@auditable/privacy-pool-zk-sdk 0.7.0 → 0.9.1-rc.0

package/dist/kyt-flow.d.ts

@@ -1,14 +1,13 @@
 import { Keypair } from '@stellar/stellar-sdk';
 import { buildKytPassageAuthorization, derivePassageFromTransactContext, hashPublicSignalBytes, type InspectKytPassageRequest, type PublicLegContextInput } from './kyt-passage.js';
-import { type OnboardingPayloadInput } from './kyt-onboarding.js';
 export interface RegisterPassageParams {
     kytRegistryId: string;
     poolContract: string;
     owner: string;
     nonce?: bigint | number;
     publicSignalsBytes: Buffer | string;
+    ciphertextBytes?: Buffer | string;
     publicLegContext: PublicLegContextInput;
-    onboarding?: OnboardingPayloadInput | null;
     signature: string;
     expiresAtLedger: number;
     source: Keypair;
@@ -21,7 +20,7 @@ export interface SubmitKytTransactParams {
     nonce: bigint | number;
     proofBytes: Buffer;
     publicSignalsBytes: Buffer;
-    onboarding?: OnboardingPayloadInput | null;
+    ciphertextBytes?: Buffer;
     /** Omit when the pool's own registered passage covers this call (no explicit signed authorization). */
     kytAuthorization?: {
         expirationLedger: number;

package/dist/kyt-passage.d.ts

@@ -1,10 +1,11 @@
-import { type OnboardingPayloadInput } from './kyt-onboarding.js';
 export declare const KYT_PASSAGE_AUTH_DOMAIN = "privacy-pool-kyt-passage-v1";
 export declare const PUBLIC_LEG_CONTEXT_DOMAIN = "privacy-pool-public-leg-context-v1";
-export declare const PASSAGE_ID_DOMAIN = "privacy-pool-passage-id-v1";
-export declare const ONBOARDING_ZERO_DOMAIN = "privacy-pool-onboarding-zero-v1";
-export declare const NOTE_AUDIT_LEN = 9;
-export declare const TOTAL_PUBLIC_SIGNALS = 79;
+export declare const PASSAGE_ID_DOMAIN = "privacy-pool-passage-id-v3";
+export declare const PASSAGE_ID_DOMAIN_V2 = "privacy-pool-passage-id-v2";
+export declare const PASSAGE_ID_DOMAIN_V1 = "privacy-pool-passage-id-v1";
+export declare const NOTE_AUDIT_LEN = 12;
+export declare const TOTAL_PUBLIC_SIGNALS = 93;
+export declare const NOTE_AUDIT_PLAINTEXT_LEN = 12;
 export interface PublicLegLayout {
     publicNInputs: number;
     publicNOutputs: number;
@@ -20,7 +21,6 @@ export interface PublicLegContextInput {
 export interface KytPassageDerivation {
     publicSignalHash: string;
     publicLegContextHash: string;
-    onboardingHash: string;
     passageId: string;
 }
 export interface KytPassageAuthorization {
@@ -33,10 +33,11 @@ export interface KytPassageAuthorization {
 /** Canonical zero-address sentinel for absent public-leg slots: `u32_be(0)` with no XDR bytes. */
 export declare function zeroAddressSentinelBuffer(): Buffer;
 export declare function addressToCanonicalXdr(address: string): Buffer;
-export declare function hashPublicSignalBytes(publicSignalsBytes: Buffer | string): string;
+export declare function hashPublicSignalBytes(publicSignalsBytes: Buffer | string, zkConfigNonce?: bigint): string;
 export declare function hashPublicLegContext(layout: PublicLegLayout, input: PublicLegContextInput): string;
-export declare function hashOnboarding(onboarding: OnboardingPayloadInput | null | undefined): string;
-export declare function derivePassageId(owner: string, nonce: bigint | number, publicSignalHash: string, publicLegContextHash: string, onboardingHash: string): string;
+export declare function derivePassageId(owner: string, nonce: bigint | number, publicSignalHash: string, publicLegContextHash: string, ciphertextHash: string): string;
+export declare function derivePassageIdV2(owner: string, nonce: bigint | number, publicSignalHash: string, publicLegContextHash: string): string;
+export declare function derivePassageIdV1(owner: string, nonce: bigint | number, publicSignalHash: string, publicLegContextHash: string, onboardingHash: string): string;
 export declare function buildKytPassageAuthorization(input: {
     poolContract: string;
     kytRegistry: string;
@@ -47,10 +48,18 @@ export declare function derivePassageFromTransactContext(input: {
     owner: string;
     nonce?: bigint | number;
     publicSignalsBytes: Buffer | string;
+    ciphertextBytes?: Buffer | string;
     publicLegContext: PublicLegContextInput;
     layout?: PublicLegLayout;
-    onboarding?: OnboardingPayloadInput | null;
 }): KytPassageDerivation;
+export declare function hashCiphertextBytes(ciphertextBytes: Buffer | string): string;
+export declare function zeroBindingTagsInPublicSignals(publicSignalsBytes: Buffer | string, zkConfigNonce?: bigint): Buffer;
+export declare function spliceBindingTagsIntoPublicSignals(parameters: {
+    publicSignalsBytes: Buffer | string;
+    zkConfigNonce: bigint;
+    auditTags: readonly string[];
+    outputNoteTags: readonly string[];
+}): Buffer;
 export declare function accountIdFromAddress(address: string): Buffer;
 export interface InspectKytPassageRequest {
     owner: string;
@@ -58,9 +67,11 @@ export interface InspectKytPassageRequest {
     kytRegistry: string;
     proofBytes: string;
     publicSignalsBytes: string;
-    applicationIdsPlaintext: [string, string, string, string];
-    onboarding?: OnboardingPayloadInput | null;
+    applicationIdsPlaintext: string[];
+    ciphertextBytes?: string;
+    outputNoteEphemeralScalars?: string[];
     nonce?: string;
+    zkConfigNonce?: string;
 }
 export interface InspectKytPassageApproved {
     status: 'approved';

package/dist/output-note-encryption.d.ts

@@ -1,9 +1,12 @@
-import type { DepositObject } from './withdrawal-transaction-input.js';
+import { buildPoseidon } from 'circomlibjs';
+import type { DepositObject, TransactionWitnessInput } from './withdrawal-transaction-input.js';
 import type { EcdhSharedKeyFn } from './shared-secret.js';
+import type { ZkLayoutParams } from './zk-layout.js';
 export declare const NOTE_OUTPUT_LEN = 6;
-export declare const OUTPUT_NOTE_TAG_DOMAIN = 3n;
+export declare const NOTE_AUDIT_LEN = 12;
 export declare const STREAM_DOMAIN = 1n;
 export declare const FR_SIZE = 32;
+type Poseidon = Awaited<ReturnType<typeof buildPoseidon>>;
 export type OutputNotePlaintext = {
     value: string;
     assetHi: string;
@@ -26,7 +29,15 @@ export type OutputNoteEventInput = {
     createdEphemeralKey: readonly [string, string];
     ciphertext: readonly string[];
     tag: string;
+    ownerMode?: bigint;
 };
+export declare function poseidonMacTag(parameters: {
+    poseidon: Poseidon;
+    domain: bigint;
+    key: bigint;
+    nonce: bigint;
+    message: readonly bigint[];
+}): bigint;
 export declare function secretFromDepositEphemeralScalarDecimal(ephemeralKeyScalarDecimal: string): Promise<string>;
 export declare function encryptOutputNoteForDeposit(parameters: {
     deposit: DepositObject;
@@ -40,3 +51,22 @@ export declare function buildOutputNoteEncryptionPublicInputs(parameters: {
     outputNoteTags: [string, string];
 }>;
 export declare function decryptOutputNoteEvent(input: OutputNoteEventInput): Promise<DecryptedOutputNote>;
+export declare function encryptNoteAuditSlot(parameters: {
+    auditPublicKey: readonly [string, string];
+    auditEphemeralScalar: string;
+    plaintext: readonly string[];
+    ecdhShared: EcdhSharedKeyFn;
+}): Promise<{
+    ciphertext: string[];
+    tag: string;
+}>;
+export declare function encryptTransactionCiphertextBlob(parameters: {
+    witness: TransactionWitnessInput;
+    layout: ZkLayoutParams;
+    ecdhShared: EcdhSharedKeyFn;
+}): Promise<{
+    ciphertextHex: string;
+    auditCiphertexts: string[][];
+    outputNoteCiphertexts: string[][];
+}>;
+export {};

package/dist/prover.d.ts

@@ -1,5 +1,5 @@
-export interface ProofResult {
+/** @deprecated Groth16 proving is in the main SDK WASM (`proveGroth16`). */
+export declare function generateProof(_wtns: Uint8Array, _zkey?: BufferSource, _zkeyFileName?: string): Promise<{
     proof: object;
     publicSignals: string[];
-}
-export declare function generateProof(wtns: Uint8Array, zkey?: BufferSource): Promise<ProofResult>;
+}>;

package/dist/sdk.d.ts

@@ -1,23 +1,31 @@
-import { type DecodedDepositorSharedSecretPreimage, type DecodedEphemeralKey, type EncodedDepositorSharedSecretPreimage, type EncodedEphemeralKey } from './ephemeral-key';
-import { type SharedSecret } from './shared-secret';
-import type { DecodedRecipientSharedSecretPreimage } from './stealth-address';
-import type { CoinData, GeneratedCoin, SDKOptions, StateFile, WithdrawMerkleWitness, WithdrawResult } from './types';
-import { type DepositSlot, type TransactionPublicLegParams, type WithdrawalProofPublicParams, type WithdrawSlot } from './withdrawal-transaction-input';
-import { type TransactionAuditParams } from './transaction-audit';
+import type { CoinData, GeneratedCoin, SDKOptions, StateFile, WithdrawMerkleWitness, WithdrawResult } from "./types";
+import { type DecodedDepositorSharedSecretPreimage, type DecodedEphemeralKey, type EncodedDepositorSharedSecretPreimage, type EncodedEphemeralKey } from "./ephemeral-key";
+import { type SharedSecret } from "./shared-secret";
+import { type SpendScalarDomain } from "./stealth-sign-message";
+import type { DecodedRecipientSharedSecretPreimage } from "./stealth-address";
+import { type DepositSlot, type TransactionPublicLegParams, type WithdrawalProofPublicParams, type WithdrawSlot } from "./withdrawal-transaction-input";
+import { type TransactionAuditParams } from "./transaction-audit";
+import { type ZkLayoutParams } from "./zk-layout";
 export declare class PrivacyPoolSDK {
     private wasm;
     private options;
+    private zkConfigNonce;
+    private circuitConfig;
+    private layout;
+    private circuitArtifacts;
     private constructor();
+    getZkConfigNonce(): bigint;
+    getLayout(): ZkLayoutParams;
     /**
      * Initialize the SDK by loading WASM modules.
      *
-     * In Node.js, assets are loaded from the filesystem automatically.
-     * In browser, pass pre-loaded buffers via options:
+     * In Node.js, proving artifacts load from `zkArtifactBaseUrl` or
+     * `ZK_ARTIFACT_BASE_URL`, defaulting to this package's GitHub release.
+     * In browser, pass pre-loaded WASM via options:
      * ```ts
      * const sdk = await PrivacyPoolSDK.init({
      *   wasmBinary: await fetch('/pkg/client_sdk_wasm_bg.wasm').then(r => r.arrayBuffer()),
-     *   circuitWasm: await fetch('/assets/main.wasm').then(r => r.arrayBuffer()),
-     *   zkey: await fetch('/assets/main_final.zkey').then(r => r.arrayBuffer()),
+     *   zkArtifactBaseUrl: 'https://github.com/Polynom-Labs/stellar-privacy-layer-contracts/releases/download/v0.8.0',
      * });
      * ```
      */
@@ -27,30 +35,34 @@ export declare class PrivacyPoolSDK {
      */
     static generateRandomScalarHex32(): string;
     /**
-     * Text to sign with a Stellar wallet for stealth derivation (UTF-8). No WASM required.
+     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
+     * The message binds network, pool, registry, and schema version (H6).
      */
-    static buildStealthAddressSignMessage(address: string, nonce?: string): string;
+    static buildStealthAddressSignMessage(address: string, domain: SpendScalarDomain, nonce?: string): string;
     /**
-     * Generate a new coin with random nullifier, secret, and random shared-secret field elements (dev / self-contained tests).
-     * @param amount Stroops encoded as `bigint` or integer `number` (WASM `u64`).
+     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
+     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
      * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
      */
-    generateCoin(amount: bigint | number, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
+    generateCoin(amount: bigint | string, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
     /**
-     * Generate a coin with the same commitment shape as on-chain deposit: pass `ecdhSharedKey` output (hex x, y).
-     * @param amount Stroops (`bigint` | `number`).
+     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinWithSharedSecret(shared: SharedSecret, amount: bigint | number, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
+    generateCoinWithOwnerPub(ownerPub: {
+        x: string;
+        y: string;
+    }, amount: bigint | string, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
     /**
      * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
-     * @param amount Stroops (`bigint` | `number`).
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinFromDepositEphemeralScalarHex(scalarHex: string, amount: bigint | number, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
+    generateCoinFromDepositEphemeralScalarHex(scalarHex: string, amount: bigint | string, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
     /**
-     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and ECDH shared key from hex coords (e.g. `ecdhSharedKey(scalar, recipient_x, recipient_y)`).
-     * @param amount Stroops (`bigint` | `number`).
+     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
+     * @param amount Decimal field element (`bigint` | `string`).
      */
-    generateCoinForDepositWithSharedHex(scalarHex: string, sharedXHex: string, sharedYHex: string, amount: bigint | number, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
+    generateCoinForDepositWithOwnerPubHex(scalarHex: string, ownerXHex: string, ownerYHex: string, amount: bigint | string, assetHiDecimal: string, assetLoDecimal: string, applicationIdDecimal?: string): GeneratedCoin;
     /**
      * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
      */
@@ -92,25 +104,23 @@ export declare class PrivacyPoolSDK {
     /** Circuit `ECDH`: scalar (32-byte hex) × recipient BabyJub point → shared key hex coords. */
     ecdhSharedKey(scalarHex: string, recipientPubXHex: string, recipientPubYHex: string): SharedSecret;
     /**
-     * `Transaction(20,2,2)` proof from high-level legs: maps to witness input (incl. `"dummy"` ECDH via WASM), then Groth16 → Soroban hex.
-     *
-     * @param publicParams Public inputs: `stateRoot`, `withdrawAddressHi` / `withdrawAddressLo`, `privKeyScalar` (decimal field strings).
-     * @param publicLegs Public token legs (`publicWithdrawnAssets`, `publicDepositedAssets`, `publicDeposits`, `publicWithdrawals`).
-     * @param withdraws Exactly two withdraw slots (`WithdrawObject` or `"dummy"`).
-     * @param deposits Exactly two deposit slots (`DepositObject` or `"dummy"`).
+     * `Transaction(20,nIns,nOuts)` proof from high-level legs: maps to witness input (incl. `"dummy"` ECDH via WASM), then Groth16 → Soroban hex.
+     * Slots are padded to the selected ZK config layout (bundled 2×2 or 6×6).
      */
-    proveTransaction(publicParams: WithdrawalProofPublicParams, publicLegs: TransactionPublicLegParams, withdraws: [WithdrawSlot, WithdrawSlot], deposits: [DepositSlot, DepositSlot], audit: TransactionAuditParams): Promise<WithdrawResult>;
+    proveTransaction(publicParams: WithdrawalProofPublicParams, publicLegs: TransactionPublicLegParams, withdraws: WithdrawSlot[], deposits: DepositSlot[], audit: TransactionAuditParams): Promise<WithdrawResult>;
+    proveTransactionSlots(publicParams: WithdrawalProofPublicParams, publicLegs: TransactionPublicLegParams, withdraws: WithdrawSlot[], deposits: DepositSlot[], audit: TransactionAuditParams): Promise<WithdrawResult>;
     /**
-     * Calculate nullifier hash: Poseidon(nullifier)
+     * Calculate owner-bound nullifier hash: Poseidon(DOM_NULLIFIER, nullifier, privKeyScalar)
      * @param nullifier Nullifier decimal string from coin data
+     * @param privKeyScalar Spend scalar decimal string
      * @returns Hex string (0x...) of the hash bytes
      */
-    calculateNullifierHash(nullifier: string): string;
+    calculateNullifierHash(nullifier: string, privKeyScalar: string): string;
     /**
      * Ed25519 signature from signing {@link buildStealthAddressSignMessage}: **128 hex chars** (optional `0x`)
-     * or **base64** (64 raw bytes after decode). `SHA-256(signature bytes)` → scalar → ECDH → `stpl1` Bech32.
+     * or **base64** (64 raw bytes after decode). Domain-separated SHA-256 → scalar → ECDH → `stpl1` Bech32.
      */
-    generateStealthAddressFromStellarSignature(signature: string): Promise<string>;
+    generateStealthAddressFromStellarSignature(signature: string, domain: SpendScalarDomain): Promise<string>;
     encodeDecodedEphemeralKey(decoded: DecodedEphemeralKey): EncodedEphemeralKey;
     decodeDecodedEphemeralKey(encoded: EncodedEphemeralKey): DecodedEphemeralKey;
     encodeDepositorSharedSecretPreimage(decoded: DecodedDepositorSharedSecretPreimage): EncodedDepositorSharedSecretPreimage;

package/dist/stealth-sign-message.d.ts

@@ -1,7 +1,20 @@
 /** Default nonce when deriving the wallet sign-in message. */
 export declare const DEFAULT_STEALTH_SIGN_NONCE = "main address";
+/** Domain tag mixed into the spend-scalar digest (H6). */
+export declare const SPEND_SCALAR_DOMAIN_TAG = "privacy-pool-spend-scalar-v1";
+/** Schema version bound into the spend-scalar message and digest. */
+export declare const OWNER_BOUND_NOTE_SCHEMA_VERSION = 1;
+export type SpendScalarDomain = {
+    networkPassphrase: string;
+    poolContract: string;
+    registryContract: string;
+    schemaVersion?: number;
+};
+export declare function resolveSpendScalarSchemaVersion(domain: SpendScalarDomain): number;
 /**
- * Plaintext for Stellar wallet message signing (stealth address derivation).
+ * Plaintext for Stellar wallet message signing (spend-key derivation).
  * Sign the exact bytes of this string (UTF-8) with the stellar account key.
+ *
+ * The derived scalar is the owner-bound spend key for notes in this environment.
  */
-export declare function buildStealthAddressSignMessage(address: string, nonce?: string): string;
+export declare function buildStealthAddressSignMessage(address: string, domain: SpendScalarDomain, nonce?: string): string;

package/dist/stealth-signature.d.ts

@@ -1,3 +1,4 @@
+import { type SpendScalarDomain } from './stealth-sign-message';
 /**
  * Ed25519 signature as **128 hex chars** (optional `0x`) or **base64** (typically 88 chars for 64 bytes, whitespace ignored).
  */
@@ -5,7 +6,14 @@ export declare function parseStellarEd25519SignatureRaw(input: string): Uint8Arr
 /** SHA-256 via Web Crypto only (`crypto.subtle`) — works in browsers and Node 19+ (global `crypto`). */
 export declare function sha256(data: Uint8Array): Promise<Uint8Array>;
 /**
- * Stellar Ed25519 signature (hex or base64) → SHA-256(signature bytes) → scalar → WASM ECDH (no UTF-8 seed hash).
+ * Domain-separated spend-scalar digest: SHA-256(
+ *   SPEND_SCALAR_DOMAIN_TAG || network || pool || registry || schemaVersion || signature
+ * ).
+ */
+export declare function spendScalarDigestFromStellarSignature(signature: string, domain: SpendScalarDomain): Promise<Uint8Array>;
+export declare function spendScalarHexFromStellarSignature(signature: string, domain: SpendScalarDomain): Promise<string>;
+/**
+ * Stellar Ed25519 signature (hex or base64) → domain-separated SHA-256 → scalar → WASM ECDH.
  */
 export declare function stealthAddressFromStellarSignature(ecdhFromScalarHex: (scalarHex64: string) => {
     x: string;
@@ -13,9 +21,9 @@ export declare function stealthAddressFromStellarSignature(ecdhFromScalarHex: (s
 }, encodeStealth: (decoded: {
     x: string;
     y: string;
-}) => string, signature: string): Promise<string>;
+}) => string, signature: string, domain: SpendScalarDomain): Promise<string>;
 /**
- * SHA-256(signature) as 32-byte BE integer, truncated to **253 bits** (same effective scalar as
- * `libs/cryptography` `scalar_mul_253` / circom `Num2Bits(253)`), decimal for `privKeyScalar`.
+ * Domain-separated SHA-256(signature, network, pool, registry, schema) reduced into
+ * `(0, BabyJub subgroup order)` so `privKeyScalar` matches `BabyPbk` and circom `LessThan(l)`.
  */
-export declare function privKeyScalarDecimalFromStellarSignature(signature: string): Promise<string>;
+export declare function privKeyScalarDecimalFromStellarSignature(signature: string, domain: SpendScalarDomain): Promise<string>;

package/dist/transaction-audit.d.ts

@@ -1,25 +1,26 @@
 import { type DepositObject, type DepositSlot, type WithdrawObject, type WithdrawSlot } from './withdrawal-transaction-input';
 export declare const TRANSACTION_N_AUDIT_SLOTS = 4;
+export declare const SIX_BY_SIX_N_AUDIT_SLOTS = 12;
 export declare const DEFAULT_APPLICATION_ID = "101";
 /** BabyJub audit public key (decimal Fr) used in BDD / local demo when env is unset. */
 export declare const DEMO_AUDIT_PUBLIC_KEY: AuditPublicKey;
 export type AuditPublicKey = [string, string];
 export interface TransactionAuditParams {
     applicationId: string;
-    noteAuditPublicKeys: [
-        AuditPublicKey,
-        AuditPublicKey,
-        AuditPublicKey,
-        AuditPublicKey
-    ];
-    auditEphemeralScalars: [string, string, string, string];
+    noteAuditPublicKey: AuditPublicKey;
+    auditEphemeralScalar: string;
 }
 export interface TransactionSlotApplicationIds {
-    inputApplicationIds: [string, string];
-    outputApplicationIds: [string, string];
+    inputApplicationIds: string[];
+    outputApplicationIds: string[];
 }
-export declare function buildUniformAuditParams(applicationId: string | undefined, auditPublicKey: AuditPublicKey): TransactionAuditParams;
-export declare function resolveSlotApplicationIds(audit: TransactionAuditParams, withdrawSlots: [WithdrawSlot, WithdrawSlot], depositSlots: [DepositSlot, DepositSlot]): TransactionSlotApplicationIds;
+export declare function buildUniformAuditParams(applicationId: string | undefined, auditPublicKey: AuditPublicKey, _nAuditSlots?: number): TransactionAuditParams;
+export declare function resolveSlotApplicationIds(audit: TransactionAuditParams, withdrawSlots: WithdrawSlot[], depositSlots: DepositSlot[]): TransactionSlotApplicationIds;
 export declare function withApplicationIdOnDeposit(deposit: DepositObject, applicationId: string): DepositObject;
 export declare function withApplicationIdOnWithdraw(withdraw: WithdrawObject, applicationId: string): WithdrawObject;
-export declare function resolveTransactionAuditParams(applicationId: string, auditPublicKey?: AuditPublicKey): TransactionAuditParams;
+/**
+ * Prefer an explicit key, then `NOTE_AUDIT_PUBLIC_KEY_X`/`_Y` env (decimal Fr),
+ * then the built-in demo key. Used by CLI/`demo.sh` for per-app audit pubkeys.
+ */
+export declare function resolveAuditPublicKeyFromEnv(auditPublicKey?: AuditPublicKey): AuditPublicKey;
+export declare function resolveTransactionAuditParams(applicationId: string, auditPublicKey?: AuditPublicKey, nAuditSlots?: number): TransactionAuditParams;

package/dist/types.d.ts

@@ -14,6 +14,8 @@ export interface GeneratedCoin {
     commitment_hex: string;
     /** 64-char lowercase hex (no `0x`), Fr big-endian for audit `precommitement`. */
     precommitement_hex: string;
+    /** JS alias of {@link GeneratedCoin.precommitement_hex}. */
+    precommitementHex: string;
 }
 /** Pool Merkle tree depth (matches `coin::TREE_DEPTH` / `Transaction` circuit). */
 export declare const POOL_MERKLE_TREE_DEPTH = 20;
@@ -43,12 +45,20 @@ export interface StateFile {
 export interface WithdrawResult {
     proof_hex: string;
     public_hex: string;
+    ciphertext_hex: string;
+    output_note_ephemeral_scalars: string[];
 }
 export interface SDKOptions {
     /** Pre-loaded Rust WASM binary (ArrayBuffer). Required in browser. */
     wasmBinary?: BufferSource;
-    /** Pre-loaded circuit WASM binary for witness generation. Required in browser. */
-    circuitWasm?: BufferSource;
-    /** Pre-loaded zkey binary for proof generation. Required in browser. */
-    zkey?: BufferSource;
+    /** Nonce-keyed circuit map. Defaults to {@link DEFAULT_ZK_CIRCUITS}. */
+    zkCircuits?: Record<string, import('./zk-layout').ZkCircuitConfig>;
+    /** Selected pool `ZkConfig` nonce. Defaults to {@link DEFAULT_ZK_CONFIG_NONCE}. */
+    zkConfigNonce?: bigint;
+    /**
+     * Directory or URL prefix for graph/r1cs/proving-key files.
+     * Defaults to the GitHub release for this SDK version. Node also reads
+     * `ZK_ARTIFACT_BASE_URL`.
+     */
+    zkArtifactBaseUrl?: string;
 }

package/dist/withdrawal-transaction-input.d.ts

@@ -1,11 +1,11 @@
 import type { TransactionAuditParams } from './transaction-audit';
 import type { WithdrawMerkleWitness } from './types';
-/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 9)` in `circuits/main.circom`. */
+/** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 12, 6)` in `circuits/main.circom`. */
 export declare const TRANSACTION_TREE_DEPTH = 20;
 export declare const TRANSACTION_N_INS = 2;
 export declare const TRANSACTION_N_OUTS = 2;
 export declare const TRANSACTION_N_AUDIT_SLOTS = 4;
-export declare const NOTE_AUDIT_LEN = 9;
+export declare const NOTE_AUDIT_LEN = 12;
 export declare const NOTE_OUTPUT_LEN = 6;
 /** Must match `Transaction(..., publicNInputs, publicNOutputs)` and contract `get_public_slot_config`. */
 export declare const TRANSACTION_PUBLIC_N_INPUTS = 1;
@@ -24,7 +24,15 @@ export interface WithdrawalProofPublicParams {
     withdrawAddressHi: string;
     /** Decimal string, circom `withdrawAddressLo` (Ed25519 key bytes [16..32] as big-endian u128). */
     withdrawAddressLo: string;
-    /** Decimal string, circom `privKeyScalar`. */
+    /** Decimal string, circom `escrowRecipientHi`. */
+    escrowRecipientHi?: string;
+    /** Decimal string, circom `escrowRecipientLo`. */
+    escrowRecipientLo?: string;
+    /** Decimal string, circom `sweepOutputOwnerPubX`. Zero off-sweep. */
+    sweepOutputOwnerPubX?: string;
+    /** Decimal string, circom `sweepOutputOwnerPubY`. Zero off-sweep. */
+    sweepOutputOwnerPubY?: string;
+    /** Decimal string, default owner scalar copied onto dummy withdraw slots. */
     privKeyScalar: string;
 }
 /** Public accounting legs (`publicWithdrawnAssets`, `publicDepositedAssets`, `publicDeposits`, `publicWithdrawals`). */
@@ -35,7 +43,8 @@ export interface TransactionPublicLegParams {
     publicWithdrawals: string[];
 }
 /** All-zero public legs (private-only pool moves). */
-export declare function zeroPublicLegs(): TransactionPublicLegParams;
+export declare function zeroPublicLegs(publicNInputs?: number, publicNOutputs?: number): TransactionPublicLegParams;
+export declare function padPublicLegs(legs: TransactionPublicLegParams, publicNInputs: number, publicNOutputs: number): TransactionPublicLegParams;
 /** Real withdraw leg; coordinates are decimal field strings (same as `CoinData`). */
 export interface WithdrawObject {
     value: string;
@@ -45,8 +54,13 @@ export interface WithdrawObject {
     asset: [string, string];
     /** BN254 Fr decimal; `0` for dummy slots. */
     applicationId: string;
-    /** Depositor ECDH point `[x, y]` as decimal strings. */
-    ephemeralKeys: [string, string];
+    /** Owner BabyJubJub public key `[x, y]` as decimal strings. */
+    ownerPub: [string, string];
+    /** Per-input owner scalar. */
+    privKeyScalar: string;
+    paddingRandom: string;
+    escrowNonce: string;
+    recipientStellar: [string, string];
     stateSiblings: string[];
     stateIndex: string;
 }
@@ -60,52 +74,46 @@ export interface DepositObject {
     applicationId: string;
     /** Recipient public key `[x, y]` as decimal strings. */
     recipientPublicKeys: [string, string];
+    escrowNonce?: string;
+    recipientStellar?: [string, string];
 }
 export type WithdrawSlot = WithdrawObject | 'dummy';
 export type DepositSlot = DepositObject | 'dummy';
-/** Witness calculator input for `circuits/main.circom` `Transaction(20,2,2,publicNInputs,publicNOutputs)`. */
+/** Witness calculator input for a `Transaction(20, nIns, nOuts, …)` instantiation. */
 export interface TransactionWitnessInput {
     stateRoot: string;
     withdrawAddressHi: string;
     withdrawAddressLo: string;
-    privKeyScalar: string;
-    withdrawnValues: [string, string];
-    withdrawnNullifiers: [string, string];
-    withdrawnSecrets: [string, string];
-    withdrawnAssets: [[string, string], [string, string]];
-    ephemeralKeys: [[string, string], [string, string]];
-    stateSiblings: [string[], string[]];
-    stateIndex: [string, string];
-    depositedValues: [string, string];
-    depositedNullifiers: [string, string];
-    depositedAssets: [[string, string], [string, string]];
-    depositedEphemeralKeyScalars: [string, string];
-    depositedRecipientPublicKeys: [[string, string], [string, string]];
+    escrowRecipientHi: string;
+    escrowRecipientLo: string;
+    sweepOutputOwnerPubX: string;
+    sweepOutputOwnerPubY: string;
+    privKeyScalars: string[];
+    ownerPubs: Array<[string, string]>;
+    paddingRandoms: string[];
+    withdrawnValues: string[];
+    withdrawnNullifiers: string[];
+    withdrawnSecrets: string[];
+    withdrawnAssets: Array<[string, string]>;
+    withdrawnEscrowNonces: string[];
+    inputRecipientStellar: Array<[string, string]>;
+    stateSiblings: string[][];
+    stateIndex: string[];
+    depositedValues: string[];
+    depositedNullifiers: string[];
+    depositedAssets: Array<[string, string]>;
+    depositedEphemeralKeyScalars: string[];
+    depositedRecipientPublicKeys: Array<[string, string]>;
+    depositedEscrowNonces: string[];
+    outputRecipientStellar: Array<[string, string]>;
     publicWithdrawnAssets: Array<[string, string]>;
     publicDepositedAssets: Array<[string, string]>;
     publicDeposits: string[];
     publicWithdrawals: string[];
-    inputApplicationIds: [string, string];
-    outputApplicationIds: [string, string];
-    auditEphemeralScalars: [string, string, string, string];
-    noteAuditPublicKeys: [
-        [
-            string,
-            string
-        ],
-        [
-            string,
-            string
-        ],
-        [
-            string,
-            string
-        ],
-        [
-            string,
-            string
-        ]
-    ];
+    inputApplicationIds: string[];
+    outputApplicationIds: string[];
+    auditEphemeralScalar: string;
+    noteAuditPublicKey: [string, string];
 }
 export interface WasmEcdhPointFns {
     ecdhEphemeralPublicKeyFromScalarHex(scalarHex: string): {
@@ -137,11 +145,18 @@ export declare function randomFrDecimal(): string;
 /** Random scalar < 2^253 for BabyJub ECDH / `Num2Bits(253)` (uses {@link generateRandomScalarHex32}). */
 export declare function randomFrDecimal253(): string;
 export declare function resolveDepositsForWitness(depositSlots: [DepositSlot, DepositSlot], wasm: WasmEcdhPointFns): [DepositObject, DepositObject];
-export declare function buildTransactionWitnessInput(publicParams: WithdrawalProofPublicParams, publicLegs: TransactionPublicLegParams, withdrawSlots: [WithdrawSlot, WithdrawSlot], depositSlots: [DepositSlot, DepositSlot], audit: TransactionAuditParams, wasm: WasmEcdhPointFns): TransactionWitnessInput;
+export declare function padWithdrawSlots(slots: WithdrawSlot[], nIns: number): WithdrawSlot[];
+export declare function padDepositSlots(slots: DepositSlot[], nOuts: number): DepositSlot[];
+export declare function buildTransactionWitnessInput(publicParams: WithdrawalProofPublicParams, publicLegs: TransactionPublicLegParams, withdrawSlots: WithdrawSlot[], depositSlots: DepositSlot[], audit: TransactionAuditParams, wasm: WasmEcdhPointFns, dims?: {
+    nIns?: number;
+    nOuts?: number;
+    publicNInputs?: number;
+    publicNOutputs?: number;
+}): TransactionWitnessInput;
 /** `stpl1…` stealth address → `[x, y]` as decimal field strings for `depositedRecipientPublicKeys`. */
 export declare function recipientPublicKeysDecimalFromStealthAddress(stealthAddress: string): [string, string];
-/** First withdraw leg: Merkle witness + depositor ECDH point coordinates (hex). */
-export declare function withdrawObjectFromMerkleWitness(witness: WithdrawMerkleWitness, depositorEphemeralHex: {
+/** First withdraw leg: Merkle witness + owner public key (hex) and matching scalar. */
+export declare function withdrawObjectFromMerkleWitness(witness: WithdrawMerkleWitness, ownerPubHex: {
     x: string;
     y: string;
-}, applicationId: string): WithdrawObject;
+}, applicationId: string, privKeyScalar: string): WithdrawObject;

package/dist/witness.d.ts

@@ -1,2 +1,3 @@
 import type { TransactionWitnessInput } from './withdrawal-transaction-input';
-export declare function generateWitness(input: TransactionWitnessInput, circuitWasm?: BufferSource): Promise<Uint8Array>;
+/** @deprecated Witness generation is in the main SDK WASM (`proveGroth16`). */
+export declare function generateWitness(_input: TransactionWitnessInput, _circuitWasm?: BufferSource, _wasmFileName?: string): Promise<Uint8Array>;

package/dist/zk-artifact-url.d.ts

@@ -0,0 +1,4 @@
+export declare const ZK_ARTIFACT_GITHUB_REPO = "Polynom-Labs/stellar-privacy-layer-contracts";
+export declare const ZK_SDK_PACKAGE_VERSION = "__ZK_SDK_PACKAGE_VERSION__";
+export declare function defaultZkArtifactBaseUrl(version?: string): string;
+export declare function trimArtifactBaseUrl(value: string): string;