@taquito/sapling 24.3.0-rc.2 → 24.3.0-rc.3

package/SAPLING_PARAMS_PROVENANCE.md

@@ -1,12 +1,17 @@
 ## Sapling Parameter Provenance
 
-The `saplingOutputParams.js` file in this package and the `saplingSpendParams.js` file in the sibling `@taquito/sapling-spend-params` package are vendored copies of the Sapling proving parameters distributed by the Zcash project.
+Taquito now treats the Sapling proving parameters as immutable release artifacts served from the first-party host at `https://sapling.taquito.io`, not as vendored package payloads.
 
-Source:
+Original source:
 - `https://download.z.cash/downloads/sapling-spend.params`
 - `https://download.z.cash/downloads/sapling-output.params`
 
-Verification data:
+Hosted release paths:
+- `https://sapling.taquito.io/params/groth16-mainnet-1/spend.params`
+- `https://sapling.taquito.io/params/groth16-mainnet-1/output.params`
+- `https://sapling.taquito.io/manifests/groth16-mainnet-1.json`
+
+Pinned verification data:
 - `sapling-spend.params`
   - Size: `47,958,396` bytes
   - SHA-256: `8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13`
@@ -14,11 +19,12 @@ Verification data:
   - Size: `3,592,860` bytes
   - SHA-256: `2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4`
 
-Why these files are vendored:
-- `@taquito/sapling` previously fetched them during `postinstall`, which made installs network-dependent.
-- Vendoring keeps published packages self-contained and makes builds reproducible.
-- These parameters are treated as fixed trusted setup artifacts, not routine updatable assets.
+Release source of truth:
+- the pinned manifest lives in `src/sapling-params-manifest.json`
+- `src/sapling-params-loader.ts` imports that manifest for the default runtime URLs and digests
+- `prepare-sapling-release-artifacts.js` emits the exact upload set for the current parameter version
 
-Maintainer note:
-- `fetch-sapling-params.js` is retained only as a repo-maintenance helper to regenerate the vendored wrapper files from the exact raw parameter files above.
-- Any regeneration should be exceptional, manually reviewed, and accompanied by explicit provenance updates in this file.
+Operational note:
+- upload only immutable, versioned objects
+- verify the public bytes against the pinned hashes after upload
+- the Cloudflare rollout and verification steps are documented in `docs/infra/sapling-cloudflare-r2-rollout.md`

package/dist/lib/sapling-module-wrapper.js

@@ -1,11 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SaplingWrapper = void 0;
-const buffer_1 = require("buffer");
 const sapling = require("./sapling-wasm");
-const sapling_output_params_1 = require("./sapling-output-params");
-const sapling_spend_params_1 = require("@taquito/sapling-spend-params");
-let cachedParams;
+const sapling_params_loader_1 = require("./sapling-params-loader");
 const getRandomValueSource = () => {
     const crypto = globalThis.crypto;
     if (!crypto?.getRandomValues) {
@@ -15,7 +12,7 @@ const getRandomValueSource = () => {
 };
 class SaplingWrapper {
     async withProvingContext(action) {
-        await this.initSaplingParameters();
+        await (0, sapling_params_loader_1.preloadSaplingParams)();
         return sapling.withProvingContext(action);
     }
     getRandomBytes(length) {
@@ -53,13 +50,7 @@ class SaplingWrapper {
         return sapling.createBindingSignature(saplingContext, balance, transactionSigHash);
     }
     async initSaplingParameters() {
-        if (!cachedParams) {
-            cachedParams = {
-                spend: buffer_1.Buffer.from(sapling_spend_params_1.default.saplingSpendParams, 'base64'),
-                output: buffer_1.Buffer.from(sapling_output_params_1.default.saplingOutputParams, 'base64'),
-            };
-        }
-        return sapling.initParameters(cachedParams.spend, cachedParams.output);
+        return (0, sapling_params_loader_1.preloadSaplingParams)();
     }
 }
 exports.SaplingWrapper = SaplingWrapper;

package/dist/lib/sapling-params-loader.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SaplingParamsError = void 0;
+exports.initSapling = initSapling;
+exports.preloadSaplingParams = preloadSaplingParams;
+const buffer_1 = require("buffer");
+const sapling = require("./sapling-wasm");
+const sapling_params_manifest_json_1 = require("./sapling-params-manifest.json");
+const DEFAULT_SAPLING_PARAMS_MANIFEST = sapling_params_manifest_json_1.default;
+class SaplingParamsError extends Error {
+    constructor(code, message, source, cause) {
+        super(message);
+        this.code = code;
+        this.source = source;
+        this.name = 'SaplingParamsError';
+        this.cause = cause;
+    }
+}
+exports.SaplingParamsError = SaplingParamsError;
+let configuredSaplingParamsSource;
+let frozenSaplingParamsSource;
+let loadedSaplingParams;
+let saplingParamsLoadPromise;
+let saplingParamsInitPromise;
+async function initSapling(options = {}) {
+    const nextSource = resolveSaplingParamsSource(options.params);
+    if (frozenSaplingParamsSource || saplingParamsLoadPromise || saplingParamsInitPromise) {
+        return;
+    }
+    configuredSaplingParamsSource = nextSource;
+}
+async function preloadSaplingParams() {
+    if (!saplingParamsInitPromise) {
+        saplingParamsInitPromise = initializeSaplingParams().catch((error) => {
+            saplingParamsInitPromise = undefined;
+            throw error;
+        });
+    }
+    return saplingParamsInitPromise;
+}
+async function initializeSaplingParams() {
+    const { spend, output } = await loadSaplingParams();
+    await sapling.initParameters(spend, output);
+}
+async function loadSaplingParams() {
+    if (loadedSaplingParams) {
+        return loadedSaplingParams;
+    }
+    if (!saplingParamsLoadPromise) {
+        const source = frozenSaplingParamsSource ?? configuredSaplingParamsSource ?? resolveSaplingParamsSource();
+        saplingParamsLoadPromise = loadSaplingParamsFromSource(source)
+            .then((params) => {
+            frozenSaplingParamsSource = source;
+            loadedSaplingParams = params;
+            return params;
+        })
+            .catch((error) => {
+            saplingParamsLoadPromise = undefined;
+            throw error;
+        });
+    }
+    return saplingParamsLoadPromise;
+}
+async function loadSaplingParamsFromSource(source) {
+    if (source.kind === 'local') {
+        const [spend, output] = await Promise.all([
+            loadLocalParam(source.spend.path, source.spend.sha256, 'spend', source.source),
+            loadLocalParam(source.output.path, source.output.sha256, 'output', source.source),
+        ]);
+        return { spend, output };
+    }
+    const [spend, output] = await Promise.all([
+        loadRemoteParam(source.spend.url, source.spend.sha256, 'spend', source.source),
+        loadRemoteParam(source.output.url, source.output.sha256, 'output', source.source),
+    ]);
+    return { spend, output };
+}
+async function loadRemoteParam(url, expectedSha256, label, source) {
+    let response;
+    try {
+        response = await fetch(url);
+    }
+    catch (error) {
+        throw new SaplingParamsError('SAPLING_PARAMS_FETCH_FAILED', `Failed to fetch Sapling ${label} params from ${url}`, source, error);
+    }
+    if (!response.ok) {
+        throw new SaplingParamsError('SAPLING_PARAMS_FETCH_FAILED', `Failed to fetch Sapling ${label} params from ${url}: ${response.status}`, source);
+    }
+    const bytes = buffer_1.Buffer.from(await response.arrayBuffer());
+    await assertSha256(bytes, expectedSha256, label, source, url);
+    return bytes;
+}
+async function loadLocalParam(path, expectedSha256, label, source) {
+    if (!isNodeLikeRuntime()) {
+        throw new SaplingParamsError('SAPLING_PARAMS_UNSUPPORTED_RUNTIME', `Sapling local ${label} params are only supported in Node.js and CI environments`, source);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { readFile } = require(getNodeFsPromisesModuleId());
+    const bytes = buffer_1.Buffer.from(await readFile(path));
+    if (expectedSha256) {
+        await assertSha256(bytes, expectedSha256, label, source, path);
+    }
+    return bytes;
+}
+async function assertSha256(bytes, expectedSha256, label, source, location) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new SaplingParamsError('SAPLING_PARAMS_UNSUPPORTED_RUNTIME', `Sapling ${label} params verification requires globalThis.crypto.subtle`, source);
+    }
+    const digest = await subtle.digest('SHA-256', Uint8Array.from(bytes));
+    const actualSha256 = buffer_1.Buffer.from(digest).toString('hex');
+    if (actualSha256 !== expectedSha256) {
+        throw new SaplingParamsError('SAPLING_PARAMS_HASH_MISMATCH', `Sapling ${label} params from ${source} failed integrity verification for ${location} (expected SHA-256 ${expectedSha256}, got ${actualSha256})`, source);
+    }
+}
+function resolveSaplingParamsSource(params = undefined) {
+    if (!params || typeof params.source !== 'undefined') {
+        const source = params?.source ?? 'taquito';
+        return {
+            kind: 'remote',
+            source,
+            spend: {
+                url: source === 'zcash'
+                    ? DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.zcashUrl
+                    : DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.taquitoUrl,
+                sha256: DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.sha256,
+            },
+            output: {
+                url: source === 'zcash'
+                    ? DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.zcashUrl
+                    : DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.taquitoUrl,
+                sha256: DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.sha256,
+            },
+        };
+    }
+    if ('spendParamsPath' in params || 'outputParamsPath' in params) {
+        if (!params.spendParamsPath || !params.outputParamsPath) {
+            throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling local params configuration requires both spendParamsPath and outputParamsPath', 'local');
+        }
+        return {
+            kind: 'local',
+            source: 'local',
+            spend: {
+                path: params.spendParamsPath,
+                sha256: params.spendParamsSha256,
+            },
+            output: {
+                path: params.outputParamsPath,
+                sha256: params.outputParamsSha256,
+            },
+        };
+    }
+    if (!params.spendParamsUrl || !params.outputParamsUrl) {
+        throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling remote params configuration requires both spendParamsUrl and outputParamsUrl', 'custom');
+    }
+    if (!params.spendParamsSha256 || !params.outputParamsSha256) {
+        throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling remote params configuration requires explicit SHA-256 digests', 'custom');
+    }
+    return {
+        kind: 'remote',
+        source: 'custom',
+        spend: {
+            url: params.spendParamsUrl,
+            sha256: params.spendParamsSha256,
+        },
+        output: {
+            url: params.outputParamsUrl,
+            sha256: params.outputParamsSha256,
+        },
+    };
+}
+function isNodeLikeRuntime() {
+    const runtimeProcess = globalThis.process;
+    return !!runtimeProcess?.versions?.node;
+}
+function getNodeFsPromisesModuleId() {
+    // Keep this module id opaque enough that browser bundlers do not eagerly
+    // try to resolve a Node-only dependency into the browser build.
+    return ['node', 'fs', 'promises'].join(':').replace('fs:promises', 'fs/promises');
+}

package/dist/lib/sapling-params-manifest.json

@@ -0,0 +1,15 @@
+{
+    "saplingParamsVersion": "groth16-mainnet-1",
+    "spendParams": {
+        "sha256": "8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13",
+        "bytes": 47958396,
+        "taquitoUrl": "https://sapling.taquito.io/params/groth16-mainnet-1/spend.params",
+        "zcashUrl": "https://download.z.cash/downloads/sapling-spend.params"
+    },
+    "outputParams": {
+        "sha256": "2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4",
+        "bytes": 3592860,
+        "taquitoUrl": "https://sapling.taquito.io/params/groth16-mainnet-1/output.params",
+        "zcashUrl": "https://download.z.cash/downloads/sapling-output.params"
+    }
+}

package/dist/lib/taquito-sapling.js

@@ -16,7 +16,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 };
 var _SaplingToolkit_inMemorySpendingKey, _SaplingToolkit_saplingId, _SaplingToolkit_contractAddress, _SaplingToolkit_memoSize, _SaplingToolkit_readProvider, _SaplingToolkit_packer, _SaplingToolkit_saplingForger, _SaplingToolkit_saplingTxBuilder, _SaplingToolkit_saplingTransactionViewer;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SaplingToolkit = exports.InMemoryProvingKey = exports.InMemorySpendingKey = exports.InMemoryViewingKey = exports.SaplingTransactionViewer = void 0;
+exports.SaplingToolkit = exports.InMemoryProvingKey = exports.InMemorySpendingKey = exports.InMemoryViewingKey = exports.SaplingTransactionViewer = exports.SaplingParamsError = exports.preloadSaplingParams = exports.initSapling = void 0;
 const buffer_1 = require("buffer");
 const bignumber_js_1 = require("bignumber.js");
 const BigNumber = bignumber_js_1.default;
@@ -29,6 +29,10 @@ const sapling_transaction_viewer_1 = require("./sapling-tx-viewer/sapling-transa
 const sapling_transactions_builder_1 = require("./sapling-tx-builder/sapling-transactions-builder");
 const constants_1 = require("./constants");
 const core_1 = require("@taquito/core");
+var sapling_params_loader_1 = require("./sapling-params-loader");
+Object.defineProperty(exports, "initSapling", { enumerable: true, get: function () { return sapling_params_loader_1.initSapling; } });
+Object.defineProperty(exports, "preloadSaplingParams", { enumerable: true, get: function () { return sapling_params_loader_1.preloadSaplingParams; } });
+Object.defineProperty(exports, "SaplingParamsError", { enumerable: true, get: function () { return sapling_params_loader_1.SaplingParamsError; } });
 var sapling_transaction_viewer_2 = require("./sapling-tx-viewer/sapling-transaction-viewer");
 Object.defineProperty(exports, "SaplingTransactionViewer", { enumerable: true, get: function () { return sapling_transaction_viewer_2.SaplingTransactionViewer; } });
 var in_memory_viewing_key_1 = require("./sapling-keys/in-memory-viewing-key");

package/dist/lib/version.js

@@ -3,6 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 // IMPORTANT: THIS FILE IS AUTO GENERATED! DO NOT MANUALLY EDIT!
 exports.VERSION = {
-    "commitHash": "7e99d97864147bbcc2291f12aac10e368afd9055",
-    "version": "24.3.0-rc.2"
+    "commitHash": "17a8431576e7c428f69f4bcb79687903a9d354ea",
+    "version": "24.3.0-rc.3"
 };

package/dist/taquito-sapling.es6.js

@@ -2,11 +2,9 @@ import BigNumberJs from 'bignumber.js';
 import { MichelCodecPacker } from '@taquito/taquito';
 import { b58Encode, PrefixV2, bytesToString, toHexBuf, stringToBytes, hex2buf, mergebuf, hex2Bytes, num2PaddedHex, b58DecodeAndCheckPrefix, format, b58DecodePublicKeyHash, validateKeyHash, ValidationResult } from '@taquito/utils';
 import { ParameterValidationError, TaquitoError, InvalidKeyHashError, InvalidAddressError } from '@taquito/core';
-import { keyAgreement, getRawPaymentAddressFromIncomingViewingKey, verifyCommitment, computeNullifier, merkleHash, withProvingContext, randR, getOutgoingViewingKey, preparePartialOutputDescription, getDiversifiedFromRawPaymentAddress, deriveEphemeralPublicKey, getPkdFromRawPaymentAddress, createBindingSignature, initParameters, getExtendedFullViewingKeyFromSpendingKey, getIncomingViewingKey, getPaymentAddressFromViewingKey, getExtendedSpendingKey, prepareSpendDescriptionWithSpendingKey, signSpendDescription, getProofAuthorizingKey, prepareSpendDescriptionWithAuthorizingKey } from '@taquito/sapling-wasm';
+import { keyAgreement, getRawPaymentAddressFromIncomingViewingKey, verifyCommitment, computeNullifier, merkleHash, initParameters, withProvingContext, randR, getOutgoingViewingKey, preparePartialOutputDescription, getDiversifiedFromRawPaymentAddress, deriveEphemeralPublicKey, getPkdFromRawPaymentAddress, createBindingSignature, getExtendedFullViewingKeyFromSpendingKey, getIncomingViewingKey, getPaymentAddressFromViewingKey, getExtendedSpendingKey, prepareSpendDescriptionWithSpendingKey, signSpendDescription, getProofAuthorizingKey, prepareSpendDescriptionWithAuthorizingKey } from '@taquito/sapling-wasm';
 import blake from 'blakejs';
 import { openSecretBox, secretBox } from '@stablelib/nacl';
-import '../saplingOutputParams.js';
-import saplingSpendParams from '@taquito/sapling-spend-params';
 import toBuffer from 'typedarray-to-buffer';
 
 /******************************************************************************
@@ -2969,17 +2967,193 @@ class SaplingState {
     }
 }
 
-const loadSaplingOutputParams = () => {
-    const saplingOutputParams = globalThis.__taquitoVendoredParams
-        ?.saplingOutputParams;
-    if (!saplingOutputParams) {
-        throw new Error('Vendored sapling output params failed to load');
-    }
-    return saplingOutputParams;
+var spendParams = {
+	sha256: "8e48ffd23abb3a5fd9c5589204f32d9c31285a04b78096ba40a79b75677efc13",
+	taquitoUrl: "https://sapling.taquito.io/params/groth16-mainnet-1/spend.params",
+	zcashUrl: "https://download.z.cash/downloads/sapling-spend.params"
+};
+var outputParams = {
+	sha256: "2f0ebbcbb9bb0bcffe95a397e7eba89c29eb4dde6191c339db88570e3f3fb0e4",
+	taquitoUrl: "https://sapling.taquito.io/params/groth16-mainnet-1/output.params",
+	zcashUrl: "https://download.z.cash/downloads/sapling-output.params"
+};
+var saplingParamsManifest = {
+	spendParams: spendParams,
+	outputParams: outputParams
 };
-var saplingOutputParams = loadSaplingOutputParams();
 
-let cachedParams;
+const DEFAULT_SAPLING_PARAMS_MANIFEST = saplingParamsManifest;
+class SaplingParamsError extends Error {
+    constructor(code, message, source, cause) {
+        super(message);
+        this.code = code;
+        this.source = source;
+        this.name = 'SaplingParamsError';
+        this.cause = cause;
+    }
+}
+let configuredSaplingParamsSource;
+let frozenSaplingParamsSource;
+let loadedSaplingParams;
+let saplingParamsLoadPromise;
+let saplingParamsInitPromise;
+async function initSapling(options = {}) {
+    const nextSource = resolveSaplingParamsSource(options.params);
+    if (frozenSaplingParamsSource || saplingParamsLoadPromise || saplingParamsInitPromise) {
+        return;
+    }
+    configuredSaplingParamsSource = nextSource;
+}
+async function preloadSaplingParams() {
+    if (!saplingParamsInitPromise) {
+        saplingParamsInitPromise = initializeSaplingParams().catch((error) => {
+            saplingParamsInitPromise = undefined;
+            throw error;
+        });
+    }
+    return saplingParamsInitPromise;
+}
+async function initializeSaplingParams() {
+    const { spend, output } = await loadSaplingParams();
+    await initParameters(spend, output);
+}
+async function loadSaplingParams() {
+    if (loadedSaplingParams) {
+        return loadedSaplingParams;
+    }
+    if (!saplingParamsLoadPromise) {
+        const source = frozenSaplingParamsSource ?? configuredSaplingParamsSource ?? resolveSaplingParamsSource();
+        saplingParamsLoadPromise = loadSaplingParamsFromSource(source)
+            .then((params) => {
+            frozenSaplingParamsSource = source;
+            loadedSaplingParams = params;
+            return params;
+        })
+            .catch((error) => {
+            saplingParamsLoadPromise = undefined;
+            throw error;
+        });
+    }
+    return saplingParamsLoadPromise;
+}
+async function loadSaplingParamsFromSource(source) {
+    if (source.kind === 'local') {
+        const [spend, output] = await Promise.all([
+            loadLocalParam(source.spend.path, source.spend.sha256, 'spend', source.source),
+            loadLocalParam(source.output.path, source.output.sha256, 'output', source.source),
+        ]);
+        return { spend, output };
+    }
+    const [spend, output] = await Promise.all([
+        loadRemoteParam(source.spend.url, source.spend.sha256, 'spend', source.source),
+        loadRemoteParam(source.output.url, source.output.sha256, 'output', source.source),
+    ]);
+    return { spend, output };
+}
+async function loadRemoteParam(url, expectedSha256, label, source) {
+    let response;
+    try {
+        response = await fetch(url);
+    }
+    catch (error) {
+        throw new SaplingParamsError('SAPLING_PARAMS_FETCH_FAILED', `Failed to fetch Sapling ${label} params from ${url}`, source, error);
+    }
+    if (!response.ok) {
+        throw new SaplingParamsError('SAPLING_PARAMS_FETCH_FAILED', `Failed to fetch Sapling ${label} params from ${url}: ${response.status}`, source);
+    }
+    const bytes = bufferExports.Buffer.from(await response.arrayBuffer());
+    await assertSha256(bytes, expectedSha256, label, source, url);
+    return bytes;
+}
+async function loadLocalParam(path, expectedSha256, label, source) {
+    if (!isNodeLikeRuntime()) {
+        throw new SaplingParamsError('SAPLING_PARAMS_UNSUPPORTED_RUNTIME', `Sapling local ${label} params are only supported in Node.js and CI environments`, source);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { readFile } = require(getNodeFsPromisesModuleId());
+    const bytes = bufferExports.Buffer.from(await readFile(path));
+    if (expectedSha256) {
+        await assertSha256(bytes, expectedSha256, label, source, path);
+    }
+    return bytes;
+}
+async function assertSha256(bytes, expectedSha256, label, source, location) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new SaplingParamsError('SAPLING_PARAMS_UNSUPPORTED_RUNTIME', `Sapling ${label} params verification requires globalThis.crypto.subtle`, source);
+    }
+    const digest = await subtle.digest('SHA-256', Uint8Array.from(bytes));
+    const actualSha256 = bufferExports.Buffer.from(digest).toString('hex');
+    if (actualSha256 !== expectedSha256) {
+        throw new SaplingParamsError('SAPLING_PARAMS_HASH_MISMATCH', `Sapling ${label} params from ${source} failed integrity verification for ${location} (expected SHA-256 ${expectedSha256}, got ${actualSha256})`, source);
+    }
+}
+function resolveSaplingParamsSource(params = undefined) {
+    if (!params || typeof params.source !== 'undefined') {
+        const source = params?.source ?? 'taquito';
+        return {
+            kind: 'remote',
+            source,
+            spend: {
+                url: source === 'zcash'
+                    ? DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.zcashUrl
+                    : DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.taquitoUrl,
+                sha256: DEFAULT_SAPLING_PARAMS_MANIFEST.spendParams.sha256,
+            },
+            output: {
+                url: source === 'zcash'
+                    ? DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.zcashUrl
+                    : DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.taquitoUrl,
+                sha256: DEFAULT_SAPLING_PARAMS_MANIFEST.outputParams.sha256,
+            },
+        };
+    }
+    if ('spendParamsPath' in params || 'outputParamsPath' in params) {
+        if (!params.spendParamsPath || !params.outputParamsPath) {
+            throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling local params configuration requires both spendParamsPath and outputParamsPath', 'local');
+        }
+        return {
+            kind: 'local',
+            source: 'local',
+            spend: {
+                path: params.spendParamsPath,
+                sha256: params.spendParamsSha256,
+            },
+            output: {
+                path: params.outputParamsPath,
+                sha256: params.outputParamsSha256,
+            },
+        };
+    }
+    if (!params.spendParamsUrl || !params.outputParamsUrl) {
+        throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling remote params configuration requires both spendParamsUrl and outputParamsUrl', 'custom');
+    }
+    if (!params.spendParamsSha256 || !params.outputParamsSha256) {
+        throw new SaplingParamsError('SAPLING_PARAMS_INVALID_CONFIG', 'Sapling remote params configuration requires explicit SHA-256 digests', 'custom');
+    }
+    return {
+        kind: 'remote',
+        source: 'custom',
+        spend: {
+            url: params.spendParamsUrl,
+            sha256: params.spendParamsSha256,
+        },
+        output: {
+            url: params.outputParamsUrl,
+            sha256: params.outputParamsSha256,
+        },
+    };
+}
+function isNodeLikeRuntime() {
+    const runtimeProcess = globalThis.process;
+    return !!runtimeProcess?.versions?.node;
+}
+function getNodeFsPromisesModuleId() {
+    // Keep this module id opaque enough that browser bundlers do not eagerly
+    // try to resolve a Node-only dependency into the browser build.
+    return ['node', 'fs', 'promises'].join(':').replace('fs:promises', 'fs/promises');
+}
+
 const getRandomValueSource = () => {
     const crypto = globalThis.crypto;
     if (!crypto?.getRandomValues) {
@@ -2989,7 +3163,7 @@ const getRandomValueSource = () => {
 };
 class SaplingWrapper {
     async withProvingContext(action) {
-        await this.initSaplingParameters();
+        await preloadSaplingParams();
         return withProvingContext(action);
     }
     getRandomBytes(length) {
@@ -3027,13 +3201,7 @@ class SaplingWrapper {
         return createBindingSignature(saplingContext, balance, transactionSigHash);
     }
     async initSaplingParameters() {
-        if (!cachedParams) {
-            cachedParams = {
-                spend: bufferExports.Buffer.from(saplingSpendParams.saplingSpendParams, 'base64'),
-                output: bufferExports.Buffer.from(saplingOutputParams.saplingOutputParams, 'base64'),
-            };
-        }
-        return initParameters(cachedParams.spend, cachedParams.output);
+        return preloadSaplingParams();
     }
 }
 
@@ -4422,5 +4590,5 @@ class SaplingToolkit {
 }
 _SaplingToolkit_inMemorySpendingKey = new WeakMap(), _SaplingToolkit_saplingId = new WeakMap(), _SaplingToolkit_contractAddress = new WeakMap(), _SaplingToolkit_memoSize = new WeakMap(), _SaplingToolkit_readProvider = new WeakMap(), _SaplingToolkit_packer = new WeakMap(), _SaplingToolkit_saplingForger = new WeakMap(), _SaplingToolkit_saplingTxBuilder = new WeakMap(), _SaplingToolkit_saplingTransactionViewer = new WeakMap();
 
-export { InMemoryProvingKey, InMemorySpendingKey, InMemoryViewingKey, SaplingToolkit, SaplingTransactionViewer };
+export { InMemoryProvingKey, InMemorySpendingKey, InMemoryViewingKey, SaplingParamsError, SaplingToolkit, SaplingTransactionViewer, initSapling, preloadSaplingParams };
 //# sourceMappingURL=taquito-sapling.es6.js.map