@invisi-labs/primitives 0.0.0-stage → 1.2.0

package/dist/credit.cjs

@@ -0,0 +1,1113 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod3) => __copyProps(__defProp({}, "__esModule", { value: true }), mod3);
+
+// src/credit/index.ts
+var credit_exports = {};
+__export(credit_exports, {
+  CREDIT_POLICY_FIELDS: () => CREDIT_POLICY_FIELDS,
+  CREDIT_USAGE_FIELDS: () => CREDIT_USAGE_FIELDS,
+  applyCreditDrawUsage: () => applyCreditDrawUsage,
+  computeCreditCommitment: () => computeCreditCommitment,
+  computeCreditNullifier: () => computeCreditNullifier,
+  computeCreditRecoveryPad: () => computeCreditRecoveryPad,
+  computeCreditSharedKeyHash: () => computeCreditSharedKeyHash,
+  creditPeriods: () => creditPeriods,
+  decryptCreditState: () => decryptCreditState,
+  deriveCreditState: () => deriveCreditState,
+  deriveCreditStateNonce: () => deriveCreditStateNonce,
+  deriveCreditUpdate: () => deriveCreditUpdate,
+  encryptCreditState: () => encryptCreditState,
+  normalizeCreditDeliveryState: () => normalizeCreditDeliveryState,
+  normalizeCreditPolicy: () => normalizeCreditPolicy,
+  normalizeCreditState: () => normalizeCreditState,
+  normalizeCreditUsage: () => normalizeCreditUsage,
+  recoverCreditState: () => recoverCreditState
+});
+module.exports = __toCommonJS(credit_exports);
+
+// src/crypto/domains.ts
+var D_CREDIT = 5n;
+var D_CNULL = 6n;
+var D_CREDIT_KEY_HASH = 7n;
+var D_CREDIT_RECOVERY = 9n;
+var D_CREDIT_STATE_NONCE = 10n;
+
+// src/crypto/random.ts
+var FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+
+// src/crypto/poseidon-constants.ts
+var INTERNAL_DIAGONAL = [
+  0x10dc6e9c006ea38b04b1e03b4bd9490c0d03f98929ca1d7fb56821fd19d3b6e7n,
+  0x0c28145b6a44df3e0149b3d0a30b3bb599df9756d4dd9b84a86b38cfb45a740bn,
+  0x00544b8338791518b2c7645a50392798b21f75bb60e3596170067d00141cac15n,
+  0x222c01175718386f2e2e82eb122789e352e105a3b8fa852613bc534433ee428bn
+];
+var ROUND_CONSTANTS = [
+  [
+    0x19b849f69450b06848da1d39bd5e4a4302bb86744edc26238b0878e269ed23e5n,
+    0x265ddfe127dd51bd7239347b758f0a1320eb2cc7450acc1dad47f80c8dcf34d6n,
+    0x199750ec472f1809e0f66a545e1e51624108ac845015c2aa3dfc36bab497d8aan,
+    0x157ff3fe65ac7208110f06a5f74302b14d743ea25067f0ffd032f787c7f1cdf8n
+  ],
+  [
+    0x2e49c43c4569dd9c5fd35ac45fca33f10b15c590692f8beefe18f4896ac94902n,
+    0x0e35fb89981890520d4aef2b6d6506c3cb2f0b6973c24fa82731345ffa2d1f1en,
+    0x251ad47cb15c4f1105f109ae5e944f1ba9d9e7806d667ffec6fe723002e0b996n,
+    0x13da07dc64d428369873e97160234641f8beb56fdd05e5f3563fa39d9c22df4en
+  ],
+  [
+    0x0c009b84e650e6d23dc00c7dccef7483a553939689d350cd46e7b89055fd4738n,
+    0x011f16b1c63a854f01992e3956f42d8b04eb650c6d535eb0203dec74befdca06n,
+    0x0ed69e5e383a688f209d9a561daa79612f3f78d0467ad45485df07093f367549n,
+    0x04dba94a7b0ce9e221acad41472b6bbe3aec507f5eb3d33f463672264c9f789bn
+  ],
+  [
+    0x0a3f2637d840f3a16eb094271c9d237b6036757d4bb50bf7ce732ff1d4fa28e8n,
+    0x259a666f129eea198f8a1c502fdb38fa39b1f075569564b6e54a485d1182323fn,
+    0x28bf7459c9b2f4c6d8e7d06a4ee3a47f7745d4271038e5157a32fdf7ede0d6a1n,
+    0x0a1ca941f057037526ea200f489be8d4c37c85bbcce6a2aeec91bd6941432447n
+  ],
+  [0x0c6f8f958be0e93053d7fd4fc54512855535ed1539f051dcb43a26fd926361cfn, 0x0n, 0x0n, 0x0n],
+  [0x123106a93cd17578d426e8128ac9d90aa9e8a00708e296e084dd57e69caaf811n, 0x0n, 0x0n, 0x0n],
+  [0x26e1ba52ad9285d97dd3ab52f8e840085e8fa83ff1e8f1877b074867cd2dee75n, 0x0n, 0x0n, 0x0n],
+  [0x1cb55cad7bd133de18a64c5c47b9c97cbe4d8b7bf9e095864471537e6a4ae2c5n, 0x0n, 0x0n, 0x0n],
+  [0x1dcd73e46acd8f8e0e2c7ce04bde7f6d2a53043d5060a41c7143f08e6e9055d0n, 0x0n, 0x0n, 0x0n],
+  [0x011003e32f6d9c66f5852f05474a4def0cda294a0eb4e9b9b12b9bb4512e5574n, 0x0n, 0x0n, 0x0n],
+  [0x2b1e809ac1d10ab29ad5f20d03a57dfebadfe5903f58bafed7c508dd2287ae8cn, 0x0n, 0x0n, 0x0n],
+  [0x2539de1785b735999fb4dac35ee17ed0ef995d05ab2fc5faeaa69ae87bcec0a5n, 0x0n, 0x0n, 0x0n],
+  [0x0c246c5a2ef8ee0126497f222b3e0a0ef4e1c3d41c86d46e43982cb11d77951dn, 0x0n, 0x0n, 0x0n],
+  [0x192089c4974f68e95408148f7c0632edbb09e6a6ad1a1c2f3f0305f5d03b527bn, 0x0n, 0x0n, 0x0n],
+  [0x1eae0ad8ab68b2f06a0ee36eeb0d0c058529097d91096b756d8fdc2fb5a60d85n, 0x0n, 0x0n, 0x0n],
+  [0x179190e5d0e22179e46f8282872abc88db6e2fdc0dee99e69768bd98c5d06bfbn, 0x0n, 0x0n, 0x0n],
+  [0x29bb9e2c9076732576e9a81c7ac4b83214528f7db00f31bf6cafe794a9b3cd1cn, 0x0n, 0x0n, 0x0n],
+  [0x225d394e42207599403efd0c2464a90d52652645882aac35b10e590e6e691e08n, 0x0n, 0x0n, 0x0n],
+  [0x064760623c25c8cf753d238055b444532be13557451c087de09efd454b23fd59n, 0x0n, 0x0n, 0x0n],
+  [0x10ba3a0e01df92e87f301c4b716d8a394d67f4bf42a75c10922910a78f6b5b87n, 0x0n, 0x0n, 0x0n],
+  [0x0e070bf53f8451b24f9c6e96b0c2a801cb511bc0c242eb9d361b77693f21471cn, 0x0n, 0x0n, 0x0n],
+  [0x1b94cd61b051b04dd39755ff93821a73ccd6cb11d2491d8aa7f921014de252fbn, 0x0n, 0x0n, 0x0n],
+  [0x1d7cb39bafb8c744e148787a2e70230f9d4e917d5713bb050487b5aa7d74070bn, 0x0n, 0x0n, 0x0n],
+  [0x2ec93189bd1ab4f69117d0fe980c80ff8785c2961829f701bb74ac1f303b17dbn, 0x0n, 0x0n, 0x0n],
+  [0x2db366bfdd36d277a692bb825b86275beac404a19ae07a9082ea46bd83517926n, 0x0n, 0x0n, 0x0n],
+  [0x062100eb485db06269655cf186a68532985275428450359adc99cec6960711b8n, 0x0n, 0x0n, 0x0n],
+  [0x0761d33c66614aaa570e7f1e8244ca1120243f92fa59e4f900c567bf41f5a59bn, 0x0n, 0x0n, 0x0n],
+  [0x20fc411a114d13992c2705aa034e3f315d78608a0f7de4ccf7a72e494855ad0dn, 0x0n, 0x0n, 0x0n],
+  [0x25b5c004a4bdfcb5add9ec4e9ab219ba102c67e8b3effb5fc3a30f317250bc5an, 0x0n, 0x0n, 0x0n],
+  [0x23b1822d278ed632a494e58f6df6f5ed038b186d8474155ad87e7dff62b37f4bn, 0x0n, 0x0n, 0x0n],
+  [0x22734b4c5c3f9493606c4ba9012499bf0f14d13bfcfcccaa16102a29cc2f69e0n, 0x0n, 0x0n, 0x0n],
+  [0x26c0c8fe09eb30b7e27a74dc33492347e5bdff409aa3610254413d3fad795ce5n, 0x0n, 0x0n, 0x0n],
+  [0x070dd0ccb6bd7bbae88eac03fa1fbb26196be3083a809829bbd626df348ccad9n, 0x0n, 0x0n, 0x0n],
+  [0x12b6595bdb329b6fb043ba78bb28c3bec2c0a6de46d8c5ad6067c4ebfd4250dan, 0x0n, 0x0n, 0x0n],
+  [0x248d97d7f76283d63bec30e7a5876c11c06fca9b275c671c5e33d95bb7e8d729n, 0x0n, 0x0n, 0x0n],
+  [0x1a306d439d463b0816fc6fd64cc939318b45eb759ddde4aa106d15d9bd9baaaan, 0x0n, 0x0n, 0x0n],
+  [0x28a8f8372e3c38daced7c00421cb4621f4f1b54ddc27821b0d62d3d6ec7c56cfn, 0x0n, 0x0n, 0x0n],
+  [0x0094975717f9a8a8bb35152f24d43294071ce320c829f388bc852183e1e2ce7en, 0x0n, 0x0n, 0x0n],
+  [0x04d5ee4c3aa78f7d80fde60d716480d3593f74d4f653ae83f4103246db2e8d65n, 0x0n, 0x0n, 0x0n],
+  [0x2a6cf5e9aa03d4336349ad6fb8ed2269c7bef54b8822cc76d08495c12efde187n, 0x0n, 0x0n, 0x0n],
+  [0x2304d31eaab960ba9274da43e19ddeb7f792180808fd6e43baae48d7efcba3f3n, 0x0n, 0x0n, 0x0n],
+  [0x03fd9ac865a4b2a6d5e7009785817249bff08a7e0726fcb4e1c11d39d199f0b0n, 0x0n, 0x0n, 0x0n],
+  [0x00b7258ded52bbda2248404d55ee5044798afc3a209193073f7954d4d63b0b64n, 0x0n, 0x0n, 0x0n],
+  [0x159f81ada0771799ec38fca2d4bf65ebb13d3a74f3298db36272c5ca65e92d9an, 0x0n, 0x0n, 0x0n],
+  [0x1ef90e67437fbc8550237a75bc28e3bb9000130ea25f0c5471e144cf4264431fn, 0x0n, 0x0n, 0x0n],
+  [0x1e65f838515e5ff0196b49aa41a2d2568df739bc176b08ec95a79ed82932e30dn, 0x0n, 0x0n, 0x0n],
+  [0x2b1b045def3a166cec6ce768d079ba74b18c844e570e1f826575c1068c94c33fn, 0x0n, 0x0n, 0x0n],
+  [0x0832e5753ceb0ff6402543b1109229c165dc2d73bef715e3f1c6e07c168bb173n, 0x0n, 0x0n, 0x0n],
+  [0x02f614e9cedfb3dc6b762ae0a37d41bab1b841c2e8b6451bc5a8e3c390b6ad16n, 0x0n, 0x0n, 0x0n],
+  [0x0e2427d38bd46a60dd640b8e362cad967370ebb777bedff40f6a0be27e7ed705n, 0x0n, 0x0n, 0x0n],
+  [0x0493630b7c670b6deb7c84d414e7ce79049f0ec098c3c7c50768bbe29214a53an, 0x0n, 0x0n, 0x0n],
+  [0x22ead100e8e482674decdab17066c5a26bb1515355d5461a3dc06cc85327cea9n, 0x0n, 0x0n, 0x0n],
+  [0x25b3e56e655b42cdaae2626ed2554d48583f1ae35626d04de5084e0b6d2a6f16n, 0x0n, 0x0n, 0x0n],
+  [0x1e32752ada8836ef5837a6cde8ff13dbb599c336349e4c584b4fdc0a0cf6f9d0n, 0x0n, 0x0n, 0x0n],
+  [0x2fa2a871c15a387cc50f68f6f3c3455b23c00995f05078f672a9864074d412e5n, 0x0n, 0x0n, 0x0n],
+  [0x2f569b8a9a4424c9278e1db7311e889f54ccbf10661bab7fcd18e7c7a7d83505n, 0x0n, 0x0n, 0x0n],
+  [0x044cb455110a8fdd531ade530234c518a7df93f7332ffd2144165374b246b43dn, 0x0n, 0x0n, 0x0n],
+  [0x227808de93906d5d420246157f2e42b191fe8c90adfe118178ddc723a5319025n, 0x0n, 0x0n, 0x0n],
+  [0x02fcca2934e046bc623adead873579865d03781ae090ad4a8579d2e7a6800355n, 0x0n, 0x0n, 0x0n],
+  [0x0ef915f0ac120b876abccceb344a1d36bad3f3c5ab91a8ddcbec2e060d8befacn, 0x0n, 0x0n, 0x0n],
+  [
+    0x1797130f4b7a3e1777eb757bc6f287f6ab0fb85f6be63b09f3b16ef2b1405d38n,
+    0x0a76225dc04170ae3306c85abab59e608c7f497c20156d4d36c668555decc6e5n,
+    0x1fffb9ec1992d66ba1e77a7b93209af6f8fa76d48acb664796174b5326a31a5cn,
+    0x25721c4fc15a3f2853b57c338fa538d85f8fbba6c6b9c6090611889b797b9c5fn
+  ],
+  [
+    0x0c817fd42d5f7a41215e3d07ba197216adb4c3790705da95eb63b982bfcaf75an,
+    0x13abe3f5239915d39f7e13c2c24970b6df8cf86ce00a22002bc15866e52b5a96n,
+    0x2106feea546224ea12ef7f39987a46c85c1bc3dc29bdbd7a92cd60acb4d391cen,
+    0x21ca859468a746b6aaa79474a37dab49f1ca5a28c748bc7157e1b3345bb0f959n
+  ],
+  [
+    0x05ccd6255c1e6f0c5cf1f0df934194c62911d14d0321662a8f1a48999e34185bn,
+    0x0f0e34a64b70a626e464d846674c4c8816c4fb267fe44fe6ea28678cb09490a4n,
+    0x0558531a4e25470c6157794ca36d0e9647dbfcfe350d64838f5b1a8a2de0d4bfn,
+    0x09d3dca9173ed2faceea125157683d18924cadad3f655a60b72f5864961f1455n
+  ],
+  [
+    0x0328cbd54e8c0913493f866ed03d218bf23f92d68aaec48617d4c722e5bd4335n,
+    0x2bf07216e2aff0a223a487b1a7094e07e79e7bcc9798c648ee3347dd5329d34bn,
+    0x1daf345a58006b736499c583cb76c316d6f78ed6a6dffc82111e11a63fe412dfn,
+    0x176563472456aaa746b694c60e1823611ef39039b2edc7ff391e6f2293d2c404n
+  ]
+];
+
+// src/crypto/poseidon.ts
+var mod = (n) => n % FIELD_MODULUS;
+var fifth = (n) => {
+  const x = mod(n), x2 = mod(x * x);
+  return mod(x * x2 * x2);
+};
+function external(s) {
+  const t0 = s[0] + s[1], t1 = s[2] + s[3], t2 = 2n * s[1] + t1, t3 = 2n * s[3] + t0;
+  const t4 = 4n * t1 + t3, t5 = 4n * t0 + t2;
+  s[0] = mod(t3 + t5);
+  s[1] = mod(t5);
+  s[2] = mod(t2 + t4);
+  s[3] = mod(t4);
+}
+function permute(s) {
+  external(s);
+  for (let r = 0; r < 64; r++) {
+    const full = r < 4 || r >= 60, rc = ROUND_CONSTANTS[r];
+    if (full) {
+      for (let i = 0; i < 4; i++) s[i] = fifth(s[i] + rc[i]);
+      external(s);
+    } else {
+      s[0] = fifth(s[0] + rc[0]);
+      const sum = s.reduce((a, b) => a + b, 0n);
+      for (let i = 0; i < 4; i++) s[i] = mod(s[i] * INTERNAL_DIAGONAL[i] + sum);
+    }
+  }
+}
+async function poseidonHash(inputs) {
+  for (let i = 0; i < inputs.length; i++)
+    if (inputs[i] < 0n || inputs[i] >= FIELD_MODULUS)
+      throw new RangeError(
+        `poseidonHash: input[${i}] out of BN254 field range [0, FIELD_MODULUS): ${inputs[i]}`
+      );
+  const state = [0n, 0n, 0n, BigInt(inputs.length) << 64n];
+  let used = 0;
+  for (const input of inputs) {
+    if (used === 3) {
+      permute(state);
+      used = 0;
+    }
+    state[used] = mod(state[used] + input);
+    used++;
+  }
+  permute(state);
+  return `0x${state[0].toString(16).padStart(64, "0")}`;
+}
+
+// src/notes/noteContext.ts
+function assertNoteContext(note, context) {
+  if (note.chainId !== context.chainId || note.protocolAddress !== context.protocolAddress) {
+    throw new Error("note context mismatch");
+  }
+}
+
+// src/credit/state.ts
+var CREDIT_POLICY_FIELDS = ["singleLimit", "dailyLimit", "monthlyLimit"];
+var CREDIT_USAGE_FIELDS = [
+  "lastDay",
+  "dailySpent",
+  "lastMonth",
+  "monthlySpent",
+  "totalSpent"
+];
+function normalizeCreditPolicy(value = {}) {
+  return Object.fromEntries(
+    CREDIT_POLICY_FIELDS.map((key) => {
+      const n = value[key] ?? 0n;
+      uint(n, 126, key);
+      return [key, n];
+    })
+  );
+}
+function normalizeCreditUsage(value = {}) {
+  const usage = Object.fromEntries(
+    CREDIT_USAGE_FIELDS.map((key) => {
+      const n = value[key] ?? 0n;
+      uint(n, key === "lastDay" || key === "lastMonth" ? 64 : 128, key);
+      return [key, n];
+    })
+  );
+  for (const [period, spent] of [
+    ["lastDay", "dailySpent"],
+    ["lastMonth", "monthlySpent"]
+  ])
+    if (usage[period] === 0n && usage[spent] !== 0n) throw Error("noncanonical Credit usage");
+  return usage;
+}
+function balance(value) {
+  uint(value.availableCredit, 128, "availableCredit");
+  if (typeof value.unlimited !== "boolean") throw TypeError("unlimited must be boolean");
+  if (value.unlimited && value.availableCredit !== 0n)
+    throw Error("unlimited Credit must have zero available credit");
+  return { availableCredit: value.availableCredit, unlimited: value.unlimited };
+}
+function creditPeriods(timestamp) {
+  if (typeof timestamp !== "bigint") throw new TypeError("Credit timestamp required");
+  uint(timestamp, 64, "timestamp");
+  const days = timestamp / 86400n, z = days + 719468n, era = z / 146097n, doe = z - era * 146097n;
+  const yoe = (doe - doe / 1460n + doe / 36524n - doe / 146096n) / 365n;
+  let year = yoe + era * 400n;
+  const doy = doe - (365n * yoe + yoe / 4n - yoe / 100n), mp = (5n * doy + 2n) / 153n;
+  const month = mp + (mp < 10n ? 3n : -9n);
+  if (month <= 2n) year++;
+  return { currentDay: days + 1n, currentMonth: (year - 1970n) * 12n + month };
+}
+function applyCreditDrawUsage(note, amount, timestamp) {
+  const policy = {
+    ...normalizeCreditPolicy(note),
+    ...normalizeCreditUsage(note),
+    ...balance(note)
+  }, periods = creditPeriods(timestamp);
+  uint(amount, 126, "draw amount");
+  if (amount === 0n) throw new Error("draw amount must be positive");
+  if (policy.singleLimit !== 0n && amount > policy.singleLimit)
+    throw new Error("single limit exceeded");
+  for (const [limit, last, spent, current] of [
+    ["dailyLimit", "lastDay", "dailySpent", "currentDay"],
+    ["monthlyLimit", "lastMonth", "monthlySpent", "currentMonth"]
+  ]) {
+    const period = periods[current];
+    if (period < policy[last]) throw new Error("Credit period rollback");
+    policy[spent] = (period === policy[last] ? policy[spent] : 0n) + amount;
+    uint(policy[spent], 128, spent);
+    policy[last] = period;
+    if (policy[limit] !== 0n && policy[spent] > policy[limit])
+      throw new Error(`${limit} exceeded`);
+  }
+  policy.totalSpent += amount;
+  uint(policy.totalSpent, 128, "totalSpent");
+  if (!policy.unlimited) {
+    if (amount > policy.availableCredit) throw Error("available credit exceeded");
+    policy.availableCredit -= amount;
+  }
+  return policy;
+}
+async function computeCreditSharedKeyHash(creditSharedKey) {
+  if (creditSharedKey <= 0n || creditSharedKey >= FIELD_MODULUS)
+    throw new RangeError("invalid Credit shared key");
+  return poseidonHash([D_CREDIT_KEY_HASH, creditSharedKey]);
+}
+function normalizeCreditState(state) {
+  const allowed = [
+    "chainId",
+    "protocolAddress",
+    "tokenAddress",
+    "spenderWalletIdentity",
+    "ownerWalletIdentity",
+    "revocationShard",
+    "revocationSlot",
+    "nonce",
+    "expiry",
+    "creditSharedKey",
+    ...CREDIT_POLICY_FIELDS,
+    ...CREDIT_USAGE_FIELDS,
+    "availableCredit",
+    "unlimited",
+    "payload"
+  ];
+  if (!state || typeof state !== "object" || Object.keys(state).some((k) => !allowed.includes(k)))
+    throw Error("Unsupported Credit fields");
+  for (const [name, bits] of [
+    ["chainId", 64],
+    ["protocolAddress", 160],
+    ["tokenAddress", 160],
+    ["revocationShard", 64],
+    ["revocationSlot", 16],
+    ["expiry", 64]
+  ])
+    uint(state[name], bits, name);
+  for (const id of [state.spenderWalletIdentity, state.ownerWalletIdentity])
+    if (!/^0x[0-9a-fA-F]{40}$/.test(id) || BigInt(id) === 0n)
+      throw Error("invalid Credit identity");
+  if (!state.protocolAddress || !state.tokenAddress || !state.revocationShard || !state.expiry)
+    throw Error("Credit deployment, token, shard and expiry must be positive");
+  field(state.nonce, "nonce");
+  field(state.creditSharedKey, "creditSharedKey");
+  if (!state.creditSharedKey) throw Error("Credit shared key must be positive");
+  if (state.payload !== void 0 && !(state.payload instanceof Uint8Array))
+    throw TypeError("payload must be Uint8Array");
+  return {
+    ...state,
+    ...normalizeCreditPolicy(state),
+    ...normalizeCreditUsage(state),
+    ...balance(state),
+    ...state.payload !== void 0 ? { payload: Uint8Array.from(state.payload) } : {}
+  };
+}
+async function computeCreditCommitment(state, keyHash) {
+  if (keyHash === void 0) state = normalizeCreditState(state);
+  for (const [name, bits] of [
+    ["chainId", 64],
+    ["protocolAddress", 160],
+    ["tokenAddress", 160],
+    ["revocationShard", 64],
+    ["revocationSlot", 16],
+    ["expiry", 64]
+  ])
+    uint(state[name], bits, name);
+  for (const identity of [state.spenderWalletIdentity, state.ownerWalletIdentity])
+    if (!/^0x[0-9a-fA-F]{40}$/.test(identity) || BigInt(identity) === 0n)
+      throw new Error("invalid Credit identity");
+  if (state.revocationShard === 0n || state.expiry === 0n)
+    throw new Error("Credit shard and expiry must be positive");
+  field(state.nonce, "nonce");
+  const hash = keyHash ?? await computeCreditSharedKeyHash(state.creditSharedKey);
+  field(BigInt(hash), "Credit shared key hash");
+  return poseidonHash([
+    D_CREDIT,
+    state.chainId,
+    state.protocolAddress,
+    BigInt(state.spenderWalletIdentity),
+    BigInt(state.ownerWalletIdentity),
+    state.tokenAddress,
+    state.revocationShard,
+    state.revocationSlot,
+    state.nonce,
+    state.expiry,
+    BigInt(hash),
+    ...CREDIT_POLICY_FIELDS.map((k) => normalizeCreditPolicy(state)[k]),
+    balance(state).availableCredit,
+    state.unlimited ? 1n : 0n,
+    ...CREDIT_USAGE_FIELDS.map((k) => normalizeCreditUsage(state)[k])
+  ]);
+}
+async function computeCreditNullifier(chainId, creditSharedKey, creditCommitment2) {
+  uint(chainId, 64, "chainId");
+  if (creditSharedKey <= 0n || creditSharedKey >= FIELD_MODULUS)
+    throw new RangeError("invalid Credit shared key");
+  if (!/^0x[0-9a-fA-F]{64}$/.test(creditCommitment2))
+    throw new Error("invalid Credit commitment encoding");
+  return poseidonHash([D_CNULL, chainId, creditSharedKey, BigInt(creditCommitment2)]);
+}
+async function deriveCreditStateNonce(chainId, protocolAddress, tokenAddress, creditNullifier, creditSharedKey) {
+  return BigInt(
+    await poseidonHash([
+      D_CREDIT_STATE_NONCE,
+      chainId,
+      protocolAddress,
+      tokenAddress,
+      creditNullifier,
+      creditSharedKey
+    ])
+  );
+}
+async function computeCreditRecoveryPad(chainId, protocolAddress, tokenAddress, creditNullifier, creditSharedKey) {
+  return BigInt(
+    await poseidonHash([
+      D_CREDIT_RECOVERY,
+      chainId,
+      protocolAddress,
+      tokenAddress,
+      creditNullifier,
+      creditSharedKey
+    ])
+  );
+}
+function uint(value, bits, name) {
+  if (typeof value !== "bigint" || value < 0n || value >= 1n << BigInt(bits))
+    throw new RangeError(`${name} out of uint${bits} range`);
+}
+function field(value, name) {
+  if (typeof value !== "bigint" || value < 0n || value >= FIELD_MODULUS)
+    throw new RangeError(`${name} out of BN254 field range`);
+}
+async function recoverCreditState(context, previous, recovery) {
+  assertNoteContext(previous, context);
+  const nullifier = await computeCreditNullifier(
+    context.chainId,
+    previous.creditSharedKey,
+    await computeCreditCommitment(previous)
+  );
+  if (nullifier.toLowerCase() !== recovery.creditNullifier.toLowerCase())
+    throw new Error("previous Credit nullifier mismatch");
+  field(recovery.recoveryAmount, "recoveryAmount");
+  const args = [
+    context.chainId,
+    context.protocolAddress,
+    previous.tokenAddress,
+    BigInt(nullifier),
+    previous.creditSharedKey
+  ];
+  const nonce = await deriveCreditStateNonce(...args), mask = await computeCreditRecoveryPad(...args);
+  const debit = (recovery.recoveryAmount - mask + FIELD_MODULUS) % FIELD_MODULUS;
+  uint(debit, 126, "recovered debit");
+  if (!debit) throw new Error("invalid recovered debit");
+  if (nonce === previous.nonce) throw new Error("state nonce must change");
+  const { payload, ...financial } = previous;
+  const state = {
+    ...financial,
+    ...applyCreditDrawUsage(previous, debit, recovery.timestamp),
+    nonce
+  };
+  if (await computeCreditCommitment(state) !== recovery.stateCommitment)
+    throw new Error("recovered Credit commitment mismatch");
+  return state;
+}
+async function deriveCreditState(previous, debit, timestamp) {
+  const nullifier = await computeCreditNullifier(
+    previous.chainId,
+    previous.creditSharedKey,
+    await computeCreditCommitment(previous)
+  );
+  const args = [
+    previous.chainId,
+    previous.protocolAddress,
+    previous.tokenAddress,
+    BigInt(nullifier),
+    previous.creditSharedKey
+  ];
+  const nonce = await deriveCreditStateNonce(...args), mask = await computeCreditRecoveryPad(...args);
+  if (nonce === previous.nonce) throw Error("state nonce must change");
+  const state = { ...previous, ...applyCreditDrawUsage(previous, debit, timestamp), nonce };
+  return {
+    state,
+    stateCommitment: await computeCreditCommitment(state),
+    nullifier,
+    recoveryAmount: (debit + mask) % FIELD_MODULUS
+  };
+}
+async function deriveCreditUpdate(previous, changes, deadline) {
+  for (const key of Object.keys(changes))
+    if (![
+      ...CREDIT_POLICY_FIELDS,
+      "expiry",
+      "unlimited",
+      "increaseAvailableCredit",
+      "decreaseAvailableCredit"
+    ].includes(key))
+      throw Error("unsupported Credit update field");
+  const old = normalizeCreditState(previous), increase = changes.increaseAvailableCredit === void 0 ? 0n : changes.increaseAvailableCredit, decrease = changes.decreaseAvailableCredit === void 0 ? 0n : changes.decreaseAvailableCredit;
+  uint(increase, 128, "increaseAvailableCredit");
+  uint(decrease, 128, "decreaseAvailableCredit");
+  if (increase !== 0n && decrease !== 0n)
+    throw Error("Credit increase and decrease are mutually exclusive");
+  const unlimited = changes.unlimited === void 0 ? old.unlimited : changes.unlimited;
+  if (typeof unlimited !== "boolean") throw TypeError("unlimited must be boolean");
+  let availableCredit = 0n;
+  if (unlimited) {
+    if (increase !== 0n || decrease !== 0n)
+      throw Error("unlimited update cannot adjust available credit");
+  } else {
+    if (decrease > old.availableCredit)
+      throw Error("available credit decrease exceeds balance");
+    availableCredit = old.availableCredit + increase - decrease;
+    uint(availableCredit, 128, "availableCredit");
+  }
+  uint(deadline, 64, "deadline");
+  const next = {
+    ...old,
+    ...normalizeCreditPolicy({ ...old, ...changes }),
+    expiry: changes.expiry ?? old.expiry,
+    availableCredit,
+    unlimited
+  };
+  if (previous.expiry < deadline || next.expiry < deadline)
+    throw Error("expiry before request deadline");
+  const nullifier = await computeCreditNullifier(
+    previous.chainId,
+    previous.creditSharedKey,
+    await computeCreditCommitment(previous)
+  );
+  const nonce = await deriveCreditStateNonce(
+    previous.chainId,
+    previous.protocolAddress,
+    previous.tokenAddress,
+    BigInt(nullifier),
+    previous.creditSharedKey
+  );
+  if (nonce === previous.nonce) throw Error("state nonce must change");
+  const state = { ...next, nonce };
+  return { state, nullifier, stateCommitment: await computeCreditCommitment(state) };
+}
+
+// src/delivery/delivery-codec.ts
+var import_ethers = require("ethers");
+
+// src/delivery/note-payload.ts
+var import_secp256k1 = require("@noble/curves/secp256k1");
+
+// src/fmd/fmd.ts
+var import_blake2b2 = require("@noble/hashes/blake2b");
+var import_utils = require("@noble/hashes/utils");
+
+// src/fmd/decaf377.ts
+var import_edwards = require("@noble/curves/abstract/edwards");
+var import_modular = require("@noble/curves/abstract/modular");
+var import_blake2b = require("@noble/hashes/blake2b");
+var FQ = 8444461749428370424248824938781546531375899335154063827935233455917409239041n;
+var FR = 2111115437357092606062206234695386632838870926408408195193685246394721360383n;
+var field2 = (0, import_modular.Field)(FQ, 253, true);
+var f = (n) => (0, import_modular.mod)(n, FQ);
+function secureRandomBytes(length) {
+  const webCrypto = globalThis.crypto;
+  if (!webCrypto?.getRandomValues) throw new Error("WebCrypto secure randomness is unavailable");
+  return webCrypto.getRandomValues(new Uint8Array(length));
+}
+var curve = (0, import_edwards.twistedEdwards)({
+  a: FQ - 1n,
+  d: 3021n,
+  Fp: field2,
+  n: FR,
+  h: 4n,
+  Gx: 4959445789346820725352484487855828915252512307947624787834978378872129235627n,
+  Gy: 6060471950081851567114691557659790004756535011754163002297540472747064943288n,
+  hash: import_blake2b.blake2b,
+  randomBytes: (length = 32) => secureRandomBytes(length)
+});
+var generator = curve.ExtendedPoint.BASE;
+function readLE(bytes2) {
+  let n = 0n;
+  for (let i = bytes2.length - 1; i >= 0; i--) n = n << 8n | BigInt(bytes2[i]);
+  return n;
+}
+function decodePoint(bytes2) {
+  if (!(bytes2 instanceof Uint8Array) || bytes2.length !== 32)
+    throw new Error("Invalid Decaf377 encoding length");
+  const s = readLE(bytes2);
+  if (s >= FQ || (s & 1n) !== 0n || bytes2[31] >> 5 !== 0)
+    throw new Error("Invalid Decaf377 encoding");
+  const ss = f(s * s);
+  const u1 = f(1n - ss);
+  const u2 = f(u1 * u1 - 4n * 3021n * ss);
+  const denominator = f(u2 * u1 * u1);
+  if (denominator === 0n) throw new Error("Invalid Decaf377 encoding");
+  let v;
+  try {
+    v = field2.sqrt(field2.inv(denominator));
+  } catch {
+    throw new Error("Invalid Decaf377 encoding");
+  }
+  const twoSU1 = f(2n * s * u1);
+  if ((f(twoSU1 * v) & 1n) !== 0n) v = f(-v);
+  const x = f(twoSU1 * v * v * u2);
+  const y = f((1n + ss) * v * u1);
+  return curve.ExtendedPoint.fromAffine({ x, y });
+}
+function isIdentity(point) {
+  return point.ex === 0n;
+}
+
+// src/fmd/fmd.ts
+function requireBytes(value, length, name) {
+  if (!(value instanceof Uint8Array) || value.length !== length)
+    throw new TypeError(`${name} must be a ${length}-byte Uint8Array`);
+}
+function validateClueKey(clueKey) {
+  requireBytes(clueKey, 32, "Clue key");
+  if (isIdentity(decodePoint(clueKey))) throw new Error("Clue key must not be the identity");
+}
+
+// src/delivery/note-payload.ts
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+function uint2(value, bits, name) {
+  if (value < 0n || value >= 1n << BigInt(bits))
+    throw new RangeError(`${name} out of uint${bits} range`);
+}
+function encode(value, length = 32) {
+  uint2(value, length * 8, "encoded value");
+  const out = new Uint8Array(length);
+  for (let i = length - 1; i >= 0; i--) {
+    out[i] = Number(value & 255n);
+    value >>= 8n;
+  }
+  return out;
+}
+function decode(value) {
+  return value.reduce((result, byte) => result << 8n | BigInt(byte), 0n);
+}
+function hexField(value) {
+  uint2(value, 160, "owner address");
+  return `0x${value.toString(16).padStart(40, "0")}`;
+}
+function receivingKeys(keys) {
+  if (!keys || !(keys.viewingPublicKey instanceof Uint8Array) || !(keys.clueKey instanceof Uint8Array))
+    throw new Error("receiving keys required");
+  const viewingPublicKey2 = Uint8Array.from(keys.viewingPublicKey), clueKey = Uint8Array.from(keys.clueKey);
+  if (viewingPublicKey2.length !== 33 || viewingPublicKey2[0] !== 2 && viewingPublicKey2[0] !== 3)
+    throw new Error("invalid compressed viewing public key");
+  import_secp256k1.secp256k1.ProjectivePoint.fromHex(viewingPublicKey2).assertValidity();
+  if (clueKey.length !== 32) throw new Error("invalid clue key length");
+  validateClueKey(clueKey);
+  return { viewingPublicKey: viewingPublicKey2, clueKey };
+}
+function normalizeCreditDeliveryState(state) {
+  if (!state || typeof state !== "object" || !state.note || typeof state.note !== "object")
+    throw new TypeError("complete Credit delivery state required");
+  const allowed = [
+    "chainId",
+    "protocolAddress",
+    "tokenAddress",
+    "spenderWalletIdentity",
+    "ownerWalletIdentity",
+    "revocationShard",
+    "revocationSlot",
+    "nonce",
+    "expiry",
+    "creditSharedKey",
+    "singleLimit",
+    "dailyLimit",
+    "monthlyLimit",
+    "availableCredit",
+    "unlimited",
+    "lastDay",
+    "dailySpent",
+    "lastMonth",
+    "monthlySpent",
+    "totalSpent",
+    "payload"
+  ];
+  if (Object.keys(state.note).some((k) => !allowed.includes(k)))
+    throw Error("Unsupported Credit fields");
+  const note = normalizeCreditState(structuredClone(state.note));
+  return {
+    note: {
+      ...note,
+      ...normalizeCreditPolicy(note)
+    },
+    ownerReceivingKeys: receivingKeys(state.ownerReceivingKeys),
+    spenderReceivingKeys: receivingKeys(state.spenderReceivingKeys)
+  };
+}
+function encodePayload(value) {
+  if (value !== void 0 && !(value instanceof Uint8Array))
+    throw new TypeError("payload must be Uint8Array");
+  const payload = value ?? new Uint8Array();
+  if (payload.length > 65535) throw new RangeError("payload length exceeds uint16");
+  return concat(encode(BigInt(payload.length), 2), payload);
+}
+function readPayload(plain, offset) {
+  if (plain.length < offset + 2) throw new Error("missing payload length");
+  const length = Number(decode(plain.slice(offset, offset + 2)));
+  if (plain.length !== offset + 2 + length) throw new Error("invalid payload length");
+  return Uint8Array.from(plain.subarray(offset + 2));
+}
+var fundsEnvelopeV1 = {
+  kind: "funds",
+  version: 1,
+  minimum: 160,
+  maximum: 4096,
+  encode(note) {
+    return concat(
+      encode(BigInt(note.ownerAddress)),
+      encode(note.amount, 16),
+      encode(note.nonce),
+      encodePayload(note.payload)
+    );
+  },
+  decode(plain, context) {
+    return {
+      chainId: context.chainId,
+      protocolAddress: context.protocolAddress,
+      tokenAddress: context.tokenAddress,
+      ownerAddress: hexField(decode(plain.slice(0, 32))),
+      amount: decode(plain.slice(32, 48)),
+      nonce: decode(plain.slice(48, 80)),
+      payload: readPayload(plain, 80)
+    };
+  }
+};
+var creditWireFields = [
+  ["spenderWalletIdentity", 32],
+  ["ownerWalletIdentity", 32],
+  ["revocationShard", 8],
+  ["revocationSlot", 2],
+  ["nonce", 32],
+  ["expiry", 8],
+  ["creditSharedKey", 32],
+  ["singleLimit", 16],
+  ["dailyLimit", 16],
+  ["monthlyLimit", 16],
+  ["availableCredit", 16],
+  ["unlimited", 1],
+  ["lastDay", 8],
+  ["dailySpent", 16],
+  ["lastMonth", 8],
+  ["monthlySpent", 16],
+  ["totalSpent", 16]
+];
+var creditEnvelopeV2 = {
+  kind: "credit",
+  version: 2,
+  minimum: 485,
+  maximum: 4096,
+  encode(input) {
+    const state = normalizeCreditDeliveryState(input);
+    return concat(
+      ...creditWireFields.map(([k, size]) => encode(BigInt(state.note[k]), size)),
+      state.ownerReceivingKeys.viewingPublicKey,
+      state.ownerReceivingKeys.clueKey,
+      state.spenderReceivingKeys.viewingPublicKey,
+      state.spenderReceivingKeys.clueKey,
+      encodePayload(state.note.payload)
+    );
+  },
+  decode(plain, context) {
+    let offset = 0;
+    const note = {
+      chainId: context.chainId,
+      protocolAddress: context.protocolAddress,
+      tokenAddress: context.tokenAddress
+    };
+    for (const [k, size] of creditWireFields) {
+      const n = decode(plain.slice(offset, offset + size));
+      if (k === "unlimited" && n !== 0n && n !== 1n)
+        throw Error("invalid Credit unlimited byte");
+      note[k] = k === "unlimited" ? n === 1n : k.endsWith("Identity") ? hexField(n) : n;
+      offset += size;
+    }
+    const keys = () => {
+      const k = {
+        viewingPublicKey: plain.slice(offset, offset + 33),
+        clueKey: plain.slice(offset + 33, offset + 65)
+      };
+      offset += 65;
+      return k;
+    };
+    const ownerReceivingKeys = keys(), spenderReceivingKeys = keys();
+    note.payload = readPayload(plain, offset);
+    return normalizeCreditDeliveryState({
+      note,
+      ownerReceivingKeys,
+      spenderReceivingKeys
+    });
+  }
+};
+
+// src/delivery/delivery-codec.ts
+var MAX_CIPHERTEXT_BYTES = 4096;
+function deliveryHeader(kind) {
+  if (kind !== "funds" && kind !== "credit") throw new Error("unsupported delivery kind");
+  return kind === "credit" ? 130 : 1;
+}
+function decodeDeliveryHeader(header) {
+  if (!Number.isInteger(header) || header < 0 || header > 255)
+    throw new Error("delivery header must be one byte");
+  const kind = header >>> 7 ? "credit" : "funds";
+  const version = header & 127;
+  if (version === 0) throw new Error("invalid envelope version");
+  return { kind, version };
+}
+function deliveryCodec(header) {
+  const { kind, version } = decodeDeliveryHeader(header);
+  if (version !== (kind === "credit" ? 2 : 1))
+    throw new Error(`unsupported envelope version ${version}`);
+  const codec = kind === "funds" ? fundsEnvelopeV1 : creditEnvelopeV2;
+  return {
+    ...codec,
+    domain: `Invisi.${kind === "funds" ? "Note" : "Credit"}Delivery.v${kind === "credit" ? 2 : 1}`
+  };
+}
+function validateDeliveryCiphertext(value, kind) {
+  const data = Uint8Array.from((0, import_ethers.getBytes)(value));
+  if (data.length === 0 || data.length > MAX_CIPHERTEXT_BYTES)
+    throw new Error("invalid envelope length");
+  const codec = deliveryCodec(data[0]);
+  if (kind !== void 0 && codec.kind !== kind) throw new Error("unexpected envelope kind");
+  if (data.length < codec.minimum || data.length > codec.maximum)
+    throw new Error("invalid envelope length");
+  return data;
+}
+
+// src/delivery/envelope.ts
+var import_secp256k12 = require("@noble/curves/secp256k1");
+
+// src/delivery/binary.ts
+var ascii = (value) => Uint8Array.from(value, (character) => character.charCodeAt(0));
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((size, p) => size + p.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+function bytes(value, length) {
+  let out;
+  if (typeof value === "string") {
+    if (!/^0x(?:[0-9a-fA-F]{2})*$/.test(value)) throw new Error("invalid hexadecimal bytes");
+    out = Uint8Array.from(value.slice(2).match(/../g) ?? [], (b) => parseInt(b, 16));
+  } else if (value instanceof Uint8Array) out = Uint8Array.from(value);
+  else throw new Error("expected hexadecimal bytes or Uint8Array");
+  if (out.length !== length) throw new Error(`expected ${length} bytes`);
+  return out;
+}
+function uint3(value, bits, name) {
+  if (value < 0n || value >= 1n << BigInt(bits))
+    throw new RangeError(`${name} out of uint${bits} range`);
+}
+function field3(value, name) {
+  if (value < 0n || value >= FIELD_MODULUS)
+    throw new RangeError(`${name} out of BN254 field range`);
+}
+function encode2(value, length = 32) {
+  uint3(value, length * 8, "encoded value");
+  const out = new Uint8Array(length);
+  for (let i = length - 1; i >= 0; i--) {
+    out[i] = Number(value & 255n);
+    value >>= 8n;
+  }
+  return out;
+}
+
+// src/delivery/validation.ts
+function validateContext(context, tokenAddress) {
+  uint3(context.chainId, 64, "chainId");
+  uint3(context.protocolAddress, 160, "protocolAddress");
+  uint3(tokenAddress, 160, "tokenAddress");
+  field3(BigInt(context.outputCommitment), "outputCommitment");
+}
+async function creditCommitment(context, note) {
+  validateContext(context, note.tokenAddress);
+  assertNoteContext(note, context);
+  const commitment = await computeCreditCommitment(note);
+  if (BigInt(commitment) !== BigInt(context.outputCommitment))
+    throw new Error("credit commitment mismatch");
+}
+
+// src/delivery/envelope.ts
+function aad(domain, context, tokenAddress, header, role) {
+  validateContext(context, tokenAddress);
+  return concat2(
+    domain,
+    header,
+    new Uint8Array([role]),
+    encode2(context.chainId, 8),
+    encode2(context.protocolAddress, 20),
+    encode2(tokenAddress, 20),
+    encode2(BigInt(context.outputCommitment))
+  );
+}
+function privateKey(value) {
+  const key = bytes(value, 32);
+  if (!import_secp256k12.secp256k1.utils.isValidPrivateKey(key)) throw new Error("invalid viewing private key");
+  return key;
+}
+function publicKey(value) {
+  const key = bytes(value, 33);
+  if (key[0] !== 2 && key[0] !== 3) throw new Error("expected compressed secp256k1 public key");
+  import_secp256k12.secp256k1.ProjectivePoint.fromHex(key);
+  return key;
+}
+function viewingPublicKey(key) {
+  return import_secp256k12.secp256k1.getPublicKey(privateKey(key), true);
+}
+function random(length) {
+  return crypto.getRandomValues(new Uint8Array(length));
+}
+function ephemeralKey() {
+  for (; ; ) {
+    const key = random(32);
+    if (import_secp256k12.secp256k1.utils.isValidPrivateKey(key)) return key;
+  }
+}
+var buffer = (value) => Uint8Array.from(value).buffer;
+async function derivedKey(key, peer, header, recipient, domain, extractable = false) {
+  const secret = import_secp256k12.secp256k1.getSharedSecret(key, peer, true).slice(1);
+  const material = await crypto.subtle.importKey("raw", buffer(secret), "HKDF", false, [
+    "deriveKey"
+  ]);
+  try {
+    return await crypto.subtle.deriveKey(
+      {
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: buffer(header.slice(34, 50)),
+        info: buffer(concat2(domain, header.slice(1, 34), recipient))
+      },
+      material,
+      { name: "AES-GCM", length: 256 },
+      extractable,
+      ["encrypt", "decrypt"]
+    );
+  } finally {
+    secret.fill(0);
+  }
+}
+async function seal(viewingKey, plaintext, context, tokenAddress, headerByte, role) {
+  const peer = publicKey(viewingKey), key = ephemeralKey();
+  const salt = random(16), iv = random(12), domain = deliveryDomain(headerByte);
+  const header = concat2(
+    new Uint8Array([headerByte]),
+    import_secp256k12.secp256k1.getPublicKey(key, true),
+    salt,
+    iv
+  );
+  const additionalData = aad(domain, context, tokenAddress, header, role);
+  try {
+    const encrypted = await crypto.subtle.encrypt(
+      {
+        name: "AES-GCM",
+        iv: buffer(iv),
+        additionalData: buffer(additionalData),
+        tagLength: 128
+      },
+      await derivedKey(key, peer, header, peer, domain),
+      buffer(plaintext)
+    );
+    return concat2(header, new Uint8Array(encrypted));
+  } finally {
+    key.fill(0);
+    plaintext.fill(0);
+  }
+}
+async function open(key, envelope, context, headerByte, role, payloadKey = false) {
+  const data = envelopeBytes(envelope, deliveryCodec(headerByte).kind === "credit");
+  if (data[0] !== headerByte) throw new Error("unsupported envelope version");
+  const domain = deliveryDomain(headerByte);
+  const additionalData = aad(domain, context, context.tokenAddress, data.slice(0, 62), role);
+  const localKey = payloadKey ? bytes(key, 32) : privateKey(key);
+  try {
+    const aes = payloadKey ? await crypto.subtle.importKey("raw", buffer(bytes(key, 32)), "AES-GCM", false, [
+      "decrypt"
+    ]) : await derivedKey(
+      localKey,
+      publicKey(data.slice(1, 34)),
+      data.slice(0, 62),
+      import_secp256k12.secp256k1.getPublicKey(localKey, true),
+      domain
+    );
+    const decrypted = await crypto.subtle.decrypt(
+      {
+        name: "AES-GCM",
+        iv: buffer(data.slice(50, 62)),
+        additionalData: buffer(additionalData),
+        tagLength: 128
+      },
+      aes,
+      buffer(data.slice(62))
+    );
+    return new Uint8Array(decrypted);
+  } finally {
+    localKey.fill(0);
+  }
+}
+function deliveryDomain(headerByte) {
+  return ascii(deliveryCodec(headerByte).domain);
+}
+function envelopeBytes(value, credit) {
+  return validateDeliveryCiphertext(value, credit ? "credit" : "funds");
+}
+
+// src/delivery/encryption.ts
+function copyPayload(value, codec) {
+  if (!(value instanceof Uint8Array)) throw new Error("codec encode must return Uint8Array");
+  if (value.length + 78 < codec.minimum || value.length + 78 > codec.maximum)
+    throw new Error("invalid codec payload length");
+  return Uint8Array.from(value);
+}
+function creditRole(role) {
+  if (role !== "owner" && role !== "spender")
+    throw new Error("Credit role must be owner or spender");
+  return role === "owner" ? 1 : 2;
+}
+function matchCreditRecipient(state, role, recipient) {
+  const keys = role === "owner" ? state.ownerReceivingKeys : state.spenderReceivingKeys;
+  if (!keys.viewingPublicKey.every((value, index) => value === recipient[index]))
+    throw new Error("recipient receiving key mismatch");
+}
+async function encryptCreditState(viewingKey, state, context) {
+  const scopedState = normalizeCreditDeliveryState(state), scopedNote = scopedState.note;
+  const scopedContext = { ...context };
+  const codec = deliveryCodec(deliveryHeader("credit"));
+  if (codec.kind !== "credit") throw new Error("unexpected envelope kind");
+  creditRole(scopedContext.role);
+  matchCreditRecipient(scopedState, scopedContext.role, publicKey(viewingKey));
+  await creditCommitment(scopedContext, scopedNote);
+  const plaintext = copyPayload(codec.encode(structuredClone(scopedState)), codec);
+  return seal(
+    viewingKey,
+    plaintext,
+    scopedContext,
+    scopedNote.tokenAddress,
+    deliveryHeader("credit"),
+    creditRole(scopedContext.role)
+  );
+}
+async function readCredit(key, envelope, context, payloadKey = false) {
+  const authenticatedContext = { ...context };
+  const data = envelopeBytes(envelope, true);
+  const plain = await open(
+    key,
+    data,
+    authenticatedContext,
+    data[0],
+    creditRole(authenticatedContext.role),
+    payloadKey
+  );
+  try {
+    const codec = deliveryCodec(data[0]);
+    if (codec.kind !== "credit") throw new Error("unexpected envelope kind");
+    const state = normalizeCreditDeliveryState(
+      structuredClone(codec.decode(plain, Object.freeze({ ...authenticatedContext })))
+    );
+    const note = state.note;
+    if (BigInt(
+      authenticatedContext.role === "owner" ? note.ownerWalletIdentity : note.spenderWalletIdentity
+    ) !== BigInt(authenticatedContext.ownerAddress))
+      throw new Error("recipient owner address mismatch");
+    if (!payloadKey)
+      matchCreditRecipient(state, authenticatedContext.role, viewingPublicKey(key));
+    if (note.tokenAddress !== authenticatedContext.tokenAddress)
+      throw new Error("Credit token context mismatch");
+    await creditCommitment(authenticatedContext, note);
+    return {
+      ...state,
+      note: { ...state.note, payload: Uint8Array.from(state.note.payload ?? []) }
+    };
+  } finally {
+    plain.fill(0);
+  }
+}
+function decryptCreditState(key, envelope, context) {
+  return readCredit(key, envelope, context);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CREDIT_POLICY_FIELDS,
+  CREDIT_USAGE_FIELDS,
+  applyCreditDrawUsage,
+  computeCreditCommitment,
+  computeCreditNullifier,
+  computeCreditRecoveryPad,
+  computeCreditSharedKeyHash,
+  creditPeriods,
+  decryptCreditState,
+  deriveCreditState,
+  deriveCreditStateNonce,
+  deriveCreditUpdate,
+  encryptCreditState,
+  normalizeCreditDeliveryState,
+  normalizeCreditPolicy,
+  normalizeCreditState,
+  normalizeCreditUsage,
+  recoverCreditState
+});
+//# sourceMappingURL=credit.cjs.map