@auditable/privacy-pool-zk-sdk 0.7.0 → 0.8.0

package/dist/cli.js

@@ -227,7 +227,7 @@ function bytesToHex$1(bytes) {
     }
     return s;
 }
-function concatBytes(a, b) {
+function concatBytes$1(a, b) {
     const out = new Uint8Array(a.length + b.length);
     out.set(a, 0);
     out.set(b, a.length);
@@ -243,7 +243,7 @@ function encodeStealthAddress(decoded) {
     if (xb.length !== yb.length) {
         throw new Error('stealth-address: x and y must encode the same number of bytes for a reversible address');
     }
-    const payload = concatBytes(xb, yb);
+    const payload = concatBytes$1(xb, yb);
     const words = bech32.toWords(payload);
     return bech32.encode(STEALTH_ADDRESS_HRP, words, BECH32_STEALTH_LIMIT);
 }
@@ -268,375 +268,54 @@ function decodeStealthAddress(address) {
 
 /** Default nonce when deriving the wallet sign-in message. */
 const DEFAULT_STEALTH_SIGN_NONCE = 'main address';
-/**
- * Plaintext for Stellar wallet message signing (stealth address derivation).
- * Sign the exact bytes of this string (UTF-8) with the stellar account key.
- */
-function buildStealthAddressSignMessage(address, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
-    return `Privacy layer app needs you to sign the message for stealth address derivation with address:\n${address}\n and nonce:\n${nonce}.\n\n This will not authorize any transaction.`;
-}
-
-/** Bech32 HRP for {@link DecodedEphemeralKey} only (`x ‖ y`, 64 bytes). */
-const DECODED_EPHEMERAL_HRP = 'epk1';
-/** Bech32 HRP for {@link DecodedDepositorSharedSecretPreimage} (96 bytes). */
-const DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP = 'epk_dep_pre1';
-const FIELD_BYTES = 32;
-const EPK_POINT_PAYLOAD = FIELD_BYTES * 2;
-const EPK_DEP_PRE_PAYLOAD = FIELD_BYTES * 3;
-const BECH32_LONG_LIMIT = 1023;
-function normalizeHex$1(hex) {
-    const s = hex.trim().replace(/^0x/i, '');
-    if (!/^[0-9a-fA-F]*$/.test(s)) {
-        throw new Error('ephemeral-key: hex must contain only 0-9, a-f');
-    }
-    return s.length % 2 === 0 ? s : `0${s}`;
-}
-function hexToBytes$1(hex) {
-    const norm = normalizeHex$1(hex);
-    const out = new Uint8Array(norm.length / 2);
-    for (let i = 0; i < out.length; i++) {
-        out[i] = parseInt(norm.slice(i * 2, i * 2 + 2), 16);
-    }
-    return out;
-}
-function bytesToHex(bytes) {
-    let s = '';
-    for (let i = 0; i < bytes.length; i++) {
-        s += bytes[i].toString(16).padStart(2, '0');
-    }
-    return s;
-}
-function concat2(a, b) {
-    const out = new Uint8Array(a.length + b.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    return out;
-}
-function concat3(a, b, c) {
-    const out = new Uint8Array(a.length + b.length + c.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    out.set(c, a.length + b.length);
-    return out;
-}
-function require32(label, bytes) {
-    if (bytes.length !== FIELD_BYTES) {
-        throw new Error(`ephemeral-key: ${label} must encode exactly ${FIELD_BYTES} bytes, got ${bytes.length}`);
-    }
-}
-/**
- * 32-byte big-endian integer as hex (64 chars), **< 2^253**, so BabyJub ECDH matches
- * `circuits/encryption.circom` `Num2Bits(253)` and `libs/cryptography` `scalar_mul_253`.
- */
-function generateRandomScalarHex32() {
-    const g = globalThis.crypto;
-    if (!g?.getRandomValues) {
-        throw new Error('ephemeral-key: crypto.getRandomValues is required');
-    }
-    const max = 1n << 253n;
-    for (let attempt = 0; attempt < 65536; attempt++) {
-        const b = new Uint8Array(32);
-        g.getRandomValues(b);
-        const hex = bytesToHex(b);
-        if (BigInt(`0x${hex}`) < max) {
-            return hex;
-        }
-    }
-    throw new Error('ephemeral-key: failed to sample scalar < 2^253');
-}
-/** Bech32 `epk1`: encodes `x ‖ y` (64 bytes). */
-function encodeDecodedEphemeralKey(decoded) {
-    const xb = hexToBytes$1(decoded.x);
-    const yb = hexToBytes$1(decoded.y);
-    require32('x', xb);
-    require32('y', yb);
-    const payload = concat2(xb, yb);
-    const words = bech32.toWords(payload);
-    return bech32.encode(DECODED_EPHEMERAL_HRP, words, BECH32_LONG_LIMIT);
-}
-function decodeDecodedEphemeralKey(encoded) {
-    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
-    if (prefix !== DECODED_EPHEMERAL_HRP) {
-        throw new Error(`ephemeral-key: expected HRP ${DECODED_EPHEMERAL_HRP}, got ${JSON.stringify(prefix)}`);
-    }
-    const bytes = new Uint8Array(bech32.fromWords(words));
-    if (bytes.length !== EPK_POINT_PAYLOAD) {
-        throw new Error(`ephemeral-key: epk1 payload must be ${EPK_POINT_PAYLOAD} bytes, got ${bytes.length}`);
-    }
-    return {
-        x: bytesToHex(bytes.subarray(0, FIELD_BYTES)),
-        y: bytesToHex(bytes.subarray(FIELD_BYTES)),
-    };
-}
-/** Bech32 `epk_dep_pre1`: `randomNonceScalar ‖ recipient.x ‖ recipient.y`. */
-function encodeDepositorSharedSecretPreimage(decoded) {
-    const sb = hexToBytes$1(decoded.randomNonceScalar);
-    const xb = hexToBytes$1(decoded.recipientStealthAddress.x);
-    const yb = hexToBytes$1(decoded.recipientStealthAddress.y);
-    require32('randomNonceScalar', sb);
-    require32('recipientStealthAddress.x', xb);
-    require32('recipientStealthAddress.y', yb);
-    const payload = concat3(sb, xb, yb);
-    const words = bech32.toWords(payload);
-    return bech32.encode(DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, words, BECH32_LONG_LIMIT);
-}
-function decodeDepositorSharedSecretPreimage(encoded) {
-    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
-    if (prefix !== DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP) {
-        throw new Error(`ephemeral-key: expected HRP ${DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP}, got ${JSON.stringify(prefix)}`);
-    }
-    const bytes = new Uint8Array(bech32.fromWords(words));
-    if (bytes.length !== EPK_DEP_PRE_PAYLOAD) {
-        throw new Error(`ephemeral-key: epk_dep_pre1 payload must be ${EPK_DEP_PRE_PAYLOAD} bytes, got ${bytes.length}`);
-    }
-    return {
-        randomNonceScalar: bytesToHex(bytes.subarray(0, FIELD_BYTES)),
-        recipientStealthAddress: {
-            x: bytesToHex(bytes.subarray(FIELD_BYTES, FIELD_BYTES * 2)),
-            y: bytesToHex(bytes.subarray(FIELD_BYTES * 2)),
-        },
-    };
-}
-
-const DEFAULT_APPLICATION_ID = '101';
-/** BabyJub audit public key (decimal Fr) used in BDD / local demo when env is unset. */
-const DEMO_AUDIT_PUBLIC_KEY = [
-    '21605515851820432880964235241069234202284600780825340516808373216881770219365',
-    '18856460861531942120859708048677603751294231190189224157283439874962410808705',
-];
-function isActiveWithdraw(slot) {
-    return slot.value !== '0';
-}
-function isActiveDeposit(slot) {
-    return slot.value !== '0';
-}
-function resolveWithdrawSlot(slot) {
-    if (slot === 'dummy') {
-        return null;
-    }
-    return slot;
-}
-function resolveDepositSlot(slot) {
-    if (slot === 'dummy') {
-        return null;
-    }
-    return slot;
-}
-function buildUniformAuditParams(applicationId = DEFAULT_APPLICATION_ID, auditPublicKey) {
-    return {
-        applicationId,
-        noteAuditPublicKeys: [
-            auditPublicKey,
-            auditPublicKey,
-            auditPublicKey,
-            auditPublicKey,
-        ],
-        auditEphemeralScalars: [
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-        ],
-    };
-}
-function resolveSlotApplicationIds(audit, withdrawSlots, depositSlots) {
-    const w0 = resolveWithdrawSlot(withdrawSlots[0]);
-    const w1 = resolveWithdrawSlot(withdrawSlots[1]);
-    const d0 = resolveDepositSlot(depositSlots[0]);
-    const d1 = resolveDepositSlot(depositSlots[1]);
-    return {
-        inputApplicationIds: [
-            w0 && isActiveWithdraw(w0) ? audit.applicationId : '0',
-            w1 && isActiveWithdraw(w1) ? audit.applicationId : '0',
-        ],
-        outputApplicationIds: [
-            d0 && isActiveDeposit(d0) ? audit.applicationId : '0',
-            d1 && isActiveDeposit(d1) ? audit.applicationId : '0',
-        ],
-    };
-}
-function resolveTransactionAuditParams(applicationId, auditPublicKey) {
-    return buildUniformAuditParams(applicationId, auditPublicKey ?? DEMO_AUDIT_PUBLIC_KEY);
+/** Domain tag mixed into the spend-scalar digest (H6). */
+const SPEND_SCALAR_DOMAIN_TAG = 'privacy-pool-spend-scalar-v1';
+/** Schema version bound into the spend-scalar message and digest. */
+const OWNER_BOUND_NOTE_SCHEMA_VERSION = 1;
+function resolveSpendScalarSchemaVersion(domain) {
+    return domain.schemaVersion ?? OWNER_BOUND_NOTE_SCHEMA_VERSION;
 }
-
-/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 9)` in `circuits/main.circom`. */
-const TRANSACTION_TREE_DEPTH = 20;
-/** BN254 scalar field modulus (ark `Fr`, circom signals). */
-const BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 /**
- * BabyJub ECDH in `circuits/encryption.circom` uses `Num2Bits(253)`; scalars must be < 2^253
- * (matches `libs/cryptography` `scalar_mul_253`).
+ * Plaintext for Stellar wallet message signing (spend-key derivation).
+ * Sign the exact bytes of this string (UTF-8) with the stellar account key.
+ *
+ * The derived scalar is the owner-bound spend key for notes in this environment.
  */
-const BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE = 1n << 253n;
-function normalizeHex(hex) {
-    const s = hex.trim().replace(/^0x/i, '');
-    if (!/^[0-9a-fA-F]*$/.test(s)) {
-        throw new Error('withdrawal-transaction-input: invalid hex');
-    }
-    return s.length % 2 === 0 ? s : `0${s}`;
-}
-/** 32-byte field coordinate (hex, no 0x) → decimal string mod BN254 scalar field. */
-function coordHexToDecimal(hex) {
-    const h = normalizeHex(hex);
-    if (h.length > 64) {
-        throw new Error('withdrawal-transaction-input: coordinate hex too long');
-    }
-    const v = BigInt(`0x${h}`);
-    return (v % BN254_SCALAR_MOD).toString(10);
-}
+function buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+    const schemaVersion = resolveSpendScalarSchemaVersion(domain);
+    return [
+        'Arcane privacy layer: derive your private-note spend key.',
+        '',
+        `Wallet: ${address}`,
+        `Network: ${domain.networkPassphrase}`,
+        `Pool: ${domain.poolContract}`,
+        `Registry: ${domain.registryContract}`,
+        `Schema: owner-bound-note-v${schemaVersion}`,
+        `Nonce: ${nonce}`,
+        '',
+        'This signature derives the key that authorizes spending your private notes in this environment.',
+    ].join('\n');
+}
+
+const BABYJUB_SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
 /**
- * 32-byte big-endian scalar hex → decimal for circom `ephemeralKeyScalar` / ECDH `priv`.
- * Integer must be < 2^253 (not reduced mod r — values ≥ 2^253 are rejected).
+ * Map any integer into `(0, l)` so it satisfies circom `LessThan(252)` vs
+ * `BABYJUB_SUBGROUP_ORDER` and `BabyPbk`. Values already in range are unchanged.
  */
-function scalarHexToFrDecimal(hex) {
-    const h = normalizeHex(hex);
-    if (h.length > 64) {
-        throw new Error('withdrawal-transaction-input: scalar hex too long');
+function canonicalBabyJubScalarFromInteger(value) {
+    if (value > 0n && value < BABYJUB_SUBGROUP_ORDER) {
+        return value;
     }
-    const v = BigInt(`0x${h.padStart(64, '0').slice(-64)}`);
-    if (v >= BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE) {
-        throw new Error('depositor ephemeral scalar must be < 2^253 (BabyJub Num2Bits); resample with random-scalar');
-    }
-    return v.toString(10);
-}
-/**
- * Stellar G-address Ed25519 payload (32 bytes as 64 hex, optional 0x) → two circom public decimals
- * (`withdrawAddressHi` / `withdrawAddressLo`). No mod-r; each half fits in 128 bits.
- */
-function ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex) {
-    const h = normalizeHex(hex).padStart(64, '0').slice(-64);
-    const hi = BigInt(`0x${h.slice(0, 32)}`);
-    const lo = BigInt(`0x${h.slice(32, 64)}`);
-    return { hi: hi.toString(10), lo: lo.toString(10) };
-}
-/**
- * Stellar contract id (`C…`) → two circom field decimals for `asset[0]`, `asset[1]` (same 32-byte split as accounts).
- */
-function stellarContractAddressToAssetFrDecimals(address) {
-    const raw = stellarSdk.StrKey.decodeContract(address);
-    const hex = Buffer.from(raw).toString('hex');
-    const { hi, lo } = ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex);
-    return [hi, lo];
-}
-/** Uniform random `Fr` as decimal (32 random bytes, mod r). For Poseidon-only inputs (e.g. nullifiers). */
-function randomFrDecimal() {
-    const hex = generateRandomScalarHex32();
-    const v = BigInt(`0x${normalizeHex(hex)}`);
-    return (v % BN254_SCALAR_MOD).toString(10);
-}
-/** Random scalar < 2^253 for BabyJub ECDH / `Num2Bits(253)` (uses {@link generateRandomScalarHex32}). */
-function randomFrDecimal253() {
-    const hex = generateRandomScalarHex32();
-    return BigInt(`0x${normalizeHex(hex)}`).toString(10);
-}
-function zerosTreeSiblings() {
-    return Array(TRANSACTION_TREE_DEPTH).fill('0');
-}
-function dummyWithdraw(wasm) {
-    const nullifier = randomFrDecimal();
-    const secretHex = generateRandomScalarHex32();
-    const secret = (BigInt(`0x${normalizeHex(secretHex)}`) % BN254_SCALAR_MOD).toString(10);
-    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(secretHex);
-    return {
-        value: '0',
-        nullifier,
-        secret,
-        asset: ['0', '0'],
-        applicationId: '0',
-        ephemeralKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
-        stateSiblings: zerosTreeSiblings(),
-        stateIndex: '0',
-    };
-}
-function dummyDeposit(wasm) {
-    const nullifier = randomFrDecimal();
-    const ephemeralKeyScalar = randomFrDecimal253();
-    const skHex = generateRandomScalarHex32();
-    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(skHex);
-    return {
-        value: '0',
-        nullifier,
-        ephemeralKeyScalar,
-        asset: ['0', '0'],
-        applicationId: '0',
-        recipientPublicKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
-    };
-}
-function resolveWithdraw(slot, wasm) {
-    return slot === 'dummy' ? dummyWithdraw(wasm) : slot;
-}
-function resolveDeposit(slot, wasm) {
-    return slot === 'dummy' ? dummyDeposit(wasm) : slot;
-}
-function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, depositSlots, audit, wasm) {
-    const w0 = resolveWithdraw(withdrawSlots[0], wasm);
-    const w1 = resolveWithdraw(withdrawSlots[1], wasm);
-    const d0 = resolveDeposit(depositSlots[0], wasm);
-    const d1 = resolveDeposit(depositSlots[1], wasm);
-    const appIds = resolveSlotApplicationIds(audit, withdrawSlots, depositSlots);
-    return {
-        stateRoot: publicParams.stateRoot,
-        withdrawAddressHi: publicParams.withdrawAddressHi,
-        withdrawAddressLo: publicParams.withdrawAddressLo,
-        privKeyScalar: publicParams.privKeyScalar,
-        withdrawnValues: [w0.value, w1.value],
-        withdrawnNullifiers: [w0.nullifier, w1.nullifier],
-        withdrawnSecrets: [w0.secret, w1.secret],
-        withdrawnAssets: [w0.asset, w1.asset],
-        ephemeralKeys: [w0.ephemeralKeys, w1.ephemeralKeys],
-        stateSiblings: [w0.stateSiblings, w1.stateSiblings],
-        stateIndex: [w0.stateIndex, w1.stateIndex],
-        depositedValues: [d0.value, d1.value],
-        depositedNullifiers: [d0.nullifier, d1.nullifier],
-        depositedAssets: [d0.asset, d1.asset],
-        depositedEphemeralKeyScalars: [d0.ephemeralKeyScalar, d1.ephemeralKeyScalar],
-        depositedRecipientPublicKeys: [d0.recipientPublicKeys, d1.recipientPublicKeys],
-        inputApplicationIds: appIds.inputApplicationIds,
-        outputApplicationIds: appIds.outputApplicationIds,
-        auditEphemeralScalars: audit.auditEphemeralScalars,
-        noteAuditPublicKeys: audit.noteAuditPublicKeys,
-        publicWithdrawnAssets: publicLegs.publicWithdrawnAssets,
-        publicDepositedAssets: publicLegs.publicDepositedAssets,
-        publicDeposits: publicLegs.publicDeposits,
-        publicWithdrawals: publicLegs.publicWithdrawals,
-    };
-}
-/** `stpl1…` stealth address → `[x, y]` as decimal field strings for `depositedRecipientPublicKeys`. */
-function recipientPublicKeysDecimalFromStealthAddress(stealthAddress) {
-    const { x, y } = decodeStealthAddress(stealthAddress);
-    return [coordHexToDecimal(x), coordHexToDecimal(y)];
-}
-/** First withdraw leg: Merkle witness + depositor ECDH point coordinates (hex). */
-function withdrawObjectFromMerkleWitness(witness, depositorEphemeralHex, applicationId) {
-    return {
-        value: witness.value,
-        nullifier: witness.nullifier,
-        secret: witness.secret,
-        asset: witness.withdrawnAsset,
-        applicationId,
-        ephemeralKeys: [
-            coordHexToDecimal(depositorEphemeralHex.x),
-            coordHexToDecimal(depositorEphemeralHex.y),
-        ],
-        stateSiblings: witness.stateSiblings,
-        stateIndex: witness.stateIndex,
-    };
+    return (value % (BABYJUB_SUBGROUP_ORDER - 1n)) + 1n;
 }
 
-function hexToBytes(hex) {
+function hexToBytes$1(hex) {
     const out = new Uint8Array(hex.length / 2);
     for (let i = 0; i < out.length; i++) {
         out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
     }
     return out;
 }
-function bytesToHexLower(bytes) {
-    let s = '';
-    for (let i = 0; i < bytes.length; i++) {
-        s += bytes[i].toString(16).padStart(2, '0');
-    }
-    return s;
-}
 /** Base64 → bytes via `atob` (browsers; Node 16+). No Node `Buffer`. */
 function decodeBase64ToBytes(s) {
     const t = s.replace(/\s/g, '');
@@ -662,7 +341,7 @@ function parseStellarEd25519SignatureRaw(input) {
     const trimmed = input.trim();
     const no0x = trimmed.replace(/^0x/i, '');
     if (/^[0-9a-fA-F]+$/.test(no0x) && no0x.length === 128) {
-        return hexToBytes(no0x.toLowerCase());
+        return hexToBytes$1(no0x.toLowerCase());
     }
     const fromB64 = decodeBase64ToBytes(trimmed);
     if (fromB64.length !== 64) {
@@ -680,29 +359,66 @@ async function sha256(data) {
     copy.set(data);
     return new Uint8Array(await subtle.digest('SHA-256', copy));
 }
+function appendU32BE(parts, value) {
+    const buf = new Uint8Array(4);
+    new DataView(buf.buffer).setUint32(0, value >>> 0, false);
+    parts.push(buf);
+}
+function appendUtf8Prefixed(parts, text) {
+    const bytes = new TextEncoder().encode(text);
+    appendU32BE(parts, bytes.length);
+    parts.push(bytes);
+}
+function concatBytes(parts) {
+    const total = parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
 /**
- * Stellar Ed25519 signature (hex or base64) → SHA-256(signature bytes) → scalar → WASM ECDH (no UTF-8 seed hash).
+ * Domain-separated spend-scalar digest: SHA-256(
+ *   SPEND_SCALAR_DOMAIN_TAG || network || pool || registry || schemaVersion || signature
+ * ).
  */
-async function stealthAddressFromStellarSignature(ecdhFromScalarHex, encodeStealth, signature) {
+async function spendScalarDigestFromStellarSignature(signature, domain) {
     const raw = parseStellarEd25519SignatureRaw(signature);
-    const scalar = await sha256(raw);
-    const scalarHex = bytesToHexLower(scalar);
-    const decoded = ecdhFromScalarHex(scalarHex);
+    const parts = [new TextEncoder().encode(SPEND_SCALAR_DOMAIN_TAG)];
+    appendUtf8Prefixed(parts, domain.networkPassphrase);
+    appendUtf8Prefixed(parts, domain.poolContract);
+    appendUtf8Prefixed(parts, domain.registryContract);
+    appendU32BE(parts, resolveSpendScalarSchemaVersion(domain));
+    parts.push(raw);
+    return sha256(concatBytes(parts));
+}
+function digestToCanonicalScalar(digest) {
+    let v = 0n;
+    for (let i = 0; i < digest.length; i++) {
+        v = (v << 8n) + BigInt(digest[i]);
+    }
+    return canonicalBabyJubScalarFromInteger(v);
+}
+function canonicalScalarHex(scalar) {
+    return scalar.toString(16).padStart(64, '0');
+}
+/**
+ * Stellar Ed25519 signature (hex or base64) → domain-separated SHA-256 → scalar → WASM ECDH.
+ */
+async function stealthAddressFromStellarSignature(ecdhFromScalarHex, encodeStealth, signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    const decoded = ecdhFromScalarHex(canonicalScalarHex(digestToCanonicalScalar(digest)));
     return encodeStealth(decoded);
 }
 /**
- * SHA-256(signature) as 32-byte BE integer, truncated to **253 bits** (same effective scalar as
- * `libs/cryptography` `scalar_mul_253` / circom `Num2Bits(253)`), decimal for `privKeyScalar`.
+ * Domain-separated SHA-256(signature, network, pool, registry, schema) reduced into
+ * `(0, BabyJub subgroup order)` so `privKeyScalar` matches `BabyPbk` and circom `LessThan(l)`.
  */
-async function privKeyScalarDecimalFromStellarSignature(signature) {
-    const raw = parseStellarEd25519SignatureRaw(signature);
-    const h = await sha256(raw);
-    let v = 0n;
-    for (let i = 0; i < h.length; i++) {
-        v = (v << 8n) + BigInt(h[i]);
-    }
-    const mask = BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE - 1n;
-    return (v & mask).toString(10);
+async function privKeyScalarDecimalFromStellarSignature(signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    return digestToCanonicalScalar(digest).toString(10);
 }
 
 /* @ts-self-types="./client_sdk_wasm.d.ts" */
@@ -722,7 +438,43 @@ function buildWithdrawMerkleWitness(coin_json, state_json) {
         const len0 = WASM_VECTOR_LEN;
         const ptr1 = passStringToWasm0(state_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        wasm.buildWithdrawMerkleWitness(retptr, ptr0, len0, ptr1, len1);
+        wasm.buildWithdrawMerkleWitness(retptr, ptr0, len0, ptr1, len1);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+        var ptr3 = r0;
+        var len3 = r1;
+        if (r3) {
+            ptr3 = 0; len3 = 0;
+            throw takeObject(r2);
+        }
+        deferred4_0 = ptr3;
+        deferred4_1 = len3;
+        return getStringFromWasm0(ptr3, len3);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * Calculate owner-bound nullifier hash from nullifier and spend-scalar decimal strings.
+ * Returns hex string (0x...)
+ * @param {string} nullifier_decimal
+ * @param {string} priv_key_scalar_decimal
+ * @returns {string}
+ */
+function calculateNullifierHash(nullifier_decimal, priv_key_scalar_decimal) {
+    let deferred4_0;
+    let deferred4_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(nullifier_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(priv_key_scalar_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.calculateNullifierHash(retptr, ptr0, len0, ptr1, len1);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -743,35 +495,33 @@ function buildWithdrawMerkleWitness(coin_json, state_json) {
 }
 
 /**
- * Calculate nullifier hash from nullifier decimal string.
- * Returns hex string (0x...)
- * @param {string} nullifier_decimal
- * @returns {string}
+ * `R = Poseidon255(2)(hi, lo)`; `scalar` is the raw Poseidon hash when it is
+ * already in `(0, BabyJub subgroup order)`. Out-of-range hashes fail so the
+ * caller can rejection-sample a new nonce.
+ * @param {string} nonce_decimal
+ * @param {string} recipient_hi_decimal
+ * @param {string} recipient_lo_decimal
+ * @returns {any}
  */
-function calculateNullifierHash(nullifier_decimal) {
-    let deferred3_0;
-    let deferred3_1;
+function derivedEscrowKey(nonce_decimal, recipient_hi_decimal, recipient_lo_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(nullifier_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr0 = passStringToWasm0(nonce_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        wasm.calculateNullifierHash(retptr, ptr0, len0);
+        const ptr1 = passStringToWasm0(recipient_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(recipient_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.derivedEscrowKey(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
-        var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-        var ptr2 = r0;
-        var len2 = r1;
-        if (r3) {
-            ptr2 = 0; len2 = 0;
-            throw takeObject(r2);
+        if (r2) {
+            throw takeObject(r1);
         }
-        deferred3_0 = ptr2;
-        deferred3_1 = len2;
-        return getStringFromWasm0(ptr2, len2);
+        return takeObject(r0);
     } finally {
         wasm.__wbindgen_add_to_stack_pointer(16);
-        wasm.__wbindgen_export4(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -852,26 +602,28 @@ function ecdhSharedKey(priv_hex, pub_x_hex, pub_y_hex) {
 }
 
 /**
- * Generate a new coin with random nullifier, secret, and shared-secret field elements.
- * `amount` is stroops (u64); JS passes `bigint`.
+ * Generate a new coin with random nullifier, secret, and owner public-key field elements.
+ * `amount_decimal` is an arbitrary-precision decimal field element (never JS `number`).
  * `asset_hi_decimal` / `asset_lo_decimal` are decimal Fr strings for the Stellar asset contract id (two limbs).
  * Returns JSON: { coin: { value, nullifier, secret, commitment, asset_hi, asset_lo }, commitment_hex, precommitement_hex }
- * @param {bigint} amount
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoin(amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoin(amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr0 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        wasm.generateCoin(retptr, amount, ptr0, len0, ptr1, len1, ptr2, len2);
+        const ptr3 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.generateCoin(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -885,32 +637,34 @@ function generateCoin(amount, asset_hi_decimal, asset_lo_decimal, application_id
 }
 
 /**
- * `Poseidon₁(scalar)` secret + fixed ECDH shared coords (hex), matching an aligned deposit witness.
+ * `Poseidon₁(scalar)` secret + recipient owner public key (hex), matching an aligned deposit witness.
  * @param {string} scalar_hex
- * @param {string} shared_x_hex
- * @param {string} shared_y_hex
- * @param {bigint} amount
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinForDepositWithSharedHex(scalar_hex, shared_x_hex, shared_y_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinForDepositWithOwnerPubHex(scalar_hex, owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
         const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(shared_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(shared_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        const ptr4 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr4 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len4 = WASM_VECTOR_LEN;
-        const ptr5 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr5 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len5 = WASM_VECTOR_LEN;
-        wasm.generateCoinForDepositWithSharedHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, amount, ptr3, len3, ptr4, len4, ptr5, len5);
+        const ptr6 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len6 = WASM_VECTOR_LEN;
+        wasm.generateCoinForDepositWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -926,24 +680,26 @@ function generateCoinForDepositWithSharedHex(scalar_hex, shared_x_hex, shared_y_
 /**
  * `secret` in coin = `Poseidon255(1)(scalar)` per `deposit.circom`; scalar is 32-byte hex (64 chars, optional `0x`).
  * @param {string} scalar_hex
- * @param {bigint} amount
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
         const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        wasm.generateCoinFromDepositEphemeralScalarHex(retptr, ptr0, len0, amount, ptr1, len1, ptr2, len2, ptr3, len3);
+        const ptr4 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        wasm.generateCoinFromDepositEphemeralScalarHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -957,29 +713,31 @@ function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount, asset_hi_
 }
 
 /**
- * Same as `generateCoin`, but commitment uses the given ECDH shared key (64-char hex coords from `ecdhSharedKey`); shared coords are not stored in `coin` JSON.
- * @param {string} shared_x_hex
- * @param {string} shared_y_hex
- * @param {bigint} amount
+ * Same as `generateCoin`, but commitment uses the given owner public key (64-char hex coords).
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinWithSharedSecretHex(shared_x_hex, shared_y_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinWithOwnerPubHex(owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(shared_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr0 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(shared_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        const ptr4 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr4 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len4 = WASM_VECTOR_LEN;
-        wasm.generateCoinWithSharedSecretHex(retptr, ptr0, len0, ptr1, len1, amount, ptr2, len2, ptr3, len3, ptr4, len4);
+        const ptr5 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len5 = WASM_VECTOR_LEN;
+        wasm.generateCoinWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -1392,13 +1150,14 @@ var wasmBindings = /*#__PURE__*/Object.freeze({
 	buildWithdrawMerkleWitness: buildWithdrawMerkleWitness,
 	calculateNullifierHash: calculateNullifierHash,
 	default: __wbg_init,
+	derivedEscrowKey: derivedEscrowKey,
 	ecdhEphemeralPublicKey: ecdhEphemeralPublicKey,
 	ecdhEphemeralPublicKeyFromScalarHex: ecdhEphemeralPublicKeyFromScalarHex,
 	ecdhSharedKey: ecdhSharedKey,
 	generateCoin: generateCoin,
-	generateCoinForDepositWithSharedHex: generateCoinForDepositWithSharedHex,
+	generateCoinForDepositWithOwnerPubHex: generateCoinForDepositWithOwnerPubHex,
 	generateCoinFromDepositEphemeralScalarHex: generateCoinFromDepositEphemeralScalarHex,
-	generateCoinWithSharedSecretHex: generateCoinWithSharedSecretHex,
+	generateCoinWithOwnerPubHex: generateCoinWithOwnerPubHex,
 	initSync: initSync,
 	proofToHex: proofToHex,
 	publicToHex: publicToHex
@@ -1844,80 +1603,494 @@ async function generateWitness(input, circuitWasm) {
             wasmBuffer = fs.readFileSync(wasmPath);
         }
     }
-    else {
-        if (!circuitWasm) {
-            throw new Error('In browser, you must pass circuitWasm to PrivacyPoolSDK.init(). ' +
-                'Load the circuit WASM file via fetch() and pass the ArrayBuffer.');
-        }
-        wasmBuffer = circuitWasm;
-        wc = { default: witnessCalculatorModule };
+    else {
+        if (!circuitWasm) {
+            throw new Error('In browser, you must pass circuitWasm to PrivacyPoolSDK.init(). ' +
+                'Load the circuit WASM file via fetch() and pass the ArrayBuffer.');
+        }
+        wasmBuffer = circuitWasm;
+        wc = { default: witnessCalculatorModule };
+    }
+    const calculator = await wc.default(wasmBuffer);
+    const wtns = await calculator.calculateWTNSBin(input, 0);
+    return wtns;
+}
+
+// @ts-ignore - snarkjs types
+const isNode = typeof process !== 'undefined' && !!process.versions?.node;
+/**
+ * Normalize BufferSource to Uint8Array. Required for @iden3/binfileutils/fastfile:
+ * they read via data.buffer and data.byteOffset, which ArrayBuffer does not have.
+ */
+function toUint8Array(src) {
+    if (src instanceof Uint8Array)
+        return src;
+    if (src instanceof ArrayBuffer)
+        return new Uint8Array(src);
+    return new Uint8Array(src.buffer, src.byteOffset, src.byteLength);
+}
+async function generateProof(wtns, zkey) {
+    let zkeyData;
+    if (zkey) {
+        zkeyData = toUint8Array(zkey);
+    }
+    else if (isNode) {
+        const fs = await import('fs');
+        const nodePath = await import('path');
+        const { fileURLToPath } = await import('url');
+        const dir = nodePath.dirname(fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href))));
+        const zkeyPath = nodePath.resolve(dir, '..', 'assets', 'main_final.zkey');
+        if (!fs.existsSync(zkeyPath)) {
+            throw new Error(`Proving key not found at ${zkeyPath}. Run build.sh first.`);
+        }
+        const zkeyBuffer = fs.readFileSync(zkeyPath);
+        zkeyData = toUint8Array(zkeyBuffer);
+    }
+    else {
+        throw new Error('In browser, you must pass zkey to PrivacyPoolSDK.init(). ' +
+            'Load the zkey file via fetch() and pass the ArrayBuffer.');
+    }
+    const wtnsData = toUint8Array(wtns);
+    const { proof, publicSignals } = await snarkjs__namespace.groth16.prove({ type: 'mem', data: zkeyData }, { type: 'mem', data: wtnsData });
+    return { proof, publicSignals };
+}
+
+/** Bech32 HRP for {@link DecodedEphemeralKey} only (`x ‖ y`, 64 bytes). */
+const DECODED_EPHEMERAL_HRP = 'epk1';
+/** Bech32 HRP for {@link DecodedDepositorSharedSecretPreimage} (96 bytes). */
+const DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP = 'epk_dep_pre1';
+const FIELD_BYTES = 32;
+const EPK_POINT_PAYLOAD = FIELD_BYTES * 2;
+const EPK_DEP_PRE_PAYLOAD = FIELD_BYTES * 3;
+const BECH32_LONG_LIMIT = 1023;
+function normalizeHex$1(hex) {
+    const s = hex.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]*$/.test(s)) {
+        throw new Error('ephemeral-key: hex must contain only 0-9, a-f');
+    }
+    return s.length % 2 === 0 ? s : `0${s}`;
+}
+function hexToBytes(hex) {
+    const norm = normalizeHex$1(hex);
+    const out = new Uint8Array(norm.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(norm.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function bytesToHex(bytes) {
+    let s = '';
+    for (let i = 0; i < bytes.length; i++) {
+        s += bytes[i].toString(16).padStart(2, '0');
+    }
+    return s;
+}
+function concat2(a, b) {
+    const out = new Uint8Array(a.length + b.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    return out;
+}
+function concat3(a, b, c) {
+    const out = new Uint8Array(a.length + b.length + c.length);
+    out.set(a, 0);
+    out.set(b, a.length);
+    out.set(c, a.length + b.length);
+    return out;
+}
+function require32(label, bytes) {
+    if (bytes.length !== FIELD_BYTES) {
+        throw new Error(`ephemeral-key: ${label} must encode exactly ${FIELD_BYTES} bytes, got ${bytes.length}`);
+    }
+}
+/**
+ * 32-byte big-endian integer as hex (64 chars), **< 2^253**, so BabyJub ECDH matches
+ * `circuits/encryption.circom` `Num2Bits(253)` and `libs/cryptography` `scalar_mul_253`.
+ */
+function generateRandomScalarHex32() {
+    const g = globalThis.crypto;
+    if (!g?.getRandomValues) {
+        throw new Error('ephemeral-key: crypto.getRandomValues is required');
+    }
+    const max = 1n << 253n;
+    for (let attempt = 0; attempt < 65536; attempt++) {
+        const b = new Uint8Array(32);
+        g.getRandomValues(b);
+        const hex = bytesToHex(b);
+        if (BigInt(`0x${hex}`) < max) {
+            return hex;
+        }
+    }
+    throw new Error('ephemeral-key: failed to sample scalar < 2^253');
+}
+/** Bech32 `epk1`: encodes `x ‖ y` (64 bytes). */
+function encodeDecodedEphemeralKey(decoded) {
+    const xb = hexToBytes(decoded.x);
+    const yb = hexToBytes(decoded.y);
+    require32('x', xb);
+    require32('y', yb);
+    const payload = concat2(xb, yb);
+    const words = bech32.toWords(payload);
+    return bech32.encode(DECODED_EPHEMERAL_HRP, words, BECH32_LONG_LIMIT);
+}
+function decodeDecodedEphemeralKey(encoded) {
+    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
+    if (prefix !== DECODED_EPHEMERAL_HRP) {
+        throw new Error(`ephemeral-key: expected HRP ${DECODED_EPHEMERAL_HRP}, got ${JSON.stringify(prefix)}`);
+    }
+    const bytes = new Uint8Array(bech32.fromWords(words));
+    if (bytes.length !== EPK_POINT_PAYLOAD) {
+        throw new Error(`ephemeral-key: epk1 payload must be ${EPK_POINT_PAYLOAD} bytes, got ${bytes.length}`);
+    }
+    return {
+        x: bytesToHex(bytes.subarray(0, FIELD_BYTES)),
+        y: bytesToHex(bytes.subarray(FIELD_BYTES)),
+    };
+}
+/** Bech32 `epk_dep_pre1`: `randomNonceScalar ‖ recipient.x ‖ recipient.y`. */
+function encodeDepositorSharedSecretPreimage(decoded) {
+    const sb = hexToBytes(decoded.randomNonceScalar);
+    const xb = hexToBytes(decoded.recipientStealthAddress.x);
+    const yb = hexToBytes(decoded.recipientStealthAddress.y);
+    require32('randomNonceScalar', sb);
+    require32('recipientStealthAddress.x', xb);
+    require32('recipientStealthAddress.y', yb);
+    const payload = concat3(sb, xb, yb);
+    const words = bech32.toWords(payload);
+    return bech32.encode(DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, words, BECH32_LONG_LIMIT);
+}
+function decodeDepositorSharedSecretPreimage(encoded) {
+    const { prefix, words } = bech32.decode(encoded, BECH32_LONG_LIMIT);
+    if (prefix !== DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP) {
+        throw new Error(`ephemeral-key: expected HRP ${DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP}, got ${JSON.stringify(prefix)}`);
+    }
+    const bytes = new Uint8Array(bech32.fromWords(words));
+    if (bytes.length !== EPK_DEP_PRE_PAYLOAD) {
+        throw new Error(`ephemeral-key: epk_dep_pre1 payload must be ${EPK_DEP_PRE_PAYLOAD} bytes, got ${bytes.length}`);
+    }
+    return {
+        randomNonceScalar: bytesToHex(bytes.subarray(0, FIELD_BYTES)),
+        recipientStealthAddress: {
+            x: bytesToHex(bytes.subarray(FIELD_BYTES, FIELD_BYTES * 2)),
+            y: bytesToHex(bytes.subarray(FIELD_BYTES * 2)),
+        },
+    };
+}
+
+/**
+ * Depositor: `randomNonceScalar * recipientStealthPoint` (same as circom `ECDH` with depositor scalar).
+ */
+function sharedSecretFromDepositorPreimage(ecdhShared, preimage) {
+    const out = ecdhShared(preimage.randomNonceScalar, preimage.recipientStealthAddress.x, preimage.recipientStealthAddress.y);
+    return { x: out.x, y: out.y };
+}
+/**
+ * Recipient: `recipientScalar * ephemeralKey` (same shared point as depositor path when keys match).
+ */
+function sharedSecretFromRecipientPreimage(ecdhShared, preimage) {
+    const out = ecdhShared(preimage.recipientScalar, preimage.ephemeralKey.x, preimage.ephemeralKey.y);
+    return { x: out.x, y: out.y };
+}
+
+const DEFAULT_APPLICATION_ID = '101';
+/** BabyJub audit public key (decimal Fr) used in BDD / local demo when env is unset. */
+const DEMO_AUDIT_PUBLIC_KEY = [
+    '21605515851820432880964235241069234202284600780825340516808373216881770219365',
+    '18856460861531942120859708048677603751294231190189224157283439874962410808705',
+];
+function isActiveWithdraw(slot) {
+    return slot.value !== '0';
+}
+function isActiveDeposit(slot) {
+    return slot.value !== '0';
+}
+function resolveWithdrawSlot(slot) {
+    if (slot === 'dummy') {
+        return null;
+    }
+    return slot;
+}
+function resolveDepositSlot(slot) {
+    if (slot === 'dummy') {
+        return null;
+    }
+    return slot;
+}
+function buildUniformAuditParams(applicationId = DEFAULT_APPLICATION_ID, auditPublicKey) {
+    return {
+        applicationId,
+        noteAuditPublicKeys: [
+            auditPublicKey,
+            auditPublicKey,
+            auditPublicKey,
+            auditPublicKey,
+        ],
+        auditEphemeralScalars: [
+            randomFrDecimal253(),
+            randomFrDecimal253(),
+            randomFrDecimal253(),
+            randomFrDecimal253(),
+        ],
+    };
+}
+function resolveSlotApplicationIds(audit, withdrawSlots, depositSlots) {
+    const w0 = resolveWithdrawSlot(withdrawSlots[0]);
+    const w1 = resolveWithdrawSlot(withdrawSlots[1]);
+    const d0 = resolveDepositSlot(depositSlots[0]);
+    const d1 = resolveDepositSlot(depositSlots[1]);
+    return {
+        inputApplicationIds: [
+            w0 && isActiveWithdraw(w0) ? audit.applicationId : '0',
+            w1 && isActiveWithdraw(w1) ? audit.applicationId : '0',
+        ],
+        outputApplicationIds: [
+            d0 && isActiveDeposit(d0) ? audit.applicationId : '0',
+            d1 && isActiveDeposit(d1) ? audit.applicationId : '0',
+        ],
+    };
+}
+/**
+ * Prefer an explicit key, then `NOTE_AUDIT_PUBLIC_KEY_X`/`_Y` env (decimal Fr),
+ * then the built-in demo key. Used by CLI/`demo.sh` for per-app audit pubkeys.
+ */
+function resolveAuditPublicKeyFromEnv(auditPublicKey) {
+    if (auditPublicKey) {
+        return auditPublicKey;
+    }
+    const x = process.env.NOTE_AUDIT_PUBLIC_KEY_X?.trim();
+    const y = process.env.NOTE_AUDIT_PUBLIC_KEY_Y?.trim();
+    if (x && y) {
+        return [x, y];
     }
-    const calculator = await wc.default(wasmBuffer);
-    const wtns = await calculator.calculateWTNSBin(input, 0);
-    return wtns;
+    return DEMO_AUDIT_PUBLIC_KEY;
+}
+function resolveTransactionAuditParams(applicationId, auditPublicKey) {
+    return buildUniformAuditParams(applicationId, resolveAuditPublicKeyFromEnv(auditPublicKey));
 }
 
-// @ts-ignore - snarkjs types
-const isNode = typeof process !== 'undefined' && !!process.versions?.node;
+/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 12, 6)` in `circuits/main.circom`. */
+const TRANSACTION_TREE_DEPTH = 20;
+/** BN254 scalar field modulus (ark `Fr`, circom signals). */
+const BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 /**
- * Normalize BufferSource to Uint8Array. Required for @iden3/binfileutils/fastfile:
- * they read via data.buffer and data.byteOffset, which ArrayBuffer does not have.
+ * BabyJub ECDH in `circuits/encryption.circom` uses `Num2Bits(253)`; scalars must be < 2^253
+ * (matches `libs/cryptography` `scalar_mul_253`).
  */
-function toUint8Array(src) {
-    if (src instanceof Uint8Array)
-        return src;
-    if (src instanceof ArrayBuffer)
-        return new Uint8Array(src);
-    return new Uint8Array(src.buffer, src.byteOffset, src.byteLength);
+const BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE = 1n << 253n;
+function normalizeHex(hex) {
+    const s = hex.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]*$/.test(s)) {
+        throw new Error('withdrawal-transaction-input: invalid hex');
+    }
+    return s.length % 2 === 0 ? s : `0${s}`;
 }
-async function generateProof(wtns, zkey) {
-    let zkeyData;
-    if (zkey) {
-        zkeyData = toUint8Array(zkey);
+/** 32-byte field coordinate (hex, no 0x) → decimal string mod BN254 scalar field. */
+function coordHexToDecimal(hex) {
+    const h = normalizeHex(hex);
+    if (h.length > 64) {
+        throw new Error('withdrawal-transaction-input: coordinate hex too long');
     }
-    else if (isNode) {
-        const fs = await import('fs');
-        const nodePath = await import('path');
-        const { fileURLToPath } = await import('url');
-        const dir = nodePath.dirname(fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('cli.js', document.baseURI).href))));
-        const zkeyPath = nodePath.resolve(dir, '..', 'assets', 'main_final.zkey');
-        if (!fs.existsSync(zkeyPath)) {
-            throw new Error(`Proving key not found at ${zkeyPath}. Run build.sh first.`);
-        }
-        const zkeyBuffer = fs.readFileSync(zkeyPath);
-        zkeyData = toUint8Array(zkeyBuffer);
+    const v = BigInt(`0x${h}`);
+    return (v % BN254_SCALAR_MOD).toString(10);
+}
+/**
+ * 32-byte big-endian scalar hex → decimal for circom `ephemeralKeyScalar` / ECDH `priv`.
+ * Integer must be < 2^253 (not reduced mod r — values ≥ 2^253 are rejected).
+ */
+function scalarHexToFrDecimal(hex) {
+    const h = normalizeHex(hex);
+    if (h.length > 64) {
+        throw new Error('withdrawal-transaction-input: scalar hex too long');
     }
-    else {
-        throw new Error('In browser, you must pass zkey to PrivacyPoolSDK.init(). ' +
-            'Load the zkey file via fetch() and pass the ArrayBuffer.');
+    const v = BigInt(`0x${h.padStart(64, '0').slice(-64)}`);
+    if (v >= BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE) {
+        throw new Error('depositor ephemeral scalar must be < 2^253 (BabyJub Num2Bits); resample with random-scalar');
     }
-    const wtnsData = toUint8Array(wtns);
-    const { proof, publicSignals } = await snarkjs__namespace.groth16.prove({ type: 'mem', data: zkeyData }, { type: 'mem', data: wtnsData });
-    return { proof, publicSignals };
+    return v.toString(10);
 }
-
 /**
- * Depositor: `randomNonceScalar * recipientStealthPoint` (same as circom `ECDH` with depositor scalar).
+ * Stellar G-address Ed25519 payload (32 bytes as 64 hex, optional 0x) → two circom public decimals
+ * (`withdrawAddressHi` / `withdrawAddressLo`). No mod-r; each half fits in 128 bits.
  */
-function sharedSecretFromDepositorPreimage(ecdhShared, preimage) {
-    const out = ecdhShared(preimage.randomNonceScalar, preimage.recipientStealthAddress.x, preimage.recipientStealthAddress.y);
-    return { x: out.x, y: out.y };
+function ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex) {
+    const h = normalizeHex(hex).padStart(64, '0').slice(-64);
+    const hi = BigInt(`0x${h.slice(0, 32)}`);
+    const lo = BigInt(`0x${h.slice(32, 64)}`);
+    return { hi: hi.toString(10), lo: lo.toString(10) };
 }
 /**
- * Recipient: `recipientScalar * ephemeralKey` (same shared point as depositor path when keys match).
+ * Stellar contract id (`C…`) → two circom field decimals for `asset[0]`, `asset[1]` (same 32-byte split as accounts).
  */
-function sharedSecretFromRecipientPreimage(ecdhShared, preimage) {
-    const out = ecdhShared(preimage.recipientScalar, preimage.ephemeralKey.x, preimage.ephemeralKey.y);
-    return { x: out.x, y: out.y };
+function stellarContractAddressToAssetFrDecimals(address) {
+    const raw = stellarSdk.StrKey.decodeContract(address);
+    const hex = Buffer.from(raw).toString('hex');
+    const { hi, lo } = ed25519PubkeyPayloadHexToWithdrawFrDecimals(hex);
+    return [hi, lo];
+}
+/** Uniform random `Fr` as decimal (32 random bytes, mod r). For Poseidon-only inputs (e.g. nullifiers). */
+function randomFrDecimal() {
+    const hex = generateRandomScalarHex32();
+    const v = BigInt(`0x${normalizeHex(hex)}`);
+    return (v % BN254_SCALAR_MOD).toString(10);
+}
+/** Random scalar < 2^253 for BabyJub ECDH / `Num2Bits(253)` (uses {@link generateRandomScalarHex32}). */
+function randomFrDecimal253() {
+    const hex = generateRandomScalarHex32();
+    return BigInt(`0x${normalizeHex(hex)}`).toString(10);
+}
+/** Spend-scalar hex in `(0, BabyJub subgroup order)` so dummy withdraws satisfy `LessThan(l)`. */
+function randomCanonicalBabyJubScalarHex() {
+    const hex = generateRandomScalarHex32();
+    const reduced = canonicalBabyJubScalarFromInteger(BigInt(`0x${normalizeHex(hex)}`));
+    return reduced.toString(16).padStart(64, '0');
+}
+function zerosTreeSiblings() {
+    return Array(TRANSACTION_TREE_DEPTH).fill('0');
+}
+function dummyWithdraw(wasm) {
+    const nullifier = randomFrDecimal();
+    const secretHex = generateRandomScalarHex32();
+    const secret = (BigInt(`0x${normalizeHex(secretHex)}`) % BN254_SCALAR_MOD).toString(10);
+    const scalarHex = randomCanonicalBabyJubScalarHex();
+    const privKeyScalar = scalarHexToFrDecimal(scalarHex);
+    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(scalarHex);
+    return {
+        value: '0',
+        nullifier,
+        secret,
+        asset: ['0', '0'],
+        applicationId: '0',
+        ownerPub: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+        stateSiblings: zerosTreeSiblings(),
+        stateIndex: '0',
+    };
+}
+function dummyDeposit(wasm) {
+    const nullifier = randomFrDecimal();
+    const ephemeralKeyScalar = randomFrDecimal253();
+    const skHex = generateRandomScalarHex32();
+    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(skHex);
+    return {
+        value: '0',
+        nullifier,
+        ephemeralKeyScalar,
+        asset: ['0', '0'],
+        applicationId: '0',
+        recipientPublicKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+    };
+}
+function resolveWithdraw(slot, wasm) {
+    return slot === 'dummy' ? dummyWithdraw(wasm) : slot;
+}
+function resolveDeposit(slot, wasm) {
+    return slot === 'dummy' ? dummyDeposit(wasm) : slot;
+}
+function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, depositSlots, audit, wasm) {
+    const w0 = resolveWithdraw(withdrawSlots[0], wasm);
+    const w1 = resolveWithdraw(withdrawSlots[1], wasm);
+    const d0 = resolveDeposit(depositSlots[0], wasm);
+    const d1 = resolveDeposit(depositSlots[1], wasm);
+    const appIds = resolveSlotApplicationIds(audit, withdrawSlots, depositSlots);
+    return {
+        stateRoot: publicParams.stateRoot,
+        withdrawAddressHi: publicParams.withdrawAddressHi,
+        withdrawAddressLo: publicParams.withdrawAddressLo,
+        escrowRecipientHi: publicParams.escrowRecipientHi ?? '0',
+        escrowRecipientLo: publicParams.escrowRecipientLo ?? '0',
+        sweepOutputOwnerPubX: publicParams.sweepOutputOwnerPubX ?? '0',
+        sweepOutputOwnerPubY: publicParams.sweepOutputOwnerPubY ?? '0',
+        privKeyScalars: [w0.privKeyScalar, w1.privKeyScalar],
+        ownerPubs: [w0.ownerPub, w1.ownerPub],
+        paddingRandoms: [w0.paddingRandom, w1.paddingRandom],
+        withdrawnValues: [w0.value, w1.value],
+        withdrawnNullifiers: [w0.nullifier, w1.nullifier],
+        withdrawnSecrets: [w0.secret, w1.secret],
+        withdrawnAssets: [w0.asset, w1.asset],
+        withdrawnEscrowNonces: [w0.escrowNonce, w1.escrowNonce],
+        inputRecipientStellar: [w0.recipientStellar, w1.recipientStellar],
+        stateSiblings: [w0.stateSiblings, w1.stateSiblings],
+        stateIndex: [w0.stateIndex, w1.stateIndex],
+        depositedValues: [d0.value, d1.value],
+        depositedNullifiers: [d0.nullifier, d1.nullifier],
+        depositedAssets: [d0.asset, d1.asset],
+        depositedEphemeralKeyScalars: [d0.ephemeralKeyScalar, d1.ephemeralKeyScalar],
+        depositedRecipientPublicKeys: [d0.recipientPublicKeys, d1.recipientPublicKeys],
+        depositedEscrowNonces: [d0.escrowNonce ?? '0', d1.escrowNonce ?? '0'],
+        outputRecipientStellar: [
+            d0.recipientStellar ?? ['0', '0'],
+            d1.recipientStellar ?? ['0', '0'],
+        ],
+        inputApplicationIds: appIds.inputApplicationIds,
+        outputApplicationIds: appIds.outputApplicationIds,
+        auditEphemeralScalars: audit.auditEphemeralScalars,
+        noteAuditPublicKeys: audit.noteAuditPublicKeys,
+        publicWithdrawnAssets: publicLegs.publicWithdrawnAssets,
+        publicDepositedAssets: publicLegs.publicDepositedAssets,
+        publicDeposits: publicLegs.publicDeposits,
+        publicWithdrawals: publicLegs.publicWithdrawals,
+    };
+}
+/** `stpl1…` stealth address → `[x, y]` as decimal field strings for `depositedRecipientPublicKeys`. */
+function recipientPublicKeysDecimalFromStealthAddress(stealthAddress) {
+    const { x, y } = decodeStealthAddress(stealthAddress);
+    return [coordHexToDecimal(x), coordHexToDecimal(y)];
+}
+/** First withdraw leg: Merkle witness + owner public key (hex) and matching scalar. */
+function withdrawObjectFromMerkleWitness(witness, ownerPubHex, applicationId, privKeyScalar) {
+    return {
+        value: witness.value,
+        nullifier: witness.nullifier,
+        secret: witness.secret,
+        asset: witness.withdrawnAsset,
+        applicationId,
+        ownerPub: [coordHexToDecimal(ownerPubHex.x), coordHexToDecimal(ownerPubHex.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
+        stateSiblings: witness.stateSiblings,
+        stateIndex: witness.stateIndex,
+    };
 }
 
-/** Stroops amount as WASM `u64` (`bigint`). */
-function wasmU64Stroops(amount) {
-    const b = typeof amount === 'bigint' ? amount : BigInt(amount);
-    if (b < 0n || b > 0xffffffffffffffffn) {
-        throw new RangeError('amount must be a non-negative u64 (stroops)');
+/** Stroops amount as a decimal field string. Reject JS `number` so 18-decimal values cannot silently narrow. */
+function coinValueDecimal(amount) {
+    if (typeof amount === 'number') {
+        throw new TypeError('coin value must be bigint or decimal string, not number');
+    }
+    if (typeof amount === 'bigint') {
+        if (amount < 0n) {
+            throw new RangeError('amount must be a non-negative integer');
+        }
+        return amount.toString(10);
+    }
+    if (typeof amount !== 'string') {
+        throw new TypeError('coin value must be bigint or decimal string, not number');
     }
-    return b;
+    const trimmed = amount.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+        throw new TypeError('coin value decimal string must be a non-negative integer');
+    }
+    return trimmed;
+}
+function generatedCoinFromWasm(value) {
+    const raw = value;
+    const precommitementHex = raw.precommitementHex ?? raw.precommitement_hex;
+    if (!precommitementHex) {
+        throw new Error('generated coin missing precommitement hex');
+    }
+    return {
+        coin: raw.coin,
+        commitment_hex: raw.commitment_hex,
+        precommitement_hex: precommitementHex,
+        precommitementHex,
+    };
 }
 class PrivacyPoolSDK {
     constructor(wasm, options) {
@@ -1949,39 +2122,40 @@ class PrivacyPoolSDK {
         return generateRandomScalarHex32();
     }
     /**
-     * Text to sign with a Stellar wallet for stealth derivation (UTF-8). No WASM required.
+     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
+     * The message binds network, pool, registry, and schema version (H6).
      */
-    static buildStealthAddressSignMessage(address, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
-        return buildStealthAddressSignMessage(address, nonce);
+    static buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+        return buildStealthAddressSignMessage(address, domain, nonce);
     }
     /**
-     * Generate a new coin with random nullifier, secret, and random shared-secret field elements (dev / self-contained tests).
-     * @param amount Stroops encoded as `bigint` or integer `number` (WASM `u64`).
+     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
+     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
      * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
      */
     generateCoin(amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoin(wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+        return generatedCoinFromWasm(this.wasm.generateCoin(coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
-     * Generate a coin with the same commitment shape as on-chain deposit: pass `ecdhSharedKey` output (hex x, y).
-     * @param amount Stroops (`bigint` | `number`).
+     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinWithSharedSecret(shared, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinWithSharedSecretHex(shared.x, shared.y, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+    generateCoinWithOwnerPub(ownerPub, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
+        return generatedCoinFromWasm(this.wasm.generateCoinWithOwnerPubHex(ownerPub.x, ownerPub.y, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
      * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
-     * @param amount Stroops (`bigint` | `number`).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
     generateCoinFromDepositEphemeralScalarHex(scalarHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+        return generatedCoinFromWasm(this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
-     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and ECDH shared key from hex coords (e.g. `ecdhSharedKey(scalar, recipient_x, recipient_y)`).
-     * @param amount Stroops (`bigint` | `number`).
+     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinForDepositWithSharedHex(scalarHex, sharedXHex, sharedYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinForDepositWithSharedHex(scalarHex, sharedXHex, sharedYHex, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+    generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
+        return generatedCoinFromWasm(this.wasm.generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
      * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
@@ -2000,10 +2174,8 @@ class PrivacyPoolSDK {
      */
     async proveWithdrawal(coin, state, params) {
         const witness = this.buildWithdrawMerkleWitness(coin, state);
-        const w0 = withdrawObjectFromMerkleWitness(witness, {
-            x: params.ephemeralXHex,
-            y: params.ephemeralYHex,
-        }, params.applicationId ?? coin.application_id ?? '0');
+        const ownerPubHex = this.ecdhEphemeralPublicKeyFromScalarHex(BigInt(params.privKeyScalar).toString(16).padStart(64, '0'));
+        const w0 = withdrawObjectFromMerkleWitness(witness, ownerPubHex, params.applicationId ?? coin.application_id ?? '0', params.privKeyScalar);
         const fullV = BigInt(coin.value);
         let publicWithdrawals;
         let deposits;
@@ -2089,19 +2261,20 @@ class PrivacyPoolSDK {
         };
     }
     /**
-     * Calculate nullifier hash: Poseidon(nullifier)
+     * Calculate owner-bound nullifier hash: Poseidon(DOM_NULLIFIER, nullifier, privKeyScalar)
      * @param nullifier Nullifier decimal string from coin data
+     * @param privKeyScalar Spend scalar decimal string
      * @returns Hex string (0x...) of the hash bytes
      */
-    calculateNullifierHash(nullifier) {
-        return this.wasm.calculateNullifierHash(nullifier);
+    calculateNullifierHash(nullifier, privKeyScalar) {
+        return this.wasm.calculateNullifierHash(nullifier, privKeyScalar);
     }
     /**
      * Ed25519 signature from signing {@link buildStealthAddressSignMessage}: **128 hex chars** (optional `0x`)
-     * or **base64** (64 raw bytes after decode). `SHA-256(signature bytes)` → scalar → ECDH → `stpl1` Bech32.
+     * or **base64** (64 raw bytes after decode). Domain-separated SHA-256 → scalar → ECDH → `stpl1` Bech32.
      */
-    async generateStealthAddressFromStellarSignature(signature) {
-        return stealthAddressFromStellarSignature((h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h), encodeStealthAddress, signature);
+    async generateStealthAddressFromStellarSignature(signature, domain) {
+        return stealthAddressFromStellarSignature((h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h), encodeStealthAddress, signature, domain);
     }
     encodeDecodedEphemeralKey(decoded) {
         return encodeDecodedEphemeralKey(decoded);
@@ -2123,38 +2296,6 @@ class PrivacyPoolSDK {
     }
 }
 
-function onboardingContractValue(onboarding) {
-    return {
-        owner: onboarding.owner,
-        temp_public_key_x: onboarding.temp_public_key_x,
-        temp_public_key_y: onboarding.temp_public_key_y,
-        encrypted_private_key: onboarding.encrypted_private_key,
-        notes: {
-            notes: onboarding.notes.map((note) => ({
-                value: note.value,
-                asset_hi: note.asset_hi,
-                asset_lo: note.asset_lo,
-                nullifier: note.nullifier,
-                secret: note.secret,
-                deposited_ephemeral_scalar: note.deposited_ephemeral_scalar,
-            })),
-        },
-        private_address_registration: onboarding.private_address_registration,
-    };
-}
-function onboardingToScVal(onboarding) {
-    return stellarSdk.nativeToScVal(onboardingContractValue(onboarding));
-}
-function onboardingOptionToScVal(onboarding) {
-    if (onboarding === null || onboarding === undefined) {
-        return stellarSdk.xdr.ScVal.scvVoid();
-    }
-    return onboardingToScVal(onboarding);
-}
-function addressToScVal(address) {
-    return stellarSdk.nativeToScVal(address, { type: 'address' });
-}
-
 function signatureBase64ToBytes(signature) {
     const value = signature.trim();
     if (/^(0x)?[0-9a-fA-F]{128}$/.test(value)) {
@@ -2163,6 +2304,9 @@ function signatureBase64ToBytes(signature) {
     return Buffer.from(value, 'base64');
 }
 
+function addressToScVal(address) {
+    return stellarSdk.nativeToScVal(address, { type: 'address' });
+}
 function passageIdHexToScVal(passageIdHex) {
     const bytes = Buffer.from(passageIdHex.replace(/^0x/, ''), 'hex');
     return stellarSdk.xdr.ScVal.scvBytes(bytes);
@@ -2179,7 +2323,6 @@ function helperSubmitWithPassageOperation(helperContractId, params, passageId, e
             stellarSdk.nativeToScVal(params.nonce, { type: 'u64' }),
             stellarSdk.xdr.ScVal.scvBytes(params.proofBytes),
             stellarSdk.xdr.ScVal.scvBytes(params.publicSignalsBytes),
-            onboardingOptionToScVal(params.onboarding),
             passageIdHexToScVal(passageId),
             stellarSdk.xdr.ScVal.scvU32(expiresAtLedger),
             signatureToScVal(signatureBase64ToBytes(signature)),
@@ -2337,6 +2480,9 @@ async function main() {
     else if (command === 'priv-scalar-from-signature') {
         await handlePrivScalarFromSignature(args.slice(1));
     }
+    else if (command === 'stealth-pubkey-hex') {
+        handleStealthPubkeyHex(args.slice(1));
+    }
     else if (command === 'kyt-submit-approved') {
         await handleKytSubmitApproved(args.slice(1));
     }
@@ -2364,13 +2510,25 @@ Commands:
 
   stealth-sign-message             Print message to sign (Stellar wallet / stellar CLI)
     --address <G...>               Stellar account address (required)
+    --network-passphrase <string>  Network passphrase bound into the spend scalar
+    --pool <C...>                  Pool contract id bound into the spend scalar
+    --registry <C...>              Registry contract id bound into the spend scalar
+    --schema-version <u32>         Note schema version (default: 1)
     --nonce <string>               Nonce label (default: "main address")
 
   stealth-from-signature           Derive stpl1 stealth address from Ed25519 signature
     --signature <value>            128 hex chars (optional 0x) or standard base64 (64 bytes)
     --signature-file <path>        Read signature from file (whitespace trimmed)
+    --network-passphrase <string>  Spend-scalar domain (same as stealth-sign-message)
+    --pool <C...>
+    --registry <C...>
+    --schema-version <u32>
 
-  priv-scalar-from-signature       Print privKeyScalar (decimal Fr) from Stellar Ed25519 signature (SHA-256(sig) mod r)
+  priv-scalar-from-signature       Print privKeyScalar (decimal Fr) from domain-separated spend digest
+
+  stealth-pubkey-hex                Decode a stpl1 stealth address into its BabyJubJub public key
+    --stealth <stpl1...>            Stealth address to decode
+                                     Prints x hex on line 1, y hex on line 2 (registry public_key_x/public_key_y)
 
   kyt-submit-approved              Submit helper.register_passage + pool.transact with signed non-root auth
     --source-secret <S...>         Secret seed for the depositing/withdrawing Stellar account (or SOURCE_SECRET env)
@@ -2478,6 +2636,24 @@ function parseArgs(args) {
     }
     return parsed;
 }
+function requireSpendScalarDomain(parsed) {
+    const networkPassphrase = parsed['network-passphrase'] ?? networkPassphraseFromArgs(parsed);
+    const poolContract = requireParsedArg(parsed, 'pool');
+    const registryContract = requireParsedArg(parsed, 'registry');
+    const schemaRaw = parsed['schema-version'];
+    const domain = {
+        networkPassphrase,
+        poolContract,
+        registryContract,
+    };
+    if (schemaRaw !== undefined) {
+        domain.schemaVersion = Number(schemaRaw);
+    }
+    else {
+        domain.schemaVersion = OWNER_BOUND_NOTE_SCHEMA_VERSION;
+    }
+    return domain;
+}
 function handleStealthSignMessage(args) {
     const parsed = parseArgs(args);
     const address = parsed['address'];
@@ -2486,7 +2662,7 @@ function handleStealthSignMessage(args) {
         process.exit(1);
     }
     const nonce = parsed['nonce'] ?? DEFAULT_STEALTH_SIGN_NONCE;
-    console.log(buildStealthAddressSignMessage(address, nonce));
+    console.log(buildStealthAddressSignMessage(address, requireSpendScalarDomain(parsed), nonce));
 }
 async function handleStealthFromSignature(args) {
     const parsed = parseArgs(args);
@@ -2499,9 +2675,16 @@ async function handleStealthFromSignature(args) {
         process.exit(1);
     }
     const sdk = await PrivacyPoolSDK.init();
-    const stealth = await sdk.generateStealthAddressFromStellarSignature(sig);
+    const stealth = await sdk.generateStealthAddressFromStellarSignature(sig, requireSpendScalarDomain(parsed));
     console.log(stealth);
 }
+function handleStealthPubkeyHex(args) {
+    const parsed = parseArgs(args);
+    const stealth = requireParsedArg(parsed, 'stealth');
+    const { x, y } = decodeStealthAddress(stealth);
+    console.log(x);
+    console.log(y);
+}
 async function handlePrivScalarFromSignature(args) {
     const parsed = parseArgs(args);
     let sig = parsed['signature'];
@@ -2512,7 +2695,7 @@ async function handlePrivScalarFromSignature(args) {
         console.error('Error: --signature <hex> or --signature-file <path> is required');
         process.exit(1);
     }
-    const dec = await privKeyScalarDecimalFromStellarSignature(sig.trim());
+    const dec = await privKeyScalarDecimalFromStellarSignature(sig.trim(), requireSpendScalarDomain(parsed));
     console.log(dec);
 }
 function handleRandomScalar() {
@@ -2541,33 +2724,22 @@ async function handleKytSubmitApproved(args) {
     });
     console.log(txHash);
 }
-function parseStroopsU64(label, raw, defaultStroops) {
+function parseCoinValueDecimal(label, raw, defaultStroops) {
     if (raw === undefined) {
-        return defaultStroops;
+        return defaultStroops.toString(10);
     }
     if (!/^\d+$/.test(raw)) {
-        console.error(`Error: ${label} must be a non-negative decimal integer (stroops u64)`);
-        process.exit(1);
-    }
-    try {
-        const b = BigInt(raw);
-        if (b < 0n || b > 0xffffffffffffffffn) {
-            console.error(`Error: ${label} out of u64 range`);
-            process.exit(1);
-        }
-        return b;
-    }
-    catch {
-        console.error(`Error: invalid ${label}`);
+        console.error(`Error: ${label} must be a non-negative decimal integer`);
         process.exit(1);
     }
+    return raw;
 }
 async function handleGenerate(args) {
     const parsed = parseArgs(args);
     const sdk = await PrivacyPoolSDK.init();
     const scalar = parsed['scalar'];
     const stealth = parsed['stealth'];
-    const amount = parseStroopsU64('--amount', parsed['amount'], BigInt(COIN_VALUE_STROOPS));
+    const amount = parseCoinValueDecimal('--amount', parsed['amount'], BigInt(COIN_VALUE_STROOPS));
     const applicationId = resolveApplicationIdFromCli(parsed);
     const token = parsed['token'] ?? process.env.TOKEN_ADDRESS;
     if (!token) {
@@ -2582,8 +2754,7 @@ async function handleGenerate(args) {
     let coin;
     if (scalar && stealth) {
         const { x, y } = decodeStealthAddress(stealth);
-        const shared = sdk.ecdhSharedKey(scalar, x, y);
-        coin = sdk.generateCoinForDepositWithSharedHex(scalar, shared.x, shared.y, amount, assetHi, assetLo, applicationId);
+        coin = sdk.generateCoinForDepositWithOwnerPubHex(scalar, x, y, amount, assetHi, assetLo, applicationId);
     }
     else if (scalar) {
         coin = sdk.generateCoinFromDepositEphemeralScalarHex(scalar, amount, assetHi, assetLo, applicationId);