derivePassageIdV2, derivedEscrowKey, ed25519PubkeyPayloadHexToWithdrawFrDecimals, encodeCiphertextBlob, encodeDecodedEphemeralKey, encodeDepositorSharedSecretPreimage, encodeStealthAddress, encodeTransactionCiphertextBlob, encryptNoteAuditSlot, encryptOutputNoteForDeposit, encryptTransactionCiphertextBlob, generateRandomScalarHex32, generateWitness, hashCiphertextBytes, hashPublicLegContext, hashPublicSignalBytes, indexAuditTags, indexOutputNoteTags, inspectKytPassage, layoutForKnownNonce, layoutFromCircuitConfig, localSignKytPassageAuthorization, padDepositSlots, padPublicLegs, padWithdrawSlots, planKytSubmit, poseidonMacTag, privKeyScalarDecimalFromStellarSignature, randomFrDecimal, randomFrDecimal253, recipientPublicKeysDecimalFromStealthAddress, registerKytPassage, resolveAuditPublicKeyFromEnv, resolveDepositsForWitness, resolveSlotApplicationIds, resolveSpendScalarSchemaVersion, resolveTransactionAuditParams, resolveZkCircuitConfig, sampleDerivedEscrowKey, scalarHexToFrDecimal, secretFromDepositEphemeralScalarDecimal, sharedSecretFromDepositorPreimage, sharedSecretFromRecipientPreimage, sixBySixBindingLayout, sixBySixLayout, spendScalarHexFromStellarSignature, spliceBindingTagsIntoPublicSignals, splitCiphertextBlob, standardBindingLayout, standardLayout, stateRootIndex, stellarContractAddressToAssetFrDecimals, submitApprovedKytPassage, submitPoolTransact, submitWithKytPassage, totalPublicSignals, withApplicationIdOnDeposit, withApplicationIdOnWithdraw, withdrawObjectFromMerkleWitness, zeroAddressSentinelBuffer, zeroBindingTagsInPublicSignals };
+//# sourceMappingURL=index.mjs.map