@auditable/privacy-pool-zk-sdk 0.8.0 → 0.9.1-rc.0

package/dist/index.mjs

@@ -1,4 +1,3 @@
-import * as snarkjs from 'snarkjs';
 import { StrKey, Address, Keypair, rpc, TransactionBuilder, Operation, xdr, nativeToScVal, authorizeEntry } from '@stellar/stellar-sdk';
 import { buildBabyjub, buildMimc7, buildPoseidon } from 'circomlibjs';
 
@@ -355,6 +354,38 @@ function proofToHex(proof_json) {
     }
 }
 
+/**
+ * Graph witness + arkworks Groth16 prove. Returns `{ proof_hex, public_hex }`.
+ * @param {Uint8Array} graph
+ * @param {Uint8Array} proving_key
+ * @param {Uint8Array} r1cs
+ * @param {string} inputs_json
+ * @returns {any}
+ */
+function proveGroth16(graph, proving_key, r1cs, inputs_json) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(graph, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passArray8ToWasm0(proving_key, wasm.__wbindgen_export);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(r1cs, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        const ptr3 = passStringToWasm0(inputs_json, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len3 = WASM_VECTOR_LEN;
+        wasm.proveGroth16(retptr, ptr0, len0, ptr1, len1, ptr2, len2, ptr3, len3);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
 /**
  * Convert snarkjs public signals JSON to hex bytes for Soroban contract.
  * @param {string} public_json
@@ -565,6 +596,13 @@ function isLikeNone(x) {
     return x === undefined || x === null;
 }
 
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
 function passStringToWasm0(arg, malloc, realloc) {
     if (realloc === undefined) {
         const buf = cachedTextEncoder.encode(arg);
@@ -741,15 +779,16 @@ var wasmBindings = /*#__PURE__*/Object.freeze({
     generateCoinWithOwnerPubHex: generateCoinWithOwnerPubHex,
     initSync: initSync,
     proofToHex: proofToHex,
+    proveGroth16: proveGroth16,
     publicToHex: publicToHex
 });
 
-const isNode$2 = typeof process !== 'undefined' && !!process.versions?.node;
+const isNode$1 = typeof process !== 'undefined' && !!process.versions?.node;
 let wasmModule = null;
 async function loadWasm(wasmBinary) {
     if (wasmModule)
         return wasmModule;
-    if (isNode$2) {
+    if (isNode$1) {
         if (wasmBinary) {
             initSync({ module: wasmBinary });
         }
@@ -776,468 +815,301 @@ async function loadWasm(wasmBinary) {
     return wasmModule;
 }
 
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
-
-var witness_calculator = async function builder(code, options) {
-
-    options = options || {};
-
-    let wasmModule;
-    try {
-	wasmModule = await WebAssembly.compile(code);
-    }  catch (err) {
-	console.log(err);
-	console.log("\nTry to run circom --c in order to generate c++ code instead\n");
-	throw new Error(err);
-    }
-
-    let wc;
-
-    let errStr = "";
-    let msgStr = "";
-    
-    const instance = await WebAssembly.instantiate(wasmModule, {
-        runtime: {
-            exceptionHandler : function(code) {
-		let err;
-                if (code == 1) {
-                    err = "Signal not found.\n";
-                } else if (code == 2) {
-                    err = "Too many signals set.\n";
-                } else if (code == 3) {
-                    err = "Signal already set.\n";
-		} else if (code == 4) {
-                    err = "Assert Failed.\n";
-		} else if (code == 5) {
-                    err = "Not enough memory.\n";
-		} else if (code == 6) {
-                    err = "Input signal array access exceeds the size.\n";
-		} else if (code == 7) {
-                    err = "Out of bounds array access.\n";
-		} else {
-		    err = "Unknown error.\n";
-                }
-                throw new Error(err + errStr);
-            },
-	    printErrorMessage : function() {
-		errStr += getMessage() + "\n";
-                // console.error(getMessage());
-	    },
-	    writeBufferMessage : function() {
-			const msg = getMessage();
-			// Any calls to `log()` will always end with a `\n`, so that's when we print and reset
-			if (msg === "\n") {
-				console.log(msgStr);
-				msgStr = "";
-			} else {
-				// If we've buffered other content, put a space in between the items
-				if (msgStr !== "") {
-					msgStr += " ";
-				}
-				// Then append the message to the message we are creating
-				msgStr += msg;
-			}
-	    },
-	    showSharedRWMemory : function() {
-		printSharedRWMemory ();
-            }
-
-        }
-    });
-
-    const sanityCheck =
-        options;
-//        options &&
-//        (
-//            options.sanityCheck ||
-//            options.logGetSignal ||
-//            options.logSetSignal ||
-//            options.logStartComponent ||
-//            options.logFinishComponent
-//        );
-
-    
-    wc = new WitnessCalculator(instance, sanityCheck);
-    return wc;
-
-    function getMessage() {
-        var message = "";
-	var c = instance.exports.getMessageChar();
-        while ( c != 0 ) {
-	    message += String.fromCharCode(c);
-	    c = instance.exports.getMessageChar();
-	}
-        return message;
-    }
-	
-    function printSharedRWMemory () {
-	const shared_rw_memory_size = instance.exports.getFieldNumLen32();
-	const arr = new Uint32Array(shared_rw_memory_size);
-	for (let j=0; j<shared_rw_memory_size; j++) {
-	    arr[shared_rw_memory_size-1-j] = instance.exports.readSharedRWMemory(j);
-	}
-
-	// If we've buffered other content, put a space in between the items
-	if (msgStr !== "") {
-		msgStr += " ";
-	}
-	// Then append the value to the message we are creating
-	msgStr += (fromArray32(arr).toString());
-	}
-
+/** Off-chain ZK layout table. Must stay byte-identical to `libs/zk::ZkLayoutParams`. */
+const LEGACY_ZK_NONCE = 0n;
+const COMMITMENT_V2_ZK_NONCE = 2n;
+const BINDING_ZK_NONCE = 3n;
+const SIX_BY_SIX_ZK_NONCE = 6n;
+const SIX_BY_SIX_BINDING_ZK_NONCE = 7n;
+const LEGACY_PUBLIC_INPUT_PREFIX_LEN = 5;
+const V2_PUBLIC_INPUT_PREFIX_LEN = 7;
+const NOTE_AUDIT_LEN$3 = 12;
+const NOTE_OUTPUT_LEN$2 = 6;
+var BundledZkCircuit;
+(function (BundledZkCircuit) {
+    BundledZkCircuit["TwoByTwo"] = "2x2";
+    BundledZkCircuit["SixBySix"] = "6x6";
+})(BundledZkCircuit || (BundledZkCircuit = {}));
+function isDevZkCircuitConfig(config) {
+    return !('circuit' in config);
+}
+const DEFAULT_ZK_CONFIG_NONCE = BINDING_ZK_NONCE;
+const DEFAULT_ZK_CIRCUITS = {
+    [BINDING_ZK_NONCE.toString()]: {
+        nIns: 2,
+        nOuts: 2,
+        publicNInputs: 1,
+        publicNOutputs: 1,
+        circuit: BundledZkCircuit.TwoByTwo,
+    },
+    [SIX_BY_SIX_BINDING_ZK_NONCE.toString()]: {
+        nIns: 6,
+        nOuts: 6,
+        publicNInputs: 1,
+        publicNOutputs: 1,
+        circuit: BundledZkCircuit.SixBySix,
+    },
 };
-
-class WitnessCalculator {
-    constructor(instance, sanityCheck) {
-        this.instance = instance;
-
-	this.version = this.instance.exports.getVersion();
-        this.n32 = this.instance.exports.getFieldNumLen32();
-
-        this.instance.exports.getRawPrime();
-        const arr = new Uint32Array(this.n32);
-        for (let i=0; i<this.n32; i++) {
-            arr[this.n32-1-i] = this.instance.exports.readSharedRWMemory(i);
-        }
-        this.prime = fromArray32(arr);
-
-        this.witnessSize = this.instance.exports.getWitnessSize();
-
-        this.sanityCheck = sanityCheck;
-    }
-    
-    circom_version() {
-	return this.instance.exports.getVersion();
-    }
-
-    async _doCalculateWitness(input_orig, sanityCheck) {
-	//input is assumed to be a map from signals to arrays of bigints
-        this.instance.exports.init((this.sanityCheck || sanityCheck) ? 1 : 0);
-	let prefix = "";
-	var input = new Object();
-	//console.log("Input: ", input_orig);
-	qualify_input(prefix,input_orig,input);
-	//console.log("Input after: ",input);	
-        const keys = Object.keys(input);
-	var input_counter = 0;
-        keys.forEach( (k) => {
-            const h = fnvHash(k);
-            const hMSB = parseInt(h.slice(0,8), 16);
-            const hLSB = parseInt(h.slice(8,16), 16);
-            const fArr = flatArray(input[k]);
-	    let signalSize = this.instance.exports.getInputSignalSize(hMSB, hLSB);
-	    if (signalSize < 0){
-		throw new Error(`Signal ${k} not found\n`);
-	    }
-	    if (fArr.length < signalSize) {
-		throw new Error(`Not enough values for input signal ${k}\n`);
-	    }
-	    if (fArr.length > signalSize) {
-		throw new Error(`Too many values for input signal ${k}\n`);
-	    }
-            for (let i=0; i<fArr.length; i++) {
-                const arrFr = toArray32(normalize(fArr[i],this.prime),this.n32);
-                for (let j=0; j<this.n32; j++) {
-		    this.instance.exports.writeSharedRWMemory(j,arrFr[this.n32-1-j]);
-		}
-		try {
-                    this.instance.exports.setInputSignal(hMSB, hLSB,i);
-		    input_counter++;
-		} catch (err) {
-		    // console.log(`After adding signal ${i} of ${k}`)
-                    throw new Error(err);
-		}
-            }
-
-        });
-	if (input_counter < this.instance.exports.getInputSize()) {
-	    throw new Error(`Not all inputs have been set. Only ${input_counter} out of ${this.instance.exports.getInputSize()}`);
-	}
+function layoutFromCircuitConfig(config) {
+    return zkLayoutFromShapeBinding(config.nIns, config.nOuts, config.publicNInputs, config.publicNOutputs, config.nIns + config.nOuts, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function resolveZkCircuitConfig(zkCircuits, zkConfigNonce) {
+    const nonce = zkConfigNonce ?? DEFAULT_ZK_CONFIG_NONCE;
+    const circuits = zkCircuits ?? DEFAULT_ZK_CIRCUITS;
+    const config = circuits[nonce.toString()];
+    if (!config) {
+        throw new Error(`no zk circuit configured for nonce ${nonce.toString()}`);
     }
-
-    async calculateWitness(input, sanityCheck) {
-
-        const w = [];
-        await this._doCalculateWitness(input, sanityCheck);
-
-        for (let i=0; i<this.witnessSize; i++) {
-            this.instance.exports.getWitness(i);
-	    const arr = new Uint32Array(this.n32);
-            for (let j=0; j<this.n32; j++) {
-            arr[this.n32-1-j] = this.instance.exports.readSharedRWMemory(j);
-            }
-            w.push(fromArray32(arr));
-        }
-
-        return w;
+    return { nonce, config };
+}
+function bundledCircuitFileNames(circuit) {
+    if (circuit === BundledZkCircuit.SixBySix) {
+        return {
+            graphFileName: 'main_6x6.graph.bin',
+            r1csFileName: 'main_6x6.r1cs.gz',
+            provingKeyFileName: 'main_6x6_proving_key.bin',
+            verificationKeyFileName: 'main_6x6_verification_key.json',
+            zkeyFileName: 'main_6x6_final.zkey',
+        };
     }
-    
-
-    async calculateBinWitness(input, sanityCheck) {
-
-        const buff32 = new Uint32Array(this.witnessSize*this.n32);
-	const buff = new  Uint8Array( buff32.buffer);
-        await this._doCalculateWitness(input, sanityCheck);
-
-        for (let i=0; i<this.witnessSize; i++) {
-            this.instance.exports.getWitness(i);
-	    const pos = i*this.n32;
-            for (let j=0; j<this.n32; j++) {
-		buff32[pos+j] = this.instance.exports.readSharedRWMemory(j);
-            }
-        }
-
-	return buff;
+    return {
+        graphFileName: 'main.graph.bin',
+        r1csFileName: 'main.r1cs.gz',
+        provingKeyFileName: 'main_proving_key.bin',
+        verificationKeyFileName: 'main_verification_key.json',
+        zkeyFileName: 'main_final.zkey',
+    };
+}
+function zkLayoutFromShape(nIns, nOuts, publicNInputs, publicNOutputs, nAuditSlots, noteAuditLen, noteOutputLen, publicInputPrefixLen = LEGACY_PUBLIC_INPUT_PREFIX_LEN) {
+    const auditOffset = nIns + nOuts + nOuts * 2;
+    const outputNoteOffset = auditOffset + nAuditSlots * 2 + nAuditSlots * noteAuditLen + nAuditSlots;
+    return {
+        nIns,
+        nOuts,
+        publicNInputs,
+        publicNOutputs,
+        nAuditSlots,
+        noteAuditLen,
+        noteOutputLen,
+        publicInputPrefixLen,
+        auditOffset,
+        outputNoteOffset,
+    };
+}
+function zkLayoutFromShapeBinding(nIns, nOuts, publicNInputs, publicNOutputs, nAuditSlots, noteAuditLen, noteOutputLen) {
+    const auditOffset = nIns + nOuts + nOuts * 2;
+    const outputNoteOffset = auditOffset + 2 + nAuditSlots;
+    return {
+        nIns,
+        nOuts,
+        publicNInputs,
+        publicNOutputs,
+        nAuditSlots,
+        noteAuditLen,
+        noteOutputLen,
+        publicInputPrefixLen: V2_PUBLIC_INPUT_PREFIX_LEN,
+        auditOffset,
+        outputNoteOffset,
+    };
+}
+function ciphertextsInPublicSignals(layout) {
+    const withCiphertext = layout.auditOffset +
+        layout.nAuditSlots * 2 +
+        layout.nAuditSlots * layout.noteAuditLen +
+        layout.nAuditSlots;
+    return layout.outputNoteOffset === withCiphertext;
+}
+function ciphertextFieldCount(layout) {
+    return layout.nAuditSlots * layout.noteAuditLen + layout.nOuts * layout.noteOutputLen;
+}
+function auditEphemeralPublicKeyCount(layout) {
+    return ciphertextsInPublicSignals(layout) ? layout.nAuditSlots : 1;
+}
+function indexAuditTags(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return (layout.auditOffset +
+            layout.nAuditSlots * 2 +
+            layout.nAuditSlots * layout.noteAuditLen);
     }
-    
-
-    async calculateWTNSBin(input, sanityCheck) {
-
-        const buff32 = new Uint32Array(this.witnessSize*this.n32+this.n32+11);
-	const buff = new  Uint8Array( buff32.buffer);
-        await this._doCalculateWitness(input, sanityCheck);
-  
-	//"wtns"
-	buff[0] = "w".charCodeAt(0);
-	buff[1] = "t".charCodeAt(0);
-	buff[2] = "n".charCodeAt(0);
-	buff[3] = "s".charCodeAt(0);
-
-	//version 2
-	buff32[1] = 2;
-
-	//number of sections: 2
-	buff32[2] = 2;
-
-	//id section 1
-	buff32[3] = 1;
-
-	const n8 = this.n32*4;
-	//id section 1 length in 64bytes
-	const idSection1length = 8 + n8;
-	const idSection1lengthHex = idSection1length.toString(16);
-        buff32[4] = parseInt(idSection1lengthHex.slice(0,8), 16);
-        buff32[5] = parseInt(idSection1lengthHex.slice(8,16), 16);
-
-	//this.n32
-	buff32[6] = n8;
-
-	//prime number
-	this.instance.exports.getRawPrime();
-
-	var pos = 7;
-        for (let j=0; j<this.n32; j++) {
-	    buff32[pos+j] = this.instance.exports.readSharedRWMemory(j);
-        }
-	pos += this.n32;
-
-	// witness size
-	buff32[pos] = this.witnessSize;
-	pos++;
-
-	//id section 2
-	buff32[pos] = 2;
-	pos++;
-
-	// section 2 length
-	const idSection2length = n8*this.witnessSize;
-	const idSection2lengthHex = idSection2length.toString(16);
-        buff32[pos] = parseInt(idSection2lengthHex.slice(0,8), 16);
-        buff32[pos+1] = parseInt(idSection2lengthHex.slice(8,16), 16);
-
-	pos += 2;
-        for (let i=0; i<this.witnessSize; i++) {
-            this.instance.exports.getWitness(i);
-            for (let j=0; j<this.n32; j++) {
-		buff32[pos+j] = this.instance.exports.readSharedRWMemory(j);
-            }
-	    pos += this.n32;
-        }
-
-	return buff;
+    return layout.auditOffset + auditEphemeralPublicKeyCount(layout) * 2;
+}
+function indexOutputNoteTags(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return layout.outputNoteOffset + layout.nOuts * layout.noteOutputLen;
     }
-
+    return layout.outputNoteOffset;
 }
-
-
-function qualify_input_list(prefix,input,input1){
-    if (Array.isArray(input)) {
-	for (let i = 0; i<input.length; i++) {
-	    let new_prefix = prefix + "[" + i + "]";
-	    qualify_input_list(new_prefix,input[i],input1);
-	}
-    } else {
-	qualify_input(prefix,input,input1);
-    }
-}
-
-function qualify_input(prefix,input,input1) {
-    if (Array.isArray(input)) {
-	let a = flatArray(input);
-	if (a.length > 0) {
-	    let t = typeof a[0];
-	    for (let i = 1; i<a.length; i++) {
-		if (typeof a[i] != t){
-		    throw new Error(`Types are not the same in the key ${prefix}`);
-		}
-	    }
-	    if (t == "object") {
-		qualify_input_list(prefix,input,input1);
-	    } else {
-		input1[prefix] = input;
-	    }
-	} else {	    
-	    input1[prefix] = input;
-	}
-    } else if (typeof input == "object") {
-        const keys = Object.keys(input);
-	keys.forEach( (k) => {
-	    let new_prefix = prefix == ""? k : prefix + "." + k;
-	    qualify_input(new_prefix,input[k],input1);
-	});
-    } else {
-	input1[prefix] = input;
+function publicOutputsLen(layout) {
+    if (ciphertextsInPublicSignals(layout)) {
+        return layout.outputNoteOffset + layout.nOuts * layout.noteOutputLen + layout.nOuts;
     }
+    return layout.outputNoteOffset + layout.nOuts;
 }
-
-function toArray32(rem,size) {
-    const res = []; //new Uint32Array(size); //has no unshift
-    const radix = BigInt(0x100000000);
-    while (rem) {
-        res.unshift( Number(rem % radix));
-        rem = rem / radix;
+function totalPublicSignals(layout) {
+    return (publicOutputsLen(layout) +
+        layout.publicInputPrefixLen +
+        2 * layout.publicNInputs +
+        2 * layout.publicNOutputs +
+        layout.publicNInputs +
+        layout.publicNOutputs);
+}
+function stateRootIndex(layout) {
+    return publicOutputsLen(layout);
+}
+function legacyOwnerBoundLayout() {
+    return zkLayoutFromShape(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function standardLayout() {
+    return zkLayoutFromShape(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2, V2_PUBLIC_INPUT_PREFIX_LEN);
+}
+function sixBySixLayout() {
+    return zkLayoutFromShape(6, 6, 1, 1, 12, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2, V2_PUBLIC_INPUT_PREFIX_LEN);
+}
+function standardBindingLayout() {
+    return zkLayoutFromShapeBinding(2, 2, 1, 1, 4, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function sixBySixBindingLayout() {
+    return zkLayoutFromShapeBinding(6, 6, 1, 1, 12, NOTE_AUDIT_LEN$3, NOTE_OUTPUT_LEN$2);
+}
+function layoutForKnownNonce(nonce) {
+    if (nonce === LEGACY_ZK_NONCE) {
+        return legacyOwnerBoundLayout();
     }
-    if (size) {
-	var i = size - res.length;
-	while (i>0) {
-	    res.unshift(0);
-	    i--;
-	}
+    if (nonce === COMMITMENT_V2_ZK_NONCE) {
+        return standardLayout();
     }
-    return res;
-}
-
-function fromArray32(arr) { //returns a BigInt
-    var res = BigInt(0);
-    const radix = BigInt(0x100000000);
-    for (let i = 0; i<arr.length; i++) {
-        res = res*radix + BigInt(arr[i]);
+    if (nonce === BINDING_ZK_NONCE) {
+        return standardBindingLayout();
     }
-    return res;
-}
-
-function flatArray(a) {
-    var res = [];
-    fillArray(res, a);
-    return res;
-
-    function fillArray(res, a) {
-        if (Array.isArray(a)) {
-            for (let i=0; i<a.length; i++) {
-                fillArray(res, a[i]);
-            }
-        } else {
-            res.push(a);
-        }
+    if (nonce === SIX_BY_SIX_ZK_NONCE) {
+        return sixBySixLayout();
     }
+    if (nonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+        return sixBySixBindingLayout();
+    }
+    throw new Error(`unknown zk config nonce ${nonce.toString()}`);
 }
-
-function normalize(n, prime) {
-    let res = BigInt(n) % prime;
-    if (res < 0) res += prime;
-    return res
+function circuitProfileFromName(name) {
+    const normalized = name.trim().toLowerCase();
+    if (normalized === '6x6' || normalized === 'six' || normalized === '6') {
+        return {
+            name: '6x6',
+            nonce: SIX_BY_SIX_BINDING_ZK_NONCE,
+            layout: sixBySixBindingLayout(),
+            wasmFileName: 'main_6x6.wasm',
+            zkeyFileName: 'main_6x6_final.zkey',
+        };
+    }
+    if (normalized === '2x2' || normalized === 'standard' || normalized === '2') {
+        return {
+            name: '2x2',
+            nonce: BINDING_ZK_NONCE,
+            layout: standardBindingLayout(),
+            wasmFileName: 'main.wasm',
+            zkeyFileName: 'main_final.zkey',
+        };
+    }
+    throw new Error(`unknown circuit profile ${name}`);
 }
-
-function fnvHash(str) {
-    const uint64_max = BigInt(2) ** BigInt(64);
-    let hash = BigInt("0xCBF29CE484222325");
-    for (var i = 0; i < str.length; i++) {
-	hash ^= BigInt(str[i].charCodeAt());
-	hash *= BigInt(0x100000001B3);
-	hash %= uint64_max;
+function circuitProfileFromNonce(nonce) {
+    if (nonce === SIX_BY_SIX_ZK_NONCE ||
+        nonce === SIX_BY_SIX_BINDING_ZK_NONCE) {
+        return circuitProfileFromName('6x6');
     }
-    let shash = hash.toString(16);
-    let n = 16 - shash.length;
-    shash = '0'.repeat(n).concat(shash);
-    return shash;
+    return circuitProfileFromName('2x2');
 }
 
-var witnessCalculatorModule = /*@__PURE__*/getDefaultExportFromCjs(witness_calculator);
-
-const isNode$1 = typeof process !== 'undefined' && !!process.versions?.node;
-async function generateWitness(input, circuitWasm) {
-    let wasmBuffer;
-    let wc;
-    if (isNode$1) {
-        const fs = await import('fs');
-        const nodePath = await import('path');
-        const { fileURLToPath } = await import('url');
-        const dir = nodePath.dirname(fileURLToPath(import.meta.url));
-        const assetsDir = nodePath.resolve(dir, '..', 'assets');
-        wc = { default: witnessCalculatorModule };
-        if (circuitWasm) {
-            wasmBuffer = circuitWasm;
-        }
-        else {
-            const wasmPath = nodePath.resolve(assetsDir, 'main.wasm');
-            if (!fs.existsSync(wasmPath)) {
-                throw new Error(`Circuit WASM not found at ${wasmPath}. Run build.sh first.`);
-            }
-            wasmBuffer = fs.readFileSync(wasmPath);
-        }
-    }
-    else {
-        if (!circuitWasm) {
-            throw new Error('In browser, you must pass circuitWasm to PrivacyPoolSDK.init(). ' +
-                'Load the circuit WASM file via fetch() and pass the ArrayBuffer.');
-        }
-        wasmBuffer = circuitWasm;
-        wc = { default: witnessCalculatorModule };
+const ZK_ARTIFACT_GITHUB_REPO = "Polynom-Labs/stellar-privacy-layer-contracts";
+const ZK_SDK_PACKAGE_VERSION = "0.9.1-rc.0";
+function defaultZkArtifactBaseUrl(version = ZK_SDK_PACKAGE_VERSION) {
+    const tag = version.startsWith("v") ? version.slice(1) : version;
+    return `https://github.com/${ZK_ARTIFACT_GITHUB_REPO}/releases/download/v${tag}`;
+}
+function trimArtifactBaseUrl(value) {
+    let trimmed = value.trim();
+    while (trimmed.endsWith("/")) {
+        trimmed = trimmed.slice(0, -1);
     }
-    const calculator = await wc.default(wasmBuffer);
-    const wtns = await calculator.calculateWTNSBin(input, 0);
-    return wtns;
+    return trimmed;
 }
 
-// @ts-ignore - snarkjs types
 const isNode = typeof process !== 'undefined' && !!process.versions?.node;
-/**
- * Normalize BufferSource to Uint8Array. Required for @iden3/binfileutils/fastfile:
- * they read via data.buffer and data.byteOffset, which ArrayBuffer does not have.
- */
 function toUint8Array(src) {
-    if (src instanceof Uint8Array)
+    if (src instanceof Uint8Array) {
         return src;
-    if (src instanceof ArrayBuffer)
+    }
+    if (src instanceof ArrayBuffer) {
         return new Uint8Array(src);
+    }
     return new Uint8Array(src.buffer, src.byteOffset, src.byteLength);
 }
-async function generateProof(wtns, zkey) {
-    let zkeyData;
-    if (zkey) {
-        zkeyData = toUint8Array(zkey);
+function nodeEnvArtifactBaseUrl() {
+    if (!isNode) {
+        return undefined;
+    }
+    const fromEnv = process.env.ZK_ARTIFACT_BASE_URL?.trim();
+    return fromEnv ? trimArtifactBaseUrl(fromEnv) : undefined;
+}
+function resolveZkArtifactBaseUrl(explicit) {
+    const trimmed = explicit?.trim();
+    if (trimmed) {
+        return trimArtifactBaseUrl(trimmed);
+    }
+    return nodeEnvArtifactBaseUrl() ?? defaultZkArtifactBaseUrl();
+}
+function isHttpUrl(value) {
+    return /^https?:\/\//i.test(value) || value.startsWith('file:');
+}
+async function readNodeAssetFile(filePath) {
+    const fs = await import('fs');
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`Circuit artifact not found at ${filePath}. Set zkArtifactBaseUrl or ZK_ARTIFACT_BASE_URL.`);
+    }
+    return fs.readFileSync(filePath);
+}
+async function fetchArtifact(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch ${url}: ${String(response.status)}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+}
+function remoteArtifactHref(base, fileName) {
+    const withSlash = `${trimArtifactBaseUrl(base)}/`;
+    if (isHttpUrl(withSlash)) {
+        return new URL(fileName, withSlash).href;
     }
-    else if (isNode) {
-        const fs = await import('fs');
+    if (typeof window !== 'undefined') {
+        return new URL(fileName, new URL(withSlash, window.location.href)).href;
+    }
+    return `${withSlash}${fileName}`;
+}
+async function loadNamedArtifact(base, fileName) {
+    if (isNode && !isHttpUrl(base)) {
         const nodePath = await import('path');
-        const { fileURLToPath } = await import('url');
-        const dir = nodePath.dirname(fileURLToPath(import.meta.url));
-        const zkeyPath = nodePath.resolve(dir, '..', 'assets', 'main_final.zkey');
-        if (!fs.existsSync(zkeyPath)) {
-            throw new Error(`Proving key not found at ${zkeyPath}. Run build.sh first.`);
-        }
-        const zkeyBuffer = fs.readFileSync(zkeyPath);
-        zkeyData = toUint8Array(zkeyBuffer);
+        return readNodeAssetFile(nodePath.resolve(base, fileName));
     }
-    else {
-        throw new Error('In browser, you must pass zkey to PrivacyPoolSDK.init(). ' +
-            'Load the zkey file via fetch() and pass the ArrayBuffer.');
+    return fetchArtifact(remoteArtifactHref(base, fileName));
+}
+async function loadBundledCircuitArtifacts(circuit, artifactBaseUrl) {
+    const base = resolveZkArtifactBaseUrl(artifactBaseUrl);
+    const names = bundledCircuitFileNames(circuit);
+    const [graph, r1cs, provingKey] = await Promise.all([
+        loadNamedArtifact(base, names.graphFileName),
+        loadNamedArtifact(base, names.r1csFileName),
+        loadNamedArtifact(base, names.provingKeyFileName),
+    ]);
+    return { graph, r1cs, provingKey };
+}
+async function resolveCircuitArtifacts(config, artifactBaseUrl) {
+    if (isDevZkCircuitConfig(config)) {
+        return {
+            graph: toUint8Array(config.circuitGraph),
+            r1cs: toUint8Array(config.r1cs),
+            provingKey: toUint8Array(config.provingKey),
+        };
     }
-    const wtnsData = toUint8Array(wtns);
-    const { proof, publicSignals } = await snarkjs.groth16.prove({ type: 'mem', data: zkeyData }, { type: 'mem', data: wtnsData });
-    return { proof, publicSignals };
+    return loadBundledCircuitArtifacts(config.circuit, artifactBaseUrl);
 }
 
 var dist = {};
@@ -1648,6 +1520,8 @@ const DOM_PADDING = 1347436868n;
 const DOM_NULLIFIER = 1346917708n;
 const DOM_ESCROW = 1346720579n;
 const DOM_ENC = 1346719299n;
+const DOM_AUDIT_TAG = 1346458695n;
+const DOM_OUTPUT_NOTE_TAG = 1347310663n;
 const BABYJUB_SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
 /**
  * Map any integer into `(0, l)` so it satisfies circom `LessThan(252)` vs
@@ -1801,37 +1675,23 @@ function resolveDepositSlot(slot) {
     }
     return slot;
 }
-function buildUniformAuditParams(applicationId = DEFAULT_APPLICATION_ID, auditPublicKey) {
+function buildUniformAuditParams(applicationId = DEFAULT_APPLICATION_ID, auditPublicKey, _nAuditSlots = TRANSACTION_N_AUDIT_SLOTS) {
     return {
         applicationId,
-        noteAuditPublicKeys: [
-            auditPublicKey,
-            auditPublicKey,
-            auditPublicKey,
-            auditPublicKey,
-        ],
-        auditEphemeralScalars: [
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-            randomFrDecimal253(),
-        ],
+        noteAuditPublicKey: auditPublicKey,
+        auditEphemeralScalar: randomFrDecimal253(),
     };
 }
 function resolveSlotApplicationIds(audit, withdrawSlots, depositSlots) {
-    const w0 = resolveWithdrawSlot(withdrawSlots[0]);
-    const w1 = resolveWithdrawSlot(withdrawSlots[1]);
-    const d0 = resolveDepositSlot(depositSlots[0]);
-    const d1 = resolveDepositSlot(depositSlots[1]);
     return {
-        inputApplicationIds: [
-            w0 && isActiveWithdraw(w0) ? audit.applicationId : '0',
-            w1 && isActiveWithdraw(w1) ? audit.applicationId : '0',
-        ],
-        outputApplicationIds: [
-            d0 && isActiveDeposit(d0) ? audit.applicationId : '0',
-            d1 && isActiveDeposit(d1) ? audit.applicationId : '0',
-        ],
+        inputApplicationIds: withdrawSlots.map((slot) => {
+            const resolved = resolveWithdrawSlot(slot);
+            return resolved && isActiveWithdraw(resolved) ? audit.applicationId : '0';
+        }),
+        outputApplicationIds: depositSlots.map((slot) => {
+            const resolved = resolveDepositSlot(slot);
+            return resolved && isActiveDeposit(resolved) ? audit.applicationId : '0';
+        }),
     };
 }
 function withApplicationIdOnDeposit(deposit, applicationId) {
@@ -1855,16 +1715,19 @@ function resolveAuditPublicKeyFromEnv(auditPublicKey) {
     }
     return DEMO_AUDIT_PUBLIC_KEY;
 }
-function resolveTransactionAuditParams(applicationId, auditPublicKey) {
-    return buildUniformAuditParams(applicationId, resolveAuditPublicKeyFromEnv(auditPublicKey));
+function resolveTransactionAuditParams(applicationId, auditPublicKey, nAuditSlots = TRANSACTION_N_AUDIT_SLOTS) {
+    return buildUniformAuditParams(applicationId, resolveAuditPublicKeyFromEnv(auditPublicKey), nAuditSlots);
 }
 
 /** Matches `Transaction(20, 2, 2, publicNInputs, publicNOutputs, 4, 12, 6)` in `circuits/main.circom`. */
 const TRANSACTION_TREE_DEPTH = 20;
 const TRANSACTION_N_INS = 2;
 const TRANSACTION_N_OUTS = 2;
-const NOTE_AUDIT_LEN$1 = 12;
+const NOTE_AUDIT_LEN$2 = 12;
 const NOTE_OUTPUT_LEN$1 = 6;
+/** Must match `Transaction(..., publicNInputs, publicNOutputs)` and contract `get_public_slot_config`. */
+const TRANSACTION_PUBLIC_N_INPUTS = 1;
+const TRANSACTION_PUBLIC_N_OUTPUTS = 1;
 /** BN254 scalar field modulus (ark `Fr`, circom signals). */
 const BN254_SCALAR_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 /**
@@ -1872,6 +1735,29 @@ const BN254_SCALAR_MOD = 2188824287183927522224640574525727508854836440041603434
  * (matches `libs/cryptography` `scalar_mul_253`).
  */
 const BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE = 1n << 253n;
+function padPublicLegs(legs, publicNInputs, publicNOutputs) {
+    const padPairs = (values, expected, label) => {
+        if (values.length > expected) {
+            throw new Error(`withdrawal-transaction-input: expected at most ${expected} ${label}`);
+        }
+        return [
+            ...values,
+            ...Array.from({ length: expected - values.length }, () => ['0', '0']),
+        ];
+    };
+    const padAmounts = (values, expected, label) => {
+        if (values.length > expected) {
+            throw new Error(`withdrawal-transaction-input: expected at most ${expected} ${label}`);
+        }
+        return [...values, ...Array.from({ length: expected - values.length }, () => '0')];
+    };
+    return {
+        publicWithdrawnAssets: padPairs(legs.publicWithdrawnAssets, publicNOutputs, 'public withdrawn assets'),
+        publicDepositedAssets: padPairs(legs.publicDepositedAssets, publicNInputs, 'public deposited assets'),
+        publicDeposits: padAmounts(legs.publicDeposits, publicNInputs, 'public deposits'),
+        publicWithdrawals: padAmounts(legs.publicWithdrawals, publicNOutputs, 'public withdrawals'),
+    };
+}
 function normalizeHex$1(hex) {
     const s = hex.trim().replace(/^0x/i, '');
     if (!/^[0-9a-fA-F]*$/.test(s)) {
@@ -1992,12 +1878,29 @@ function resolveDepositsForWitness(depositSlots, wasm) {
         resolveDeposit(depositSlots[1], wasm),
     ];
 }
-function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, depositSlots, audit, wasm) {
-    const w0 = resolveWithdraw(withdrawSlots[0], wasm);
-    const w1 = resolveWithdraw(withdrawSlots[1], wasm);
-    const d0 = resolveDeposit(depositSlots[0], wasm);
-    const d1 = resolveDeposit(depositSlots[1], wasm);
-    const appIds = resolveSlotApplicationIds(audit, withdrawSlots, depositSlots);
+function padWithdrawSlots(slots, nIns) {
+    if (slots.length > nIns) {
+        throw new Error(`withdrawal-transaction-input: expected at most ${nIns} withdraw slots`);
+    }
+    return [...slots, ...Array.from({ length: nIns - slots.length }, () => 'dummy')];
+}
+function padDepositSlots(slots, nOuts) {
+    if (slots.length > nOuts) {
+        throw new Error(`withdrawal-transaction-input: expected at most ${nOuts} deposit slots`);
+    }
+    return [...slots, ...Array.from({ length: nOuts - slots.length }, () => 'dummy')];
+}
+function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, depositSlots, audit, wasm, dims = {}) {
+    const nIns = dims.nIns ?? TRANSACTION_N_INS;
+    const nOuts = dims.nOuts ?? TRANSACTION_N_OUTS;
+    const publicNInputs = dims.publicNInputs ?? TRANSACTION_PUBLIC_N_INPUTS;
+    const publicNOutputs = dims.publicNOutputs ?? TRANSACTION_PUBLIC_N_OUTPUTS;
+    const paddedWithdraws = padWithdrawSlots(withdrawSlots, nIns);
+    const paddedDeposits = padDepositSlots(depositSlots, nOuts);
+    const paddedLegs = padPublicLegs(publicLegs, publicNInputs, publicNOutputs);
+    const withdraws = paddedWithdraws.map((slot) => resolveWithdraw(slot, wasm));
+    const deposits = paddedDeposits.map((slot) => resolveDeposit(slot, wasm));
+    const appIds = resolveSlotApplicationIds(audit, paddedWithdraws, paddedDeposits);
     return {
         stateRoot: publicParams.stateRoot,
         withdrawAddressHi: publicParams.withdrawAddressHi,
@@ -2006,35 +1909,32 @@ function buildTransactionWitnessInput(publicParams, publicLegs, withdrawSlots, d
         escrowRecipientLo: publicParams.escrowRecipientLo ?? '0',
         sweepOutputOwnerPubX: publicParams.sweepOutputOwnerPubX ?? '0',
         sweepOutputOwnerPubY: publicParams.sweepOutputOwnerPubY ?? '0',
-        privKeyScalars: [w0.privKeyScalar, w1.privKeyScalar],
-        ownerPubs: [w0.ownerPub, w1.ownerPub],
-        paddingRandoms: [w0.paddingRandom, w1.paddingRandom],
-        withdrawnValues: [w0.value, w1.value],
-        withdrawnNullifiers: [w0.nullifier, w1.nullifier],
-        withdrawnSecrets: [w0.secret, w1.secret],
-        withdrawnAssets: [w0.asset, w1.asset],
-        withdrawnEscrowNonces: [w0.escrowNonce, w1.escrowNonce],
-        inputRecipientStellar: [w0.recipientStellar, w1.recipientStellar],
-        stateSiblings: [w0.stateSiblings, w1.stateSiblings],
-        stateIndex: [w0.stateIndex, w1.stateIndex],
-        depositedValues: [d0.value, d1.value],
-        depositedNullifiers: [d0.nullifier, d1.nullifier],
-        depositedAssets: [d0.asset, d1.asset],
-        depositedEphemeralKeyScalars: [d0.ephemeralKeyScalar, d1.ephemeralKeyScalar],
-        depositedRecipientPublicKeys: [d0.recipientPublicKeys, d1.recipientPublicKeys],
-        depositedEscrowNonces: [d0.escrowNonce ?? '0', d1.escrowNonce ?? '0'],
-        outputRecipientStellar: [
-            d0.recipientStellar ?? ['0', '0'],
-            d1.recipientStellar ?? ['0', '0'],
-        ],
+        privKeyScalars: withdraws.map((w) => w.privKeyScalar),
+        ownerPubs: withdraws.map((w) => w.ownerPub),
+        paddingRandoms: withdraws.map((w) => w.paddingRandom),
+        withdrawnValues: withdraws.map((w) => w.value),
+        withdrawnNullifiers: withdraws.map((w) => w.nullifier),
+        withdrawnSecrets: withdraws.map((w) => w.secret),
+        withdrawnAssets: withdraws.map((w) => w.asset),
+        withdrawnEscrowNonces: withdraws.map((w) => w.escrowNonce),
+        inputRecipientStellar: withdraws.map((w) => w.recipientStellar),
+        stateSiblings: withdraws.map((w) => w.stateSiblings),
+        stateIndex: withdraws.map((w) => w.stateIndex),
+        depositedValues: deposits.map((d) => d.value),
+        depositedNullifiers: deposits.map((d) => d.nullifier),
+        depositedAssets: deposits.map((d) => d.asset),
+        depositedEphemeralKeyScalars: deposits.map((d) => d.ephemeralKeyScalar),
+        depositedRecipientPublicKeys: deposits.map((d) => d.recipientPublicKeys),
+        depositedEscrowNonces: deposits.map((d) => d.escrowNonce ?? '0'),
+        outputRecipientStellar: deposits.map((d) => d.recipientStellar ?? ['0', '0']),
         inputApplicationIds: appIds.inputApplicationIds,
         outputApplicationIds: appIds.outputApplicationIds,
-        auditEphemeralScalars: audit.auditEphemeralScalars,
-        noteAuditPublicKeys: audit.noteAuditPublicKeys,
-        publicWithdrawnAssets: publicLegs.publicWithdrawnAssets,
-        publicDepositedAssets: publicLegs.publicDepositedAssets,
-        publicDeposits: publicLegs.publicDeposits,
-        publicWithdrawals: publicLegs.publicWithdrawals,
+        auditEphemeralScalar: audit.auditEphemeralScalar,
+        noteAuditPublicKey: audit.noteAuditPublicKey,
+        publicWithdrawnAssets: paddedLegs.publicWithdrawnAssets,
+        publicDepositedAssets: paddedLegs.publicDepositedAssets,
+        publicDeposits: paddedLegs.publicDeposits,
+        publicWithdrawals: paddedLegs.publicWithdrawals,
     };
 }
 /** `stpl1…` stealth address → `[x, y]` as decimal field strings for `depositedRecipientPublicKeys`. */
@@ -2060,133 +1960,628 @@ function withdrawObjectFromMerkleWitness(witness, ownerPubHex, applicationId, pr
     };
 }
 
-/** Stroops amount as a decimal field string. Reject JS `number` so 18-decimal values cannot silently narrow. */
-function coinValueDecimal(amount) {
-    if (typeof amount === 'number') {
-        throw new TypeError('coin value must be bigint or decimal string, not number');
-    }
-    if (typeof amount === 'bigint') {
-        if (amount < 0n) {
-            throw new RangeError('amount must be a non-negative integer');
-        }
-        return amount.toString(10);
-    }
-    if (typeof amount !== 'string') {
-        throw new TypeError('coin value must be bigint or decimal string, not number');
-    }
-    const trimmed = amount.trim();
-    if (!/^[0-9]+$/.test(trimmed)) {
-        throw new TypeError('coin value decimal string must be a non-negative integer');
+const FR_SIZE$1 = 32;
+const CIPHERTEXT_BLOB_HEADER_BYTES = 4;
+const FR_MODULUS$1 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+function moduleFr$1(value) {
+    const reduced = value % FR_MODULUS$1;
+    return reduced >= 0n ? reduced : reduced + FR_MODULUS$1;
+}
+function fieldToBytes(value) {
+    let remaining = moduleFr$1(value);
+    const buf = Buffer.alloc(FR_SIZE$1);
+    for (let index = FR_SIZE$1 - 1; index >= 0; index -= 1) {
+        buf[index] = Number(remaining & 0xffn);
+        remaining >>= 8n;
     }
-    return trimmed;
+    return buf;
 }
-function generatedCoinFromWasm(value) {
-    const raw = value;
-    const precommitementHex = raw.precommitementHex ?? raw.precommitement_hex;
-    if (!precommitementHex) {
-        throw new Error('generated coin missing precommitement hex');
+function decimalOrHexToBigint(value) {
+    const trimmed = value.trim();
+    if (/^0x/i.test(trimmed) || /^[0-9a-f]{64}$/i.test(trimmed)) {
+        return BigInt(`0x${trimmed.replace(/^0x/i, '')}`);
     }
-    return {
-        coin: raw.coin,
-        commitment_hex: raw.commitment_hex,
-        precommitement_hex: precommitementHex,
-        precommitementHex,
-    };
+    return BigInt(trimmed);
 }
-class PrivacyPoolSDK {
-    constructor(wasm, options) {
-        this.wasm = wasm;
-        this.options = options;
+function encodeCiphertextBlob(fields) {
+    const prefix = Buffer.alloc(CIPHERTEXT_BLOB_HEADER_BYTES);
+    prefix.writeUInt32BE(fields.length);
+    return Buffer.concat([
+        prefix,
+        ...fields.map((field) => fieldToBytes(decimalOrHexToBigint(field))),
+    ]);
+}
+function decodeCiphertextBlob(blob) {
+    if (blob.length < CIPHERTEXT_BLOB_HEADER_BYTES) {
+        throw new Error('ciphertext_bytes too short');
     }
-    /**
-     * Initialize the SDK by loading WASM modules.
-     *
-     * In Node.js, assets are loaded from the filesystem automatically.
-     * In browser, pass pre-loaded buffers via options:
-     * ```ts
-     * const sdk = await PrivacyPoolSDK.init({
-     *   wasmBinary: await fetch('/pkg/client_sdk_wasm_bg.wasm').then(r => r.arrayBuffer()),
-     *   circuitWasm: await fetch('/assets/main.wasm').then(r => r.arrayBuffer()),
-     *   zkey: await fetch('/assets/main_final.zkey').then(r => r.arrayBuffer()),
-     * });
-     * ```
-     */
-    static async init(options) {
-        const opts = options ?? {};
-        const wasm = await loadWasm(opts.wasmBinary);
-        return new PrivacyPoolSDK(wasm, opts);
+    const count = blob.readUInt32BE(0);
+    const need = CIPHERTEXT_BLOB_HEADER_BYTES + count * FR_SIZE$1;
+    if (blob.length < need) {
+        throw new Error('ciphertext_bytes truncated');
     }
-    /**
-     * Uniform 32-byte scalar as lowercase hex (Web Crypto). Same in browser and Node 19+.
-     */
-    static generateRandomScalarHex32() {
-        return generateRandomScalarHex32();
+    const fields = [];
+    let offset = CIPHERTEXT_BLOB_HEADER_BYTES;
+    for (let index = 0; index < count; index += 1) {
+        fields.push(blob.subarray(offset, offset + FR_SIZE$1).toString('hex'));
+        offset += FR_SIZE$1;
     }
-    /**
-     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
-     * The message binds network, pool, registry, and schema version (H6).
-     */
-    static buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
-        return buildStealthAddressSignMessage(address, domain, nonce);
+    return fields;
+}
+function encodeTransactionCiphertextBlob(parameters) {
+    const expected = ciphertextFieldCount(parameters.layout);
+    const fields = [];
+    for (const slot of parameters.auditCiphertexts) {
+        fields.push(...slot);
     }
-    /**
-     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
-     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
-     * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
-     */
-    generateCoin(amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return generatedCoinFromWasm(this.wasm.generateCoin(coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    for (const note of parameters.outputNoteCiphertexts) {
+        fields.push(...note);
     }
-    /**
-     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
-     * @param amount Decimal field element (`bigint` | `string`).
-     */
-    generateCoinWithOwnerPub(ownerPub, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return generatedCoinFromWasm(this.wasm.generateCoinWithOwnerPubHex(ownerPub.x, ownerPub.y, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    if (fields.length !== expected) {
+        throw new Error(`ciphertext blob expected ${String(expected)} fields, got ${String(fields.length)}`);
     }
-    /**
-     * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
-     * @param amount Decimal field element (`bigint` | `string`).
-     */
-    generateCoinFromDepositEphemeralScalarHex(scalarHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return generatedCoinFromWasm(this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    return encodeCiphertextBlob(fields);
+}
+function splitCiphertextBlob(parameters) {
+    const fields = decodeCiphertextBlob(parameters.blob);
+    const expected = ciphertextFieldCount(parameters.layout);
+    if (fields.length !== expected) {
+        throw new Error(`ciphertext blob expected ${String(expected)} fields, got ${String(fields.length)}`);
     }
-    /**
-     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
-     * @param amount Decimal field element (`bigint` | `string`).
-     */
-    generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = '0') {
-        return generatedCoinFromWasm(this.wasm.generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    const { nAuditSlots, noteAuditLen, nOuts, noteOutputLen } = parameters.layout;
+    const auditCiphertexts = [];
+    let offset = 0;
+    for (let slot = 0; slot < nAuditSlots; slot += 1) {
+        auditCiphertexts.push(fields.slice(offset, offset + noteAuditLen));
+        offset += noteAuditLen;
     }
-    /**
-     * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
-     */
-    buildWithdrawMerkleWitness(coin, state) {
-        const coinJson = JSON.stringify(coin);
-        const stateJson = JSON.stringify(state);
-        const resultJson = this.wasm.buildWithdrawMerkleWitness(coinJson, stateJson);
-        return JSON.parse(resultJson);
+    const outputNoteCiphertexts = [];
+    for (let note = 0; note < nOuts; note += 1) {
+        outputNoteCiphertexts.push(fields.slice(offset, offset + noteOutputLen));
+        offset += noteOutputLen;
     }
-    /**
-     * Full `Transaction(20,2,2)` withdrawal proof: one real withdraw + dummies, using coin/state and depositor ECDH point (hex).
-     *
-     * Optional **partial public withdraw**: spend the full coin commitment `coin.value` (V), send `publicWithdrawStroops` (W) to the
+    return { auditCiphertexts, outputNoteCiphertexts };
+}
+
+const NOTE_OUTPUT_LEN = 6;
+const NOTE_AUDIT_LEN$1 = 12;
+const STREAM_DOMAIN = 1n;
+const FR_SIZE = 32;
+const FR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const ONE = 1n;
+const ZERO = 0n;
+const BABYJUB_SCALAR_BITS = 253n;
+const SCALAR_253_MASK = (ONE << BABYJUB_SCALAR_BITS) - ONE;
+let primitivesPromise;
+function primitives() {
+    primitivesPromise ?? (primitivesPromise = Promise.all([
+        buildBabyjub(),
+        buildMimc7(),
+        buildPoseidon(),
+    ]).then(([babyJub, mimc7, poseidon]) => ({ babyJub, mimc7, poseidon })));
+    return primitivesPromise;
+}
+function normalizeHex(value) {
+    return value.trim().replace(/^0x/i, '').padStart(FR_SIZE * 2, '0');
+}
+function bigintFromHex(value) {
+    return BigInt(`0x${normalizeHex(value)}`);
+}
+function bigintFromDecimal(value) {
+    const parsed = BigInt(value);
+    return parsed % FR_MODULUS;
+}
+function bigintToFrHex(value) {
+    let v = moduleFr(value);
+    const buf = Buffer.alloc(FR_SIZE);
+    for (let index = FR_SIZE - 1; index >= 0; index -= 1) {
+        buf[index] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return buf.toString('hex');
+}
+function frDecimalToHex(value) {
+    return bigintToFrHex(bigintFromDecimal(value));
+}
+function frDecimalFromBigint(value) {
+    const reduced = value >= ZERO ? value % FR_MODULUS : (value % FR_MODULUS) + FR_MODULUS;
+    return reduced.toString(10);
+}
+function fieldBigint(field, value) {
+    return BigInt(field.toString(value));
+}
+function moduleFr(value) {
+    const reduced = value % FR_MODULUS;
+    return reduced >= ZERO ? reduced : reduced + FR_MODULUS;
+}
+function mimcHash(parameters) {
+    return fieldBigint(parameters.mimc7.F, parameters.mimc7.hash(parameters.mimc7.F.e(parameters.message), parameters.mimc7.F.e(parameters.key)));
+}
+function poseidonHash(poseidon, inputs) {
+    return fieldBigint(poseidon.F, poseidon(inputs.map((input) => poseidon.F.e(input))));
+}
+function deriveEncCipherKey(poseidon, sharedX) {
+    return poseidonHash(poseidon, [DOM_ENC, sharedX]);
+}
+function sharedKeyFromDepositor(parameters) {
+    const scalarHex = frDecimalToHex(parameters.ephemeralKeyScalarDecimal);
+    const shared = parameters.ecdhShared(scalarHex, frDecimalToHex(parameters.recipientPublicKey[0]), frDecimalToHex(parameters.recipientPublicKey[1]));
+    return [bigintFromHex(shared.x), bigintFromHex(shared.y)];
+}
+function sharedKeyFromRecipient(parameters) {
+    const { babyJub, recipientScalarHex, ephemeralPublicKey } = parameters;
+    const point = [
+        babyJub.F.e(bigintFromHex(ephemeralPublicKey[0])),
+        babyJub.F.e(bigintFromHex(ephemeralPublicKey[1])),
+    ];
+    if (!babyJub.inCurve(point)) {
+        throw new Error('Created ephemeral public key is not on BabyJubJub curve');
+    }
+    const product = babyJub.mulPointEscalar(point, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
+    return [
+        fieldBigint(babyJub.F, product[0]),
+        fieldBigint(babyJub.F, product[1]),
+    ];
+}
+function poseidonMacTag(parameters) {
+    return poseidonHash(parameters.poseidon, [
+        parameters.domain,
+        parameters.key,
+        parameters.nonce,
+        ...parameters.message,
+    ]);
+}
+function outputNoteTag(parameters) {
+    return poseidonMacTag({
+        poseidon: parameters.poseidon,
+        domain: DOM_OUTPUT_NOTE_TAG,
+        key: parameters.key,
+        nonce: parameters.nonce,
+        message: parameters.plaintext,
+    });
+}
+function encryptFields(parameters) {
+    return parameters.plaintext.map((field, index) => {
+        const seed = poseidonHash(parameters.poseidon, [
+            parameters.nonce,
+            STREAM_DOMAIN,
+            BigInt(index),
+        ]);
+        const stream = mimcHash({
+            mimc7: parameters.mimc7,
+            message: seed,
+            key: parameters.key,
+        });
+        return moduleFr(field + stream);
+    });
+}
+function decryptFields(parameters) {
+    return parameters.ciphertext.map((field, index) => {
+        const seed = poseidonHash(parameters.poseidon, [
+            parameters.nonce,
+            STREAM_DOMAIN,
+            BigInt(index),
+        ]);
+        const stream = mimcHash({
+            mimc7: parameters.mimc7,
+            message: seed,
+            key: parameters.key,
+        });
+        return moduleFr(bigintFromHex(field) - stream);
+    });
+}
+function plaintextBigints(plaintext) {
+    return [
+        bigintFromDecimal(plaintext.value),
+        bigintFromDecimal(plaintext.assetHi),
+        bigintFromDecimal(plaintext.assetLo),
+        bigintFromDecimal(plaintext.nullifier),
+        bigintFromDecimal(plaintext.secret),
+        bigintFromDecimal(plaintext.applicationId),
+    ];
+}
+function plaintextFromBigints(fields) {
+    return {
+        value: frDecimalFromBigint(fields[0] ?? ZERO),
+        assetHi: frDecimalFromBigint(fields[1] ?? ZERO),
+        assetLo: frDecimalFromBigint(fields[2] ?? ZERO),
+        nullifier: frDecimalFromBigint(fields[3] ?? ZERO),
+        secret: frDecimalFromBigint(fields[4] ?? ZERO),
+        applicationId: frDecimalFromBigint(fields[5] ?? ZERO),
+    };
+}
+async function secretFromDepositEphemeralScalarDecimal(ephemeralKeyScalarDecimal) {
+    const { poseidon } = await primitives();
+    const secret = poseidonHash(poseidon, [bigintFromDecimal(ephemeralKeyScalarDecimal)]);
+    return frDecimalFromBigint(secret);
+}
+async function encryptOutputNoteForDeposit(parameters) {
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const secret = await secretFromDepositEphemeralScalarDecimal(parameters.deposit.ephemeralKeyScalar);
+    const plaintext = {
+        value: parameters.deposit.value,
+        assetHi: parameters.deposit.asset[0],
+        assetLo: parameters.deposit.asset[1],
+        nullifier: parameters.deposit.nullifier,
+        secret,
+        applicationId: parameters.deposit.applicationId,
+    };
+    const [sharedX, sharedY] = sharedKeyFromDepositor({
+        babyJub,
+        ecdhShared: parameters.ecdhShared,
+        ephemeralKeyScalarDecimal: parameters.deposit.ephemeralKeyScalar,
+        recipientPublicKey: parameters.deposit.recipientPublicKeys,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const message = plaintextBigints(plaintext);
+    const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
+    const tag = outputNoteTag({ poseidon, key, nonce, plaintext: message });
+    return {
+        ciphertext: ciphertext.map((field) => frDecimalFromBigint(field)),
+        tag: frDecimalFromBigint(tag),
+    };
+}
+function ownerPubFromRecipientScalar(babyJub, recipientScalarHex) {
+    const product = babyJub.mulPointEscalar(babyJub.Base8, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
+    return [
+        fieldBigint(babyJub.F, product[0]),
+        fieldBigint(babyJub.F, product[1]),
+    ];
+}
+function commitmentFromPlaintextAndOwnerPub(parameters) {
+    const commitment = poseidonHash(parameters.poseidon, [
+        bigintFromDecimal(parameters.plaintext.value),
+        bigintFromDecimal(parameters.plaintext.secret),
+        bigintFromDecimal(parameters.plaintext.nullifier),
+        parameters.ownerPub[0],
+        parameters.ownerPub[1],
+        parameters.ownerMode,
+        bigintFromDecimal(parameters.plaintext.assetHi),
+        bigintFromDecimal(parameters.plaintext.assetLo),
+        bigintFromDecimal(parameters.plaintext.applicationId),
+    ]);
+    return normalizeHex(commitment.toString(16));
+}
+async function decryptOutputNoteEvent(input) {
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const [sharedX, sharedY] = sharedKeyFromRecipient({
+        babyJub,
+        recipientScalarHex: input.recipientScalarHex,
+        ephemeralPublicKey: input.createdEphemeralKey,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const decrypted = decryptFields({
+        mimc7,
+        poseidon,
+        key,
+        nonce,
+        ciphertext: input.ciphertext,
+    });
+    const expectedTag = outputNoteTag({
+        poseidon,
+        key,
+        nonce,
+        plaintext: decrypted,
+    });
+    if (expectedTag !== bigintFromHex(input.tag)) {
+        throw new Error('Output note tag verification failed');
+    }
+    const plaintext = plaintextFromBigints(decrypted);
+    const commitmentHex = commitmentFromPlaintextAndOwnerPub({
+        poseidon,
+        plaintext,
+        ownerPub: ownerPubFromRecipientScalar(babyJub, input.recipientScalarHex),
+        ownerMode: input.ownerMode ?? 0n,
+    });
+    const commitmentMatches = normalizeHex(input.commitmentHashHex) === commitmentHex;
+    if (!commitmentMatches) {
+        throw new Error('Output note commitment checksum mismatch');
+    }
+    return {
+        ...plaintext,
+        commitmentHex,
+        commitmentMatches,
+    };
+}
+function ownerModeFromEscrowNonce(escrowNonce) {
+    return bigintFromDecimal(escrowNonce) === ZERO ? ZERO : ONE;
+}
+function emptyFlagFromValue(value) {
+    return bigintFromDecimal(value) === ZERO ? ONE : ZERO;
+}
+function precommitmentFromOpening(parameters) {
+    const ownerKeyHash = poseidonHash(parameters.poseidon, [
+        parameters.ownerPub[0],
+        parameters.ownerPub[1],
+    ]);
+    return poseidonHash(parameters.poseidon, [
+        parameters.secret,
+        parameters.ownerMode,
+        ownerKeyHash,
+    ]);
+}
+async function encryptNoteAuditSlot(parameters) {
+    if (parameters.plaintext.length !== NOTE_AUDIT_LEN$1) {
+        throw new Error(`encryptNoteAuditSlot: expected ${String(NOTE_AUDIT_LEN$1)} limbs`);
+    }
+    const { babyJub, mimc7, poseidon } = await primitives();
+    const [sharedX, sharedY] = sharedKeyFromDepositor({
+        babyJub,
+        ecdhShared: parameters.ecdhShared,
+        ephemeralKeyScalarDecimal: parameters.auditEphemeralScalar,
+        recipientPublicKey: parameters.auditPublicKey,
+    });
+    const key = deriveEncCipherKey(poseidon, sharedX);
+    const nonce = sharedY;
+    const message = parameters.plaintext.map((field) => bigintFromDecimal(field));
+    const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
+    const tag = poseidonMacTag({
+        poseidon,
+        domain: DOM_AUDIT_TAG,
+        key,
+        nonce,
+        message,
+    });
+    return {
+        ciphertext: ciphertext.map((field) => frDecimalFromBigint(field)),
+        tag: frDecimalFromBigint(tag),
+    };
+}
+function auditPlaintextForWithdraw(parameters) {
+    const value = parameters.witness.withdrawnValues[parameters.index] ?? '0';
+    const ownerPub = parameters.witness.ownerPubs[parameters.index] ?? ['0', '0'];
+    const escrowNonce = parameters.witness.withdrawnEscrowNonces[parameters.index] ?? '0';
+    const secret = bigintFromDecimal(parameters.witness.withdrawnSecrets[parameters.index] ?? '0');
+    const ownerMode = ownerModeFromEscrowNonce(escrowNonce);
+    const precommitment = precommitmentFromOpening({
+        poseidon: parameters.poseidon,
+        secret,
+        ownerMode,
+        ownerPub: [bigintFromDecimal(ownerPub[0]), bigintFromDecimal(ownerPub[1])],
+    });
+    const asset = parameters.witness.withdrawnAssets[parameters.index] ?? ['0', '0'];
+    const stellar = parameters.witness.inputRecipientStellar[parameters.index] ?? ['0', '0'];
+    return [
+        frDecimalFromBigint(emptyFlagFromValue(value)),
+        value,
+        asset[0],
+        asset[1],
+        frDecimalFromBigint(precommitment),
+        parameters.witness.withdrawnNullifiers[parameters.index] ?? '0',
+        ownerPub[0],
+        ownerPub[1],
+        parameters.witness.inputApplicationIds[parameters.index] ?? '0',
+        stellar[0],
+        stellar[1],
+        escrowNonce,
+    ];
+}
+async function auditPlaintextForDeposit(parameters) {
+    const value = parameters.witness.depositedValues[parameters.index] ?? '0';
+    const ownerPub = parameters.witness.depositedRecipientPublicKeys[parameters.index] ?? ['0', '0'];
+    const escrowNonce = parameters.witness.depositedEscrowNonces[parameters.index] ?? '0';
+    const secret = poseidonHash(parameters.poseidon, [
+        bigintFromDecimal(parameters.witness.depositedEphemeralKeyScalars[parameters.index] ?? '0'),
+    ]);
+    const ownerMode = ownerModeFromEscrowNonce(escrowNonce);
+    const precommitment = precommitmentFromOpening({
+        poseidon: parameters.poseidon,
+        secret,
+        ownerMode,
+        ownerPub: [bigintFromDecimal(ownerPub[0]), bigintFromDecimal(ownerPub[1])],
+    });
+    const asset = parameters.witness.depositedAssets[parameters.index] ?? ['0', '0'];
+    const stellar = parameters.witness.outputRecipientStellar[parameters.index] ?? ['0', '0'];
+    return [
+        frDecimalFromBigint(emptyFlagFromValue(value)),
+        value,
+        asset[0],
+        asset[1],
+        frDecimalFromBigint(precommitment),
+        parameters.witness.depositedNullifiers[parameters.index] ?? '0',
+        ownerPub[0],
+        ownerPub[1],
+        parameters.witness.outputApplicationIds[parameters.index] ?? '0',
+        stellar[0],
+        stellar[1],
+        escrowNonce,
+    ];
+}
+async function encryptTransactionCiphertextBlob(parameters) {
+    const { poseidon } = await primitives();
+    const nIns = parameters.witness.withdrawnValues.length;
+    const nOuts = parameters.witness.depositedValues.length;
+    const nAuditSlots = parameters.layout.nAuditSlots;
+    const auditCiphertexts = [];
+    for (let slot = 0; slot < nAuditSlots; slot += 1) {
+        const plaintext = slot < nIns
+            ? auditPlaintextForWithdraw({
+                poseidon,
+                witness: parameters.witness,
+                index: slot,
+            })
+            : await auditPlaintextForDeposit({
+                poseidon,
+                witness: parameters.witness,
+                index: slot - nIns,
+            });
+        const encrypted = await encryptNoteAuditSlot({
+            auditPublicKey: parameters.witness.noteAuditPublicKey,
+            auditEphemeralScalar: parameters.witness.auditEphemeralScalar,
+            plaintext,
+            ecdhShared: parameters.ecdhShared,
+        });
+        auditCiphertexts.push(encrypted.ciphertext);
+    }
+    const outputNoteCiphertexts = [];
+    for (let index = 0; index < nOuts; index += 1) {
+        const deposit = {
+            value: parameters.witness.depositedValues[index] ?? '0',
+            nullifier: parameters.witness.depositedNullifiers[index] ?? '0',
+            ephemeralKeyScalar: parameters.witness.depositedEphemeralKeyScalars[index] ?? '0',
+            asset: parameters.witness.depositedAssets[index] ?? ['0', '0'],
+            applicationId: parameters.witness.outputApplicationIds[index] ?? '0',
+            recipientPublicKeys: parameters.witness.depositedRecipientPublicKeys[index] ?? ['0', '0'],
+        };
+        const encrypted = await encryptOutputNoteForDeposit({
+            deposit,
+            ecdhShared: parameters.ecdhShared,
+        });
+        outputNoteCiphertexts.push([...encrypted.ciphertext]);
+    }
+    const blob = encodeTransactionCiphertextBlob({
+        layout: parameters.layout,
+        auditCiphertexts,
+        outputNoteCiphertexts,
+    });
+    return {
+        ciphertextHex: blob.toString('hex'),
+        auditCiphertexts,
+        outputNoteCiphertexts,
+    };
+}
+
+/** Stroops amount as a decimal field string. Reject JS `number` so 18-decimal values cannot silently narrow. */
+function coinValueDecimal(amount) {
+    if (typeof amount === "number") {
+        throw new TypeError("coin value must be bigint or decimal string, not number");
+    }
+    if (typeof amount === "bigint") {
+        if (amount < 0n) {
+            throw new RangeError("amount must be a non-negative integer");
+        }
+        return amount.toString(10);
+    }
+    if (typeof amount !== "string") {
+        throw new TypeError("coin value must be bigint or decimal string, not number");
+    }
+    const trimmed = amount.trim();
+    if (!/^[0-9]+$/.test(trimmed)) {
+        throw new TypeError("coin value decimal string must be a non-negative integer");
+    }
+    return trimmed;
+}
+function generatedCoinFromWasm(value) {
+    const raw = value;
+    const precommitementHex = raw.precommitementHex ?? raw.precommitement_hex;
+    if (!precommitementHex) {
+        throw new Error("generated coin missing precommitement hex");
+    }
+    return {
+        coin: raw.coin,
+        commitment_hex: raw.commitment_hex,
+        precommitement_hex: precommitementHex,
+        precommitementHex,
+    };
+}
+class PrivacyPoolSDK {
+    constructor(wasm, options, resolved) {
+        this.wasm = wasm;
+        this.options = options;
+        this.zkConfigNonce = resolved.nonce;
+        this.circuitConfig = resolved.config;
+        this.layout = layoutFromCircuitConfig(resolved.config);
+    }
+    getZkConfigNonce() {
+        return this.zkConfigNonce;
+    }
+    getLayout() {
+        return this.layout;
+    }
+    /**
+     * Initialize the SDK by loading WASM modules.
+     *
+     * In Node.js, proving artifacts load from `zkArtifactBaseUrl` or
+     * `ZK_ARTIFACT_BASE_URL`, defaulting to this package's GitHub release.
+     * In browser, pass pre-loaded WASM via options:
+     * ```ts
+     * const sdk = await PrivacyPoolSDK.init({
+     *   wasmBinary: await fetch('/pkg/client_sdk_wasm_bg.wasm').then(r => r.arrayBuffer()),
+     *   zkArtifactBaseUrl: 'https://github.com/Polynom-Labs/stellar-privacy-layer-contracts/releases/download/v0.8.0',
+     * });
+     * ```
+     */
+    static async init(options) {
+        const opts = options ?? {};
+        const wasm = await loadWasm(opts.wasmBinary);
+        const resolved = resolveZkCircuitConfig(opts.zkCircuits, opts.zkConfigNonce);
+        const sdk = new PrivacyPoolSDK(wasm, opts, resolved);
+        sdk.circuitArtifacts = await resolveCircuitArtifacts(resolved.config, opts.zkArtifactBaseUrl);
+        return sdk;
+    }
+    /**
+     * Uniform 32-byte scalar as lowercase hex (Web Crypto). Same in browser and Node 19+.
+     */
+    static generateRandomScalarHex32() {
+        return generateRandomScalarHex32();
+    }
+    /**
+     * Text to sign with a Stellar wallet for spend-key derivation (UTF-8). No WASM required.
+     * The message binds network, pool, registry, and schema version (H6).
+     */
+    static buildStealthAddressSignMessage(address, domain, nonce = DEFAULT_STEALTH_SIGN_NONCE) {
+        return buildStealthAddressSignMessage(address, domain, nonce);
+    }
+    /**
+     * Generate a new coin with random nullifier, secret, and random owner-pub field elements (dev / self-contained tests).
+     * @param amount Decimal field element as `bigint` or decimal `string` (never JS `number`).
+     * @param assetHiDecimal / assetLoDecimal Decimal Fr strings for Stellar asset contract id (two limbs).
+     */
+    generateCoin(amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoin(coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Generate a coin with the same commitment shape as on-chain deposit: pass owner public key (hex x, y).
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinWithOwnerPub(ownerPub, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinWithOwnerPubHex(ownerPub.x, ownerPub.y, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Coin for a depositor `ephemeralKeyScalar` (32-byte hex): `coin.secret = Poseidon255(1)(scalar)` as in `deposit.circom`.
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinFromDepositEphemeralScalarHex(scalarHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinFromDepositEphemeralScalarHex(scalarHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Aligned deposit coin: `secret = Poseidon₁(scalar)` and owner pub from recipient hex coords.
+     * @param amount Decimal field element (`bigint` | `string`).
+     */
+    generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, amount, assetHiDecimal, assetLoDecimal, applicationIdDecimal = "0") {
+        return generatedCoinFromWasm(this.wasm.generateCoinForDepositWithOwnerPubHex(scalarHex, ownerXHex, ownerYHex, coinValueDecimal(amount), assetHiDecimal, assetLoDecimal, applicationIdDecimal));
+    }
+    /**
+     * Merkle root, path, and coin fields for the first withdraw leg (Rust LeanIMT + Poseidon).
+     */
+    buildWithdrawMerkleWitness(coin, state) {
+        const coinJson = JSON.stringify(coin);
+        const stateJson = JSON.stringify(state);
+        const resultJson = this.wasm.buildWithdrawMerkleWitness(coinJson, stateJson);
+        return JSON.parse(resultJson);
+    }
+    /**
+     * Full `Transaction(20,2,2)` withdrawal proof: one real withdraw + dummies, using coin/state and depositor ECDH point (hex).
+     *
+     * Optional **partial public withdraw**: spend the full coin commitment `coin.value` (V), send `publicWithdrawStroops` (W) to the
      * Stellar receiver, and re-deposit the remainder (V−W) as a new private note to `changeRecipientStealthAddress` (same circuit balance).
      */
     async proveWithdrawal(coin, state, params) {
         const witness = this.buildWithdrawMerkleWitness(coin, state);
-        const ownerPubHex = this.ecdhEphemeralPublicKeyFromScalarHex(BigInt(params.privKeyScalar).toString(16).padStart(64, '0'));
-        const w0 = withdrawObjectFromMerkleWitness(witness, ownerPubHex, params.applicationId ?? coin.application_id ?? '0', params.privKeyScalar);
+        const ownerPubHex = this.ecdhEphemeralPublicKeyFromScalarHex(BigInt(params.privKeyScalar).toString(16).padStart(64, "0"));
+        const w0 = withdrawObjectFromMerkleWitness(witness, ownerPubHex, params.applicationId ?? coin.application_id ?? "0", params.privKeyScalar);
         const fullV = BigInt(coin.value);
         let publicWithdrawals;
         let deposits;
         if (params.publicWithdrawStroops !== undefined) {
             const W = params.publicWithdrawStroops;
             if (params.changeRecipientStealthAddress === undefined) {
-                throw new Error('proveWithdrawal: changeRecipientStealthAddress is required when publicWithdrawStroops is set');
+                throw new Error("proveWithdrawal: changeRecipientStealthAddress is required when publicWithdrawStroops is set");
             }
             if (W <= 0n || W >= fullV) {
-                throw new Error('proveWithdrawal: publicWithdrawStroops must be strictly between 0 and coin.value');
+                throw new Error("proveWithdrawal: publicWithdrawStroops must be strictly between 0 and coin.value");
             }
             const change = fullV - W;
             publicWithdrawals = [W.toString()];
@@ -2195,29 +2590,29 @@ class PrivacyPoolSDK {
                 nullifier: randomFrDecimal(),
                 ephemeralKeyScalar: randomFrDecimal253(),
                 asset: [coin.asset_hi, coin.asset_lo],
-                applicationId: params.applicationId ?? '0',
+                applicationId: params.applicationId ?? "0",
                 recipientPublicKeys: recipientPublicKeysDecimalFromStealthAddress(params.changeRecipientStealthAddress),
             };
-            deposits = [changeDeposit, 'dummy'];
+            deposits = [changeDeposit];
         }
         else {
             publicWithdrawals = [coin.value];
-            deposits = ['dummy', 'dummy'];
+            deposits = [];
         }
         // On-chain `transact` sends `publicWithdrawals` / `publicWithdrawnAssets` to the withdraw account.
         const publicLegs = {
             publicWithdrawnAssets: [[coin.asset_hi, coin.asset_lo]],
-            publicDepositedAssets: [['0', '0']],
-            publicDeposits: ['0'],
+            publicDepositedAssets: [["0", "0"]],
+            publicDeposits: ["0"],
             publicWithdrawals,
         };
-        return this.proveTransaction({
+        return this.proveTransactionSlots({
             stateRoot: witness.stateRoot,
             withdrawAddressHi: params.withdrawAddressHi,
             withdrawAddressLo: params.withdrawAddressLo,
             privKeyScalar: params.privKeyScalar,
-        }, publicLegs, [w0, 'dummy'], deposits, params.audit
-            ?? resolveTransactionAuditParams(params.applicationId ?? coin.application_id ?? DEFAULT_APPLICATION_ID, DEMO_AUDIT_PUBLIC_KEY));
+        }, publicLegs, [w0], deposits, params.audit ??
+            resolveTransactionAuditParams(params.applicationId ?? coin.application_id ?? DEFAULT_APPLICATION_ID, DEMO_AUDIT_PUBLIC_KEY, this.layout.nAuditSlots));
     }
     /**
      * Convert a snarkjs proof JSON to hex bytes for Soroban.
@@ -2242,23 +2637,33 @@ class PrivacyPoolSDK {
         return this.wasm.ecdhSharedKey(scalarHex, recipientPubXHex, recipientPubYHex);
     }
     /**
-     * `Transaction(20,2,2)` proof from high-level legs: maps to witness input (incl. `"dummy"` ECDH via WASM), then Groth16 → Soroban hex.
-     *
-     * @param publicParams Public inputs: `stateRoot`, `withdrawAddressHi` / `withdrawAddressLo`, `privKeyScalar` (decimal field strings).
-     * @param publicLegs Public token legs (`publicWithdrawnAssets`, `publicDepositedAssets`, `publicDeposits`, `publicWithdrawals`).
-     * @param withdraws Exactly two withdraw slots (`WithdrawObject` or `"dummy"`).
-     * @param deposits Exactly two deposit slots (`DepositObject` or `"dummy"`).
+     * `Transaction(20,nIns,nOuts)` proof from high-level legs: maps to witness input (incl. `"dummy"` ECDH via WASM), then Groth16 → Soroban hex.
+     * Slots are padded to the selected ZK config layout (bundled 2×2 or 6×6).
      */
     async proveTransaction(publicParams, publicLegs, withdraws, deposits, audit) {
+        return this.proveTransactionSlots(publicParams, publicLegs, withdraws, deposits, audit);
+    }
+    async proveTransactionSlots(publicParams, publicLegs, withdraws, deposits, audit) {
         const wasmEcdh = {
             ecdhEphemeralPublicKeyFromScalarHex: (h) => this.wasm.ecdhEphemeralPublicKeyFromScalarHex(h),
         };
-        const witnessInput = buildTransactionWitnessInput(publicParams, publicLegs, withdraws, deposits, audit, wasmEcdh);
-        const wtns = await generateWitness(witnessInput, this.options.circuitWasm);
-        const { proof, publicSignals } = await generateProof(wtns, this.options.zkey);
+        const { nIns, nOuts, publicNInputs, publicNOutputs } = this.layout;
+        const witnessInput = buildTransactionWitnessInput(publicParams, publicLegs, withdraws, deposits, audit, wasmEcdh, { nIns, nOuts, publicNInputs, publicNOutputs });
+        const artifacts = this.circuitArtifacts;
+        if (!artifacts) {
+            throw new Error("PrivacyPoolSDK circuit artifacts are not loaded");
+        }
+        const proved = this.wasm.proveGroth16(artifacts.graph, artifacts.provingKey, artifacts.r1cs, JSON.stringify(witnessInput));
+        const encrypted = await encryptTransactionCiphertextBlob({
+            witness: witnessInput,
+            layout: this.layout,
+            ecdhShared: (priv, pubX, pubY) => this.wasm.ecdhSharedKey(priv, pubX, pubY),
+        });
         return {
-            proof_hex: this.proofToHex(proof),
-            public_hex: this.publicToHex(publicSignals),
+            proof_hex: proved.proof_hex,
+            public_hex: proved.public_hex,
+            ciphertext_hex: encrypted.ciphertextHex,
+            output_note_ephemeral_scalars: witnessInput.depositedEphemeralKeyScalars,
         };
     }
     /**
@@ -2297,6 +2702,11 @@ class PrivacyPoolSDK {
     }
 }
 
+/** @deprecated Witness generation is in the main SDK WASM (`proveGroth16`). */
+async function generateWitness(_input, _circuitWasm, _wasmFileName) {
+    throw new Error('generateWitness is removed. Call PrivacyPoolSDK.proveTransaction (graph witness + Groth16 in sdk.wasm).');
+}
+
 /** Pool Merkle tree depth (matches `coin::TREE_DEPTH` / `Transaction` circuit). */
 const POOL_MERKLE_TREE_DEPTH = 20;
 /** Default coin value in stroops (1 XLM); matches Rust `coin::COIN_VALUE`. */
@@ -2904,14 +3314,14 @@ const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(),
 
 const KYT_PASSAGE_AUTH_DOMAIN = 'privacy-pool-kyt-passage-v1';
 const PUBLIC_LEG_CONTEXT_DOMAIN = 'privacy-pool-public-leg-context-v1';
-const PASSAGE_ID_DOMAIN = 'privacy-pool-passage-id-v2';
+const PASSAGE_ID_DOMAIN = 'privacy-pool-passage-id-v3';
+const PASSAGE_ID_DOMAIN_V2 = 'privacy-pool-passage-id-v2';
 const PASSAGE_ID_DOMAIN_V1 = 'privacy-pool-passage-id-v1';
 const NOTE_AUDIT_LEN = 12;
 const TOTAL_PUBLIC_SIGNALS = 93;
 const NOTE_AUDIT_PLAINTEXT_LEN = 12;
 const FIELD_BYTES = 32;
 const LENGTH_PREFIX_BYTES = 4;
-const STATE_ROOT_SIGNAL_INDEX = 82;
 function sha256Hex(data) {
     return bytesToHex(sha256(data));
 }
@@ -2921,14 +3331,10 @@ function publicSignalsBuffer(publicSignalsBytes) {
         : publicSignalsBytes;
 }
 function expectedSignalCountForNonce(zkConfigNonce = 0n) {
-    if (zkConfigNonce !== 0n) {
-        throw new Error(`unknown zk config nonce ${zkConfigNonce.toString()}`);
-    }
-    return TOTAL_PUBLIC_SIGNALS;
+    return totalPublicSignals(layoutForKnownNonce(zkConfigNonce));
 }
 function stateRootIndexForNonce(zkConfigNonce = 0n) {
-    expectedSignalCountForNonce(zkConfigNonce);
-    return STATE_ROOT_SIGNAL_INDEX;
+    return stateRootIndex(layoutForKnownNonce(zkConfigNonce));
 }
 function parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce = 0n) {
     const expectedCount = expectedSignalCountForNonce(zkConfigNonce);
@@ -3066,9 +3472,19 @@ function hashPublicLegContext(layout, input) {
     }
     return sha256Hex(Buffer.concat(parts));
 }
-function derivePassageId(owner, nonce, publicSignalHash, publicLegContextHash) {
+function derivePassageId(owner, nonce, publicSignalHash, publicLegContextHash, ciphertextHash) {
+    const parts = [];
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN, 'utf8'));
+    appendAddressStrkey(parts, owner);
+    appendU64BE(parts, nonce);
+    appendBytes32(parts, publicSignalHash);
+    appendBytes32(parts, publicLegContextHash);
+    appendBytes32(parts, ciphertextHash);
+    return sha256Hex(Buffer.concat(parts));
+}
+function derivePassageIdV2(owner, nonce, publicSignalHash, publicLegContextHash) {
     const parts = [];
-    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN, 'utf8'));
+    appendBytes(parts, Buffer.from(PASSAGE_ID_DOMAIN_V2, 'utf8'));
     appendAddressStrkey(parts, owner);
     appendU64BE(parts, nonce);
     appendBytes32(parts, publicSignalHash);
@@ -3106,27 +3522,90 @@ function derivePassageFromTransactContext(input) {
     const nonce = BigInt(input.nonce ?? 0);
     const publicSignalHash = hashPublicSignalBytes(input.publicSignalsBytes, nonce);
     const publicLegContextHash = hashPublicLegContext(layout, input.publicLegContext);
-    const passageId = derivePassageId(input.owner, nonce, publicSignalHash, publicLegContextHash);
+    const zkLayout = layoutForKnownNonce(nonce);
+    const passageId = ciphertextsInPublicSignals(zkLayout)
+        ? derivePassageIdV2(input.owner, nonce, publicSignalHash, publicLegContextHash)
+        : derivePassageId(input.owner, nonce, publicSignalHash, publicLegContextHash, hashCiphertextBytes(input.ciphertextBytes ?? Buffer.alloc(0)));
     return {
         publicSignalHash,
         publicLegContextHash,
         passageId,
     };
 }
+function hashCiphertextBytes(ciphertextBytes) {
+    const buffer = typeof ciphertextBytes === 'string'
+        ? Buffer.from(ciphertextBytes.replace(/^0x/i, ''), 'hex')
+        : ciphertextBytes;
+    return sha256Hex(buffer);
+}
+function zeroBindingTagsInPublicSignals(publicSignalsBytes, zkConfigNonce = 0n) {
+    const layout = layoutForKnownNonce(zkConfigNonce);
+    if (ciphertextsInPublicSignals(layout)) {
+        return publicSignalsBuffer(publicSignalsBytes);
+    }
+    const parsed = parsePublicSignalsBytes(publicSignalsBytes, zkConfigNonce);
+    const zero = Buffer.alloc(FIELD_BYTES);
+    const auditStart = indexAuditTags(layout);
+    for (let slot = 0; slot < layout.nAuditSlots; slot += 1) {
+        parsed.fields[auditStart + slot] = Buffer.from(zero);
+    }
+    const outputStart = indexOutputNoteTags(layout);
+    for (let note = 0; note < layout.nOuts; note += 1) {
+        parsed.fields[outputStart + note] = Buffer.from(zero);
+    }
+    return encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix);
+}
+function spliceBindingTagsIntoPublicSignals(parameters) {
+    const layout = layoutForKnownNonce(parameters.zkConfigNonce);
+    const parsed = parsePublicSignalsBytes(parameters.publicSignalsBytes, parameters.zkConfigNonce);
+    const auditStart = indexAuditTags(layout);
+    for (let slot = 0; slot < layout.nAuditSlots; slot += 1) {
+        const tag = parameters.auditTags[slot];
+        if (tag !== undefined) {
+            parsed.fields[auditStart + slot] = fieldElementBuffer(tag);
+        }
+    }
+    const outputStart = indexOutputNoteTags(layout);
+    for (let note = 0; note < layout.nOuts; note += 1) {
+        const tag = parameters.outputNoteTags[note];
+        if (tag !== undefined) {
+            parsed.fields[outputStart + note] = fieldElementBuffer(tag);
+        }
+    }
+    return encodePublicSignalsBytes(parsed.fields, parsed.hasLengthPrefix);
+}
+function fieldElementBuffer(value) {
+    const trimmed = value.trim().replace(/^0x/i, '');
+    const asBigint = /^[0-9]+$/.test(trimmed)
+        ? BigInt(trimmed)
+        : BigInt(`0x${trimmed}`);
+    const buf = Buffer.alloc(FIELD_BYTES);
+    let remaining = asBigint;
+    for (let index = FIELD_BYTES - 1; index >= 0; index -= 1) {
+        buf[index] = Number(remaining & 0xffn);
+        remaining >>= 8n;
+    }
+    return buf;
+}
 async function inspectKytPassage(backendUrl, request) {
+    const nonce = BigInt(request.zkConfigNonce ?? 0);
+    const body = {
+        ...request,
+        publicSignalsBytes: zeroBindingTagsInPublicSignals(request.publicSignalsBytes, nonce).toString('hex'),
+    };
     const response = await fetch(`${backendUrl.replace(/\/$/, '')}/api/kyt/passages/inspect`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify(request),
+        body: JSON.stringify(body),
     });
     if (!response.ok) {
         throw new Error(`KYT inspect failed: ${response.status} ${await response.text()}`);
     }
-    const body = await response.json();
-    if (body.status !== 'approved') {
-        throw new Error(`KYT inspect rejected: ${JSON.stringify(body)}`);
+    const payload = await response.json();
+    if (payload.status !== 'approved') {
+        throw new Error(`KYT inspect rejected: ${JSON.stringify(payload)}`);
     }
-    return body;
+    return payload;
 }
 function signatureBase64ToBytes(signature) {
     const value = signature.trim();
@@ -3143,6 +3622,7 @@ var kytPassage = /*#__PURE__*/Object.freeze({
     NOTE_AUDIT_PLAINTEXT_LEN: NOTE_AUDIT_PLAINTEXT_LEN,
     PASSAGE_ID_DOMAIN: PASSAGE_ID_DOMAIN,
     PASSAGE_ID_DOMAIN_V1: PASSAGE_ID_DOMAIN_V1,
+    PASSAGE_ID_DOMAIN_V2: PASSAGE_ID_DOMAIN_V2,
     PUBLIC_LEG_CONTEXT_DOMAIN: PUBLIC_LEG_CONTEXT_DOMAIN,
     TOTAL_PUBLIC_SIGNALS: TOTAL_PUBLIC_SIGNALS,
     addressToCanonicalXdr: addressToCanonicalXdr,
@@ -3150,11 +3630,15 @@ var kytPassage = /*#__PURE__*/Object.freeze({
     derivePassageFromTransactContext: derivePassageFromTransactContext,
     derivePassageId: derivePassageId,
     derivePassageIdV1: derivePassageIdV1,
+    derivePassageIdV2: derivePassageIdV2,
+    hashCiphertextBytes: hashCiphertextBytes,
     hashPublicLegContext: hashPublicLegContext,
     hashPublicSignalBytes: hashPublicSignalBytes,
     inspectKytPassage: inspectKytPassage,
     signatureBase64ToBytes: signatureBase64ToBytes,
-    zeroAddressSentinelBuffer: zeroAddressSentinelBuffer
+    spliceBindingTagsIntoPublicSignals: spliceBindingTagsIntoPublicSignals,
+    zeroAddressSentinelBuffer: zeroAddressSentinelBuffer,
+    zeroBindingTagsInPublicSignals: zeroBindingTagsInPublicSignals
 });
 
 function addressToScVal(address) {
@@ -3196,6 +3680,7 @@ function poolTransactOperation(params) {
             nativeToScVal(params.nonce, { type: 'u64' }),
             xdr.ScVal.scvBytes(params.proofBytes),
             xdr.ScVal.scvBytes(params.publicSignalsBytes),
+            xdr.ScVal.scvBytes(params.ciphertextBytes ?? Buffer.alloc(0)),
             kytAuthorizationOptionToScVal(params.kytAuthorization),
         ],
     });
@@ -3340,6 +3825,7 @@ async function registerKytPassage(params) {
         owner: params.owner,
         nonce: params.nonce,
         publicSignalsBytes: params.publicSignalsBytes,
+        ciphertextBytes: params.ciphertextBytes,
         publicLegContext: params.publicLegContext,
     });
     await submitTransaction({
@@ -3389,6 +3875,7 @@ async function submitWithKytPassage(params) {
         owner: params.owner,
         nonce: params.nonce,
         publicSignalsBytes: params.publicSignalsBytes,
+        ciphertextBytes: params.ciphertextBytes,
         publicLegContext: params.publicLegContext,
     });
     if (approved.passageId.replace(/^0x/, '') !== derivation.passageId) {
@@ -3465,259 +3952,5 @@ async function sampleDerivedEscrowKey(recipientHi, recipientLo, startNonce = 1n,
     throw new Error(OUT_OF_RANGE_MESSAGE);
 }
 
-const NOTE_OUTPUT_LEN = 6;
-const OUTPUT_NOTE_TAG_DOMAIN = 3n;
-const STREAM_DOMAIN = 1n;
-const FR_SIZE = 32;
-const FR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
-const ONE = 1n;
-const ZERO = 0n;
-const BABYJUB_SCALAR_BITS = 253n;
-const SCALAR_253_MASK = (ONE << BABYJUB_SCALAR_BITS) - ONE;
-let primitivesPromise;
-function primitives() {
-    primitivesPromise ?? (primitivesPromise = Promise.all([
-        buildBabyjub(),
-        buildMimc7(),
-        buildPoseidon(),
-    ]).then(([babyJub, mimc7, poseidon]) => ({ babyJub, mimc7, poseidon })));
-    return primitivesPromise;
-}
-function normalizeHex(value) {
-    return value.trim().replace(/^0x/i, '').padStart(FR_SIZE * 2, '0');
-}
-function bigintFromHex(value) {
-    return BigInt(`0x${normalizeHex(value)}`);
-}
-function bigintFromDecimal(value) {
-    const parsed = BigInt(value);
-    return parsed % FR_MODULUS;
-}
-function bigintToFrHex(value) {
-    let v = moduleFr(value);
-    const buf = Buffer.alloc(FR_SIZE);
-    for (let index = FR_SIZE - 1; index >= 0; index -= 1) {
-        buf[index] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return buf.toString('hex');
-}
-function frDecimalToHex(value) {
-    return bigintToFrHex(bigintFromDecimal(value));
-}
-function frDecimalFromBigint(value) {
-    const reduced = value >= ZERO ? value % FR_MODULUS : (value % FR_MODULUS) + FR_MODULUS;
-    return reduced.toString(10);
-}
-function fieldBigint(field, value) {
-    return BigInt(field.toString(value));
-}
-function moduleFr(value) {
-    const reduced = value % FR_MODULUS;
-    return reduced >= ZERO ? reduced : reduced + FR_MODULUS;
-}
-function mimcHash(parameters) {
-    return fieldBigint(parameters.mimc7.F, parameters.mimc7.hash(parameters.mimc7.F.e(parameters.message), parameters.mimc7.F.e(parameters.key)));
-}
-function poseidonHash(poseidon, inputs) {
-    return fieldBigint(poseidon.F, poseidon(inputs.map((input) => poseidon.F.e(input))));
-}
-function deriveEncCipherKey(poseidon, sharedX) {
-    return poseidonHash(poseidon, [DOM_ENC, sharedX]);
-}
-function sharedKeyFromDepositor(parameters) {
-    const scalarHex = frDecimalToHex(parameters.ephemeralKeyScalarDecimal);
-    const shared = parameters.ecdhShared(scalarHex, frDecimalToHex(parameters.recipientPublicKey[0]), frDecimalToHex(parameters.recipientPublicKey[1]));
-    return [bigintFromHex(shared.x), bigintFromHex(shared.y)];
-}
-function sharedKeyFromRecipient(parameters) {
-    const { babyJub, recipientScalarHex, ephemeralPublicKey } = parameters;
-    const point = [
-        babyJub.F.e(bigintFromHex(ephemeralPublicKey[0])),
-        babyJub.F.e(bigintFromHex(ephemeralPublicKey[1])),
-    ];
-    if (!babyJub.inCurve(point)) {
-        throw new Error('Created ephemeral public key is not on BabyJubJub curve');
-    }
-    const product = babyJub.mulPointEscalar(point, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
-    return [
-        fieldBigint(babyJub.F, product[0]),
-        fieldBigint(babyJub.F, product[1]),
-    ];
-}
-function outputNoteTag(parameters) {
-    let accumulator = poseidonHash(parameters.poseidon, [
-        parameters.nonce,
-        OUTPUT_NOTE_TAG_DOMAIN,
-        BigInt(parameters.plaintext.length),
-    ]);
-    for (const field of parameters.plaintext) {
-        accumulator = poseidonHash(parameters.poseidon, [accumulator, field]);
-    }
-    return mimcHash({
-        mimc7: parameters.mimc7,
-        message: accumulator,
-        key: parameters.key,
-    });
-}
-function encryptFields(parameters) {
-    return parameters.plaintext.map((field, index) => {
-        const seed = poseidonHash(parameters.poseidon, [
-            parameters.nonce,
-            STREAM_DOMAIN,
-            BigInt(index),
-        ]);
-        const stream = mimcHash({
-            mimc7: parameters.mimc7,
-            message: seed,
-            key: parameters.key,
-        });
-        return moduleFr(field + stream);
-    });
-}
-function decryptFields(parameters) {
-    return parameters.ciphertext.map((field, index) => {
-        const seed = poseidonHash(parameters.poseidon, [
-            parameters.nonce,
-            STREAM_DOMAIN,
-            BigInt(index),
-        ]);
-        const stream = mimcHash({
-            mimc7: parameters.mimc7,
-            message: seed,
-            key: parameters.key,
-        });
-        return moduleFr(bigintFromHex(field) - stream);
-    });
-}
-function plaintextBigints(plaintext) {
-    return [
-        bigintFromDecimal(plaintext.value),
-        bigintFromDecimal(plaintext.assetHi),
-        bigintFromDecimal(plaintext.assetLo),
-        bigintFromDecimal(plaintext.nullifier),
-        bigintFromDecimal(plaintext.secret),
-        bigintFromDecimal(plaintext.applicationId),
-    ];
-}
-function plaintextFromBigints(fields) {
-    return {
-        value: frDecimalFromBigint(fields[0] ?? ZERO),
-        assetHi: frDecimalFromBigint(fields[1] ?? ZERO),
-        assetLo: frDecimalFromBigint(fields[2] ?? ZERO),
-        nullifier: frDecimalFromBigint(fields[3] ?? ZERO),
-        secret: frDecimalFromBigint(fields[4] ?? ZERO),
-        applicationId: frDecimalFromBigint(fields[5] ?? ZERO),
-    };
-}
-async function secretFromDepositEphemeralScalarDecimal(ephemeralKeyScalarDecimal) {
-    const { poseidon } = await primitives();
-    const secret = poseidonHash(poseidon, [bigintFromDecimal(ephemeralKeyScalarDecimal)]);
-    return frDecimalFromBigint(secret);
-}
-async function encryptOutputNoteForDeposit(parameters) {
-    const { babyJub, mimc7, poseidon } = await primitives();
-    const secret = await secretFromDepositEphemeralScalarDecimal(parameters.deposit.ephemeralKeyScalar);
-    const plaintext = {
-        value: parameters.deposit.value,
-        assetHi: parameters.deposit.asset[0],
-        assetLo: parameters.deposit.asset[1],
-        nullifier: parameters.deposit.nullifier,
-        secret,
-        applicationId: parameters.deposit.applicationId,
-    };
-    const [sharedX, sharedY] = sharedKeyFromDepositor({
-        babyJub,
-        ecdhShared: parameters.ecdhShared,
-        ephemeralKeyScalarDecimal: parameters.deposit.ephemeralKeyScalar,
-        recipientPublicKey: parameters.deposit.recipientPublicKeys,
-    });
-    const key = deriveEncCipherKey(poseidon, sharedX);
-    const nonce = sharedY;
-    const message = plaintextBigints(plaintext);
-    const ciphertext = encryptFields({ mimc7, poseidon, key, nonce, plaintext: message });
-    const tag = outputNoteTag({ mimc7, poseidon, key, nonce, plaintext: message });
-    return {
-        ciphertext: ciphertext.map((field) => frDecimalFromBigint(field)),
-        tag: frDecimalFromBigint(tag),
-    };
-}
-function ownerPubFromRecipientScalar(babyJub, recipientScalarHex) {
-    const product = babyJub.mulPointEscalar(babyJub.Base8, bigintFromHex(recipientScalarHex) & SCALAR_253_MASK);
-    return [
-        fieldBigint(babyJub.F, product[0]),
-        fieldBigint(babyJub.F, product[1]),
-    ];
-}
-function commitmentFromPlaintextAndOwnerPub(parameters) {
-    const ownerKeyHash = poseidonHash(parameters.poseidon, [
-        parameters.ownerPub[0],
-        parameters.ownerPub[1],
-    ]);
-    const precommitment = poseidonHash(parameters.poseidon, [
-        bigintFromDecimal(parameters.plaintext.secret),
-        parameters.ownerMode,
-        ownerKeyHash,
-    ]);
-    const balance = poseidonHash(parameters.poseidon, [
-        bigintFromDecimal(parameters.plaintext.value),
-        bigintFromDecimal(parameters.plaintext.assetHi),
-        bigintFromDecimal(parameters.plaintext.assetLo),
-    ]);
-    const appCommitment = poseidonHash(parameters.poseidon, [
-        bigintFromDecimal(parameters.plaintext.applicationId),
-        balance,
-        precommitment,
-    ]);
-    const commitment = poseidonHash(parameters.poseidon, [
-        bigintFromDecimal(parameters.plaintext.nullifier),
-        appCommitment,
-    ]);
-    return normalizeHex(commitment.toString(16));
-}
-async function decryptOutputNoteEvent(input) {
-    const { babyJub, mimc7, poseidon } = await primitives();
-    const [sharedX, sharedY] = sharedKeyFromRecipient({
-        babyJub,
-        recipientScalarHex: input.recipientScalarHex,
-        ephemeralPublicKey: input.createdEphemeralKey,
-    });
-    const key = deriveEncCipherKey(poseidon, sharedX);
-    const nonce = sharedY;
-    const decrypted = decryptFields({
-        mimc7,
-        poseidon,
-        key,
-        nonce,
-        ciphertext: input.ciphertext,
-    });
-    const expectedTag = outputNoteTag({
-        mimc7,
-        poseidon,
-        key,
-        nonce,
-        plaintext: decrypted,
-    });
-    if (expectedTag !== bigintFromHex(input.tag)) {
-        throw new Error('Output note tag verification failed');
-    }
-    const plaintext = plaintextFromBigints(decrypted);
-    const commitmentHex = commitmentFromPlaintextAndOwnerPub({
-        poseidon,
-        plaintext,
-        ownerPub: ownerPubFromRecipientScalar(babyJub, input.recipientScalarHex),
-        ownerMode: input.ownerMode ?? 0n,
-    });
-    const commitmentMatches = normalizeHex(input.commitmentHashHex) === commitmentHex;
-    if (!commitmentMatches) {
-        throw new Error('Output note commitment checksum mismatch');
-    }
-    return {
-        ...plaintext,
-        commitmentHex,
-        commitmentMatches,
-    };
-}
-
-export { BABYJUB_SUBGROUP_ORDER, BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE, BN254_SCALAR_MOD, COIN_VALUE_STROOPS, DECODED_EPHEMERAL_HRP, DEFAULT_APPLICATION_ID, DEFAULT_STEALTH_SIGN_NONCE, DEMO_AUDIT_PUBLIC_KEY, DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, DOM_ENC, DOM_ESCROW, DOM_NULLIFIER, DOM_PADDING, NOTE_AUDIT_LEN as KYT_NOTE_AUDIT_LEN, NOTE_AUDIT_LEN$1 as NOTE_AUDIT_LEN, NOTE_AUDIT_PLAINTEXT_LEN, NOTE_OUTPUT_LEN$1 as NOTE_OUTPUT_LEN, NOTE_OUTPUT_LEN as OUTPUT_NOTE_LEN, OWNER_BOUND_NOTE_SCHEMA_VERSION, POOL_MERKLE_TREE_DEPTH, PrivacyPoolSDK, SPEND_SCALAR_DOMAIN_TAG, STEALTH_ADDRESS_HRP, TOTAL_PUBLIC_SIGNALS, TRANSACTION_N_AUDIT_SLOTS, TRANSACTION_N_INS, TRANSACTION_N_OUTS, TRANSACTION_TREE_DEPTH, addressToCanonicalXdr, buildKytPassageAuthorization, buildStealthAddressSignMessage, buildTransactionWitnessInput, buildUniformAuditParams, canonicalBabyJubScalarFromInteger, coordHexToDecimal, decodeDecodedEphemeralKey, decodeDepositorSharedSecretPreimage, decodeStealthAddress, decryptOutputNoteEvent, derivePassageFromTransactContext, derivePassageId, derivePassageIdV1, derivedEscrowKey, ed25519PubkeyPayloadHexToWithdrawFrDecimals, encodeDecodedEphemeralKey, encodeDepositorSharedSecretPreimage, encodeStealthAddress, encryptOutputNoteForDeposit, generateRandomScalarHex32, generateWitness, hashPublicLegContext, hashPublicSignalBytes, inspectKytPassage, localSignKytPassageAuthorization, planKytSubmit, privKeyScalarDecimalFromStellarSignature, randomFrDecimal, randomFrDecimal253, recipientPublicKeysDecimalFromStealthAddress, registerKytPassage, resolveAuditPublicKeyFromEnv, resolveDepositsForWitness, resolveSlotApplicationIds, resolveSpendScalarSchemaVersion, resolveTransactionAuditParams, sampleDerivedEscrowKey, scalarHexToFrDecimal, secretFromDepositEphemeralScalarDecimal, sharedSecretFromDepositorPreimage, sharedSecretFromRecipientPreimage, spendScalarHexFromStellarSignature, stellarContractAddressToAssetFrDecimals, submitApprovedKytPassage, submitPoolTransact, submitWithKytPassage, withApplicationIdOnDeposit, withApplicationIdOnWithdraw, withdrawObjectFromMerkleWitness, zeroAddressSentinelBuffer };
+export { BABYJUB_SUBGROUP_ORDER, BINDING_ZK_NONCE, BN254_BABYJUB_SCALAR_MAX_EXCLUSIVE, BN254_SCALAR_MOD, BundledZkCircuit, COIN_VALUE_STROOPS, COMMITMENT_V2_ZK_NONCE, DECODED_EPHEMERAL_HRP, DEFAULT_APPLICATION_ID, DEFAULT_STEALTH_SIGN_NONCE, DEFAULT_ZK_CIRCUITS, DEFAULT_ZK_CONFIG_NONCE, DEMO_AUDIT_PUBLIC_KEY, DEPOSITOR_SHARED_SECRET_PREIMAGE_HRP, DOM_ENC, DOM_ESCROW, DOM_NULLIFIER, DOM_PADDING, NOTE_AUDIT_LEN as KYT_NOTE_AUDIT_LEN, LEGACY_ZK_NONCE, NOTE_AUDIT_LEN$2 as NOTE_AUDIT_LEN, NOTE_AUDIT_PLAINTEXT_LEN, NOTE_OUTPUT_LEN$1 as NOTE_OUTPUT_LEN, NOTE_OUTPUT_LEN as OUTPUT_NOTE_LEN, OWNER_BOUND_NOTE_SCHEMA_VERSION, POOL_MERKLE_TREE_DEPTH, PrivacyPoolSDK, SIX_BY_SIX_BINDING_ZK_NONCE, SIX_BY_SIX_ZK_NONCE, SPEND_SCALAR_DOMAIN_TAG, STEALTH_ADDRESS_HRP, TOTAL_PUBLIC_SIGNALS, TRANSACTION_N_AUDIT_SLOTS, TRANSACTION_N_INS, TRANSACTION_N_OUTS, TRANSACTION_TREE_DEPTH, ZK_ARTIFACT_GITHUB_REPO, ZK_SDK_PACKAGE_VERSION, addressToCanonicalXdr, auditEphemeralPublicKeyCount, buildKytPassageAuthorization, buildStealthAddressSignMessage, buildTransactionWitnessInput, buildUniformAuditParams, bundledCircuitFileNames, canonicalBabyJubScalarFromInteger, ciphertextFieldCount, ciphertextsInPublicSignals, circuitProfileFromName, circuitProfileFromNonce, coordHexToDecimal, decodeCiphertextBlob, decodeDecodedEphemeralKey, decodeDepositorSharedSecretPreimage, decodeStealthAddress, decryptOutputNoteEvent, defaultZkArtifactBaseUrl, derivePassageFromTransactContext, derivePassageId, derivePassageIdV1, derivePassageIdV2, derivedEscrowKey, ed25519PubkeyPayloadHexToWithdrawFrDecimals, encodeCiphertextBlob, encodeDecodedEphemeralKey, encodeDepositorSharedSecretPreimage, encodeStealthAddress, encodeTransactionCiphertextBlob, encryptNoteAuditSlot, encryptOutputNoteForDeposit, encryptTransactionCiphertextBlob, generateRandomScalarHex32, generateWitness, hashCiphertextBytes, hashPublicLegContext, hashPublicSignalBytes, indexAuditTags, indexOutputNoteTags, inspectKytPassage, layoutForKnownNonce, layoutFromCircuitConfig, localSignKytPassageAuthorization, padDepositSlots, padPublicLegs, padWithdrawSlots, planKytSubmit, poseidonMacTag, privKeyScalarDecimalFromStellarSignature, randomFrDecimal, randomFrDecimal253, recipientPublicKeysDecimalFromStealthAddress, registerKytPassage, resolveAuditPublicKeyFromEnv, resolveDepositsForWitness, resolveSlotApplicationIds, resolveSpendScalarSchemaVersion, resolveTransactionAuditParams, resolveZkCircuitConfig, sampleDerivedEscrowKey, scalarHexToFrDecimal, secretFromDepositEphemeralScalarDecimal, sharedSecretFromDepositorPreimage, sharedSecretFromRecipientPreimage, sixBySixBindingLayout, sixBySixLayout, spendScalarHexFromStellarSignature, spliceBindingTagsIntoPublicSignals, splitCiphertextBlob, standardBindingLayout, standardLayout, stateRootIndex, stellarContractAddressToAssetFrDecimals, submitApprovedKytPassage, submitPoolTransact, submitWithKytPassage, totalPublicSignals, withApplicationIdOnDeposit, withApplicationIdOnWithdraw, withdrawObjectFromMerkleWitness, zeroAddressSentinelBuffer, zeroBindingTagsInPublicSignals };
 //# sourceMappingURL=index.mjs.map