@openzeppelin/miden-multisig-client 0.15.0 → 0.16.0

package/src/signers/miden-wallet.ecdsa-recovery.test.ts

@@ -0,0 +1,201 @@
+import { describe, expect, it } from 'vitest';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+
+import { MidenWalletSigner, type WalletSigningContext } from './miden-wallet.js';
+import type { Signer } from '../types.js';
+import { tryComputeEcdsaCommitmentHex } from '../utils/signature.js';
+import { bytesToHex, hexToBytes } from '../utils/encoding.js';
+import { buildGuardianSignatureFromSigner } from '../multisig/signing.js';
+
+// Real-crypto repro for the reported failure:
+//   "assertion failed with error message: invalid public key commitment"
+//
+// These tests use the real WASM SDK (Poseidon2/PublicKey, via tests/setup-wasm.ts)
+// and real secp256k1 keypairs — NOT mocks — so they exercise the exact kernel
+// invariant `Poseidon2(publicKey) == pub_key_commitment` that the transaction
+// kernel enforces in `ecdsa_k256_keccak.masm` (`assert_eqw "invalid public key
+// commitment"`). A wallet-delegated ECDSA cosigner whose `publicKey` degrades to
+// the 32-byte commitment — or is a valid-but-wrong key — fails that invariant.
+
+// Deterministic keys so the repro is reproducible run-to-run.
+const PRIVATE_KEY = hexToBytes('0x' + '11'.repeat(32));
+const COMPRESSED_PUBKEY_HEX = bytesToHex(secp256k1.getPublicKey(PRIVATE_KEY, true));
+
+// A second, unrelated key: valid secp256k1 but NOT the one the commitment is for.
+const OTHER_PRIVATE_KEY = hexToBytes('0x' + '22'.repeat(32));
+const OTHER_COMPRESSED_PUBKEY_HEX = bytesToHex(secp256k1.getPublicKey(OTHER_PRIVATE_KEY, true));
+
+/** Asserts a nullable value is present and returns it narrowed (avoids `!`). */
+function expectPresent<T>(value: T | null | undefined): T {
+  expect(value ?? null).not.toBeNull();
+  return value as T;
+}
+
+/**
+ * A wallet that signs like the real Miden Wallet ECDSA path: it keccak256-hashes
+ * the word bytes it receives, produces a 65-byte `r||s||v` signature, and prepends
+ * a 1-byte scheme tag (which `MidenWalletSigner.signWord` strips via `slice(1)`).
+ */
+function ecdsaWallet(privateKey: Uint8Array): WalletSigningContext {
+  return {
+    async signBytes(data: Uint8Array): Promise<Uint8Array> {
+      const msgHash = keccak_256(data);
+      const sig = secp256k1.sign(msgHash, privateKey);
+      const compact = sig.toCompactRawBytes(); // 64 bytes: r || s
+      const tagged = new Uint8Array(1 + 65);
+      tagged[0] = 1; // scheme tag, dropped by the signer
+      tagged.set(compact, 1);
+      tagged[1 + 64] = sig.recovery; // recovery byte v
+      return tagged;
+    },
+  };
+}
+
+/** Minimal ECDSA delegate (`localAuthSigner`) carrying a fixed public key. */
+function ecdsaDelegate(commitment: string, publicKey: string): Signer {
+  return {
+    commitment,
+    publicKey,
+    scheme: 'ecdsa',
+    signAccountIdWithTimestamp: async () => '0x00',
+    signCommitment: async () => '0x00',
+  };
+}
+
+describe('MidenWalletSigner ECDSA public-key resolution', () => {
+  it('resolves the real ECDSA public key from its own signature so it hashes to the account commitment', async () => {
+    // The account's stored commitment is Poseidon2(pubkey) — exactly what the kernel checks.
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+
+    // Wallet-delegated ECDSA cosigner constructed WITHOUT an explicit public key —
+    // the reported failure path, where `publicKey` silently fell back to the commitment.
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa');
+
+    await signer.signCommitment(accountCommitment);
+
+    // The resolved public key must be the real 33-byte key, not the 32-byte commitment...
+    expect(signer.publicKey).toBe(COMPRESSED_PUBKEY_HEX);
+    expect(signer.publicKey).not.toBe(accountCommitment);
+    // ...and it must Poseidon2-hash back to the commitment (the kernel's assert_eqw).
+    expect(tryComputeEcdsaCommitmentHex(signer.publicKey)).toBe(accountCommitment);
+  });
+
+  it('fails closed when the wallet signature recovers a key that does not match the commitment', async () => {
+    // The account commitment is for PRIVATE_KEY, but the wallet signs with a
+    // different key. Recovery must reject the mismatch rather than trust it.
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+
+    const signer = new MidenWalletSigner(ecdsaWallet(OTHER_PRIVATE_KEY), accountCommitment, 'ecdsa');
+    await signer.signCommitment(accountCommitment);
+
+    expect(() => signer.publicKey).toThrow(/does not match the signer commitment/);
+  });
+
+  it('accepts an explicit ECDSA public key whose commitment matches, without needing to sign', () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const signer = new MidenWalletSigner(
+      ecdsaWallet(PRIVATE_KEY),
+      accountCommitment,
+      'ecdsa',
+      undefined,
+      COMPRESSED_PUBKEY_HEX,
+    );
+    expect(signer.publicKey).toBe(COMPRESSED_PUBKEY_HEX);
+    expect(tryComputeEcdsaCommitmentHex(signer.publicKey)).toBe(accountCommitment);
+  });
+
+  it('rejects an explicit ECDSA public key whose commitment does not match the signer commitment', () => {
+    // A well-formed 33-byte key (passes format validation) that belongs to a
+    // different account. It must be rejected at the source, not carried into signing.
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const signer = new MidenWalletSigner(
+      ecdsaWallet(PRIVATE_KEY),
+      accountCommitment,
+      'ecdsa',
+      undefined,
+      OTHER_COMPRESSED_PUBKEY_HEX,
+    );
+    expect(() => signer.publicKey).toThrow(/does not match the signer commitment/);
+  });
+
+  it('rejects an explicit ECDSA key that is a valid length but not a secp256k1 point', () => {
+    // 33-byte, correct compressed tag, but x is off-curve — must be rejected at
+    // construction, SDK-independently, not silently carried to execute time.
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    expect(
+      () =>
+        new MidenWalletSigner(
+          ecdsaWallet(PRIVATE_KEY),
+          accountCommitment,
+          'ecdsa',
+          undefined,
+          '0x02' + 'ff'.repeat(32),
+        ),
+    ).toThrow(/not a valid secp256k1 point/);
+  });
+
+  it('compresses an explicitly-provided 65-byte uncompressed public key', () => {
+    const uncompressed = bytesToHex(secp256k1.getPublicKey(PRIVATE_KEY, false)); // 65 bytes
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const signer = new MidenWalletSigner(
+      ecdsaWallet(PRIVATE_KEY),
+      accountCommitment,
+      'ecdsa',
+      undefined,
+      uncompressed,
+    );
+    expect(signer.publicKey).toBe(COMPRESSED_PUBKEY_HEX);
+  });
+
+  it('accepts a localAuthSigner whose ECDSA public key matches the commitment', () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const delegate = ecdsaDelegate(accountCommitment, COMPRESSED_PUBKEY_HEX);
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa', delegate);
+    expect(signer.publicKey).toBe(COMPRESSED_PUBKEY_HEX);
+    expect(tryComputeEcdsaCommitmentHex(signer.publicKey)).toBe(accountCommitment);
+  });
+
+  it('rejects a localAuthSigner whose ECDSA public key does not match the commitment', () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const delegate = ecdsaDelegate(accountCommitment, OTHER_COMPRESSED_PUBKEY_HEX);
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa', delegate);
+    expect(() => signer.publicKey).toThrow(/does not match the signer commitment/);
+  });
+
+  it('rejects a localAuthSigner whose ECDSA key is a valid length but not a secp256k1 point', () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const delegate = ecdsaDelegate(accountCommitment, '0x02' + 'ff'.repeat(32));
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa', delegate);
+    expect(() => signer.publicKey).toThrow(/not a valid secp256k1 point/);
+  });
+
+  it('resolves the public key through a non-signCommitment path (signLookupMessage)', async () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa');
+
+    await signer.signLookupMessage(accountCommitment, 1700000000);
+
+    expect(signer.publicKey).toBe(COMPRESSED_PUBKEY_HEX);
+  });
+
+  it('builds a guardian ProposalSignature carrying the recovered key (integration via buildGuardianSignatureFromSigner)', async () => {
+    const accountCommitment = expectPresent(tryComputeEcdsaCommitmentHex(COMPRESSED_PUBKEY_HEX));
+    const signer = new MidenWalletSigner(ecdsaWallet(PRIVATE_KEY), accountCommitment, 'ecdsa');
+
+    // The exact call the guardian flow makes (multisig/signing.ts): sign the
+    // commitment, then read `signer.publicKey` for the ProposalSignature that is sent
+    // to the guardian and packed into the transaction advice map. This is the seam
+    // where the report observed `publicKey === commitment`.
+    const proposalSignature = await buildGuardianSignatureFromSigner(signer, accountCommitment);
+
+    expect(proposalSignature.scheme).toBe('ecdsa');
+    if (proposalSignature.scheme !== 'ecdsa') throw new Error('expected an ecdsa ProposalSignature');
+    // The signature reaching the guardian/kernel must carry the real 33-byte key,
+    // not the 32-byte commitment — otherwise Poseidon2(publicKey) == commitment fails.
+    const resolvedKey = expectPresent(proposalSignature.publicKey);
+    expect(resolvedKey).toBe(COMPRESSED_PUBKEY_HEX);
+    expect(resolvedKey).not.toBe(accountCommitment);
+    expect(tryComputeEcdsaCommitmentHex(resolvedKey)).toBe(accountCommitment);
+  });
+});

package/src/signers/miden-wallet.test.ts

@@ -54,28 +54,20 @@ describe('MidenWalletSigner', () => {
       expect(signer.publicKey).toBe('0xcommitment');
     });
 
-    it('should use explicit publicKey when provided', () => {
-      const signer = new MidenWalletSigner(
-        mockWallet,
-        '0xcommitment',
-        'ecdsa',
-        undefined,
-        '0xwalletpubkey',
-      );
-      expect(signer.publicKey).toBe('0xwalletpubkey');
+    it('throws on an invalid explicit ECDSA publicKey instead of falling back to the commitment', () => {
+      expect(
+        () => new MidenWalletSigner(mockWallet, '0xcommitment', 'ecdsa', undefined, '0xwalletpubkey'),
+      ).toThrow(/invalid ECDSA public key/);
     });
 
-    it('should use localAuthSigner publicKey when provided', () => {
-      const localSigner: Signer = {
-        commitment: '0xlocal',
-        publicKey: '0xlocalpubkey',
-        scheme: 'ecdsa',
-        signAccountIdWithTimestamp: vi.fn(),
-        signCommitment: vi.fn(),
-      };
-      const signer = new MidenWalletSigner(mockWallet, '0xcommitment', 'ecdsa', localSigner);
-      expect(signer.publicKey).toBe('0xlocalpubkey');
+    it('does not fall back to the commitment for an ECDSA signer with no key (throws until a signature exists)', () => {
+      const signer = new MidenWalletSigner(mockWallet, '0xcommitment', 'ecdsa');
+      expect(() => signer.publicKey).toThrow(/not available yet/);
     });
+
+    // ECDSA publicKey resolution against a real commitment (explicit key and
+    // localAuthSigner, match and mismatch) needs real Poseidon2 and is covered in
+    // miden-wallet.ecdsa-recovery.test.ts, which runs the WASM SDK.
   });
 
   describe('signAccountIdWithTimestamp', () => {

package/src/signers/miden-wallet.ts

@@ -1,20 +1,39 @@
 import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
 import type { Signer, SignatureScheme } from '../types.js';
 import { AuthDigest } from '../utils/digest.js';
-import { bytesToHex } from '../utils/encoding.js';
+import { EcdsaFormat } from '../utils/ecdsa.js';
+import { bytesToHex, normalizeHexWord } from '../utils/encoding.js';
 import { lookupAuthDigest } from '../lookupAuth.js';
+import { tryComputeEcdsaCommitmentHex } from '../utils/signature.js';
 import { wordToBytes } from '../utils/word.js';
 
 export interface WalletSigningContext {
+  /**
+   * Sign `data` with the wallet's key.
+   *
+   * `signBytes` MUST return the signature in the Miden SDK's serialized form: a
+   * 1-byte scheme tag followed by the raw signature. The signer always strips that
+   * leading tag byte, exactly as the SDK's own `EcdsaSigner`/`FalconSigner` do with
+   * `Signature.serialize()`.
+   *
+   * For an ECDSA (secp256k1/keccak) signer constructed WITHOUT an explicit public
+   * key and without a `localAuthSigner`, the raw signature MUST carry the recovery
+   * byte — the 65-byte `r||s||v` form (66 bytes including the tag) — so the public
+   * key can be recovered from it. A 64-byte signature with no recovery byte cannot
+   * be recovered, and the signer fails closed when `publicKey` is read.
+   */
   signBytes(data: Uint8Array, kind: 'word' | 'signingInputs'): Promise<Uint8Array>;
 }
 
 export class MidenWalletSigner implements Signer {
   readonly commitment: string;
-  readonly publicKey: string;
   readonly scheme: SignatureScheme;
   private readonly wallet: WalletSigningContext;
   private readonly localAuthSigner: Signer | null;
+  private readonly explicitPublicKey: string | null;
+  private resolvedPublicKey: string | null;
+  private lastSignedMessage: Uint8Array | null = null;
+  private lastSignature: Uint8Array | null = null;
 
   constructor(
     wallet: WalletSigningContext,
@@ -27,7 +46,86 @@ export class MidenWalletSigner implements Signer {
     this.commitment = commitment;
     this.scheme = scheme;
     this.localAuthSigner = localAuthSigner ?? null;
-    this.publicKey = publicKey ?? localAuthSigner?.publicKey ?? commitment;
+
+    if (scheme === 'ecdsa') {
+      this.explicitPublicKey = publicKey == null ? null : validateEcdsaPublicKeyHex(publicKey);
+      this.resolvedPublicKey = null;
+    } else {
+      this.explicitPublicKey = null;
+      this.resolvedPublicKey = publicKey ?? localAuthSigner?.publicKey ?? commitment;
+    }
+  }
+
+  /**
+   * The signer's public key.
+   *
+   * Returns immediately for Falcon. For ECDSA the key is resolved from one of
+   * three sources — an explicit key, a delegate `localAuthSigner`, or recovery
+   * from a signature the signer has already produced — and every source is
+   * verified against {@link commitment} via the same `Poseidon2(publicKey) ==
+   * commitment` invariant the transaction kernel enforces. Reading `publicKey`
+   * before any source is available, or when the resolved key does not match the
+   * commitment, throws: a loud sign-time failure instead of an opaque kernel
+   * assertion ("invalid public key commitment") at execute time.
+   */
+  get publicKey(): string {
+    if (this.resolvedPublicKey !== null) {
+      return this.resolvedPublicKey;
+    }
+
+    if (this.explicitPublicKey !== null) {
+      return this.verifyAndCache(this.explicitPublicKey, false);
+    }
+
+    if (this.localAuthSigner !== null) {
+      return this.verifyAndCache(validateEcdsaPublicKeyHex(this.localAuthSigner.publicKey), false);
+    }
+
+    if (this.lastSignature === null || this.lastSignedMessage === null) {
+      throw new Error(
+        'MidenWalletSigner: ECDSA public key is not available yet — produce a signature first, ' +
+          'or pass `publicKey` to the constructor.',
+      );
+    }
+
+    const recovered = EcdsaFormat.recoverCompressedPublicKeyHex(
+      this.lastSignedMessage,
+      this.lastSignature,
+    );
+    return this.verifyAndCache(recovered, true);
+  }
+
+  /**
+   * Verify an already point-validated ECDSA public-key candidate against
+   * {@link commitment} and cache it on success.
+   *
+   * A mismatching commitment is always rejected. `requireCommitment` distinguishes
+   * the recovery path — where a signature already exists, so the SDK must be
+   * initialized and an uncomputable commitment is an error — from the
+   * explicit/delegate paths, where a caller may read `publicKey` before the SDK is
+   * initialized. In that cold-SDK case the commitment cannot be computed yet, so
+   * the candidate is returned WITHOUT being cached and verification is re-attempted
+   * on the next read (once the SDK is up, as it always is in the guardian flow).
+   */
+  private verifyAndCache(candidate: string, requireCommitment: boolean): string {
+    const candidateCommitment = tryComputeEcdsaCommitmentHex(candidate);
+    if (candidateCommitment === null) {
+      if (requireCommitment) {
+        throw new Error(
+          'MidenWalletSigner: could not compute a commitment for the recovered ECDSA public key ' +
+            '(is the Miden SDK initialized?).',
+        );
+      }
+      return candidate;
+    }
+    if (candidateCommitment !== normalizeHexWord(this.commitment)) {
+      throw new Error(
+        'MidenWalletSigner: the ECDSA public key does not match the signer commitment.',
+      );
+    }
+
+    this.resolvedPublicKey = candidate;
+    return candidate;
   }
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
@@ -46,10 +144,6 @@ export class MidenWalletSigner implements Signer {
     if (this.localAuthSigner?.signRequest) {
       return this.localAuthSigner.signRequest(accountId, timestamp, requestPayload);
     }
-
-    if (this.scheme === 'falcon') {
-      return this.signWord(AuthDigest.fromRequest(accountId, timestamp, requestPayload));
-    }
     return this.signWord(AuthDigest.fromRequest(accountId, timestamp, requestPayload));
   }
 
@@ -74,6 +168,39 @@ export class MidenWalletSigner implements Signer {
     const bytes = wordToBytes(word);
     const signatureBytes = await this.wallet.signBytes(bytes, 'word');
     const rawSignature = signatureBytes.slice(1);
+    if (
+      this.scheme === 'ecdsa' &&
+      this.explicitPublicKey === null &&
+      this.localAuthSigner === null
+    ) {
+      this.lastSignedMessage = bytes;
+      this.lastSignature = rawSignature;
+    }
     return bytesToHex(rawSignature);
   }
 }
+
+/**
+ * Validate an ECDSA public key and return its compressed (33-byte) form.
+ *
+ * The key must be a 33-/65-byte hex key AND a real secp256k1 curve point; a
+ * malformed or off-curve key throws immediately (SDK-independent) rather than
+ * degrading to the commitment or surfacing as an opaque kernel assertion at
+ * execute time. Mirrors the format handling ParaSigner does for explicit keys.
+ */
+function validateEcdsaPublicKeyHex(publicKey: string): string {
+  if (!EcdsaFormat.validatePublicKeyHex(publicKey)) {
+    throw new Error(
+      'MidenWalletSigner: invalid ECDSA public key (expected a 33- or 65-byte hex key); ' +
+        'refusing to fall back to the commitment.',
+    );
+  }
+  const compressed = EcdsaFormat.compressPublicKey(publicKey);
+  if (!EcdsaFormat.isValidPublicKeyPoint(compressed)) {
+    throw new Error(
+      'MidenWalletSigner: invalid ECDSA public key (not a valid secp256k1 point); ' +
+        'refusing to fall back to the commitment.',
+    );
+  }
+  return compressed;
+}

package/src/transaction/consumeNotes.ts

@@ -15,7 +15,7 @@ import { LegacyConsumeNotesNoteMissingError } from '../multisig/consumeNotesErro
 import { getRawMidenClient } from '../raw-client.js';
 import { normalizeHexWord } from '../utils/encoding.js';
 import { randomWord } from '../utils/random.js';
-import type { SignatureOptions } from './options.js';
+import type { MidenClientSignatureOptions, SignatureOptions } from './options.js';
 
 /**
  * Build a consume-notes request from loaded `Note` objects (no local-store
@@ -57,6 +57,16 @@ export function buildConsumeNotesTransactionRequestFromNotes(
  * Legacy/creation adapter: fetches notes from the local store and delegates
  * to the from-notes variant. v2 verification MUST NOT call this.
  */
+export function buildConsumeNotesTransactionRequest(
+  client: MidenClient,
+  noteIds: string[],
+  options: MidenClientSignatureOptions,
+): Promise<{ request: TransactionRequest; salt: Word }>;
+export function buildConsumeNotesTransactionRequest(
+  client: WasmWebClient,
+  noteIds: string[],
+  options?: SignatureOptions,
+): Promise<{ request: TransactionRequest; salt: Word }>;
 export async function buildConsumeNotesTransactionRequest(
   client: MidenClient | WasmWebClient,
   noteIds: string[],

package/src/transaction/options.ts

@@ -7,3 +7,7 @@ export interface SignatureOptions {
   signatureScheme?: SignatureScheme;
   midenRpcEndpoint?: string;
 }
+
+export interface MidenClientSignatureOptions extends SignatureOptions {
+  midenRpcEndpoint: string;
+}

package/src/transaction/p2id.test.ts

@@ -2,10 +2,13 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Word } from '@miden-sdk/miden-sdk';
 
 const {
+  mockFromVaultKey,
+  mockFungibleAssetConstructor,
   mockHashElements,
   mockNormalizeHexWord,
   mockRandomWord,
   mockWordFromHex,
+  noteMetadataCalls,
   saltFelts,
 } = vi.hoisted(() => {
   const saltFelts = [
@@ -16,6 +19,13 @@ const {
   ];
 
   return {
+    mockFromVaultKey: vi.fn((vaultKey: unknown, amount: bigint) => ({
+      kind: 'asset-from-vault-key',
+      vaultKey,
+      amount,
+    })),
+    mockFungibleAssetConstructor: vi.fn(),
+    noteMetadataCalls: [] as unknown[][],
     mockHashElements: vi.fn().mockReturnValue({ toString: () => 'serial' }),
     mockNormalizeHexWord: vi.fn((hex: string) => hex),
     mockRandomWord: vi.fn().mockReturnValue({
@@ -66,10 +76,12 @@ vi.mock('@miden-sdk/miden-sdk', () => {
 
   class NoteMetadata {
     constructor(
-      _sender: unknown,
-      _noteType: unknown,
-      _noteTag: unknown,
-    ) {}
+      sender: unknown,
+      noteType: unknown,
+      noteTag: unknown,
+    ) {
+      noteMetadataCalls.push([sender, noteType, noteTag]);
+    }
   }
 
   class NoteRecipient {
@@ -89,7 +101,11 @@ vi.mock('@miden-sdk/miden-sdk', () => {
   }
 
   class FungibleAsset {
-    constructor(_faucet: unknown, _amount: bigint) {}
+    constructor(faucet: unknown, amount: bigint) {
+      mockFungibleAssetConstructor(faucet, amount);
+    }
+
+    static fromVaultKey = mockFromVaultKey;
   }
 
   class NoteArray {
@@ -120,6 +136,7 @@ vi.mock('@miden-sdk/miden-sdk', () => {
         hex,
         prefix: () => 1,
         suffix: () => 2,
+        toString: () => hex,
       })),
     },
     Felt,
@@ -140,7 +157,8 @@ vi.mock('@miden-sdk/miden-sdk', () => {
       withAccountTarget: vi.fn(() => ({ kind: 'tag' })),
     },
     NoteType: {
-      Public: 'public',
+      Private: 0,
+      Public: 1,
     },
     OutputNote: {
       full: vi.fn((note: unknown) => ({ note })),
@@ -163,14 +181,32 @@ vi.mock('../utils/random.js', () => ({
   randomWord: mockRandomWord,
 }));
 
-import { buildP2idTransactionRequest } from './p2id.js';
+import { buildP2idTransactionRequest, parseP2idNoteType, p2idNoteTypeToMetadata } from './p2id.js';
+import type { Account } from '@miden-sdk/miden-sdk';
+
+const FAUCET_ID = '0x7bfb0f38b0fafa103f86a805594171';
+
+const mockAccount = {
+  vault: () => ({
+    fungibleAssets: () => [
+      {
+        faucetId: () => ({ toString: () => FAUCET_ID }),
+        vaultKey: () => ({ kind: 'vault-key' }),
+      },
+    ],
+  }),
+} as unknown as Account;
+import { NoteType } from '@miden-sdk/miden-sdk';
 
 describe('buildP2idTransactionRequest', () => {
   beforeEach(() => {
+    mockFromVaultKey.mockClear();
+    mockFungibleAssetConstructor.mockClear();
     mockHashElements.mockClear();
     mockNormalizeHexWord.mockClear();
     mockRandomWord.mockClear();
     mockWordFromHex.mockClear();
+    noteMetadataCalls.length = 0;
   });
 
   it('derives serial number from salt felts plus four zero felts', () => {
@@ -179,8 +215,9 @@ describe('buildP2idTransactionRequest', () => {
     buildP2idTransactionRequest(
       '0x7bfb0f38b0fafa103f86a805594170',
       '0x8a65fc5a39e4cd106d648e3eb4ab5f',
-      '0x7bfb0f38b0fafa103f86a805594171',
+      FAUCET_ID,
       10n,
+      mockAccount,
       { salt },
     );
 
@@ -197,4 +234,57 @@ describe('buildP2idTransactionRequest', () => {
       expect((felt as { value: bigint }).value).toBe(0n);
     }
   });
+
+  it('creates a public note by default (issue #322)', () => {
+    buildP2idTransactionRequest(
+      '0x7bfb0f38b0fafa103f86a805594170',
+      '0x8a65fc5a39e4cd106d648e3eb4ab5f',
+      '0x7bfb0f38b0fafa103f86a805594171',
+      10n,
+      mockAccount,
+    );
+
+    expect(noteMetadataCalls).toHaveLength(1);
+    expect(noteMetadataCalls[0][1]).toBe(NoteType.Public);
+  });
+
+  it('threads the requested noteType into the note metadata (issue #322)', () => {
+    buildP2idTransactionRequest(
+      '0x7bfb0f38b0fafa103f86a805594170',
+      '0x8a65fc5a39e4cd106d648e3eb4ab5f',
+      '0x7bfb0f38b0fafa103f86a805594171',
+      10n,
+      mockAccount,
+      { noteType: NoteType.Private },
+    );
+
+    expect(noteMetadataCalls).toHaveLength(1);
+    expect(noteMetadataCalls[0][1]).toBe(NoteType.Private);
+  });
+});
+
+describe('parseP2idNoteType', () => {
+  it('maps absent to Public (pre-#322 proposals)', () => {
+    expect(parseP2idNoteType(undefined)).toBe(NoteType.Public);
+  });
+
+  it('maps wire values to note types', () => {
+    expect(parseP2idNoteType('public')).toBe(NoteType.Public);
+    expect(parseP2idNoteType('private')).toBe(NoteType.Private);
+  });
+
+  it('rejects unknown values instead of silently rebuilding a public note', () => {
+    expect(() => parseP2idNoteType('encrypted')).toThrow(/unsupported metadata.noteType/);
+  });
+});
+
+describe('p2idNoteTypeToMetadata', () => {
+  it('omits the default so public payloads keep the legacy wire shape', () => {
+    expect(p2idNoteTypeToMetadata(undefined)).toBeUndefined();
+    expect(p2idNoteTypeToMetadata(NoteType.Public)).toBeUndefined();
+  });
+
+  it('serializes private', () => {
+    expect(p2idNoteTypeToMetadata(NoteType.Private)).toBe('private');
+  });
 });