@invisi-labs/protocol 1.1.2 → 1.1.4

package/dist/index.cjs

@@ -43,7 +43,6 @@ __export(src_exports, {
   buildTopUpCreditCalldata: () => buildTopUpCreditCalldata,
   buildTransactAggregateCalldata: () => buildTransactAggregateCalldata,
   buildTransactCalldata: () => buildTransactCalldata,
-  buildWithdrawalCalldata: () => buildWithdrawalCalldata,
   cancelCreditBaseInputs: () => cancelCreditBaseInputs,
   cancelCreditPublicInputs: () => cancelCreditPublicInputs,
   cancelCreditRequestHash: () => cancelCreditRequestHash,
@@ -73,8 +72,8 @@ __export(src_exports, {
   getEIP712Domain: () => getEIP712Domain,
   known: () => known,
   normalizeContext: () => normalizeContext,
-  normalizeDelivery: () => normalizeDelivery,
   normalizeFunding: () => normalizeFunding,
+  normalizeOpaqueDelivery: () => normalizeOpaqueDelivery,
   normalizeSources: () => normalizeSources,
   normalizeTransactRequest: () => normalizeTransactRequest,
   notes: () => notes,
@@ -3943,27 +3942,20 @@ var RegistrationOperation = class _RegistrationOperation {
       update: this.#plan.update
     };
   }
-  /** Sign with ethers, or attach externally obtained ERC-1271 signature bytes. */
-  async authorize(options = {}) {
+  /** Export portable EIP-712 data for external signing. */
+  async exportRegistrationAuthorization(options = {}) {
+    check(this.status === "prepared", "registry operation is not awaiting authorization");
+    options.signal?.throwIfAborted();
+    await this.validateFreshness();
+    options.signal?.throwIfAborted();
+    return (0, import_core2.createSigningRequest)(this.typedData());
+  }
+  /** Validate and attach an independently obtained EOA or ERC-1271 signature. */
+  async withSignature(signature, options = {}) {
     check(this.status === "prepared", "registry operation is not awaiting authorization");
     options.signal?.throwIfAborted();
     await this.validateFreshness();
     options.signal?.throwIfAborted();
-    let signature = options.signature;
-    if (signature === void 0) {
-      const signer = this.#runtime.signer;
-      check(signer, "registry signer capability is missing");
-      check(
-        BigInt(await signer.getAddress()) === BigInt(this.#plan.registration.walletIdentity),
-        "registry signer does not match wallet owner"
-      );
-      const typed = this.typedData();
-      signature = await signer.signTypedData(
-        typed.domain,
-        typed.types,
-        typed.message
-      );
-    }
     check(
       /^0x(?:[a-fA-F0-9]{2})+$/.test(signature),
       "registry signature must be nonempty hexadecimal bytes"
@@ -4220,9 +4212,10 @@ var AddressRegistry = class {
 
 // src/credit-create.ts
 var import_ethers5 = require("ethers");
-var import_core4 = require("@invisi-labs/core");
+var import_core5 = require("@invisi-labs/core");
 
 // src/validation.ts
+var import_core4 = require("@invisi-labs/core");
 var import_ethers4 = require("ethers");
 var FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 var ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
@@ -4309,19 +4302,14 @@ var pad = (v, n) => [
   ...v,
   ...Array(n - v.length).fill(0n)
 ];
-function normalizeDelivery(value, options = {}) {
+function normalizeOpaqueDelivery(value, options = {}) {
   known(value, ["ciphertext", "clue"], "delivery");
   if (options.empty) {
     if (value.ciphertext !== "0x" || value.clue !== "0x")
       throw new Error("absent output requires an empty delivery");
     return { ciphertext: "0x", clue: "0x" };
   }
-  const ciphertext = envelope(
-    value.ciphertext,
-    options.credit ? 402 : 160,
-    options.credit ? 4 : 2,
-    options.credit ? 658 : 416
-  );
+  const ciphertext = envelope(value.ciphertext, 1, void 0, import_core4.MAX_CIPHERTEXT_BYTES);
   const clue = envelope(value.clue, 68);
   if (clue.slice(130, 132).toLowerCase() !== "18") throw new Error("clue precision must be 24");
   return { ciphertext, clue };
@@ -4404,7 +4392,7 @@ function validateCreateCreditRequest(c, p, cs, funding = {}) {
     throw new Error("owner must be nonzero and expiry future");
   if (dense(cs, "deliveries").length !== 3) throw new Error("deliveries count mismatch");
   const deliveries = cs.map(
-    (v, i) => normalizeDelivery(v, { credit: i < 2, empty: i === 2 && BigInt(changeCommitment) === 0n })
+    (v, i) => normalizeOpaqueDelivery(v, { empty: i === 2 && BigInt(changeCommitment) === 0n })
   );
   if (ns.length === 0 && f.amount === 0n)
     throw new Error("empty inputs require positive funding");
@@ -4454,7 +4442,7 @@ function createCreditBaseInputs(c, p, cs, f = {}) {
 function createCreditPublicInputs(c, p, deliveries, funding = {}) {
   const base = createCreditBaseInputs(c, p, deliveries, funding);
   const digest = BigInt(
-    (0, import_core4.computeWalletAuthorizationDigest)({
+    (0, import_core5.computeWalletAuthorizationDigest)({
       context: { chainId: c.chainId, protocolAddress: BigInt(c.protocolAddress) },
       operation: "create-credit",
       capacity: 10,
@@ -4490,7 +4478,7 @@ function createCreditRequestHash(p, cs, f = {}) {
   );
 }
 function encodeCreateCreditTypedData(c, p, deliveries, funding = {}) {
-  return (0, import_core4.walletAuthorizationTypedData)({
+  return (0, import_core5.walletAuthorizationTypedData)({
     context: { chainId: c.chainId, protocolAddress: BigInt(c.protocolAddress) },
     operation: "create-credit",
     capacity: 10,
@@ -4537,7 +4525,7 @@ function encodeCreditProof(proof) {
 
 // src/credit-lifecycle.ts
 var import_ethers6 = require("ethers");
-var import_core5 = require("@invisi-labs/core");
+var import_core6 = require("@invisi-labs/core");
 var CREDIT_DRAW_CAPACITIES = [1, 12, 50, 120];
 function selectCreditDrawCircuit(count) {
   if (!Number.isInteger(count) || count < 1 || count > 120)
@@ -4546,7 +4534,7 @@ function selectCreditDrawCircuit(count) {
   return {
     name: `credit_draw_slots${maxSize}`,
     maxSize,
-    publicInputCount: 6 * maxSize + 12,
+    publicInputCount: 6 * maxSize + 14,
     totalBits: 126 + Math.ceil(Math.log2(maxSize))
   };
 }
@@ -4586,7 +4574,7 @@ function validateCreditDrawRequest(c, p, cs) {
   if (dense(cs, "deliveries").length !== 2 * ns.length)
     throw new Error("deliveries count mismatch");
   const deliveries = cs.map(
-    (v, i) => BigInt(remainderCommitments[Math.floor(i / 2)]) === 0n ? normalizeDelivery(v, { empty: true }) : normalizeDelivery(v, { credit: true })
+    (v, i) => BigInt(remainderCommitments[Math.floor(i / 2)]) === 0n ? normalizeOpaqueDelivery(v, { empty: true }) : normalizeOpaqueDelivery(v, {})
   );
   return {
     ...ctx,
@@ -4599,7 +4587,8 @@ function validateCreditDrawRequest(c, p, cs) {
     totalAmount,
     deadline: checkDeadline(c, p.deadline),
     deliveries,
-    profile
+    profile,
+    periods: (0, import_core6.creditPeriods)(c.timestamp)
   };
 }
 function creditDrawBaseInputs(c, p, cs) {
@@ -4626,7 +4615,9 @@ function creditDrawBaseInputs(c, p, cs) {
     r.deadline,
     h >> 128n,
     h & (1n << 128n) - 1n,
-    ...pad(r.recoveryAmounts.map(BigInt), n)
+    ...pad(r.recoveryAmounts.map(BigInt), n),
+    r.periods.currentDay,
+    r.periods.currentMonth
   ].map(word);
 }
 function validateCancelCreditRequest(c, p) {
@@ -4725,7 +4716,7 @@ function topUpCreditRequestHash(p, cs, f = {}) {
   );
 }
 function authorize(c, operation, capacity, words) {
-  return (0, import_core5.walletAuthorizationTypedData)({
+  return (0, import_core6.walletAuthorizationTypedData)({
     context: { chainId: c.chainId, protocolAddress: BigInt(c.protocolAddress) },
     operation,
     capacity,
@@ -4734,7 +4725,7 @@ function authorize(c, operation, capacity, words) {
 }
 function appendDigest(c, operation, capacity, words) {
   const digest = BigInt(
-    (0, import_core5.computeWalletAuthorizationDigest)({
+    (0, import_core6.computeWalletAuthorizationDigest)({
       context: { chainId: c.chainId, protocolAddress: BigInt(c.protocolAddress) },
       operation,
       capacity,
@@ -4824,7 +4815,7 @@ function buildTopUpCreditCalldata(p) {
 
 // src/funds.ts
 var import_ethers7 = require("ethers");
-var import_core6 = require("@invisi-labs/core");
+var import_core7 = require("@invisi-labs/core");
 var TRANSACT_CAPACITIES = [14, 56, 112, 168];
 function selectTransactCapacity(inputs, outputs) {
   if (!Number.isInteger(inputs) || !Number.isInteger(outputs) || inputs < 0 || outputs < 0 || inputs + outputs < 1 || inputs === 0 && outputs < 2 || inputs + outputs > 168)
@@ -4845,7 +4836,7 @@ function normalizeTransactRequest(c, p, cs, funding = {}) {
     "deadline"
   ]);
   const ns = notes(p.nullifiers, "nullifiers"), os = notes(p.outputCommitments, "outputCommitments"), capacity = selectTransactCapacity(ns.length, os.length);
-  const sources = normalizeSources(p.sources, ns.length, capacity), deliveries = dense(cs, "deliveries").map((v) => normalizeDelivery(v));
+  const sources = normalizeSources(p.sources, ns.length, capacity), deliveries = dense(cs, "deliveries").map((v) => normalizeOpaqueDelivery(v));
   if (deliveries.length !== os.length) throw new Error("deliveries count mismatch");
   const withdrawalAmount = uint(p.withdrawalAmount, 128, "withdrawalAmount"), withdrawalAddress = (0, import_ethers7.getAddress)(p.withdrawalAddress), f = normalizeFunding(funding);
   if (withdrawalAmount === 0n !== (BigInt(withdrawalAddress) === 0n) || os.length === 0 && withdrawalAmount === 0n)
@@ -4903,7 +4894,7 @@ function transactPublicInputs(c, p, cs, f = {}) {
 }
 function encodeTransactTypedData(c, p, deliveries, f = {}) {
   const r = normalizeTransactRequest(c, p, deliveries, f);
-  return (0, import_core6.walletAuthorizationTypedData)({
+  return (0, import_core7.walletAuthorizationTypedData)({
     context: { chainId: r.chainId, protocolAddress: BigInt(r.protocolAddress) },
     operation: "transact",
     capacity: r.capacity,
@@ -5024,8 +5015,8 @@ async function validateShieldRequest(p) {
     uint(o.amount, 128, "amount");
     if (o.amount === 0n) throw new Error("amount must be positive");
     field(o.identity);
-    normalizeDelivery(cs[i]);
-    if (await (0, import_core6.computeNoteCommitment)(
+    normalizeOpaqueDelivery(cs[i]);
+    if (await (0, import_core7.computeNoteCommitment)(
       p.context.chainId,
       o.identity,
       BigInt(p.context.tokenAddress),
@@ -5153,7 +5144,7 @@ var import_rpc = require("@invisi-labs/rpc");
 
 // src/TokenProtocol.ts
 var import_ethers8 = require("ethers");
-var import_core7 = require("@invisi-labs/core");
+var import_core8 = require("@invisi-labs/core");
 var TokenProtocol = class {
   context;
   expectedRuntimeCodeHash;
@@ -5171,7 +5162,7 @@ var TokenProtocol = class {
   }
   async validateDeployment(reader, options = {}) {
     if ((options.requireRuntimeProfile ?? true) && !this.expectedRuntimeCodeHash) {
-      throw new import_core7.MissingCapabilityError("trusted deployment profile");
+      throw new import_core8.MissingCapabilityError("trusted deployment profile");
     }
     if (await reader.getChainId() !== this.context.chainId) {
       throw new Error("deployment chain mismatch");
@@ -5319,20 +5310,20 @@ var Protocol = class _Protocol {
 };
 
 // src/verify.ts
-var import_core8 = require("@invisi-labs/core");
+var import_core9 = require("@invisi-labs/core");
 async function verifyNoteCommitment(params) {
-  const expected = await (0, import_core8.computeNoteCommitment)(
+  const expected = await (0, import_core9.computeNoteCommitment)(
     params.chainId,
-    await (0, import_core8.computeNoteIdentity)(BigInt(params.walletIdentity), BigInt(params.nonce)),
+    await (0, import_core9.computeNoteIdentity)(BigInt(params.walletIdentity), BigInt(params.nonce)),
     BigInt(params.tokenAddress),
     params.amount
   );
   return BigInt(expected) === BigInt(params.noteCommitment);
 }
 async function verifyCreditCommitment(params) {
-  if (params.creditSharedKey <= 0n || params.creditSharedKey >= import_core8.FIELD_MODULUS)
+  if (params.creditSharedKey <= 0n || params.creditSharedKey >= import_core9.FIELD_MODULUS)
     throw new RangeError("creditSharedKey must be a nonzero canonical Field");
-  const expected = await (0, import_core8.computeCreditCommitment)(
+  const expected = await (0, import_core9.computeCreditCommitment)(
     params.chainId,
     params.spenderWalletIdentity,
     params.ownerWalletIdentity,
@@ -5342,41 +5333,12 @@ async function verifyCreditCommitment(params) {
     params.amount,
     params.nonce,
     params.expiry,
-    await (0, import_core8.computeCreditSharedKeyHash)(params.creditSharedKey)
+    await (0, import_core9.computeCreditSharedKeyHash)(params.creditSharedKey),
+    params
   );
   return BigInt(expected) === BigInt(params.creditCommitment);
 }
 
-// src/withdrawal.ts
-var import_core9 = require("@invisi-labs/core");
-async function buildWithdrawalCalldata(p) {
-  const r = normalizeTransactRequest(p.context, p.params, [], p.funding);
-  if (r.outputCount !== 0 || r.depositAmount !== 0n || p.sourceNotes.length === 0 || p.sourceNotes.length !== r.inputCount) {
-    throw new Error("full withdrawal requires inputs, no private outputs and no funding");
-  }
-  const walletIdentity = BigInt(p.sourceNotes[0].walletIdentity);
-  let total = 0n;
-  for (const [index, note] of p.sourceNotes.entries()) {
-    if (note.chainId !== p.context.chainId || note.protocolAddress !== BigInt(p.context.protocolAddress))
-      throw new Error("source note context mismatch");
-    if (BigInt(note.walletIdentity) !== walletIdentity || note.tokenAddress !== BigInt(p.context.tokenAddress) || note.amount <= 0n)
-      throw new Error("source note wallet/token/amount mismatch");
-    const commitment = await (0, import_core9.computeNoteCommitment)(
-      note.chainId,
-      await (0, import_core9.computeNoteIdentity)(walletIdentity, note.nonce),
-      note.tokenAddress,
-      note.amount
-    );
-    const nullifier = await (0, import_core9.computeNoteNullifier)(note.chainId, note.nonce, commitment);
-    if (nullifier.toLowerCase() !== r.nullifiers[index].toLowerCase())
-      throw new Error("source note nullifier mismatch");
-    total += note.amount;
-  }
-  if (r.withdrawalAmount !== total)
-    throw new Error("withdrawal must equal the full input balance");
-  return buildTransactCalldata({ ...p, deliveries: [] });
-}
-
 // src/witness.ts
 var import_core10 = require("@invisi-labs/core");
 var import_prover = require("@invisi-labs/prover");
@@ -5901,9 +5863,9 @@ var witness_layouts_default = {
     ]
   },
   create_credit: {
-    artifactSha256: "078c6d2da1ed2d6bd27fab28af9970261fe626a0b22ae56ad170e5d15b1b05ba",
+    artifactSha256: "3ed6cfdee4f5fd840f023580f76c208768777fea79737f2511377e5c55be0230",
     keys: {
-      evm: "8285456447e92833a4fa9c330b9c667a3a1b9e48649578082041b9738f037c8f"
+      evm: "56f663c6053be0d158a271022d200c732597efd3a2e0be48fe94549d0b1795e0"
     },
     publicInputCount: 46,
     public: [
@@ -6018,16 +5980,19 @@ var witness_layouts_default = {
       "credit_amount",
       "credit_nonce",
       "credit_shared_key",
+      "single_limit",
+      "daily_limit",
+      "monthly_limit",
       "change_amount",
       "change_nonce"
     ]
   },
   credit_draw_slots1: {
-    artifactSha256: "2b9da9d3d1dbd411d9be1bbe2b34305ac5dce7c7d18e3857d8e2be7dd9bf7c21",
+    artifactSha256: "4542b227e0552b45c302f1dace21cadeba4962c96244e021472f1f7531cff8d1",
     keys: {
-      evm: "613699a440f50a0937e4c57e5152b5fdea42c31b10157d6b93226fef313df553"
+      evm: "43c051a2bedf9454c12e70b10156361e414944823ba23e80662c16c7ced0a2ce"
     },
-    publicInputCount: 18,
+    publicInputCount: 20,
     public: [
       {
         name: "chain_id",
@@ -6109,6 +6074,16 @@ var witness_layouts_default = {
         count: 1,
         array: true
       },
+      {
+        name: "current_day",
+        count: 1,
+        array: false
+      },
+      {
+        name: "current_month",
+        count: 1,
+        array: false
+      },
       {
         name: "auth_digest_high",
         count: 1,
@@ -6133,15 +6108,22 @@ var witness_layouts_default = {
       "leaf_indices",
       "merkle_paths",
       "input_source_indices",
-      "draw_amounts"
+      "draw_amounts",
+      "single_limits",
+      "daily_limits",
+      "monthly_limits",
+      "last_days",
+      "daily_spents",
+      "last_months",
+      "monthly_spents"
     ]
   },
   credit_draw_slots12: {
-    artifactSha256: "92b741e161a99c05b8810bc24cee6bafc1cebc85347ea47fe511ee6c8f7065be",
+    artifactSha256: "dd72b0867fc3be7cd90de263bd2d0892075cb18eb4f6dd671b13111710f10369",
     keys: {
-      evm: "a5ae214784fe6e523977ef4e283a6d217fc3f4ec0c5a40effb275693a74ee5ce"
+      evm: "5e31d771e6294993736078596d9c69f21fe7595eda50e3cce6d7406b65cf1443"
     },
-    publicInputCount: 84,
+    publicInputCount: 86,
     public: [
       {
         name: "chain_id",
@@ -6223,6 +6205,16 @@ var witness_layouts_default = {
         count: 12,
         array: true
       },
+      {
+        name: "current_day",
+        count: 1,
+        array: false
+      },
+      {
+        name: "current_month",
+        count: 1,
+        array: false
+      },
       {
         name: "auth_digest_high",
         count: 1,
@@ -6247,15 +6239,22 @@ var witness_layouts_default = {
       "leaf_indices",
       "merkle_paths",
       "input_source_indices",
-      "draw_amounts"
+      "draw_amounts",
+      "single_limits",
+      "daily_limits",
+      "monthly_limits",
+      "last_days",
+      "daily_spents",
+      "last_months",
+      "monthly_spents"
     ]
   },
   credit_draw_slots50: {
-    artifactSha256: "9c6a23d5dbca3a1aeed461c908f228e89642550775cbc519d633bb1c984a3d04",
+    artifactSha256: "09c7469866748b4c0c4bbf2b040844771948a170999f6dc7a38fe5c0ecda4054",
     keys: {
-      evm: "f0b192e2cb312148c7a16fae3acaed9efb01b0c6a1b381ce03468f00b4ef0f2a"
+      evm: "7b613225b6f32a077011d4196c356e836d22dcd116efe687fde53144fbd8db9f"
     },
-    publicInputCount: 312,
+    publicInputCount: 314,
     public: [
       {
         name: "chain_id",
@@ -6337,6 +6336,16 @@ var witness_layouts_default = {
         count: 50,
         array: true
       },
+      {
+        name: "current_day",
+        count: 1,
+        array: false
+      },
+      {
+        name: "current_month",
+        count: 1,
+        array: false
+      },
       {
         name: "auth_digest_high",
         count: 1,
@@ -6361,15 +6370,22 @@ var witness_layouts_default = {
       "leaf_indices",
       "merkle_paths",
       "input_source_indices",
-      "draw_amounts"
+      "draw_amounts",
+      "single_limits",
+      "daily_limits",
+      "monthly_limits",
+      "last_days",
+      "daily_spents",
+      "last_months",
+      "monthly_spents"
     ]
   },
   credit_draw_slots120: {
-    artifactSha256: "69686a4f0a8a98d8cef06485b0de1804ca2e8f47ce0244287a03ceef4d67625a",
+    artifactSha256: "6ccd0366a669c50fd5da875c3eae194fe8aa4c36d35a5f9ebfd64636ea599b48",
     keys: {
-      evm: "6f32ca89775f332a9193af9b1e25641ef14fda9fbdd2685c33ee775d3c170b92"
+      evm: "d715848afc5c1ecdfcef5ed5026865abef5040a3bc232fd65330a5ffee8475fb"
     },
-    publicInputCount: 732,
+    publicInputCount: 734,
     public: [
       {
         name: "chain_id",
@@ -6451,6 +6467,16 @@ var witness_layouts_default = {
         count: 120,
         array: true
       },
+      {
+        name: "current_day",
+        count: 1,
+        array: false
+      },
+      {
+        name: "current_month",
+        count: 1,
+        array: false
+      },
       {
         name: "auth_digest_high",
         count: 1,
@@ -6475,13 +6501,20 @@ var witness_layouts_default = {
       "leaf_indices",
       "merkle_paths",
       "input_source_indices",
-      "draw_amounts"
+      "draw_amounts",
+      "single_limits",
+      "daily_limits",
+      "monthly_limits",
+      "last_days",
+      "daily_spents",
+      "last_months",
+      "monthly_spents"
     ]
   },
   credit_cancel: {
-    artifactSha256: "ff278a04f22d2886c9f27f7785a0b8fc317dd242fd4aa9d0d9398d18b7513daf",
+    artifactSha256: "b4459c2cf756d096e37291cf4d7cd129866b6d420b6d03c928f383b057112ccb",
     keys: {
-      evm: "1f8a3c20cb081d6a90962556da3124919cc4e5675e59ad31562af39299da02fb"
+      evm: "fc8ad196ef15f3328afcc8f01d867a3ebefd15451c2813948442fab1923b73b2"
     },
     publicInputCount: 11,
     public: [
@@ -6551,14 +6584,21 @@ var witness_layouts_default = {
       "input_nonce",
       "expiry",
       "credit_shared_key",
+      "single_limit",
+      "daily_limit",
+      "monthly_limit",
+      "last_day",
+      "daily_spent",
+      "last_month",
+      "monthly_spent",
       "leaf_index",
       "merkle_path"
     ]
   },
   credit_top_up: {
-    artifactSha256: "fbe662363d9814983f7940f74369117cd6c84783945fbf527b0ed48d011b58a4",
+    artifactSha256: "2ffebd5753ec1b0c050204d4f97498765fe61ea01a793a9b2466c2f97536345c",
     keys: {
-      evm: "44436f31414497a708355426da051ee48ba63fdebcb6cfd72347c37c34c98c50"
+      evm: "40b02a9d2e7eb7b49daaac4b7760328537b7982fd5a225cc065bb74cd5ef44b3"
     },
     publicInputCount: 50,
     public: [
@@ -6693,6 +6733,16 @@ var witness_layouts_default = {
       "credit_amount",
       "credit_nonce",
       "credit_shared_key",
+      "single_limit",
+      "daily_limit",
+      "monthly_limit",
+      "previous_single_limit",
+      "previous_daily_limit",
+      "previous_monthly_limit",
+      "last_day",
+      "daily_spent",
+      "last_month",
+      "monthly_spent",
       "change_amount",
       "change_nonce",
       "previous_credit_amount",
@@ -6708,6 +6758,20 @@ var pad2 = (values, count, zero) => {
   if (values.length > count) throw new Error("witness capacity exceeded");
   return [...values, ...Array.from({ length: count - values.length }, zero)];
 };
+var policyWitness = (note, usage = true) => {
+  const p = (0, import_core10.normalizeCreditPolicy)(note);
+  return {
+    single_limit: p.singleLimit,
+    daily_limit: p.dailyLimit,
+    monthly_limit: p.monthlyLimit,
+    ...usage ? {
+      last_day: p.lastDay,
+      daily_spent: p.dailySpent,
+      last_month: p.lastMonth,
+      monthly_spent: p.monthlySpent
+    } : {}
+  };
+};
 var zeros = () => Array(16).fill(0n);
 var zeroAuthority = () => ({
   public_key_x: Array(32).fill(0),
@@ -6836,7 +6900,8 @@ var WitnessBuilder = class {
       note.amount,
       note.nonce,
       note.expiry,
-      await (0, import_core10.computeCreditSharedKeyHash)(note.creditSharedKey)
+      await (0, import_core10.computeCreditSharedKeyHash)(note.creditSharedKey),
+      note
     );
   }
   async noteInputs(inputs, sources, nullifiers, identity, authority) {
@@ -6920,6 +6985,8 @@ var WitnessBuilder = class {
       await this.creditLeaf(note) === p.params.creditCommitment && note.ownerPayout === BigInt(p.params.owner) && note.expiry === p.params.expiry,
       "Credit creation mismatch"
     );
+    if (operation === "create-credit" && [note.lastDay, note.dailySpent, note.lastMonth, note.monthlySpent].some((v) => v !== 0n))
+      throw new Error("new Credit usage must be zero");
     const authority = await this.authority(
       operation,
       10,
@@ -6966,6 +7033,7 @@ var WitnessBuilder = class {
       spender_payout: note.spenderPayout,
       spender_wallet_identity: BigInt(note.spenderWalletIdentity),
       owner_wallet_identity: BigInt(note.ownerWalletIdentity),
+      ...policyWitness(note, operation === "top-up-credit"),
       credit_amount: note.amount,
       credit_nonce: note.nonce,
       credit_shared_key: note.creditSharedKey,
@@ -7007,6 +7075,7 @@ var WitnessBuilder = class {
         spender_payout: note.spenderPayout,
         spender_wallet_identity: BigInt(note.spenderWalletIdentity),
         owner_wallet_identity: BigInt(note.ownerWalletIdentity),
+        ...policyWitness(note),
         input_nonce: note.nonce,
         expiry: note.expiry,
         credit_shared_key: note.creditSharedKey,
@@ -7017,7 +7086,7 @@ var WitnessBuilder = class {
     );
   }
   async drawCredit(p) {
-    const c = this.#protocol.context, profile = selectCreditDrawCircuit(p.inputs.length), capacity = profile.maxSize;
+    const c = { ...this.#protocol.context, timestamp: p.timestamp }, profile = selectCreditDrawCircuit(p.inputs.length), capacity = profile.maxSize;
     check2(
       p.inputs.length === p.amounts.length && p.inputs.length === p.params.nullifiers.length,
       "draw input count mismatch"
@@ -7032,6 +7101,7 @@ var WitnessBuilder = class {
     );
     const sourceIndices = await Promise.all(
       notes2.map(async (note, i) => {
+        (0, import_core10.applyCreditDrawUsage)(note, p.amounts[i], p.timestamp);
         const leaf = await this.creditLeaf(note);
         check2(
           note.spenderWalletIdentity === identity && note.spenderPayout === BigInt(p.params.spender) && note.expiry === p.params.expiries[i] && p.amounts[i] > 0n && p.amounts[i] <= note.amount && await (0, import_core10.computeCreditNullifier)(c.chainId, note.creditSharedKey, leaf) === p.params.nullifiers[i],
@@ -7044,6 +7114,26 @@ var WitnessBuilder = class {
       profile.name,
       {
         ...authority,
+        ...Object.fromEntries(
+          Object.entries({
+            singleLimit: "single_limits",
+            dailyLimit: "daily_limits",
+            monthlyLimit: "monthly_limits",
+            lastDay: "last_days",
+            dailySpent: "daily_spents",
+            lastMonth: "last_months",
+            monthlySpent: "monthly_spents"
+          }).map(([key, name]) => [
+            name,
+            pad2(
+              notes2.map(
+                (note) => (0, import_core10.normalizeCreditPolicy)(note)[key]
+              ),
+              capacity,
+              () => 0n
+            )
+          ])
+        ),
         spender_wallet_identity: BigInt(identity),
         owner_payouts: pad2(
           notes2.map((note) => note.ownerPayout),
@@ -7093,7 +7183,11 @@ var WitnessBuilder = class {
       "ownerWalletIdentity",
       "spenderPayout",
       "ownerPayout",
-      "creditSharedKey"
+      "creditSharedKey",
+      "lastDay",
+      "dailySpent",
+      "lastMonth",
+      "monthlySpent"
     ])
       check2(old[field2] === note[field2], "Credit role or payout changed");
     check2(
@@ -7114,6 +7208,9 @@ var WitnessBuilder = class {
       "credit_top_up",
       {
         ...base,
+        previous_single_limit: old.singleLimit,
+        previous_daily_limit: old.dailyLimit,
+        previous_monthly_limit: old.monthlyLimit,
         previous_credit_amount: old.amount,
         previous_credit_nonce: old.nonce,
         previous_credit_leaf_index: BigInt(p.previous.leafIndex),
@@ -7159,7 +7256,6 @@ async function resolveInstanceAddress(client, factoryAddress, salt) {
   buildTopUpCreditCalldata,
   buildTransactAggregateCalldata,
   buildTransactCalldata,
-  buildWithdrawalCalldata,
   cancelCreditBaseInputs,
   cancelCreditPublicInputs,
   cancelCreditRequestHash,
@@ -7189,8 +7285,8 @@ async function resolveInstanceAddress(client, factoryAddress, salt) {
   getEIP712Domain,
   known,
   normalizeContext,
-  normalizeDelivery,
   normalizeFunding,
+  normalizeOpaqueDelivery,
   normalizeSources,
   normalizeTransactRequest,
   notes,