@auditable/privacy-pool-zk-sdk 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import * as snarkjs from 'snarkjs';
-import { StrKey, xdr, nativeToScVal, Address, Keypair, rpc, TransactionBuilder, Operation, authorizeEntry } from '@stellar/stellar-sdk';
+import { StrKey, Address, Keypair, rpc, TransactionBuilder, Operation, xdr, nativeToScVal, authorizeEntry } from '@stellar/stellar-sdk';
 import { buildBabyjub, buildMimc7, buildPoseidon } from 'circomlibjs';
 
 /* @ts-self-types="./client_sdk_wasm.d.ts" */
@@ -40,35 +40,69 @@ function buildWithdrawMerkleWitness(coin_json, state_json) {
 }
 
 /**
- * Calculate nullifier hash from nullifier decimal string.
+ * Calculate owner-bound nullifier hash from nullifier and spend-scalar decimal strings.
  * Returns hex string (0x...)
  * @param {string} nullifier_decimal
+ * @param {string} priv_key_scalar_decimal
  * @returns {string}
  */
-function calculateNullifierHash(nullifier_decimal) {
-    let deferred3_0;
-    let deferred3_1;
+function calculateNullifierHash(nullifier_decimal, priv_key_scalar_decimal) {
+    let deferred4_0;
+    let deferred4_1;
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
         const ptr0 = passStringToWasm0(nullifier_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        wasm.calculateNullifierHash(retptr, ptr0, len0);
+        const ptr1 = passStringToWasm0(priv_key_scalar_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        wasm.calculateNullifierHash(retptr, ptr0, len0, ptr1, len1);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
         var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
-        var ptr2 = r0;
-        var len2 = r1;
+        var ptr3 = r0;
+        var len3 = r1;
         if (r3) {
-            ptr2 = 0; len2 = 0;
+            ptr3 = 0; len3 = 0;
             throw takeObject(r2);
         }
-        deferred3_0 = ptr2;
-        deferred3_1 = len2;
-        return getStringFromWasm0(ptr2, len2);
+        deferred4_0 = ptr3;
+        deferred4_1 = len3;
+        return getStringFromWasm0(ptr3, len3);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export4(deferred4_0, deferred4_1, 1);
+    }
+}
+
+/**
+ * `R = Poseidon255(2)(hi, lo)`; `scalar` is the raw Poseidon hash when it is
+ * already in `(0, BabyJub subgroup order)`. Out-of-range hashes fail so the
+ * caller can rejection-sample a new nonce.
+ * @param {string} nonce_decimal
+ * @param {string} recipient_hi_decimal
+ * @param {string} recipient_lo_decimal
+ * @returns {any}
+ */
+function derivedEscrowKey$1(nonce_decimal, recipient_hi_decimal, recipient_lo_decimal) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passStringToWasm0(nonce_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(recipient_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passStringToWasm0(recipient_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.derivedEscrowKey(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
     } finally {
         wasm.__wbindgen_add_to_stack_pointer(16);
-        wasm.__wbindgen_export4(deferred3_0, deferred3_1, 1);
     }
 }
 
@@ -149,26 +183,28 @@ function ecdhSharedKey(priv_hex, pub_x_hex, pub_y_hex) {
 }
 
 /**
- * Generate a new coin with random nullifier, secret, and shared-secret field elements.
- * `amount` is stroops (u64); JS passes `bigint`.
+ * Generate a new coin with random nullifier, secret, and owner public-key field elements.
+ * `amount_decimal` is an arbitrary-precision decimal field element (never JS `number`).
  * `asset_hi_decimal` / `asset_lo_decimal` are decimal Fr strings for the Stellar asset contract id (two limbs).
  * Returns JSON: { coin: { value, nullifier, secret, commitment, asset_hi, asset_lo }, commitment_hex, precommitement_hex }
- * @param {bigint} amount
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoin(amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoin(amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr0 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        wasm.generateCoin(retptr, amount, ptr0, len0, ptr1, len1, ptr2, len2);
+        const ptr3 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.generateCoin(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -182,32 +218,34 @@ function generateCoin(amount, asset_hi_decimal, asset_lo_decimal, application_id
 }
 
 /**
- * `Poseidon₁(scalar)` secret + fixed ECDH shared coords (hex), matching an aligned deposit witness.
+ * `Poseidon₁(scalar)` secret + recipient owner public key (hex), matching an aligned deposit witness.
  * @param {string} scalar_hex
- * @param {string} shared_x_hex
- * @param {string} shared_y_hex
- * @param {bigint} amount
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinForDepositWithSharedHex(scalar_hex, shared_x_hex, shared_y_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinForDepositWithOwnerPubHex(scalar_hex, owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
         const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(shared_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(shared_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        const ptr4 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr4 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len4 = WASM_VECTOR_LEN;
-        const ptr5 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr5 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len5 = WASM_VECTOR_LEN;
-        wasm.generateCoinForDepositWithSharedHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, amount, ptr3, len3, ptr4, len4, ptr5, len5);
+        const ptr6 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len6 = WASM_VECTOR_LEN;
+        wasm.generateCoinForDepositWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5, ptr6, len6);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -223,24 +261,26 @@ function generateCoinForDepositWithSharedHex(scalar_hex, shared_x_hex, shared_y_
 /**
  * `secret` in coin = `Poseidon255(1)(scalar)` per `deposit.circom`; scalar is 32-byte hex (64 chars, optional `0x`).
  * @param {string} scalar_hex
- * @param {bigint} amount
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
         const ptr0 = passStringToWasm0(scalar_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        wasm.generateCoinFromDepositEphemeralScalarHex(retptr, ptr0, len0, amount, ptr1, len1, ptr2, len2, ptr3, len3);
+        const ptr4 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len4 = WASM_VECTOR_LEN;
+        wasm.generateCoinFromDepositEphemeralScalarHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -254,29 +294,31 @@ function generateCoinFromDepositEphemeralScalarHex(scalar_hex, amount, asset_hi_
 }
 
 /**
- * Same as `generateCoin`, but commitment uses the given ECDH shared key (64-char hex coords from `ecdhSharedKey`); shared coords are not stored in `coin` JSON.
- * @param {string} shared_x_hex
- * @param {string} shared_y_hex
- * @param {bigint} amount
+ * Same as `generateCoin`, but commitment uses the given owner public key (64-char hex coords).
+ * @param {string} owner_x_hex
+ * @param {string} owner_y_hex
+ * @param {string} amount_decimal
  * @param {string} asset_hi_decimal
  * @param {string} asset_lo_decimal
  * @param {string} application_id_decimal
  * @returns {any}
  */
-function generateCoinWithSharedSecretHex(shared_x_hex, shared_y_hex, amount, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
+function generateCoinWithOwnerPubHex(owner_x_hex, owner_y_hex, amount_decimal, asset_hi_decimal, asset_lo_decimal, application_id_decimal) {
     try {
         const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
-        const ptr0 = passStringToWasm0(shared_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr0 = passStringToWasm0(owner_x_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(shared_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr1 = passStringToWasm0(owner_y_hex, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len1 = WASM_VECTOR_LEN;
-        const ptr2 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr2 = passStringToWasm0(amount_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len2 = WASM_VECTOR_LEN;
-        const ptr3 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr3 = passStringToWasm0(asset_hi_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len3 = WASM_VECTOR_LEN;
-        const ptr4 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const ptr4 = passStringToWasm0(asset_lo_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
         const len4 = WASM_VECTOR_LEN;
-        wasm.generateCoinWithSharedSecretHex(retptr, ptr0, len0, ptr1, len1, amount, ptr2, len2, ptr3, len3, ptr4, len4);
+        const ptr5 = passStringToWasm0(application_id_decimal, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len5 = WASM_VECTOR_LEN;
+        wasm.generateCoinWithOwnerPubHex(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3, ptr4, len4, ptr5, len5);
         var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
         var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
         var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
@@ -689,13 +731,14 @@ var wasmBindings = /*#__PURE__*/Object.freeze({
     buildWithdrawMerkleWitness: buildWithdrawMerkleWitness,
     calculateNullifierHash: calculateNullifierHash,
     default: __wbg_init,
+    derivedEscrowKey: derivedEscrowKey$1,
     ecdhEphemeralPublicKey: ecdhEphemeralPublicKey,
     ecdhEphemeralPublicKeyFromScalarHex: ecdhEphemeralPublicKeyFromScalarHex,
     ecdhSharedKey: ecdhSharedKey,
     generateCoin: generateCoin,
-    generateCoinForDepositWithSharedHex: generateCoinForDepositWithSharedHex,
+    generateCoinForDepositWithOwnerPubHex: generateCoinForDepositWithOwnerPubHex,
     generateCoinFromDepositEphemeralScalarHex: generateCoinFromDepositEphemeralScalarHex,
-    generateCoinWithSharedSecretHex: generateCoinWithSharedSecretHex,
+    generateCoinWithOwnerPubHex: generateCoinWithOwnerPubHex,
     initSync: initSync,
     proofToHex: proofToHex,
     publicToHex: publicToHex
@@ -1531,7 +1574,7 @@ function bytesToHex$1(bytes) {
     }
     return s;
 }
-function concatBytes(a, b) {
+function concatBytes$1(a, b) {
     const out = new Uint8Array(a.length + b.length);
     out.set(a, 0);
     out.set(b, a.length);
@@ -1547,7 +1590,7 @@ function encodeStealthAddress(decoded) {
     if (xb.length !== yb.length) {
         throw new Error('stealth-address: x and y must encode the same number of bytes for a reversible address');
     }
-    const payload = concatBytes(xb, yb);
+    const payload = concatBytes$1(xb, yb);
     const words = bech32.toWords(payload);
     return bech32.encode(STEALTH_ADDRESS_HRP, words, BECH32_STEALTH_LIMIT);
 }
@@ -1572,12 +1615,165 @@ function decodeStealthAddress(address) {
 
 /** Default nonce when deriving the wallet sign-in message. */
 const DEFAULT_STEALTH_SIGN_NONCE = 'main address';
+/** Domain tag mixed into the spend-scalar digest (H6). */
+const SPEND_SCALAR_DOMAIN_TAG = 'privacy-pool-spend-scalar-v1';
+/** Schema version bound into the spend-scalar message and digest. */
+const OWNER_BOUND_NOTE_SCHEMA_VERSION = 1;
+function resolveSpendScalarSchemaVersion(domain) {
+    return domain.schemaVersion ?? OWNER_BOUND_NOTE_SCHEMA_VERSION;
+}
 /**
- * Plaintext for Stellar wallet message signing (stealth address derivation).
+ * Plaintext for Stellar wallet message signing (spend-key derivation).
  * Sign the exact bytes of this string (UTF-8) with the stellar account key.
+ *
+ * The derived scalar is the owner-bound spend key for notes in this environment.
+ */
+function buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+    const schemaVersion = resolveSpendScalarSchemaVersion(domain);
+    return [
+        'Arcane privacy layer: derive your private-note spend key.',
+        '',
+        `Wallet: ${address}`,
+        `Network: ${domain.networkPassphrase}`,
+        `Pool: ${domain.poolContract}`,
+        `Registry: ${domain.registryContract}`,
+        `Schema: owner-bound-note-v${schemaVersion}`,
+        `Nonce: ${nonce}`,
+        '',
+        'This signature derives the key that authorizes spending your private notes in this environment.',
+    ].join('\n');
+}
+
+const DOM_PADDING = 1347436868n;
+const DOM_NULLIFIER = 1346917708n;
+const DOM_ESCROW = 1346720579n;
+const DOM_ENC = 1346719299n;
+const BABYJUB_SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+/**
+ * Map any integer into `(0, l)` so it satisfies circom `LessThan(252)` vs
+ * `BABYJUB_SUBGROUP_ORDER` and `BabyPbk`. Values already in range are unchanged.
+ */
+function canonicalBabyJubScalarFromInteger(value) {
+    if (value > 0n && value < BABYJUB_SUBGROUP_ORDER) {
+        return value;
+    }
+    return (value % (BABYJUB_SUBGROUP_ORDER - 1n)) + 1n;
+}
+
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Base64 → bytes via `atob` (browsers; Node 16+). No Node `Buffer`. */
+function decodeBase64ToBytes(s) {
+    const t = s.replace(/\s/g, '');
+    if (typeof atob !== 'function') {
+        throw new Error('Base64 decoding requires atob (browser or Node 16+)');
+    }
+    try {
+        const binary = atob(t);
+        const out = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            out[i] = binary.charCodeAt(i);
+        }
+        return out;
+    }
+    catch {
+        throw new Error('Invalid base64 signature');
+    }
+}
+/**
+ * Ed25519 signature as **128 hex chars** (optional `0x`) or **base64** (typically 88 chars for 64 bytes, whitespace ignored).
+ */
+function parseStellarEd25519SignatureRaw(input) {
+    const trimmed = input.trim();
+    const no0x = trimmed.replace(/^0x/i, '');
+    if (/^[0-9a-fA-F]+$/.test(no0x) && no0x.length === 128) {
+        return hexToBytes(no0x.toLowerCase());
+    }
+    const fromB64 = decodeBase64ToBytes(trimmed);
+    if (fromB64.length !== 64) {
+        throw new Error(`Decoded signature must be 64 bytes (Ed25519); got ${fromB64.length} from base64`);
+    }
+    return fromB64;
+}
+/** SHA-256 via Web Crypto only (`crypto.subtle`) — works in browsers and Node 19+ (global `crypto`). */
+async function sha256$1(data) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error('SHA-256 requires crypto.subtle (HTTPS or localhost in browsers, or Node.js 19+).');
+    }
+    const copy = new Uint8Array(data.length);
+    copy.set(data);
+    return new Uint8Array(await subtle.digest('SHA-256', copy));
+}
+function appendU32BE$1(parts, value) {
+    const buf = new Uint8Array(4);
+    new DataView(buf.buffer).setUint32(0, value >>> 0, false);
+    parts.push(buf);
+}
+function appendUtf8Prefixed(parts, text) {
+    const bytes = new TextEncoder().encode(text);
+    appendU32BE$1(parts, bytes.length);
+    parts.push(bytes);
+}
+function concatBytes(parts) {
+    const total = parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+/**
+ * Domain-separated spend-scalar digest: SHA-256(
+ *   SPEND_SCALAR_DOMAIN_TAG || network || pool || registry || schemaVersion || signature
+ * ).
+ */
+async function spendScalarDigestFromStellarSignature(signature, domain) {
+    const raw = parseStellarEd25519SignatureRaw(signature);
+    const parts = [new TextEncoder().encode(SPEND_SCALAR_DOMAIN_TAG)];
+    appendUtf8Prefixed(parts, domain.networkPassphrase);
+    appendUtf8Prefixed(parts, domain.poolContract);
+    appendUtf8Prefixed(parts, domain.registryContract);
+    appendU32BE$1(parts, resolveSpendScalarSchemaVersion(domain));
+    parts.push(raw);
+    return sha256$1(concatBytes(parts));
+}
+function digestToCanonicalScalar(digest) {
+    let v = 0n;
+    for (let i = 0; i < digest.length; i++) {
+        v = (v << 8n) + BigInt(digest[i]);
+    }
+    return canonicalBabyJubScalarFromInteger(v);
+}
+function canonicalScalarHex(scalar) {
+    return scalar.toString(16).padStart(64, '0');
+}
+async function spendScalarHexFromStellarSignature(signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    return canonicalScalarHex(digestToCanonicalScalar(digest));
+}
+/**
+ * Stellar Ed25519 signature (hex or base64) → domain-separated SHA-256 → scalar → WASM ECDH.
+ */
+async function stealthAddressFromStellarSignature(ecdhFromScalarHex, encodeStealth, signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    const decoded = ecdhFromScalarHex(canonicalScalarHex(digestToCanonicalScalar(digest)));
+    return encodeStealth(decoded);
+}
+/**
+ * Domain-separated SHA-256(signature, network, pool, registry, schema) reduced into
+ * `(0, BabyJub subgroup order)` so `privKeyScalar` matches `BabyPbk` and circom `LessThan(l)`.
  */
-function buildStealthAddressSignMessage(address, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
-    return `Privacy layer app needs you to sign the message for stealth address derivation with address:\n${address}\n and nonce:\n${nonce}.\n\n This will not authorize any transaction.`;
+async function privKeyScalarDecimalFromStellarSignature(signature, domain) {
+    const digest = await spendScalarDigestFromStellarSignature(signature, domain);
+    return digestToCanonicalScalar(digest).toString(10);
 }
 
 const TRANSACTION_N_AUDIT_SLOTS = 4;
@@ -1644,15 +1840,30 @@ function withApplicationIdOnDeposit(deposit, applicationId) {
 function withApplicationIdOnWithdraw(withdraw, applicationId) {
     return { ...withdraw, applicationId };
 }
+/**
+ * Prefer an explicit key, then `NOTE_AUDIT_PUBLIC_KEY_X`/`_Y` env (decimal Fr),
+ * then the built-in demo key. Used by CLI/`demo.sh` for per-app audit pubkeys.
+ */
+function resolveAuditPublicKeyFromEnv(auditPublicKey) {
+    if (auditPublicKey) {
+        return auditPublicKey;
+    }
+    const x = process.env.NOTE_AUDIT_PUBLIC_KEY_X?.trim();
+    const y = process.env.NOTE_AUDIT_PUBLIC_KEY_Y?.trim();
+    if (x && y) {
+        return [x, y];
+    }
+    return DEMO_AUDIT_PUBLIC_KEY;
+}
 function resolveTransactionAuditParams(applicationId, auditPublicKey) {
-    return buildUniformAuditParams(applicationId, auditPublicKey ?? DEMO_AUDIT_PUBLIC_KEY);
+    return buildUniformAuditParams(applicationId, resolveAuditPublicKeyFromEnv(auditPublicKey));
 }
 
-/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 9)` in `circuits/main.circom`. */
+/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 12, 6)` in `circuits/main.circom`. */
 const TRANSACTION_TREE_DEPTH = 20;
 const TRANSACTION_N_INS = 2;
 const TRANSACTION_N_OUTS = 2;
-const NOTE_AUDIT_LEN$1 = 9;
+const NOTE_AUDIT_LEN$1 = 12;
 const NOTE_OUTPUT_LEN$1 = 6;
 /** BN254 scalar field modulus (ark `Fr`, circom signals). */
 const BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
@@ -1722,6 +1933,12 @@ function randomFrDecimal253() {
     const hex = generateRandomScalarHex32();
     return BigInt(`0x${normalizeHex$1(hex)}`).toString(10);
 }
+/** Spend-scalar hex in `(0, BabyJub subgroup order)` so dummy withdraws satisfy `LessThan(l)`. */
+function randomCanonicalBabyJubScalarHex() {
+    const hex = generateRandomScalarHex32();
+    const reduced = canonicalBabyJubScalarFromInteger(BigInt(`0x${normalizeHex$1(hex)}`));
+    return reduced.toString(16).padStart(64, '0');
+}
 function zerosTreeSiblings() {
     return Array(TRANSACTION_TREE_DEPTH).fill('0');
 }
@@ -1729,14 +1946,20 @@ function dummyWithdraw(wasm) {
     const nullifier = randomFrDecimal();
     const secretHex = generateRandomScalarHex32();
     const secret = (BigInt(`0x${normalizeHex$1(secretHex)}`) % BN254_SCALAR_MOD).toString(10);
-    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(secretHex);
+    const scalarHex = randomCanonicalBabyJubScalarHex();
+    const privKeyScalar = scalarHexToFrDecimal(scalarHex);
+    const pt = wasm.ecdhEphemeralPublicKeyFromScalarHex(scalarHex);
     return {
         value: '0',
         nullifier,
         secret,
         asset: ['0', '0'],
         applicationId: '0',
-        ephemeralKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        ownerPub: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
         stateSiblings: zerosTreeSiblings(),
         stateIndex: '0',
     };
@@ -1753,6 +1976,8 @@ function dummyDeposit(wasm) {
         asset: ['0', '0'],
         applicationId: '0',
         recipientPublicKeys: [coordHexToDecimal(pt.x), coordHexToDecimal(pt.y)],
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
     };
 }
 function resolveWithdraw(slot, wasm) {
@@ -1777,12 +2002,19 @@ function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, d
         stateRoot: publicParams.stateRoot,
         withdrawAddressHi: publicParams.withdrawAddressHi,
         withdrawAddressLo: publicParams.withdrawAddressLo,
-        privKeyScalar: publicParams.privKeyScalar,
+        escrowRecipientHi: publicParams.escrowRecipientHi ?? '0',
+        escrowRecipientLo: publicParams.escrowRecipientLo ?? '0',
+        sweepOutputOwnerPubX: publicParams.sweepOutputOwnerPubX ?? '0',
+        sweepOutputOwnerPubY: publicParams.sweepOutputOwnerPubY ?? '0',
+        privKeyScalars: [w0.privKeyScalar, w1.privKeyScalar],
+        ownerPubs: [w0.ownerPub, w1.ownerPub],
+        paddingRandoms: [w0.paddingRandom, w1.paddingRandom],
         withdrawnValues: [w0.value, w1.value],
         withdrawnNullifiers: [w0.nullifier, w1.nullifier],
         withdrawnSecrets: [w0.secret, w1.secret],
         withdrawnAssets: [w0.asset, w1.asset],
-        ephemeralKeys: [w0.ephemeralKeys, w1.ephemeralKeys],
+        withdrawnEscrowNonces: [w0.escrowNonce, w1.escrowNonce],
+        inputRecipientStellar: [w0.recipientStellar, w1.recipientStellar],
         stateSiblings: [w0.stateSiblings, w1.stateSiblings],
         stateIndex: [w0.stateIndex, w1.stateIndex],
         depositedValues: [d0.value, d1.value],
@@ -1790,6 +2022,11 @@ function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, d
         depositedAssets: [d0.asset, d1.asset],
         depositedEphemeralKeyScalars: [d0.ephemeralKeyScalar, d1.ephemeralKeyScalar],
         depositedRecipientPublicKeys: [d0.recipientPublicKeys, d1.recipientPublicKeys],
+        depositedEscrowNonces: [d0.escrowNonce ?? '0', d1.escrowNonce ?? '0'],
+        outputRecipientStellar: [
+            d0.recipientStellar ?? ['0', '0'],
+            d1.recipientStellar ?? ['0', '0'],
+        ],
         inputApplicationIds: appIds.inputApplicationIds,
         outputApplicationIds: appIds.outputApplicationIds,
         auditEphemeralScalars: audit.auditEphemeralScalars,
@@ -1805,112 +2042,56 @@ function recipientPublicKeysDecimalFromStealthAddress(stealthAddress) {
     const { x, y } = decodeStealthAddress(stealthAddress);
     return [coordHexToDecimal(x), coordHexToDecimal(y)];
 }
-/** First withdraw leg: Merkle witness + depositor ECDH point coordinates (hex). */
-function withdrawObjectFromMerkleWitness(witness, depositorEphemeralHex, applicationId) {
+/** First withdraw leg: Merkle witness + owner public key (hex) and matching scalar. */
+function withdrawObjectFromMerkleWitness(witness, ownerPubHex, applicationId, privKeyScalar) {
     return {
         value: witness.value,
         nullifier: witness.nullifier,
         secret: witness.secret,
         asset: witness.withdrawnAsset,
         applicationId,
-        ephemeralKeys: [
-            coordHexToDecimal(depositorEphemeralHex.x),
-            coordHexToDecimal(depositorEphemeralHex.y),
-        ],
+        ownerPub: [coordHexToDecimal(ownerPubHex.x), coordHexToDecimal(ownerPubHex.y)],
+        privKeyScalar,
+        paddingRandom: randomFrDecimal(),
+        escrowNonce: '0',
+        recipientStellar: ['0', '0'],
         stateSiblings: witness.stateSiblings,
         stateIndex: witness.stateIndex,
     };
 }
 
-function hexToBytes(hex) {
-    const out = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < out.length; i++) {
-        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-    }
-    return out;
-}
-function bytesToHexLower(bytes) {
-    let s = '';
-    for (let i = 0; i < bytes.length; i++) {
-        s += bytes[i].toString(16).padStart(2, '0');
+/** Stroops amount as a decimal field string. Reject JS `number` so 18-decimal values cannot silently narrow. */
+function coinValueDecimal(amount) {
+    if (typeof amount === 'number') {
+        throw new TypeError('coin value must be bigint or decimal string, not number');
     }
-    return s;
-}
-/** Base64 → bytes via `atob` (browsers; Node 16+). No Node `Buffer`. */
-function decodeBase64ToBytes(s) {
-    const t = s.replace(/\s/g, '');
-    if (typeof atob !== 'function') {
-        throw new Error('Base64 decoding requires atob (browser or Node 16+)');
-    }
-    try {
-        const binary = atob(t);
-        const out = new Uint8Array(binary.length);
-        for (let i = 0; i < binary.length; i++) {
-            out[i] = binary.charCodeAt(i);
+    if (typeof amount === 'bigint') {
+        if (amount < 0n) {
+            throw new RangeError('amount must be a non-negative integer');
         }
-        return out;
-    }
-    catch {
-        throw new Error('Invalid base64 signature');
-    }
-}
-/**
- * Ed25519 signature as **128 hex chars** (optional `0x`) or **base64** (typically 88 chars for 64 bytes, whitespace ignored).
- */
-function parseStellarEd25519SignatureRaw(input) {
-    const trimmed = input.trim();
-    const no0x = trimmed.replace(/^0x/i, '');
-    if (/^[0-9a-fA-F]+$/.test(no0x) && no0x.length === 128) {
-        return hexToBytes(no0x.toLowerCase());
+        return amount.toString(10);
     }
-    const fromB64 = decodeBase64ToBytes(trimmed);
-    if (fromB64.length !== 64) {
-        throw new Error(`Decoded signature must be 64 bytes (Ed25519); got ${fromB64.length} from base64`);
-    }
-    return fromB64;
-}
-/** SHA-256 via Web Crypto only (`crypto.subtle`) — works in browsers and Node 19+ (global `crypto`). */
-async function sha256$1(data) {
-    const subtle = globalThis.crypto?.subtle;
-    if (!subtle) {
-        throw new Error('SHA-256 requires crypto.subtle (HTTPS or localhost in browsers, or Node.js 19+).');
+    if (typeof amount !== 'string') {
+        throw new TypeError('coin value must be bigint or decimal string, not number');
     }
-    const copy = new Uint8Array(data.length);
-    copy.set(data);
-    return new Uint8Array(await subtle.digest('SHA-256', copy));
-}
-/**
- * Stellar Ed25519 signature (hex or base64) → SHA-256(signature bytes) → scalar → WASM ECDH (no UTF-8 seed hash).
- */
-async function stealthAddressFromStellarSignature(ecdhFromScalarHex, encodeStealth, signature) {
-    const raw = parseStellarEd25519SignatureRaw(signature);
-    const scalar = await sha256$1(raw);
-    const scalarHex = bytesToHexLower(scalar);
-    const decoded = ecdhFromScalarHex(scalarHex);
-    return encodeStealth(decoded);
-}
-/**
- * SHA-256(signature) as 32-byte BE integer, truncated to **253 bits** (same effective scalar as
- * `libs/cryptography` `scalar_mul_253` / circom `Num2Bits(253)`), decimal for `privKeyScalar`.
- */
-async function privKeyScalarDecimalFromStellarSignature(signature) {
-    const raw = parseStellarEd25519SignatureRaw(signature);
-    const h = await sha256$1(raw);
-    let v = 0n;
-    for (let i = 0; i < h.length; i++) {
-        v = (v << 8n) + BigInt(h[i]);
+    const trimmed = amount.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+        throw new TypeError('coin value decimal string must be a non-negative integer');
     }
-    const mask = BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE - 1n;
-    return (v & mask).toString(10);
+    return trimmed;
 }
-
-/** Stroops amount as WASM `u64` (`bigint`). */
-function wasmU64Stroops(amount) {
-    const b = typeof amount === 'bigint' ? amount : BigInt(amount);
-    if (b < 0n || b > 0xffffffffffffffffn) {
-        throw new RangeError('amount must be a non-negative u64 (stroops)');
+function generatedCoinFromWasm(value) {
+    const raw = value;
+    const precommitementHex = raw.precommitementHex ?? raw.precommitement_hex;
+    if (!precommitementHex) {
+        throw new Error('generated coin missing precommitement hex');
     }
-    return b;
+    return {
+        coin: raw.coin,
+        commitment_hex: raw.commitment_hex,
+        precommitement_hex: precommitementHex,
+        precommitementHex,
+    };
 }
 class PrivacyPoolSDK {
     constructor(wasm, options) {
@@ -1942,39 +2123,40 @@ class PrivacyPoolSDK {
         return generateRandomScalarHex32();
     }
     /**
-     * Text to sign with a Stellar wallet for stealth derivation (UTF-8). No WASM required.
+     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
+     * The message binds network, pool, registry, and schema version (H6).
      */
-    static buildStealthAddressSignMessage(address, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
-        return buildStealthAddressSignMessage(address, nonce);
+    static buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+        return buildStealthAddressSignMessage(address, domain, nonce);
     }
     /**
-     * Generate a new coin with random nullifier, secret, and random shared-secret field elements (dev / self-contained tests).
-     * @param amount Stroops encoded as `bigint` or integer `number` (WASM `u64`).
+     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
+     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
      * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
      */
     generateCoin(amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoin(wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+        return generatedCoinFromWasm(this.wasm.generateCoin(coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
-     * Generate a coin with the same commitment shape as on-chain deposit: pass `ecdhSharedKey` output (hex x, y).
-     * @param amount Stroops (`bigint` | `number`).
+     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinWithSharedSecret(shared, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinWithSharedSecretHex(shared.x, shared.y, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+    generateCoinWithOwnerPub(ownerPub, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
+        return generatedCoinFromWasm(this.wasm.generateCoinWithOwnerPubHex(ownerPub.x, ownerPub.y, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
      * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
-     * @param amount Stroops (`bigint` | `number`).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
     generateCoinFromDepositEphemeralScalarHex(scalarHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+        return generatedCoinFromWasm(this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
-     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and ECDH shared key from hex coords (e.g. `ecdhSharedKey(scalar, recipient_x, recipient_y)`).
-     * @param amount Stroops (`bigint` | `number`).
+     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinForDepositWithSharedHex(scalarHex, sharedXHex, sharedYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return this.wasm.generateCoinForDepositWithSharedHex(scalarHex, sharedXHex, sharedYHex, wasmU64Stroops(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal);
+    generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
+        return generatedCoinFromWasm(this.wasm.generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
     }
     /**
      * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
@@ -1993,10 +2175,8 @@ class PrivacyPoolSDK {
      */
     async proveWithdrawal(coin, state, params) {
         const witness = this.buildWithdrawMerkleWitness(coin, state);
-        const w0 = withdrawObjectFromMerkleWitness(witness, {
-            x: params.ephemeralXHex,
-            y: params.ephemeralYHex,
-        }, params.applicationId ?? coin.application_id ?? '0');
+        const ownerPubHex = this.ecdhEphemeralPublicKeyFromScalarHex(BigInt(params.privKeyScalar).toString(16).padStart(64, '0'));
+        const w0 = withdrawObjectFromMerkleWitness(witness, ownerPubHex, params.applicationId ?? coin.application_id ?? '0', params.privKeyScalar);
         const fullV = BigInt(coin.value);
         let publicWithdrawals;
         let deposits;
@@ -2082,19 +2262,20 @@ class PrivacyPoolSDK {
         };
     }
     /**
-     * Calculate nullifier hash: Poseidon(nullifier)
+     * Calculate owner-bound nullifier hash: Poseidon(DOM_NULLIFIER, nullifier, privKeyScalar)
      * @param nullifier Nullifier decimal string from coin data
+     * @param privKeyScalar Spend scalar decimal string
      * @returns Hex string (0x...) of the hash bytes
      */
-    calculateNullifierHash(nullifier) {
-        return this.wasm.calculateNullifierHash(nullifier);
+    calculateNullifierHash(nullifier, privKeyScalar) {
+        return this.wasm.calculateNullifierHash(nullifier, privKeyScalar);
     }
     /**
      * Ed25519 signature from signing {@link buildStealthAddressSignMessage}: **128 hex chars** (optional `0x`)
-     * or **base64** (64 raw bytes after decode). `SHA-256(signature bytes)` → scalar → ECDH → `stpl1` Bech32.
+     * or **base64** (64 raw bytes after decode). Domain-separated SHA-256 → scalar → ECDH → `stpl1` Bech32.
      */
-    async generateStealthAddressFromStellarSignature(signature) {
-        return stealthAddressFromStellarSignature((h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h), encodeStealthAddress, signature);
+    async generateStealthAddressFromStellarSignature(signature, domain) {
+        return stealthAddressFromStellarSignature((h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h), encodeStealthAddress, signature, domain);
     }
     encodeDecodedEphemeralKey(decoded) {
         return encodeDecodedEphemeralKey(decoded);
@@ -2121,6 +2302,20 @@ const POOL_MERKLE_TREE_DEPTH = 20;
 /** Default coin value in stroops (1 XLM); matches Rust `coin::COIN_VALUE`. */
 const COIN_VALUE_STROOPS = 1000000000;
 
+// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers
+// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below
+// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).
+const fromNumH = (n) => (n / 2 ** 32) | 0;
+const fromNumL = (n) => n >>> 0;
+// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call
+// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.
+function setU64FromNum(view, byteOffset, n, isLE) {
+    const h = fromNumH(n);
+    const l = fromNumL(n);
+    view.setUint32(byteOffset, isLE ? l : h, isLE);
+    view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+
 /**
  * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
  * @param a - value to test
@@ -2142,6 +2337,9 @@ function isBytes(a) {
             'BYTES_PER_ELEMENT' in a &&
             a.BYTES_PER_ELEMENT === 1));
 }
+// Shared error-message prefix builder. Only called on throw paths, so assert
+// success paths never pay for the string concatenation.
+const atitle = (title) => (title ? `"${title}" ` : '');
 /**
  * Asserts something is Uint8Array.
  * @param value - value to validate
@@ -2157,20 +2355,32 @@ function isBytes(a) {
  * ```
  */
 function abytes(value, length, title = '') {
+    // Success path first: this runs at the start of every update() / digestInto(), and the
+    // common `abytes(data)` form must not pay for length handling it does not use.
+    if (isBytes(value) && (length === undefined))
+        return value;
     const bytes = isBytes(value);
-    const len = value?.length;
-    const needsLen = length !== undefined;
-    if (!bytes || (needsLen)) {
-        const prefix = title && `"${title}" `;
-        const ofLen = '';
-        const got = bytes ? `length=${len}` : `type=${typeof value}`;
-        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
-        if (!bytes)
-            throw new TypeError(message);
-        throw new RangeError(message);
-    }
-    return value;
-}
+    const ofLen = '';
+    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+    const message = atitle(title) + 'expected Uint8Array' + ofLen + ', got ' + got;
+    if (!bytes)
+        throw new TypeError(message);
+    throw new RangeError(message);
+}
+const aobject = (value, label) => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError((label === 'object' ? '' : `"${label}" `) + 'expected object, got type=' + typeof value);
+};
+const aopts = (value, label) => {
+    aobject(value, label);
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        throw new TypeError(`"${label}" expected plain object`);
+    // Object.assign() treats an own "__proto__" source key as a write to the target's legacy
+    // prototype setter. Reject it before merging so inherited option values cannot be injected.
+    if (Object.hasOwn(value, '__proto__'))
+        throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 /**
  * Asserts a hash instance has not been destroyed or finished.
  * @param instance - hash instance to validate
@@ -2186,10 +2396,12 @@ function abytes(value, length, title = '') {
  * ```
  */
 function aexists(instance, checkFinished = true) {
+    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their
+    // truthiness is checked - re-validating their type per call was pure hot-path overhead.
     if (instance.destroyed)
-        throw new Error('Hash instance has been destroyed');
+        throw new Error('hash was destroyed');
     if (checkFinished && instance.finished)
-        throw new Error('Hash#digest() has already been called');
+        throw new Error('digest() was already called');
 }
 /**
  * Asserts output is a sufficiently-sized byte array.
@@ -2208,10 +2420,12 @@ function aexists(instance, checkFinished = true) {
  * ```
  */
 function aoutput(out, instance) {
-    abytes(out, undefined, 'digestInto() output');
+    abytes(out, undefined, 'output');
+    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast
+    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.
     const min = instance.outputLen;
-    if (out.length < min) {
-        throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+    if (!(out.length >= min)) {
+        throw new RangeError('"output" expected length >= ' + min);
     }
 }
 /**
@@ -2286,6 +2500,28 @@ function bytesToHex(bytes) {
     }
     return hex;
 }
+/**
+ * Merges default options and passed options.
+ * @param defaults - base option object
+ * @param opts - user overrides
+ * @param title - label included in thrown override errors
+ * @returns Fresh merged option object with a null prototype.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Merge user overrides onto default options.
+ * ```ts
+ * checkOpts({ dkLen: 32 }, { asyncTick: 10 });
+ * ```
+ */
+function checkOpts(defaults, opts, title = 'opts') {
+    aopts(defaults, 'defaults');
+    if (opts !== undefined)
+        aopts(opts, title);
+    // Callers read optional fields directly, so omitted values must not fall through to ambient
+    // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).
+    const merged = Object.assign(Object.create(null), defaults, opts);
+    return merged;
+}
 /**
  * Creates a callable hash function from a stateful class constructor.
  * @param hashCons - hash constructor or factory
@@ -2294,6 +2530,7 @@ function bytesToHex(bytes) {
  *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
  *   `outputLen` / `blockLen`, so constructor side effects happen at module
  *   init time.
+ * @throws On wrong argument types. {@link TypeError}
  * @example
  * Wrap a stateful hash constructor into a callable helper.
  * ```ts
@@ -2304,6 +2541,9 @@ function bytesToHex(bytes) {
  * ```
  */
 function createHasher(hashCons, info = {}) {
+    if (typeof hashCons !== 'function')
+        throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+    info = checkOpts({}, info, 'info');
     const hashC = (msg, opts) => hashCons(opts)
         .update(msg)
         .digest();
@@ -2415,6 +2655,7 @@ class HashMD {
         abytes(data);
         const { view, buffer, blockLen } = this;
         const len = data.length;
+        let processed = false;
         for (let pos = 0; pos < len;) {
             const take = Math.min(blockLen - this.pos, len - pos);
             // Fast path only when there is no buffered partial block: `take === blockLen` implies
@@ -2423,18 +2664,25 @@ class HashMD {
                 const dataView = createView(data);
                 for (; blockLen <= len - pos; pos += blockLen)
                     this.process(dataView, pos);
+                processed = true;
                 continue;
             }
-            buffer.set(data.subarray(pos, pos + take), this.pos);
+            // When the whole input is buffered in one go (common for short messages), passing `data`
+            // directly avoids allocating a subarray view.
+            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
             this.pos += take;
             pos += take;
             if (this.pos === blockLen) {
                 this.process(view, 0);
                 this.pos = 0;
+                processed = true;
             }
         }
         this.length += data.length;
-        this.roundClean();
+        // Shared schedule buffers only pick up input-derived words inside process(); if everything
+        // was buffered without processing, there is nothing to zero.
+        if (processed)
+            this.roundClean();
         return this;
     }
     digestInto(out) {
@@ -2446,32 +2694,33 @@ class HashMD {
         // was previously not allocated here. But it won't change performance.
         const { buffer, view, blockLen, isLE } = this;
         let { pos } = this;
-        // append the bit '1' to the message
+        // append the bit '1' to the message, then zero-pad the rest of the block
         buffer[pos++] = 0b10000000;
-        clean(this.buffer.subarray(pos));
+        buffer.fill(0, pos);
         // we have less than padOffset left in buffer, so we cannot put length in
         // current block, need process it and pad again
         if (this.padOffset > blockLen - pos) {
             this.process(view, 0);
-            pos = 0;
+            buffer.fill(0);
         }
-        // Pad until full block byte with zeros
-        for (let i = pos; i < blockLen; i++)
-            buffer[i] = 0;
         // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
         // the padding fill above, and JS will overflow before user input can make that half non-zero.
-        // So we only need to write the low 64 bits here.
-        view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+        // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an
+        // integer below 2**53, so the split inside the helper stays exact).
+        setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
         this.process(view, 0);
-        const oview = createView(out);
+        // The final block above is processed outside update(), so the shared message-schedule
+        // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().
+        this.roundClean();
+        // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.
+        const oview = out === buffer ? view : createView(out);
         const len = this.outputLen;
         // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
-        if (len % 4)
-            throw new Error('_sha2: outputLen must be aligned to 32bit');
         const outLen = len / 4;
         const state = this.get();
-        if (outLen > state.length)
-            throw new Error('_sha2: outputLen bigger than state');
+        // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.
+        if (len % 4 || outLen > state.length)
+            throw new Error('invalid outputLen');
         for (let i = 0; i < outLen; i++)
             oview.setUint32(4 * i, state[i], isLE);
     }
@@ -2484,18 +2733,16 @@ class HashMD {
         this.destroy();
         return res;
     }
-    _cloneInto(to) {
-        to ||= new this.constructor();
-        to.set(...this.get());
-        const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    _cloneIntoMeta(to) {
+        const { buffer, length, finished, destroyed, pos } = this;
         to.destroyed = destroyed;
         to.finished = finished;
         to.length = length;
         to.pos = pos;
         // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
         // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
-        if (length % blockLen)
-            to.buffer.set(buffer);
+        if (pos)
+            to.buffer.set(buffer); // Avoid a hot modulo guard.
         return to;
     }
     clone() {
@@ -2539,8 +2786,28 @@ const SHA256_K = /* @__PURE__ */ Uint32Array.from([
 const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
 /** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
 class SHA2_32B extends HashMD {
-    constructor(outputLen) {
+    // We cannot use array here since array allows indexing by variable
+    // which means optimizer/compiler cannot use registers.
+    // Numeric initializers matter: starting the fields as `undefined` changes
+    // V8's field representation and makes sha256 3x slower (measured).
+    A = 0;
+    B = 0;
+    C = 0;
+    D = 0;
+    E = 0;
+    F = 0;
+    G = 0;
+    H = 0;
+    constructor(outputLen, IV) {
         super(64, outputLen, 8, false);
+        this.A = IV[0] | 0;
+        this.B = IV[1] | 0;
+        this.C = IV[2] | 0;
+        this.D = IV[3] | 0;
+        this.E = IV[4] | 0;
+        this.F = IV[5] | 0;
+        this.G = IV[6] | 0;
+        this.H = IV[7] | 0;
     }
     get() {
         const { A, B, C, D, E, F, G, H } = this;
@@ -2557,6 +2824,10 @@ class SHA2_32B extends HashMD {
         this.G = G | 0;
         this.H = H | 0;
     }
+    _cloneInto(to) {
+        (to ||= new this.constructor()).set(...this.get());
+        return this._cloneIntoMeta(to);
+    }
     process(view, offset) {
         // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
         for (let i = 0; i < 16; i++, offset += 4)
@@ -2608,18 +2879,8 @@ class SHA2_32B extends HashMD {
 }
 /** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
 class _SHA256 extends SHA2_32B {
-    // We cannot use array here since array allows indexing by variable
-    // which means optimizer/compiler cannot use registers.
-    A = SHA256_IV[0] | 0;
-    B = SHA256_IV[1] | 0;
-    C = SHA256_IV[2] | 0;
-    D = SHA256_IV[3] | 0;
-    E = SHA256_IV[4] | 0;
-    F = SHA256_IV[5] | 0;
-    G = SHA256_IV[6] | 0;
-    H = SHA256_IV[7] | 0;
     constructor() {
-        super(32);
+        super(32, SHA256_IV);
     }
 }
 /**
@@ -2630,6 +2891,7 @@ class _SHA256 extends SHA2_32B {
  * - Each sha256 hash is executing 2^18 bit operations.
  * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
  * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
  * @returns Digest bytes.
  * @example
  * Hash a message with SHA2-256.
@@ -2640,121 +2902,16 @@ class _SHA256 extends SHA2_32B {
 const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), 
 /* @__PURE__ */ oidNist(0x01));
 
-const ONBOARDING_ZERO_DOMAIN = 'privacy-pool-onboarding-zero-v1';
-function sha256Hex$1(data) {
-    return bytesToHex(sha256(data));
-}
-function appendU8$1(parts, value) {
-    parts.push(Buffer.from([value & 0xff]));
-}
-function appendU32BE$1(parts, value) {
-    const buf = Buffer.alloc(4);
-    buf.writeUInt32BE(value >>> 0);
-    parts.push(buf);
-}
-function appendU128BE$1(parts, value) {
-    const buf = Buffer.alloc(16);
-    buf.writeBigUInt64BE(value >> 64n, 0);
-    buf.writeBigUInt64BE(value & ((1n << 64n) - 1n), 8);
-    parts.push(buf);
-}
-function appendAddressStrkey$1(parts, address) {
-    const bytes = Buffer.from(address.trim(), 'utf8');
-    appendU32BE$1(parts, bytes.length);
-    parts.push(bytes);
-}
-function appendBytes32$1(parts, value) {
-    if (value.length !== 32) {
-        throw new Error(`expected 32-byte field, got ${value.length}`);
-    }
-    parts.push(value);
-}
-function appendBytesBlob(parts, data) {
-    appendU32BE$1(parts, data.length);
-    parts.push(data);
-}
-function encodePlaintextNote(parts, note) {
-    appendU128BE$1(parts, note.value);
-    appendBytes32$1(parts, note.asset_hi);
-    appendBytes32$1(parts, note.asset_lo);
-    appendBytes32$1(parts, note.nullifier);
-    appendBytes32$1(parts, note.secret);
-    if (note.deposited_ephemeral_scalar !== undefined) {
-        appendU8$1(parts, 1);
-        appendBytes32$1(parts, note.deposited_ephemeral_scalar);
-    }
-    else {
-        appendU8$1(parts, 0);
-    }
-}
-function encodeOptionalRegistration(parts, registration) {
-    if (registration.tag === 'None') {
-        appendU8$1(parts, 0);
-        return;
-    }
-    appendU8$1(parts, 1);
-    const reg = registration.values[0];
-    appendAddressStrkey$1(parts, reg.owner);
-    appendBytes32$1(parts, reg.public_key_x);
-    appendBytes32$1(parts, reg.public_key_y);
-}
-/** Canonical `onboardingHash` matching `libs/kyt-passage/src/lib.rs::hash_onboarding`. */
-function hashOnboardingCanonical(onboarding) {
-    if (onboarding === null || onboarding === undefined) {
-        return sha256Hex$1(Buffer.from(ONBOARDING_ZERO_DOMAIN, 'utf8'));
-    }
-    const parts = [];
-    appendAddressStrkey$1(parts, onboarding.owner);
-    appendBytes32$1(parts, onboarding.temp_public_key_x);
-    appendBytes32$1(parts, onboarding.temp_public_key_y);
-    appendBytesBlob(parts, onboarding.encrypted_private_key);
-    appendU32BE$1(parts, onboarding.notes.length);
-    for (const note of onboarding.notes) {
-        encodePlaintextNote(parts, note);
-    }
-    encodeOptionalRegistration(parts, onboarding.private_address_registration);
-    return sha256Hex$1(Buffer.concat(parts));
-}
-function onboardingContractValue(onboarding) {
-    return {
-        owner: onboarding.owner,
-        temp_public_key_x: onboarding.temp_public_key_x,
-        temp_public_key_y: onboarding.temp_public_key_y,
-        encrypted_private_key: onboarding.encrypted_private_key,
-        notes: {
-            notes: onboarding.notes.map((note) => ({
-                value: note.value,
-                asset_hi: note.asset_hi,
-                asset_lo: note.asset_lo,
-                nullifier: note.nullifier,
-                secret: note.secret,
-                deposited_ephemeral_scalar: note.deposited_ephemeral_scalar,
-            })),
-        },
-        private_address_registration: onboarding.private_address_registration,
-    };
-}
-function onboardingToScVal(onboarding) {
-    return nativeToScVal(onboardingContractValue(onboarding));
-}
-function onboardingOptionToScVal(onboarding) {
-    if (onboarding === null || onboarding === undefined) {
-        return xdr.ScVal.scvVoid();
-    }
-    return onboardingToScVal(onboarding);
-}
-function addressToScVal(address) {
-    return nativeToScVal(address, { type: 'address' });
-}
-
 const KYT_PASSAGE_AUTH_DOMAIN = 'privacy-pool-kyt-passage-v1';
 const PUBLIC_LEG_CONTEXT_DOMAIN = 'privacy-pool-public-leg-context-v1';
-const PASSAGE_ID_DOMAIN = 'privacy-pool-passage-id-v1';
-const NOTE_AUDIT_LEN = 9;
-const TOTAL_PUBLIC_SIGNALS = 79;
+const PASSAGE_ID_DOMAIN = 'privacy-pool-passage-id-v2';
+const PASSAGE_ID_DOMAIN_V1 = 'privacy-pool-passage-id-v1';
+const NOTE_AUDIT_LEN = 12;
+const TOTAL_PUBLIC_SIGNALS = 93;
+const NOTE_AUDIT_PLAINTEXT_LEN = 12;
 const FIELD_BYTES = 32;
 const LENGTH_PREFIX_BYTES = 4;
-const STATE_ROOT_SIGNAL_INDEX = 70;
+const STATE_ROOT_SIGNAL_INDEX = 82;
 function sha256Hex(data) {
     return bytesToHex(sha256(data));
 }
@@ -2763,7 +2920,18 @@ function publicSignalsBuffer(publicSignalsBytes) {
         ? Buffer.from(publicSignalsBytes.replace(/^0x/, ''), 'hex')
         : publicSignalsBytes;
 }
-function parsePublicSignalsBytes(publicSignalsBytes) {
+function expectedSignalCountForNonce(zkConfigNonce = 0n) {
+    if (zkConfigNonce !== 0n) {
+        throw new Error(`unknown zk config nonce ${zkConfigNonce.toString()}`);
+    }
+    return TOTAL_PUBLIC_SIGNALS;
+}
+function stateRootIndexForNonce(zkConfigNonce = 0n) {
+    expectedSignalCountForNonce(zkConfigNonce);
+    return STATE_ROOT_SIGNAL_INDEX;
+}
+function parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce = 0n) {
+    const expectedCount = expectedSignalCountForNonce(zkConfigNonce);
     const buf = publicSignalsBuffer(publicSignalsBytes);
     let offset = 0;
     let hasLengthPrefix = false;
@@ -2775,11 +2943,11 @@ function parsePublicSignalsBytes(publicSignalsBytes) {
         }
     }
     const signalBytes = buf.subarray(offset);
-    if (signalBytes.length !== TOTAL_PUBLIC_SIGNALS * FIELD_BYTES) {
-        throw new Error(`expected ${TOTAL_PUBLIC_SIGNALS} public signals`);
+    if (signalBytes.length !== expectedCount * FIELD_BYTES) {
+        throw new Error(`expected ${expectedCount} public signals`);
     }
     return {
-        fields: Array.from({ length: TOTAL_PUBLIC_SIGNALS }, (_, index) => Buffer.from(signalBytes.subarray(index * FIELD_BYTES, (index + 1) * FIELD_BYTES))),
+        fields: Array.from({ length: expectedCount }, (_, index) => Buffer.from(signalBytes.subarray(index * FIELD_BYTES, (index + 1) * FIELD_BYTES))),
         hasLengthPrefix,
     };
 }
@@ -2874,9 +3042,9 @@ function encodeLegSlot(parts, kind, slot, isPresent, assetHi, assetLo, amount, a
         parts.push(zeroAddressBuffer());
     }
 }
-function hashPublicSignalBytes(publicSignalsBytes) {
-    const parsed = parsePublicSignalsBytes(publicSignalsBytes);
-    parsed.fields[STATE_ROOT_SIGNAL_INDEX] = Buffer.alloc(FIELD_BYTES);
+function hashPublicSignalBytes(publicSignalsBytes, zkConfigNonce = 0n) {
+    const parsed = parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce);
+    parsed.fields[stateRootIndexForNonce(zkConfigNonce)] = Buffer.alloc(FIELD_BYTES);
     return sha256Hex(encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix));
 }
 function hashPublicLegContext(layout, input) {
@@ -2898,16 +3066,22 @@ function hashPublicLegContext(layout, input) {
     }
     return sha256Hex(Buffer.concat(parts));
 }
-function hashOnboarding(onboarding) {
-    return hashOnboardingCanonical(onboarding);
-}
-function derivePassageId(owner, nonce, publicSignalHash, publicLegContextHash, onboardingHash) {
+function derivePassageId(owner, nonce, publicSignalHash, publicLegContextHash) {
     const parts = [];
     appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN, 'utf8'));
     appendAddressStrkey(parts, owner);
     appendU64BE(parts, nonce);
     appendBytes32(parts, publicSignalHash);
     appendBytes32(parts, publicLegContextHash);
+    return sha256Hex(Buffer.concat(parts));
+}
+function derivePassageIdV1(owner, nonce, publicSignalHash, publicLegContextHash, onboardingHash) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN_V1, 'utf8'));
+    appendAddressStrkey(parts, owner);
+    appendU64BE(parts, nonce);
+    appendBytes32(parts, publicSignalHash);
+    appendBytes32(parts, publicLegContextHash);
     appendBytes32(parts, onboardingHash);
     return sha256Hex(Buffer.concat(parts));
 }
@@ -2929,15 +3103,13 @@ function buildKytPassageAuthorization(input) {
 }
 function derivePassageFromTransactContext(input) {
     const layout = input.layout ?? { publicNInputs: 1, publicNOutputs: 1 };
-    const nonce = input.nonce ?? 0n;
-    const publicSignalHash = hashPublicSignalBytes(input.publicSignalsBytes);
+    const nonce = BigInt(input.nonce ?? 0);
+    const publicSignalHash = hashPublicSignalBytes(input.publicSignalsBytes, nonce);
     const publicLegContextHash = hashPublicLegContext(layout, input.publicLegContext);
-    const onboardingHash = hashOnboarding(input.onboarding ?? null);
-    const passageId = derivePassageId(input.owner, nonce, publicSignalHash, publicLegContextHash, onboardingHash);
+    const passageId = derivePassageId(input.owner, nonce, publicSignalHash, publicLegContextHash);
     return {
         publicSignalHash,
         publicLegContextHash,
-        onboardingHash,
         passageId,
     };
 }
@@ -2968,14 +3140,16 @@ var kytPassage = /*#__PURE__*/Object.freeze({
     __proto__: null,
     KYT_PASSAGE_AUTH_DOMAIN: KYT_PASSAGE_AUTH_DOMAIN,
     NOTE_AUDIT_LEN: NOTE_AUDIT_LEN,
+    NOTE_AUDIT_PLAINTEXT_LEN: NOTE_AUDIT_PLAINTEXT_LEN,
     PASSAGE_ID_DOMAIN: PASSAGE_ID_DOMAIN,
+    PASSAGE_ID_DOMAIN_V1: PASSAGE_ID_DOMAIN_V1,
     PUBLIC_LEG_CONTEXT_DOMAIN: PUBLIC_LEG_CONTEXT_DOMAIN,
     TOTAL_PUBLIC_SIGNALS: TOTAL_PUBLIC_SIGNALS,
     addressToCanonicalXdr: addressToCanonicalXdr,
     buildKytPassageAuthorization: buildKytPassageAuthorization,
     derivePassageFromTransactContext: derivePassageFromTransactContext,
     derivePassageId: derivePassageId,
-    hashOnboarding: hashOnboarding,
+    derivePassageIdV1: derivePassageIdV1,
     hashPublicLegContext: hashPublicLegContext,
     hashPublicSignalBytes: hashPublicSignalBytes,
     inspectKytPassage: inspectKytPassage,
@@ -2983,6 +3157,9 @@ var kytPassage = /*#__PURE__*/Object.freeze({
     zeroAddressSentinelBuffer: zeroAddressSentinelBuffer
 });
 
+function addressToScVal(address) {
+    return nativeToScVal(address, { type: 'address' });
+}
 function passageIdHexToScVal(passageIdHex) {
     const bytes = Buffer.from(passageIdHex.replace(/^0x/, ''), 'hex');
     return xdr.ScVal.scvBytes(bytes);
@@ -3019,7 +3196,6 @@ function poolTransactOperation(params) {
             nativeToScVal(params.nonce, { type: 'u64' }),
             xdr.ScVal.scvBytes(params.proofBytes),
             xdr.ScVal.scvBytes(params.publicSignalsBytes),
-            onboardingOptionToScVal(params.onboarding),
             kytAuthorizationOptionToScVal(params.kytAuthorization),
         ],
     });
@@ -3033,7 +3209,6 @@ function helperSubmitWithPassageOperation(helperContractId, params, passageId, e
             nativeToScVal(params.nonce, { type: 'u64' }),
             xdr.ScVal.scvBytes(params.proofBytes),
             xdr.ScVal.scvBytes(params.publicSignalsBytes),
-            onboardingOptionToScVal(params.onboarding),
             passageIdHexToScVal(passageId),
             xdr.ScVal.scvU32(expiresAtLedger),
             signatureToScVal(signatureBase64ToBytes(signature)),
@@ -3166,7 +3341,6 @@ async function registerKytPassage(params) {
         nonce: params.nonce,
         publicSignalsBytes: params.publicSignalsBytes,
         publicLegContext: params.publicLegContext,
-        onboarding: params.onboarding,
     });
     await submitTransaction({
         source: params.source,
@@ -3216,7 +3390,6 @@ async function submitWithKytPassage(params) {
         nonce: params.nonce,
         publicSignalsBytes: params.publicSignalsBytes,
         publicLegContext: params.publicLegContext,
-        onboarding: params.onboarding,
     });
     if (approved.passageId.replace(/^0x/, '') !== derivation.passageId) {
         throw new Error('KYT approval passageId does not match local transaction context');
@@ -3231,7 +3404,6 @@ async function submitWithKytPassage(params) {
             nonce: params.nonce,
             proofBytes: params.proofBytes,
             publicSignalsBytes: params.publicSignalsBytes,
-            onboarding: params.onboarding,
             kytSubmitHelperId: params.kytSubmitHelperId,
             passageId: derivation.passageId,
             expiresAtLedger: approved.expiresAtLedger,
@@ -3255,6 +3427,44 @@ function localSignKytPassageAuthorization(secretSeed, authorization) {
     return sig.toString('base64');
 }
 
+const SCALAR_HEX_LENGTH = 64;
+const OUT_OF_RANGE_MESSAGE = 'derived escrow hash is outside BabyJub subgroup; retry nonce';
+function hexFromCanonicalScalar(value) {
+    return value.toString(16).padStart(SCALAR_HEX_LENGTH, '0');
+}
+function assertCanonicalBabyJubScalar(scalar) {
+    if (!(scalar > 0n && scalar < BABYJUB_SUBGROUP_ORDER)) {
+        throw new Error(OUT_OF_RANGE_MESSAGE);
+    }
+}
+async function derivedEscrowKey(nonce, recipientHi, recipientLo) {
+    const wasm = await loadWasm();
+    const out = wasm.derivedEscrowKey(nonce.toString(), recipientHi.toString(), recipientLo.toString());
+    const scalar = BigInt(`0x${out.scalarHex}`);
+    assertCanonicalBabyJubScalar(scalar);
+    return {
+        scalarHex: hexFromCanonicalScalar(scalar),
+        pointXHex: out.pointXHex,
+        pointYHex: out.pointYHex,
+    };
+}
+async function sampleDerivedEscrowKey(recipientHi, recipientLo, startNonce = 1n, window = 1024n) {
+    for (let offset = 0n; offset < window; offset += 1n) {
+        const nonce = startNonce + offset;
+        try {
+            const key = await derivedEscrowKey(nonce, recipientHi, recipientLo);
+            return { nonce, key };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!message.includes('outside BabyJub subgroup')) {
+                throw error;
+            }
+        }
+    }
+    throw new Error(OUT_OF_RANGE_MESSAGE);
+}
+
 const NOTE_OUTPUT_LEN = 6;
 const OUTPUT_NOTE_TAG_DOMAIN = 3n;
 const STREAM_DOMAIN = 1n;
@@ -3312,6 +3522,9 @@ function mimcHash(parameters) {
 function poseidonHash(poseidon, inputs) {
     return fieldBigint(poseidon.F, poseidon(inputs.map((input) => poseidon.F.e(input))));
 }
+function deriveEncCipherKey(poseidon, sharedX) {
+    return poseidonHash(poseidon, [DOM_ENC, sharedX]);
+}
 function sharedKeyFromDepositor(parameters) {
     const scalarHex = frDecimalToHex(parameters.ephemeralKeyScalarDecimal);
     const shared = parameters.ecdhShared(scalarHex, frDecimalToHex(parameters.recipientPublicKey[0]), frDecimalToHex(parameters.recipientPublicKey[1]));
@@ -3413,12 +3626,14 @@ async function encryptOutputNoteForDeposit(parameters) {
         secret,
         applicationId: parameters.deposit.applicationId,
     };
-    const [key, nonce] = sharedKeyFromDepositor({
+    const [sharedX, sharedY] = sharedKeyFromDepositor({
         babyJub,
         ecdhShared: parameters.ecdhShared,
         ephemeralKeyScalarDecimal: parameters.deposit.ephemeralKeyScalar,
         recipientPublicKey: parameters.deposit.recipientPublicKeys,
     });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
     const message = plaintextBigints(plaintext);
     const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
     const tag = outputNoteTag({ mimc7, poseidon, key, nonce, plaintext: message });
@@ -3427,13 +3642,22 @@ async function encryptOutputNoteForDeposit(parameters) {
         tag: frDecimalFromBigint(tag),
     };
 }
-function commitmentFromPlaintextAndSharedSecret(parameters) {
-    const sharedX = bigintFromHex(parameters.sharedSecret.x);
-    const sharedY = bigintFromHex(parameters.sharedSecret.y);
+function ownerPubFromRecipientScalar(babyJub, recipientScalarHex) {
+    const product = babyJub.mulPointEscalar(babyJub.Base8, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
+    return [
+        fieldBigint(babyJub.F, product[0]),
+        fieldBigint(babyJub.F, product[1]),
+    ];
+}
+function commitmentFromPlaintextAndOwnerPub(parameters) {
+    const ownerKeyHash = poseidonHash(parameters.poseidon, [
+        parameters.ownerPub[0],
+        parameters.ownerPub[1],
+    ]);
     const precommitment = poseidonHash(parameters.poseidon, [
         bigintFromDecimal(parameters.plaintext.secret),
-        sharedX,
-        sharedY,
+        parameters.ownerMode,
+        ownerKeyHash,
     ]);
     const balance = poseidonHash(parameters.poseidon, [
         bigintFromDecimal(parameters.plaintext.value),
@@ -3453,11 +3677,13 @@ function commitmentFromPlaintextAndSharedSecret(parameters) {
 }
 async function decryptOutputNoteEvent(input) {
     const { babyJub, mimc7, poseidon } = await primitives();
-    const [key, nonce] = sharedKeyFromRecipient({
+    const [sharedX, sharedY] = sharedKeyFromRecipient({
         babyJub,
         recipientScalarHex: input.recipientScalarHex,
         ephemeralPublicKey: input.createdEphemeralKey,
     });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
     const decrypted = decryptFields({
         mimc7,
         poseidon,
@@ -3476,14 +3702,11 @@ async function decryptOutputNoteEvent(input) {
         throw new Error('Output note tag verification failed');
     }
     const plaintext = plaintextFromBigints(decrypted);
-    const sharedSecret = {
-        x: bigintToFrHex(key),
-        y: bigintToFrHex(nonce),
-    };
-    const commitmentHex = commitmentFromPlaintextAndSharedSecret({
+    const commitmentHex = commitmentFromPlaintextAndOwnerPub({
         poseidon,
         plaintext,
-        sharedSecret,
+        ownerPub: ownerPubFromRecipientScalar(babyJub, input.recipientScalarHex),
+        ownerMode: input.ownerMode ?? 0n,
     });
     const commitmentMatches = normalizeHex(input.commitmentHashHex) === commitmentHex;
     if (!commitmentMatches) {
@@ -3496,5 +3719,5 @@ async function decryptOutputNoteEvent(input) {
     };
 }
 
-export { BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE, BN254_SCALAR_MOD, COIN_VALUE_STROOPS, DECODED_EPHEMERAL_HRP, DEFAULT_APPLICATION_ID, DEFAULT_STEALTH_SIGN_NONCE, DEMO_AUDIT_PUBLIC_KEY, DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, NOTE_AUDIT_LEN as KYT_NOTE_AUDIT_LEN, NOTE_AUDIT_LEN$1 as NOTE_AUDIT_LEN, NOTE_OUTPUT_LEN$1 as NOTE_OUTPUT_LEN, NOTE_OUTPUT_LEN as OUTPUT_NOTE_LEN, POOL_MERKLE_TREE_DEPTH, PrivacyPoolSDK, STEALTH_ADDRESS_HRP, TOTAL_PUBLIC_SIGNALS, TRANSACTION_N_AUDIT_SLOTS, TRANSACTION_N_INS, TRANSACTION_N_OUTS, TRANSACTION_TREE_DEPTH, addressToCanonicalXdr, buildKytPassageAuthorization, buildStealthAddressSignMessage, buildTransactionWitnessInput, buildUniformAuditParams, coordHexToDecimal, decodeDecodedEphemeralKey, decodeDepositorSharedSecretPreimage, decodeStealthAddress, decryptOutputNoteEvent, derivePassageFromTransactContext, derivePassageId, ed25519PubkeyPayloadHexToWithdrawFrDecimals, encodeDecodedEphemeralKey, encodeDepositorSharedSecretPreimage, encodeStealthAddress, encryptOutputNoteForDeposit, generateRandomScalarHex32, hashOnboarding, hashOnboardingCanonical, hashPublicLegContext, hashPublicSignalBytes, inspectKytPassage, localSignKytPassageAuthorization, onboardingOptionToScVal, onboardingToScVal, planKytSubmit, privKeyScalarDecimalFromStellarSignature, randomFrDecimal, randomFrDecimal253, recipientPublicKeysDecimalFromStealthAddress, registerKytPassage, resolveDepositsForWitness, resolveSlotApplicationIds, resolveTransactionAuditParams, scalarHexToFrDecimal, sharedSecretFromDepositorPreimage, sharedSecretFromRecipientPreimage, stellarContractAddressToAssetFrDecimals, submitApprovedKytPassage, submitPoolTransact, submitWithKytPassage, withApplicationIdOnDeposit, withApplicationIdOnWithdraw, withdrawObjectFromMerkleWitness, zeroAddressSentinelBuffer };
+export { BABYJUB_SUBGROUP_ORDER, BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE, BN254_SCALAR_MOD, COIN_VALUE_STROOPS, DECODED_EPHEMERAL_HRP, DEFAULT_APPLICATION_ID, DEFAULT_STEALTH_SIGN_NONCE, DEMO_AUDIT_PUBLIC_KEY, DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, DOM_ENC, DOM_ESCROW, DOM_NULLIFIER, DOM_PADDING, NOTE_AUDIT_LEN as KYT_NOTE_AUDIT_LEN, NOTE_AUDIT_LEN$1 as NOTE_AUDIT_LEN, NOTE_AUDIT_PLAINTEXT_LEN, NOTE_OUTPUT_LEN$1 as NOTE_OUTPUT_LEN, NOTE_OUTPUT_LEN as OUTPUT_NOTE_LEN, OWNER_BOUND_NOTE_SCHEMA_VERSION, POOL_MERKLE_TREE_DEPTH, PrivacyPoolSDK, SPEND_SCALAR_DOMAIN_TAG, STEALTH_ADDRESS_HRP, TOTAL_PUBLIC_SIGNALS, TRANSACTION_N_AUDIT_SLOTS, TRANSACTION_N_INS, TRANSACTION_N_OUTS, TRANSACTION_TREE_DEPTH, addressToCanonicalXdr, buildKytPassageAuthorization, buildStealthAddressSignMessage, buildTransactionWitnessInput, buildUniformAuditParams, canonicalBabyJubScalarFromInteger, coordHexToDecimal, decodeDecodedEphemeralKey, decodeDepositorSharedSecretPreimage, decodeStealthAddress, decryptOutputNoteEvent, derivePassageFromTransactContext, derivePassageId, derivePassageIdV1, derivedEscrowKey, ed25519PubkeyPayloadHexToWithdrawFrDecimals, encodeDecodedEphemeralKey, encodeDepositorSharedSecretPreimage, encodeStealthAddress, encryptOutputNoteForDeposit, generateRandomScalarHex32, generateWitness, hashPublicLegContext, hashPublicSignalBytes, inspectKytPassage, localSignKytPassageAuthorization, planKytSubmit, privKeyScalarDecimalFromStellarSignature, randomFrDecimal, randomFrDecimal253, recipientPublicKeysDecimalFromStealthAddress, registerKytPassage, resolveAuditPublicKeyFromEnv, resolveDepositsForWitness, resolveSlotApplicationIds, resolveSpendScalarSchemaVersion, resolveTransactionAuditParams, sampleDerivedEscrowKey, scalarHexToFrDecimal, secretFromDepositEphemeralScalarDecimal, sharedSecretFromDepositorPreimage, sharedSecretFromRecipientPreimage, spendScalarHexFromStellarSignature, stellarContractAddressToAssetFrDecimals, submitApprovedKytPassage, submitPoolTransact, submitWithKytPassage, withApplicationIdOnDeposit, withApplicationIdOnWithdraw, withdrawObjectFromMerkleWitness, zeroAddressSentinelBuffer };
 //# sourceMappingURL=index.mjs.map