@xchainjs/xchain-monero 0.2.0

package/lib/index.js

@@ -0,0 +1,2538 @@
+'use strict';
+
+var xchainClient = require('@xchainjs/xchain-client');
+var xchainCrypto = require('@xchainjs/xchain-crypto');
+var xchainUtil = require('@xchainjs/xchain-util');
+var sha3 = require('@noble/hashes/sha3');
+var slip10 = require('micro-key-producer/slip10.js');
+var ed25519 = require('@noble/curves/ed25519');
+var utils = require('@noble/curves/abstract/utils');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var slip10__default = /*#__PURE__*/_interopDefault(slip10);
+
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
+
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
+
+/**
+ * Monero chain symbol
+ */
+const XMRChain = 'XMR';
+/**
+ * Monero native asset decimals (piconero = 10^-12 XMR)
+ */
+const XMR_DECIMALS = 12;
+/**
+ * Monero native asset
+ */
+const AssetXMR = {
+    chain: 'XMR',
+    ticker: 'XMR',
+    symbol: 'XMR',
+    type: xchainUtil.AssetType.NATIVE,
+};
+const mainnetExplorer = new xchainClient.ExplorerProvider('https://xmrchain.net/', 'https://xmrchain.net/search?value=%%ADDRESS%%', 'https://xmrchain.net/tx/%%TX_ID%%');
+const defaultXMRParams = {
+    network: xchainClient.Network.Mainnet,
+    rootDerivationPaths: {
+        [xchainClient.Network.Mainnet]: "m/44'/128'/",
+        [xchainClient.Network.Testnet]: "m/44'/128'/",
+        [xchainClient.Network.Stagenet]: "m/44'/128'/",
+    },
+    explorerProviders: {
+        [xchainClient.Network.Mainnet]: mainnetExplorer,
+        [xchainClient.Network.Testnet]: new xchainClient.ExplorerProvider('https://stagenet.xmrchain.net/', 'https://stagenet.xmrchain.net/search?value=%%ADDRESS%%', 'https://stagenet.xmrchain.net/tx/%%TX_ID%%'),
+        [xchainClient.Network.Stagenet]: mainnetExplorer,
+    },
+    daemonUrls: {
+        [xchainClient.Network.Mainnet]: ['https://xmr-node.cakewallet.com:18081', 'https://node.sethforprivacy.com'],
+        [xchainClient.Network.Testnet]: ['http://stagenet.xmr-tw.org:38081'],
+        [xchainClient.Network.Stagenet]: ['https://xmr-node.cakewallet.com:18081', 'https://node.sethforprivacy.com'],
+    },
+    lwsUrls: {
+        [xchainClient.Network.Mainnet]: [],
+        [xchainClient.Network.Testnet]: [],
+        [xchainClient.Network.Stagenet]: [],
+    },
+};
+
+/**
+ * Monero's custom base58 encoding.
+ * Unlike Bitcoin's base58, Monero encodes in fixed 8-byte blocks → 11-char blocks.
+ * The last block may be shorter depending on remaining bytes.
+ */
+const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+/** Number of base58 chars needed to encode N bytes (for N = 0..8) */
+const ENCODED_BLOCK_SIZES = [0, 2, 3, 5, 6, 7, 9, 10, 11];
+const FULL_BLOCK_SIZE = 8;
+const FULL_ENCODED_BLOCK_SIZE = 11;
+/**
+ * Encodes a block of bytes (up to 8) into base58 characters.
+ */
+function encodeBlock(data) {
+    if (data.length === 0)
+        return '';
+    const size = ENCODED_BLOCK_SIZES[data.length];
+    // Convert bytes to a big number (big-endian)
+    let num = BigInt(0);
+    for (let i = 0; i < data.length; i++) {
+        num = (num << BigInt(8)) | BigInt(data[i]);
+    }
+    // Convert to base58 with fixed-width output
+    const chars = new Array(size);
+    for (let i = size - 1; i >= 0; i--) {
+        chars[i] = ALPHABET[Number(num % BigInt(58))];
+        num = num / BigInt(58);
+    }
+    return chars.join('');
+}
+/**
+ * Decodes a base58-encoded block back to bytes.
+ */
+function decodeBlock(encoded, targetLen) {
+    if (encoded.length === 0)
+        return new Uint8Array(0);
+    // Convert base58 string to number
+    let num = BigInt(0);
+    for (let i = 0; i < encoded.length; i++) {
+        const idx = ALPHABET.indexOf(encoded[i]);
+        if (idx === -1)
+            throw new Error(`Invalid base58 character: ${encoded[i]}`);
+        num = num * BigInt(58) + BigInt(idx);
+    }
+    // Convert number to bytes (big-endian, fixed width)
+    const result = new Uint8Array(targetLen);
+    for (let i = targetLen - 1; i >= 0; i--) {
+        result[i] = Number(num & BigInt(0xff));
+        num = num >> BigInt(8);
+    }
+    return result;
+}
+/**
+ * Encodes a Uint8Array using Monero's base58 scheme.
+ */
+const cnBase58Encode = (data) => {
+    const fullBlocks = Math.floor(data.length / FULL_BLOCK_SIZE);
+    const lastBlockSize = data.length % FULL_BLOCK_SIZE;
+    let result = '';
+    for (let i = 0; i < fullBlocks; i++) {
+        const block = data.slice(i * FULL_BLOCK_SIZE, (i + 1) * FULL_BLOCK_SIZE);
+        result += encodeBlock(block);
+    }
+    if (lastBlockSize > 0) {
+        const lastBlock = data.slice(fullBlocks * FULL_BLOCK_SIZE);
+        result += encodeBlock(lastBlock);
+    }
+    return result;
+};
+/**
+ * Decodes a Monero base58-encoded string to Uint8Array.
+ */
+const cnBase58Decode = (encoded) => {
+    // Figure out how many full encoded blocks and the remainder
+    const fullBlocks = Math.floor(encoded.length / FULL_ENCODED_BLOCK_SIZE);
+    const lastEncodedSize = encoded.length % FULL_ENCODED_BLOCK_SIZE;
+    // Find the byte length of the last block
+    let lastBlockSize = 0;
+    if (lastEncodedSize > 0) {
+        lastBlockSize = ENCODED_BLOCK_SIZES.indexOf(lastEncodedSize);
+        if (lastBlockSize === -1)
+            throw new Error(`Invalid encoded length: ${encoded.length}`);
+    }
+    const totalBytes = fullBlocks * FULL_BLOCK_SIZE + lastBlockSize;
+    const result = new Uint8Array(totalBytes);
+    let offset = 0;
+    let encodedOffset = 0;
+    for (let i = 0; i < fullBlocks; i++) {
+        const block = encoded.slice(encodedOffset, encodedOffset + FULL_ENCODED_BLOCK_SIZE);
+        const decoded = decodeBlock(block, FULL_BLOCK_SIZE);
+        result.set(decoded, offset);
+        offset += FULL_BLOCK_SIZE;
+        encodedOffset += FULL_ENCODED_BLOCK_SIZE;
+    }
+    if (lastEncodedSize > 0) {
+        const lastEncoded = encoded.slice(encodedOffset);
+        const decoded = decodeBlock(lastEncoded, lastBlockSize);
+        result.set(decoded, offset);
+    }
+    return result;
+};
+
+/** Network address prefixes (byte value) */
+const NETWORK_PREFIXES = {
+    0: 0x12, // mainnet (18)
+    1: 0x35, // testnet (53)
+    2: 0x18, // stagenet (24)
+};
+/**
+ * Encodes a standard Monero address from public spend/view keys.
+ * Format: [1-byte prefix][32-byte pubSpend][32-byte pubView][4-byte checksum]
+ * Result is 69 bytes → 95 base58 characters.
+ */
+const encodeAddress = (publicSpendKey, publicViewKey, networkType) => {
+    const prefix = NETWORK_PREFIXES[networkType];
+    if (prefix === undefined)
+        throw new Error(`Unknown network type: ${networkType}`);
+    // Build the 65-byte payload: prefix + pubSpend + pubView
+    const payload = new Uint8Array(1 + 32 + 32);
+    payload[0] = prefix;
+    payload.set(publicSpendKey, 1);
+    payload.set(publicViewKey, 33);
+    // Checksum: first 4 bytes of keccak256(payload)
+    const checksum = sha3.keccak_256(payload).slice(0, 4);
+    // Full data: payload + checksum = 69 bytes
+    const full = new Uint8Array(69);
+    full.set(payload, 0);
+    full.set(checksum, 65);
+    return cnBase58Encode(full);
+};
+/**
+ * Decodes a standard Monero address into its public spend/view keys.
+ * Validates the checksum.
+ */
+const decodeAddress = (address) => {
+    const data = cnBase58Decode(address);
+    if (data.length !== 69)
+        throw new Error(`Invalid address length: ${data.length}`);
+    const payload = data.slice(0, 65);
+    const checksum = data.slice(65, 69);
+    // Verify checksum
+    const expected = sha3.keccak_256(payload).slice(0, 4);
+    for (let i = 0; i < 4; i++) {
+        if (checksum[i] !== expected[i])
+            throw new Error('Invalid address checksum');
+    }
+    const prefix = data[0];
+    let networkType;
+    if (prefix === 0x12)
+        networkType = 0; // mainnet
+    else if (prefix === 0x35)
+        networkType = 1; // testnet
+    else if (prefix === 0x18)
+        networkType = 2; // stagenet
+    else
+        throw new Error(`Unknown address prefix: ${prefix}`);
+    return {
+        publicSpendKey: data.slice(1, 33),
+        publicViewKey: data.slice(33, 65),
+        networkType,
+    };
+};
+
+/**
+ * Monero network type values matching monero-ts MoneroNetworkType enum
+ */
+const MoneroNetworkType = {
+    MAINNET: 0,
+    STAGENET: 2,
+};
+/**
+ * Maps XChainJS Network to Monero network type
+ */
+const getMoneroNetworkType = (network) => {
+    const networkMap = {
+        [xchainClient.Network.Mainnet]: MoneroNetworkType.MAINNET,
+        [xchainClient.Network.Stagenet]: MoneroNetworkType.STAGENET,
+        [xchainClient.Network.Testnet]: MoneroNetworkType.STAGENET, // Monero testnet is deprecated; stagenet is used for testing
+    };
+    return networkMap[network];
+};
+/**
+ * Validates a Monero address format.
+ * Standard addresses are 95 chars, integrated addresses are 106 chars.
+ * Uses base58 character set and prefix validation.
+ */
+const validateMoneroAddress = (address) => {
+    const base58Chars = /^[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]+$/;
+    if (!base58Chars.test(address))
+        return false;
+    // Standard address (95 chars): primary starts with 4/5/9, subaddress starts with 8/7/B
+    if (address.length === 95)
+        return /^[45789B]/.test(address);
+    // Integrated address (106 chars): starts with 4/5/A
+    if (address.length === 106)
+        return /^[45A]/.test(address);
+    return false;
+};
+/**
+ * Ed25519 group order (l) for sc_reduce32
+ */
+const ED25519_ORDER = BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989');
+/**
+ * Reduces a 32-byte value modulo the ed25519 group order.
+ * Required to produce valid Monero private keys from arbitrary 32-byte seeds.
+ */
+const scReduce32 = (bytes) => {
+    if (bytes.length !== 32) {
+        throw new Error(`scReduce32 expects 32 bytes, got ${bytes.length}`);
+    }
+    // Interpret as little-endian integer
+    let value = BigInt(0);
+    for (let i = 31; i >= 0; i--) {
+        value = (value << BigInt(8)) | BigInt(bytes[i]);
+    }
+    // Reduce mod l
+    value = value % ED25519_ORDER;
+    // Convert back to little-endian bytes
+    const result = new Uint8Array(32);
+    let tmp = value;
+    for (let i = 0; i < 32; i++) {
+        result[i] = Number(tmp & BigInt(0xff));
+        tmp >>= BigInt(8);
+    }
+    return result;
+};
+/**
+ * Converts a Uint8Array to hex string
+ */
+const bytesToHex = (bytes) => {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+};
+/**
+ * Converts a hex string to Uint8Array
+ */
+const hexToBytes = (hex) => {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return bytes;
+};
+function bytesToBigIntLE(bytes) {
+    let value = BigInt(0);
+    for (let i = bytes.length - 1; i >= 0; i--) {
+        value = (value << BigInt(8)) | BigInt(bytes[i]);
+    }
+    return value;
+}
+function bigIntToBytes32LE(value) {
+    const result = new Uint8Array(32);
+    let tmp = value;
+    for (let i = 0; i < 32; i++) {
+        result[i] = Number(tmp & BigInt(0xff));
+        tmp >>= BigInt(8);
+    }
+    return result;
+}
+/**
+ * Scalar multiplication: (a * b) mod l
+ */
+function scMul(a, b) {
+    const aVal = bytesToBigIntLE(a);
+    const bVal = bytesToBigIntLE(b);
+    return bigIntToBytes32LE((aVal * bVal) % ED25519_ORDER);
+}
+/**
+ * Scalar multiply-add: (a * b + c) mod l
+ */
+function scMulAdd(a, b, c) {
+    const aVal = bytesToBigIntLE(a);
+    const bVal = bytesToBigIntLE(b);
+    const cVal = bytesToBigIntLE(c);
+    return bigIntToBytes32LE((aVal * bVal + cVal) % ED25519_ORDER);
+}
+/**
+ * Scalar multiply-subtract: (c - a * b) mod l
+ */
+function scMulSub(a, b, c) {
+    const aVal = bytesToBigIntLE(a);
+    const bVal = bytesToBigIntLE(b);
+    const cVal = bytesToBigIntLE(c);
+    let result = (cVal - aVal * bVal) % ED25519_ORDER;
+    if (result < BigInt(0))
+        result += ED25519_ORDER;
+    return bigIntToBytes32LE(result);
+}
+/**
+ * Hash to scalar: keccak256(data) reduced mod l
+ */
+function hashToScalar$1(data) {
+    return scReduce32(sha3.keccak_256(data));
+}
+/**
+ * Concatenate multiple Uint8Arrays
+ */
+function concatBytes(...arrays) {
+    const totalLen = arrays.reduce((sum, a) => sum + a.length, 0);
+    const result = new Uint8Array(totalLen);
+    let offset = 0;
+    for (const arr of arrays) {
+        result.set(arr, offset);
+        offset += arr.length;
+    }
+    return result;
+}
+
+/**
+ * Derives an ed25519 public key from a raw private key scalar.
+ * Unlike standard EdDSA (which applies SHA-512 + clamping), Monero uses the raw scalar directly.
+ */
+const secretKeyToPublicKey = (privateKey) => {
+    const scalar = utils.bytesToNumberLE(privateKey);
+    return ed25519.ed25519.ExtendedPoint.BASE.multiply(scalar).toRawBytes();
+};
+/**
+ * Derives the private view key from a private spend key.
+ * view_key = sc_reduce32(keccak256(spend_key))
+ */
+const derivePrivateViewKey = (privateSpendKey) => {
+    const hash = sha3.keccak_256(privateSpendKey);
+    return scReduce32(hash);
+};
+/**
+ * Derives all four Monero keys from a private spend key.
+ */
+const deriveKeyPairs = (privateSpendKey) => {
+    const publicSpendKey = secretKeyToPublicKey(privateSpendKey);
+    const privateViewKey = derivePrivateViewKey(privateSpendKey);
+    const publicViewKey = secretKeyToPublicKey(privateViewKey);
+    return {
+        privateSpendKey,
+        publicSpendKey,
+        privateViewKey,
+        publicViewKey,
+    };
+};
+
+/**
+ * Monero daemon HTTP JSON-RPC client.
+ * Provides raw RPC calls without depending on monero-ts.
+ */
+function jsonRpc(url, method, params) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const response = yield fetch(`${url}/json_rpc`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: '0',
+                method,
+                params: params !== null && params !== void 0 ? params : {},
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Daemon RPC error: ${response.status} ${response.statusText}`);
+        }
+        const data = (yield response.json());
+        if (data.error) {
+            throw new Error(`Daemon RPC error: ${data.error.message} (code ${data.error.code})`);
+        }
+        return data.result;
+    });
+}
+function httpPost(url, path, body) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const response = yield fetch(`${url}${path}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new Error(`Daemon HTTP error: ${response.status} ${response.statusText}`);
+        }
+        return (yield response.json());
+    });
+}
+/**
+ * Get fee estimate from daemon.
+ * Returns fee per byte in piconero.
+ */
+const getFeeEstimate = (url) => __awaiter(void 0, void 0, void 0, function* () {
+    const result = yield jsonRpc(url, 'get_fee_estimate');
+    return result.fee;
+});
+/**
+ * Get transaction details by hash(es).
+ */
+const getTransactions = (url, txHashes) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const result = yield httpPost(url, '/get_transactions', {
+        txs_hashes: txHashes,
+        decode_as_json: false,
+    });
+    return (_a = result.txs) !== null && _a !== void 0 ? _a : [];
+});
+const getOuts = (url, outputs) => __awaiter(void 0, void 0, void 0, function* () {
+    const result = yield httpPost(url, '/get_outs', {
+        outputs,
+        get_txid: true,
+    });
+    if (result.status !== 'OK')
+        throw new Error(`get_outs failed: ${result.status}`);
+    return result.outs;
+});
+/**
+ * Get output distribution for decoy selection.
+ */
+const getOutputDistribution = (url_1, ...args_1) => __awaiter(void 0, [url_1, ...args_1], void 0, function* (url, fromHeight = 0, toHeight = 0) {
+    const result = yield jsonRpc(url, 'get_output_distribution', {
+        amounts: [0],
+        cumulative: true,
+        from_height: fromHeight,
+        to_height: toHeight,
+    });
+    if (!result.distributions || result.distributions.length === 0) {
+        throw new Error('No output distribution data returned from daemon');
+    }
+    const dist = result.distributions[0].distribution;
+    return { distribution: dist.data, startHeight: dist.start_height, base: dist.base };
+});
+/**
+ * Get current blockchain height.
+ */
+const getHeight = (url) => __awaiter(void 0, void 0, void 0, function* () {
+    const result = yield jsonRpc(url, 'get_block_count');
+    return result.count;
+});
+const getTransactionsDecoded = (url, txHashes) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    if (txHashes.length === 0)
+        return [];
+    const result = yield httpPost(url, '/get_transactions', {
+        txs_hashes: txHashes,
+        decode_as_json: true,
+    });
+    return (_a = result.txs) !== null && _a !== void 0 ? _a : [];
+});
+const getBlockHeadersRange = (url, startHeight, endHeight) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const result = yield jsonRpc(url, 'get_block_headers_range', {
+        start_height: startHeight,
+        end_height: endHeight,
+    });
+    return (_a = result.headers) !== null && _a !== void 0 ? _a : [];
+});
+/**
+ * Get block tx hashes for a specific height.
+ * Returns just the tx_hashes array (excludes miner tx).
+ */
+const getBlockTxHashes = (url, height) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const result = yield jsonRpc(url, 'get_block', { height });
+    return { txHashes: (_a = result.tx_hashes) !== null && _a !== void 0 ? _a : [], timestamp: result.block_header.timestamp };
+});
+/**
+ * Broadcast a raw transaction hex to the network.
+ */
+const sendRawTransaction = (url, txHex) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const result = yield httpPost(url, '/send_raw_transaction', {
+        tx_as_hex: txHex,
+        do_not_relay: false,
+    });
+    if (result.status !== 'OK') {
+        throw new Error(`Broadcast failed: ${(_a = result.reason) !== null && _a !== void 0 ? _a : result.status}`);
+    }
+    return result;
+});
+
+/**
+ * MyMonero-compatible Light Wallet Server (LWS) REST API client.
+ * LWS accepts private view keys and returns pre-decoded balances/transactions,
+ * avoiding the need for client-side blockchain scanning.
+ */
+function lwsPost(url, path, body) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const response = yield fetch(`${url}${path}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new Error(`LWS error: ${response.status} ${response.statusText}`);
+        }
+        return (yield response.json());
+    });
+}
+/**
+ * Register wallet address with LWS for scanning.
+ * Must be called before other endpoints will return data.
+ */
+const login = (url, address, viewKeyHex) => __awaiter(void 0, void 0, void 0, function* () {
+    return lwsPost(url, '/login', {
+        address,
+        view_key: viewKeyHex,
+        create_account: true,
+        generated_locally: false,
+    });
+});
+/**
+ * Get balance summary for an address.
+ * Returns total received/sent in piconero strings.
+ */
+const getAddressInfo = (url, address, viewKeyHex) => __awaiter(void 0, void 0, void 0, function* () {
+    return lwsPost(url, '/get_address_info', {
+        address,
+        view_key: viewKeyHex,
+    });
+});
+/**
+ * Get transaction history for an address.
+ * Returns transactions with per-tx received/sent amounts.
+ */
+const getAddressTxs = (url, address, viewKeyHex) => __awaiter(void 0, void 0, void 0, function* () {
+    return lwsPost(url, '/get_address_txs', {
+        address,
+        view_key: viewKeyHex,
+    });
+});
+/**
+ * Get unspent outputs for transaction building.
+ */
+const getUnspentOuts = (url_1, address_1, viewKeyHex_1, ...args_1) => __awaiter(void 0, [url_1, address_1, viewKeyHex_1, ...args_1], void 0, function* (url, address, viewKeyHex, amount = '0') {
+    return lwsPost(url, '/get_unspent_outs', {
+        address,
+        view_key: viewKeyHex,
+        amount,
+        mixin: 15,
+        use_dust: false,
+        dust_threshold: '2000000000',
+    });
+});
+
+/**
+ * Monero's hash_to_ec / ge_fromfe_frombytes_vartime implementation.
+ * Ported from CoinSpace/monerolib (pure JS Monero library).
+ *
+ * Maps arbitrary data to an ed25519 point. This is NOT standard hash-to-curve
+ * (RFC 9380) — it matches Monero's specific algorithm from crypto-ops.c.
+ */
+const ExtPoint$6 = ed25519.ed25519.ExtendedPoint;
+// ed25519 field prime: 2^255 - 19
+const P = BigInt('57896044618658097711785492504343953926634992332820282019728792003956564819949');
+function mod(a) {
+    const r = a % P;
+    return r >= BigInt(0) ? r : r + P;
+}
+const A = BigInt(486662);
+const A_SQUARED = mod(A * A);
+// Precomputed constants (big-endian hex from monerolib/Monero C code)
+const SQRTM1 = BigInt('0x547cdb7fb03e20f4d4b2ff66c2042858d0bce7f952d01b873b11e4d8b5f15f3d');
+const FFFB1 = BigInt('0x7e71fbefdad61b1720a9c53741fb19e3d19404a8b92a738d22a76975321c41ee');
+const FFFB2 = BigInt('0x32f9e1f5fba5d3096e2bae483fe9a041ae21fcb9fba908202d219b7c9f83650d');
+const FFFB3 = BigInt('0x1a43f3031067dbf926c0f4887ef7432eee46fc08a13f4a49853d1903b6b39186');
+const FFFB4 = BigInt('0x674a110d14c208efb89546403f0da2ed4024ff4ea5964229581b7d8717302c66');
+function modPow(base, exp) {
+    let result = BigInt(1);
+    base = mod(base);
+    while (exp > BigInt(0)) {
+        if (exp & BigInt(1)) {
+            result = mod(result * base);
+        }
+        exp >>= BigInt(1);
+        base = mod(base * base);
+    }
+    return result;
+}
+/**
+ * fe_divpowm1: computes (u/v)^((p+3)/8)
+ * Formula: u * v^3 * (u * v^7)^((p-5)/8)
+ */
+function divPowM1(u, v) {
+    const v3 = mod(v * mod(v * v));
+    const v7 = mod(v3 * mod(v3 * v));
+    const uv7 = mod(u * v7);
+    const exp = (P - BigInt(5)) >> BigInt(3); // (p-5)/8
+    const t = modPow(uv7, exp);
+    return mod(u * mod(v3 * t));
+}
+/**
+ * Hash arbitrary data to an ed25519 point (Monero's hash_to_ec).
+ * Algorithm: ge_fromfe_frombytes_vartime
+ */
+function hashToPoint(data) {
+    const hash = sha3.keccak_256(data);
+    const u = mod(utils.bytesToNumberLE(hash));
+    // v = 2*u^2
+    const v = mod(BigInt(2) * mod(u * u));
+    // w = 1 + 2*u^2
+    const w = mod(v + BigInt(1));
+    // t = w^2 - A^2*v
+    const t = mod(mod(w * w) - mod(A_SQUARED * v));
+    // x = (w/t)^((p+3)/8) via divPowM1
+    let x = divPowM1(w, t);
+    let negative = false;
+    // Check: w - x^2*t == 0?
+    let check = mod(w - mod(mod(x * x) * t));
+    if (check !== BigInt(0)) {
+        // Check: w + x^2*t == 0?
+        check = mod(w + mod(mod(x * x) * t));
+        if (check !== BigInt(0)) {
+            negative = true;
+        }
+        else {
+            x = mod(x * FFFB1);
+        }
+    }
+    else {
+        x = mod(x * FFFB2);
+    }
+    let odd;
+    let r;
+    if (!negative) {
+        odd = false;
+        r = mod(P - mod(A * v)); // r = -A*v
+        x = mod(x * u); // x *= u
+    }
+    else {
+        odd = true;
+        r = mod(P - A); // r = -A
+        // Check with sqrtm1
+        check = mod(w - mod(mod(mod(x * x) * t) * SQRTM1));
+        if (check !== BigInt(0)) {
+            check = mod(w + mod(mod(mod(x * x) * t) * SQRTM1));
+            if (check !== BigInt(0)) {
+                throw new Error('hashToPoint: invalid point (should never happen)');
+            }
+            else {
+                x = mod(x * FFFB3);
+            }
+        }
+        else {
+            x = mod(x * FFFB4);
+        }
+    }
+    // Adjust sign
+    const xIsOdd = (x & BigInt(1)) === BigInt(1);
+    if (xIsOdd !== odd) {
+        x = mod(P - x);
+    }
+    // Projective coordinates: (X, Y, Z) where affine = (X/Z, Y/Z)
+    const z = mod(r + w);
+    const y = mod(r - w);
+    const X = mod(x * z);
+    // Convert projective (X, Y, Z) to affine and encode
+    const zInv = modPow(z, P - BigInt(2));
+    const xAff = mod(X * zInv);
+    const yAff = mod(y * zInv);
+    // Encode as ed25519 point bytes
+    const yBytes = utils.numberToBytesLE(yAff, 32);
+    if (xAff & BigInt(1)) {
+        yBytes[31] |= 0x80;
+    }
+    const point = ExtPoint$6.fromHex(yBytes);
+    // Cofactor clearing: multiply by 8 (Monero's hash_to_ec = ge_fromfe + mul8)
+    return point.multiply(BigInt(8));
+}
+
+/**
+ * CLSAG (Concise Linkable Spontaneous Anonymous Group) signature.
+ * Used in Monero RingCT for input authorization + commitment balance proof.
+ *
+ * Reference: monero/src/ringct/rctSigs.cpp (CLSAG_Gen, verRctCLSAGSimple)
+ */
+const ExtPoint$5 = ed25519.ed25519.ExtendedPoint;
+// Domain separators (ASCII zero-padded to 32 bytes)
+function domainTag(s) {
+    const tag = new Uint8Array(32);
+    const encoded = new TextEncoder().encode(s);
+    tag.set(encoded);
+    return tag;
+}
+const CLSAG_AGG_0 = domainTag('CLSAG_agg_0');
+const CLSAG_AGG_1 = domainTag('CLSAG_agg_1');
+const CLSAG_ROUND = domainTag('CLSAG_round');
+// INV_EIGHT: modular inverse of 8 mod l (ed25519 group order)
+const INV_EIGHT_HEX = '792fdce229e50661d0da1c7db39dd30700000000000000000000000000000006';
+const INV_EIGHT$1 = hexToBytes(INV_EIGHT_HEX);
+/**
+ * Generate a random 32-byte scalar reduced mod l.
+ */
+function randomScalar$2() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return scReduce32(bytes);
+}
+/**
+ * CLSAG signing.
+ *
+ * @param message - 32-byte transaction prefix hash
+ * @param ring - Ring members (dest + mask for each)
+ * @param Cout - Pseudo-output commitment (C_offset)
+ * @param secretKey - Signer's one-time private key (p)
+ * @param secretMask - Commitment mask difference: z = input_mask - pseudo_out_mask
+ * @param realIndex - Index of real signer in ring
+ * @param keyImage - Pre-computed key image (p * Hp(P[l]))
+ * @returns CLSAG signature
+ */
+function clsagSign(message, ring, Cout, secretKey, secretMask, realIndex, keyImage) {
+    const n = ring.length;
+    if (n === 0)
+        throw new Error('CLSAG: ring must not be empty');
+    if (realIndex < 0 || realIndex >= n)
+        throw new Error(`CLSAG: realIndex ${realIndex} out of range [0, ${n})`);
+    const I = ExtPoint$5.fromHex(keyImage);
+    // Hp(P[l]) — hash of real signer's public key
+    const H = hashToPoint(ring[realIndex].dest);
+    // D_full = z * Hp(P[l])
+    const zScalar = utils.bytesToNumberLE(secretMask);
+    const D_full = H.multiply(zScalar);
+    // sig.D = (1/8) * D_full
+    const invEightScalar = utils.bytesToNumberLE(INV_EIGHT$1);
+    const D = D_full.multiply(invEightScalar);
+    const DBytes = D.toRawBytes();
+    // Extract ring keys as byte arrays
+    const P = ring.map((m) => m.dest);
+    const C_nonzero = ring.map((m) => m.mask);
+    // Compute aggregation coefficients mu_P, mu_C
+    const aggParts = [...P.map((p) => p), ...C_nonzero.map((c) => c), keyImage, DBytes, Cout];
+    const muP = hashToScalar$1(concatBytes(CLSAG_AGG_0, ...aggParts));
+    const muC = hashToScalar$1(concatBytes(CLSAG_AGG_1, ...aggParts));
+    // Round hash prefix (constant across all rounds)
+    const roundPrefix = concatBytes(CLSAG_ROUND, ...P, ...C_nonzero, Cout, message);
+    // Step 3: Generate nonce
+    const alpha = randomScalar$2();
+    const alphaScalar = utils.bytesToNumberLE(alpha);
+    const aG = ExtPoint$5.BASE.multiply(alphaScalar);
+    const aH = H.multiply(alphaScalar);
+    // Initial challenge at signer's position
+    let c = hashToScalar$1(concatBytes(roundPrefix, aG.toRawBytes(), aH.toRawBytes()));
+    // Precompute C_offset point
+    const CoutPoint = ExtPoint$5.fromHex(Cout);
+    // Ring loop
+    const s = new Array(n);
+    let c1;
+    let i = (realIndex + 1) % n;
+    if (i === 0)
+        c1 = c;
+    while (i !== realIndex) {
+        s[i] = randomScalar$2();
+        const sScalar = utils.bytesToNumberLE(s[i]);
+        const cP = scMul(c, muP);
+        const cC = scMul(c, muC);
+        const cPScalar = utils.bytesToNumberLE(cP);
+        const cCScalar = utils.bytesToNumberLE(cC);
+        const Pi = ExtPoint$5.fromHex(P[i]);
+        const Ci = ExtPoint$5.fromHex(C_nonzero[i]).subtract(CoutPoint);
+        // L = s[i]*G + c_p*P[i] + c_c*C[i]
+        const L = ExtPoint$5.BASE.multiply(sScalar).add(Pi.multiply(cPScalar)).add(Ci.multiply(cCScalar));
+        // R = s[i]*Hp(P[i]) + c_p*I + c_c*D_full
+        const HpPi = hashToPoint(P[i]);
+        const R = HpPi.multiply(sScalar).add(I.multiply(cPScalar)).add(D_full.multiply(cCScalar));
+        c = hashToScalar$1(concatBytes(roundPrefix, L.toRawBytes(), R.toRawBytes()));
+        i = (i + 1) % n;
+        if (i === 0)
+            c1 = c;
+    }
+    // Final response: s[l] = alpha - c * (mu_P * p + mu_C * z)
+    const muPp = scMul(muP, secretKey);
+    const combined = scMulAdd(muC, secretMask, muPp);
+    s[realIndex] = scMulSub(c, combined, alpha);
+    if (c1 === undefined)
+        c1 = c;
+    return { s, c1, D: DBytes };
+}
+
+/**
+ * Pedersen commitment scheme for Monero.
+ * C = mask*G + amount*H
+ */
+const ExtPoint$4 = ed25519.ed25519.ExtendedPoint;
+// Monero's second generator H, hardcoded from rctTypes.h.
+// Historically derived via toPoint(cn_fast_hash(G)), now a consensus constant.
+const H_HEX = '8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94';
+let _H = null;
+/**
+ * Get the Pedersen generator H.
+ */
+function getH() {
+    if (_H === null) {
+        _H = ExtPoint$4.fromHex(H_HEX);
+    }
+    return _H;
+}
+/**
+ * Create a Pedersen commitment: C = mask*G + amount*H
+ * @param mask - Blinding factor (32-byte scalar LE)
+ * @param amount - Amount to commit to (bigint)
+ */
+function commit(mask, amount) {
+    const maskScalar = utils.bytesToNumberLE(mask);
+    const H = getH();
+    const maskG = ExtPoint$4.BASE.multiply(maskScalar);
+    const amountH = H.multiply(amount);
+    return maskG.add(amountH);
+}
+
+/**
+ * Bulletproofs+ range proof implementation for Monero.
+ * Proves amounts are in [0, 2^64) without revealing them.
+ *
+ * Reference: monero/src/ringct/bulletproofs_plus.cc
+ */
+const ExtPoint$3 = ed25519.ed25519.ExtendedPoint;
+// Ed25519 group order
+const L$1 = BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989');
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+BigInt(8);
+const maxN = 64; // bits per value
+const maxM = 16; // max aggregated outputs
+function modL(x) {
+    const r = x % L$1;
+    return r < ZERO ? r + L$1 : r;
+}
+// INV_EIGHT = modular inverse of 8 mod l
+const INV_EIGHT = utils.bytesToNumberLE(hexToBytes('792fdce229e50661d0da1c7db39dd30700000000000000000000000000000006'));
+const MINUS_INV_EIGHT = modL(L$1 - INV_EIGHT);
+// Domain separator for generator derivation
+const EXPONENT_TAG = new TextEncoder().encode('bulletproof_plus');
+// Domain separator for transcript
+const TRANSCRIPT_TAG = new TextEncoder().encode('bulletproof_plus_transcript');
+// Varint encoding (same as tx/serialize)
+function encodeVarint$2(n) {
+    const bytes = [];
+    let val = n;
+    while (val >= 0x80) {
+        bytes.push((val & 0x7f) | 0x80);
+        val >>>= 7;
+    }
+    bytes.push(val & 0x7f);
+    return new Uint8Array(bytes);
+}
+// --- Generator cache ---
+let _generators = null;
+function getExponent(base, idx) {
+    const data = concatBytes(base, EXPONENT_TAG, encodeVarint$2(idx));
+    const hash = sha3.keccak_256(data);
+    return hashToPoint(hash);
+}
+function getGenerators(count) {
+    if (_generators !== null && _generators.Gi.length >= count)
+        return _generators;
+    const H = getH();
+    const hBytes = H.toRawBytes();
+    const Gi = new Array(count);
+    const Hi = new Array(count);
+    for (let i = 0; i < count; i++) {
+        Hi[i] = getExponent(hBytes, i * 2);
+        Gi[i] = getExponent(hBytes, i * 2 + 1);
+    }
+    _generators = { Gi, Hi };
+    return _generators;
+}
+// --- Initial transcript (cached) ---
+let _initTranscript = null;
+function getInitialTranscript() {
+    if (_initTranscript !== null)
+        return _initTranscript;
+    const hash = sha3.keccak_256(TRANSCRIPT_TAG);
+    const point = hashToPoint(hash);
+    _initTranscript = point.toRawBytes();
+    return _initTranscript;
+}
+// --- Transcript updates ---
+function transcriptUpdate1(transcript, update0) {
+    return hashToScalar$1(concatBytes(transcript, update0));
+}
+function transcriptUpdate2(transcript, update0, update1) {
+    return hashToScalar$1(concatBytes(transcript, update0, update1));
+}
+// --- Scalar helpers ---
+function scalarToBytes(s) {
+    return new Uint8Array(utils.numberToBytesLE(s, 32));
+}
+function randomScalar$1() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return utils.bytesToNumberLE(scReduce32(bytes));
+}
+function scalarInvert(x) {
+    // Fermat's little theorem: x^(l-2) mod l
+    let result = ONE;
+    let base = modL(x);
+    let exp = L$1 - TWO;
+    while (exp > ZERO) {
+        if (exp & ONE)
+            result = modL(result * base);
+        exp >>= ONE;
+        base = modL(base * base);
+    }
+    return result;
+}
+function nextPow2(n) {
+    let p = 1;
+    while (p < n)
+        p <<= 1;
+    return p;
+}
+function log2(n) {
+    let r = 0;
+    let v = n;
+    while (v > 1) {
+        v >>= 1;
+        r++;
+    }
+    return r;
+}
+// Weighted inner product: WIP(a, b, y) = sum(a[i] * b[i] * y^(i+1))
+function weightedInnerProduct(a, b, y) {
+    let result = ZERO;
+    let yPow = ONE;
+    for (let i = 0; i < a.length; i++) {
+        yPow = modL(yPow * y);
+        result = modL(result + modL(modL(a[i] * b[i]) * yPow));
+    }
+    return result;
+}
+// Compute L or R in the inner product argument
+function computeLR(size, yFactor, G, gOff, H, hOff, a, aOff, b, bOff, c, d) {
+    // Multi-scalar multiplication
+    let result = ExtPoint$3.BASE.multiply(modL(d * INV_EIGHT)).add(getH().multiply(modL(c * INV_EIGHT)));
+    for (let i = 0; i < size; i++) {
+        const aScaled = modL(a[aOff + i] * modL(yFactor * INV_EIGHT));
+        const bScaled = modL(b[bOff + i] * INV_EIGHT);
+        result = result.add(G[gOff + i].multiply(aScaled));
+        result = result.add(H[hOff + i].multiply(bScaled));
+    }
+    return result;
+}
+/**
+ * Generate a Bulletproofs+ range proof.
+ *
+ * @param amounts - Array of amounts (bigint, each < 2^64)
+ * @param masks - Array of blinding factors (32-byte scalars)
+ * @returns BP+ proof
+ */
+function bulletproofPlusProve(amounts, masks) {
+    const m = amounts.length;
+    if (m === 0 || m > maxM)
+        throw new Error(`BP+: invalid output count ${m}`);
+    const M = nextPow2(m);
+    const logM = log2(M);
+    const MN = M * maxN;
+    const logMN = logM + log2(maxN);
+    // Get generators
+    const gens = getGenerators(MN);
+    const { Gi, Hi } = gens;
+    // Compute V[i] = (gamma*INV_EIGHT)*G + (sv*INV_EIGHT)*H
+    const V = [];
+    const sv = [];
+    const gamma = [];
+    for (let i = 0; i < m; i++) {
+        sv.push(amounts[i]);
+        gamma.push(utils.bytesToNumberLE(masks[i]));
+        const gScalar = modL(gamma[i] * INV_EIGHT);
+        const hScalar = modL(sv[i] * INV_EIGHT);
+        const point = ExtPoint$3.BASE.multiply(gScalar).add(getH().multiply(hScalar));
+        V.push(point.toRawBytes());
+    }
+    // Bit decomposition
+    const aL = new Array(MN);
+    const aR = new Array(MN);
+    const aL8 = new Array(MN);
+    const aR8 = new Array(MN);
+    for (let j = 0; j < M; j++) {
+        for (let i = 0; i < maxN; i++) {
+            const idx = j * maxN + i;
+            if (j < m && ((sv[j] >> BigInt(i)) & ONE) === ONE) {
+                aL[idx] = ONE;
+                aR[idx] = ZERO;
+                aL8[idx] = INV_EIGHT;
+                aR8[idx] = ZERO;
+            }
+            else {
+                aL[idx] = ZERO;
+                aR[idx] = modL(L$1 - ONE); // -1 mod l
+                aL8[idx] = ZERO;
+                aR8[idx] = MINUS_INV_EIGHT;
+            }
+        }
+    }
+    // Transcript initialization
+    let transcript = getInitialTranscript();
+    const vConcat = concatBytes(...V);
+    transcript = scalarToBytes(utils.bytesToNumberLE(transcriptUpdate1(transcript, hashToScalar$1(vConcat))));
+    // Commitment A
+    const alpha = randomScalar$1();
+    // pre_A = sum(aL8[i]*Gi[i] + aR8[i]*Hi[i])
+    let preA = ExtPoint$3.ZERO;
+    for (let i = 0; i < MN; i++) {
+        if (aL8[i] !== ZERO)
+            preA = preA.add(Gi[i].multiply(aL8[i]));
+        if (aR8[i] !== ZERO)
+            preA = preA.add(Hi[i].multiply(aR8[i]));
+    }
+    const A = preA.add(ExtPoint$3.BASE.multiply(modL(alpha * INV_EIGHT)));
+    const ABytes = A.toRawBytes();
+    // Challenge y
+    const yBytes = transcriptUpdate1(transcript, ABytes);
+    const y = utils.bytesToNumberLE(yBytes);
+    if (y === ZERO)
+        throw new Error('BP+: y is zero');
+    // Challenge z
+    const zBytes = hashToScalar$1(yBytes);
+    const z = utils.bytesToNumberLE(zBytes);
+    transcript = zBytes;
+    if (z === ZERO)
+        throw new Error('BP+: z is zero');
+    const zSq = modL(z * z);
+    // d vector: d[j*N+i] = z^(2*(j+1)) * 2^i
+    const d = new Array(MN);
+    d[0] = zSq;
+    for (let i = 1; i < maxN; i++) {
+        d[i] = modL(d[i - 1] * TWO);
+    }
+    for (let j = 1; j < M; j++) {
+        for (let i = 0; i < maxN; i++) {
+            d[j * maxN + i] = modL(d[(j - 1) * maxN + i] * zSq);
+        }
+    }
+    // y powers: y^0 to y^(MN+1)
+    const yPowers = new Array(MN + 2);
+    yPowers[0] = ONE;
+    for (let i = 1; i <= MN + 1; i++) {
+        yPowers[i] = modL(yPowers[i - 1] * y);
+    }
+    // aL1 = aL - z, aR1 = aR + z + d[i]*y^(MN-i)
+    const aL1 = new Array(MN);
+    const aR1 = new Array(MN);
+    for (let i = 0; i < MN; i++) {
+        aL1[i] = modL(aL[i] - z);
+        aR1[i] = modL(modL(aR[i] + z) + modL(d[i] * yPowers[MN - i]));
+    }
+    // alpha1 = alpha + sum(y^(MN+1) * z^(2*(j+1)) * gamma[j])
+    let alpha1 = alpha;
+    let temp = ONE;
+    for (let j = 0; j < m; j++) {
+        temp = modL(temp * zSq);
+        alpha1 = modL(alpha1 + modL(modL(yPowers[MN + 1] * temp) * gamma[j]));
+    }
+    // Inner-product argument
+    let nprime = MN;
+    const Gprime = Gi.slice(0, MN);
+    const Hprime = Hi.slice(0, MN);
+    let aprime = aL1.slice();
+    let bprime = aR1.slice();
+    const yInv = scalarInvert(y);
+    const yInvPow = new Array(MN);
+    yInvPow[0] = ONE;
+    for (let i = 1; i < MN; i++) {
+        yInvPow[i] = modL(yInvPow[i - 1] * yInv);
+    }
+    const Ls = [];
+    const Rs = [];
+    for (let round = 0; round < logMN; round++) {
+        nprime = nprime >> 1;
+        const cL = weightedInnerProduct(aprime.slice(0, nprime), bprime.slice(nprime, nprime * 2), y);
+        // For cR: aprime[nprime..] scaled by y^nprime
+        const aScaled = new Array(nprime);
+        for (let i = 0; i < nprime; i++) {
+            aScaled[i] = modL(aprime[nprime + i] * yPowers[nprime]);
+        }
+        const cR = weightedInnerProduct(aScaled, bprime.slice(0, nprime), y);
+        const dL = randomScalar$1();
+        const dR = randomScalar$1();
+        const LPoint = computeLR(nprime, yInvPow[nprime], Gprime, nprime, Hprime, 0, aprime, 0, bprime, nprime, cL, dL);
+        const RPoint = computeLR(nprime, yPowers[nprime], Gprime, 0, Hprime, nprime, aprime, nprime, bprime, 0, cR, dR);
+        const LBytes = LPoint.toRawBytes();
+        const RBytes = RPoint.toRawBytes();
+        Ls.push(LBytes);
+        Rs.push(RBytes);
+        const eBytes = transcriptUpdate2(transcript, LBytes, RBytes);
+        const e = utils.bytesToNumberLE(eBytes);
+        if (e === ZERO)
+            throw new Error('BP+: challenge is zero');
+        transcript = eBytes;
+        const eInv = scalarInvert(e);
+        // Fold generators
+        const tempG = modL(yInvPow[nprime] * e);
+        const newGprime = new Array(nprime);
+        const newHprime = new Array(nprime);
+        for (let i = 0; i < nprime; i++) {
+            newGprime[i] = Gprime[i].multiply(eInv).add(Gprime[nprime + i].multiply(tempG));
+            newHprime[i] = Hprime[i].multiply(e).add(Hprime[nprime + i].multiply(eInv));
+        }
+        // Fold scalar vectors
+        const tempA = modL(eInv * yPowers[nprime]);
+        const newAprime = new Array(nprime);
+        const newBprime = new Array(nprime);
+        for (let i = 0; i < nprime; i++) {
+            newAprime[i] = modL(modL(e * aprime[i]) + modL(tempA * aprime[nprime + i]));
+            newBprime[i] = modL(modL(eInv * bprime[i]) + modL(e * bprime[nprime + i]));
+        }
+        // Update alpha1
+        alpha1 = modL(alpha1 + modL(dL * modL(e * e)) + modL(dR * modL(eInv * eInv)));
+        // Replace arrays
+        Gprime.length = nprime;
+        Hprime.length = nprime;
+        for (let i = 0; i < nprime; i++) {
+            Gprime[i] = newGprime[i];
+            Hprime[i] = newHprime[i];
+        }
+        aprime = newAprime;
+        bprime = newBprime;
+    }
+    // Final round
+    const r = randomScalar$1();
+    const s = randomScalar$1();
+    const d_ = randomScalar$1();
+    const eta = randomScalar$1();
+    const rysb = modL(modL(r * modL(y * bprime[0])) + modL(s * modL(y * aprime[0])));
+    const A1 = Gprime[0]
+        .multiply(modL(r * INV_EIGHT))
+        .add(Hprime[0].multiply(modL(s * INV_EIGHT)))
+        .add(ExtPoint$3.BASE.multiply(modL(d_ * INV_EIGHT)))
+        .add(getH().multiply(modL(rysb * INV_EIGHT)));
+    const A1Bytes = A1.toRawBytes();
+    const B = ExtPoint$3.BASE.multiply(modL(eta * INV_EIGHT)).add(getH().multiply(modL(modL(r * modL(y * s)) * INV_EIGHT)));
+    const BBytes = B.toRawBytes();
+    // Final challenge
+    const eFinalBytes = transcriptUpdate2(transcript, A1Bytes, BBytes);
+    const eFinal = utils.bytesToNumberLE(eFinalBytes);
+    if (eFinal === ZERO)
+        throw new Error('BP+: final challenge is zero');
+    const eFinalSq = modL(eFinal * eFinal);
+    const r1 = scalarToBytes(modL(modL(aprime[0] * eFinal) + r));
+    const s1 = scalarToBytes(modL(modL(bprime[0] * eFinal) + s));
+    const d1 = scalarToBytes(modL(eta + modL(d_ * eFinal) + modL(alpha1 * eFinalSq)));
+    return { A: ABytes, A1: A1Bytes, B: BBytes, r1, s1, d1, L: Ls, R: Rs };
+}
+
+/**
+ * Key image generation for Monero ring signatures.
+ * KI = x * Hp(P) where x is the private key and P is the public key.
+ */
+/**
+ * Generate a key image from a private/public key pair.
+ * KI = x * Hp(P)
+ * @param privKey - Private key (32-byte scalar LE)
+ * @param pubKey - Corresponding public key (32-byte compressed point)
+ * @returns Key image as 32-byte compressed point
+ */
+function generateKeyImage(privKey, pubKey) {
+    const hp = hashToPoint(pubKey);
+    const scalar = utils.bytesToNumberLE(privKey);
+    return hp.multiply(scalar).toRawBytes();
+}
+
+/**
+ * Monero stealth address (one-time address) derivation.
+ *
+ * Output key: P = Hs(r*A || i)*G + B
+ * - r: tx private key
+ * - A: recipient's public view key
+ * - B: recipient's public spend key
+ * - i: output index
+ * - Hs: keccak256 -> sc_reduce32 (hash to scalar)
+ *
+ * Input key recovery: x = Hs(a*R || i) + b
+ * - a: recipient's private view key
+ * - R: tx public key (r*G)
+ * - b: recipient's private spend key
+ */
+const ExtPoint$2 = ed25519.ed25519.ExtendedPoint;
+/**
+ * Hash to scalar: Hs(data) = sc_reduce32(keccak256(data))
+ */
+function hashToScalar(data) {
+    return scReduce32(sha3.keccak_256(data));
+}
+function encodeVarint$1(n) {
+    const bytes = [];
+    while (n >= 0x80) {
+        bytes.push((n & 0x7f) | 0x80);
+        n >>>= 7;
+    }
+    bytes.push(n & 0x7f);
+    return new Uint8Array(bytes);
+}
+/**
+ * Concatenate buffers with a varint output index.
+ */
+function deriveKeyData(sharedSecret, outputIndex) {
+    const secretBytes = sharedSecret.toRawBytes();
+    // Encode output index as varint (simple case: single byte for index < 128)
+    const indexBytes = encodeVarint$1(outputIndex);
+    const combined = new Uint8Array(secretBytes.length + indexBytes.length);
+    combined.set(secretBytes, 0);
+    combined.set(indexBytes, secretBytes.length);
+    return combined;
+}
+/**
+ * Derive the one-time output public key for a transaction output.
+ * P = Hs(r*A || i)*G + B
+ *
+ * @param txPrivKey - Transaction private key r (32 bytes)
+ * @param recipPubViewKey - Recipient's public view key A (32 bytes)
+ * @param recipPubSpendKey - Recipient's public spend key B (32 bytes)
+ * @param outputIndex - Output index i
+ * @returns One-time public key P (32 bytes)
+ */
+function deriveOutputKey(txPrivKey, recipPubViewKey, recipPubSpendKey, outputIndex) {
+    const rScalar = utils.bytesToNumberLE(txPrivKey);
+    const A = ExtPoint$2.fromHex(recipPubViewKey);
+    const B = ExtPoint$2.fromHex(recipPubSpendKey);
+    // Monero derivation: 8*r*A (cofactor multiplication)
+    const rA = A.multiply(rScalar).multiply(BigInt(8));
+    // Hs(r*A || i)
+    const keyData = deriveKeyData(rA, outputIndex);
+    const hsBytes = hashToScalar(keyData);
+    const hs = utils.bytesToNumberLE(hsBytes);
+    // P = Hs(r*A || i)*G + B
+    const hsG = ExtPoint$2.BASE.multiply(hs);
+    return hsG.add(B).toRawBytes();
+}
+/**
+ * Derive the one-time private key for spending a received output.
+ * x = Hs(a*R || i) + b
+ *
+ * @param txPubKey - Transaction public key R = r*G (32 bytes)
+ * @param privViewKey - Recipient's private view key a (32 bytes)
+ * @param privSpendKey - Recipient's private spend key b (32 bytes)
+ * @param outputIndex - Output index i
+ * @returns One-time private key x (32 bytes)
+ */
+function deriveInputKey(txPubKey, privViewKey, privSpendKey, outputIndex) {
+    const aScalar = utils.bytesToNumberLE(privViewKey);
+    const R = ExtPoint$2.fromHex(txPubKey);
+    // Monero derivation: 8*a*R (cofactor multiplication)
+    const aR = R.multiply(aScalar).multiply(BigInt(8));
+    // Hs(8*a*R || i)
+    const keyData = deriveKeyData(aR, outputIndex);
+    const hsBytes = hashToScalar(keyData);
+    const hs = utils.bytesToNumberLE(hsBytes);
+    // x = Hs(8*a*R || i) + b
+    const b = utils.bytesToNumberLE(privSpendKey);
+    const L = BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989');
+    const x = (hs + b) % L;
+    return utils.numberToBytesLE(x, 32);
+}
+/**
+ * Check if an output belongs to us.
+ * Computes P' = Hs(a*R || i)*G + B and checks if P' == P.
+ *
+ * @param txPubKey - Transaction public key R (32 bytes)
+ * @param privViewKey - Our private view key a (32 bytes)
+ * @param pubSpendKey - Our public spend key B (32 bytes)
+ * @param outputKey - The output's public key P (32 bytes)
+ * @param outputIndex - Output index i
+ * @returns true if the output belongs to us
+ */
+function isOutputForUs(txPubKey, privViewKey, pubSpendKey, outputKey, outputIndex) {
+    const aScalar = utils.bytesToNumberLE(privViewKey);
+    const R = ExtPoint$2.fromHex(txPubKey);
+    const B = ExtPoint$2.fromHex(pubSpendKey);
+    // Monero derivation: 8*a*R (cofactor multiplication)
+    const aR = R.multiply(aScalar).multiply(BigInt(8));
+    const keyData = deriveKeyData(aR, outputIndex);
+    const hsBytes = hashToScalar(keyData);
+    const hs = utils.bytesToNumberLE(hsBytes);
+    const expectedP = ExtPoint$2.BASE.multiply(hs).add(B);
+    const actualP = ExtPoint$2.fromHex(outputKey);
+    return expectedP.equals(actualP);
+}
+
+/**
+ * ECDH-based amount encryption/decryption for Monero RingCT.
+ *
+ * Shared secret: ss = 8 * r * A (or 8 * a * R)
+ * Amount mask: first 8 bytes of keccak256("amount" || Hs(ss || index))
+ * Encrypted amount: XOR of 8-byte LE amount with mask
+ */
+const ExtPoint$1 = ed25519.ed25519.ExtendedPoint;
+function encodeVarint(n) {
+    const bytes = [];
+    while (n >= 0x80) {
+        bytes.push((n & 0x7f) | 0x80);
+        n >>>= 7;
+    }
+    bytes.push(n & 0x7f);
+    return new Uint8Array(bytes);
+}
+/**
+ * Derive the shared secret scalar for amount encryption.
+ * Hs(r*A || i) — same derivation as stealth address.
+ */
+function derivationToScalar(sharedSecret, outputIndex) {
+    const indexBytes = encodeVarint(outputIndex);
+    const combined = new Uint8Array(sharedSecret.length + indexBytes.length);
+    combined.set(sharedSecret, 0);
+    combined.set(indexBytes, sharedSecret.length);
+    return scReduce32(sha3.keccak_256(combined));
+}
+/**
+ * Generate the amount mask for XOR encryption.
+ * mask = keccak256("amount" || scalar)[0..8]
+ */
+function amountMask(scalar) {
+    const prefix = new TextEncoder().encode('amount');
+    const data = new Uint8Array(prefix.length + scalar.length);
+    data.set(prefix, 0);
+    data.set(scalar, prefix.length);
+    return sha3.keccak_256(data).slice(0, 8);
+}
+/**
+ * Derive ECDH shared secret point from tx private key and recipient's public view key.
+ * Returns the compressed point bytes of r*A.
+ */
+function deriveSharedSecret(txPrivKey, pubViewKey) {
+    const rScalar = utils.bytesToNumberLE(txPrivKey);
+    const A = ExtPoint$1.fromHex(pubViewKey);
+    // Monero derivation: 8*r*A (cofactor multiplication)
+    return A.multiply(rScalar).multiply(BigInt(8)).toRawBytes();
+}
+/**
+ * Compute the 1-byte view tag for an output.
+ * view_tag = keccak256("view_tag" || derivation || varint(outputIndex))[0]
+ */
+function computeViewTag(sharedSecret, outputIndex) {
+    const prefix = new TextEncoder().encode('view_tag');
+    const idxBuf = encodeVarint(outputIndex);
+    const data = new Uint8Array(prefix.length + sharedSecret.length + idxBuf.length);
+    data.set(prefix, 0);
+    data.set(sharedSecret, prefix.length);
+    data.set(idxBuf, prefix.length + sharedSecret.length);
+    return sha3.keccak_256(data)[0];
+}
+/**
+ * Encrypt an amount using ECDH-derived mask.
+ * @param amount - Amount in piconero (bigint)
+ * @param sharedSecret - ECDH shared secret (r*A compressed bytes)
+ * @param outputIndex - Output index for key derivation
+ * @returns 8-byte encrypted amount
+ */
+function encryptAmount(amount, sharedSecret, outputIndex) {
+    const scalar = derivationToScalar(sharedSecret, outputIndex);
+    const mask = amountMask(scalar);
+    const amountBytes = utils.numberToBytesLE(amount, 8);
+    const encrypted = new Uint8Array(8);
+    for (let i = 0; i < 8; i++) {
+        encrypted[i] = amountBytes[i] ^ mask[i];
+    }
+    return encrypted;
+}
+/**
+ * Decrypt an amount using ECDH-derived mask.
+ * @param encrypted - 8-byte encrypted amount
+ * @param sharedSecret - ECDH shared secret (a*R compressed bytes)
+ * @param outputIndex - Output index for key derivation
+ * @returns Decrypted amount in piconero
+ */
+function decryptAmount(encrypted, sharedSecret, outputIndex) {
+    if (encrypted.length < 8)
+        throw new Error(`decryptAmount: expected 8 bytes, got ${encrypted.length}`);
+    const scalar = derivationToScalar(sharedSecret, outputIndex);
+    const mask = amountMask(scalar);
+    const decrypted = new Uint8Array(8);
+    for (let i = 0; i < 8; i++) {
+        decrypted[i] = encrypted[i] ^ mask[i];
+    }
+    return utils.bytesToNumberLE(decrypted);
+}
+
+/**
+ * Decoy output selection for Monero ring signatures.
+ * Uses gamma distribution (shape=19.28, scale=1/1.61) matching Monero's wallet2.
+ *
+ * Reference: monero/src/wallet/wallet2.cpp (get_outs)
+ */
+const RING_SIZE = 16;
+const GAMMA_SHAPE = 19.28;
+const GAMMA_RATE = 1.61; // scale = 1/rate
+/**
+ * Generate a cryptographically secure random float in [0, 1).
+ */
+function secureRandom() {
+    const buf = new Uint32Array(1);
+    crypto.getRandomValues(buf);
+    return buf[0] / 0x100000000;
+}
+/**
+ * Sample from gamma distribution using Marsaglia & Tsang's method.
+ * Uses crypto.getRandomValues() for privacy-safe randomness.
+ */
+function sampleGamma(shape, rate) {
+    const d = shape - 1 / 3;
+    const c = 1 / Math.sqrt(9 * d);
+    while (true) {
+        let x;
+        let v;
+        do {
+            // Box-Muller for standard normal
+            const u1 = secureRandom();
+            const u2 = secureRandom();
+            x = Math.sqrt(-2 * Math.log(u1)) * Math.cos(2 * Math.PI * u2);
+            v = Math.pow(1 + c * x, 3);
+        } while (v <= 0);
+        const u = secureRandom();
+        if (u < 1 - 0.0331 * Math.pow(x, 4) || Math.log(u) < 0.5 * x * x + d * (1 - v + Math.log(v))) {
+            return (d * v) / rate;
+        }
+    }
+}
+/**
+ * Select decoy global output indices for ring signature construction.
+ *
+ * @param realGlobalIndex - Global output index of the real input
+ * @param numOutputs - Total number of outputs on chain
+ * @param newestHeight - Current blockchain height
+ * @param outputDistribution - Cumulative output distribution per block
+ * @param distStartHeight - Start height of distribution data
+ * @returns Array of RING_SIZE - 1 decoy global indices (excluding the real one)
+ */
+function selectDecoys(realGlobalIndex, numOutputs, newestHeight, outputDistribution, distStartHeight) {
+    const decoys = new Set();
+    const maxIndex = numOutputs - 1;
+    let attempts = 0;
+    while (decoys.size < RING_SIZE - 1 && attempts < 1000) {
+        attempts++;
+        // Sample from gamma distribution
+        let blockOffset = Math.floor(sampleGamma(GAMMA_SHAPE, GAMMA_RATE));
+        // Map to a block height (counting from the newest block backwards)
+        let blockHeight = newestHeight - blockOffset;
+        // Ensure within valid range
+        if (blockHeight < distStartHeight)
+            blockHeight = distStartHeight;
+        if (blockHeight >= distStartHeight + outputDistribution.length) {
+            blockHeight = distStartHeight + outputDistribution.length - 1;
+        }
+        // Get output range for this block
+        const distIdx = blockHeight - distStartHeight;
+        const blockStart = distIdx > 0 ? outputDistribution[distIdx - 1] : 0;
+        const blockEnd = outputDistribution[distIdx];
+        if (blockEnd <= blockStart)
+            continue; // empty block
+        // Pick random output within this block
+        const outputIdx = blockStart + Math.floor(secureRandom() * (blockEnd - blockStart));
+        if (outputIdx > maxIndex)
+            continue;
+        if (outputIdx === realGlobalIndex)
+            continue;
+        if (decoys.has(outputIdx))
+            continue;
+        decoys.add(outputIdx);
+    }
+    // If we couldn't get enough decoys from gamma sampling, fill randomly
+    let fallbackAttempts = 0;
+    while (decoys.size < RING_SIZE - 1 && fallbackAttempts < 10000) {
+        fallbackAttempts++;
+        const idx = Math.floor(secureRandom() * (maxIndex + 1));
+        if (idx !== realGlobalIndex && !decoys.has(idx)) {
+            decoys.add(idx);
+        }
+    }
+    if (decoys.size < RING_SIZE - 1) {
+        throw new Error(`Insufficient decoys: need ${RING_SIZE - 1}, got ${decoys.size} from ${maxIndex + 1} outputs`);
+    }
+    return Array.from(decoys).sort((a, b) => a - b);
+}
+/**
+ * Build sorted ring with real index.
+ * Returns the ring indices (sorted) and the position of the real input.
+ */
+function buildRingIndices(realGlobalIndex, decoys) {
+    const all = [...decoys, realGlobalIndex].sort((a, b) => a - b);
+    const realIndex = all.indexOf(realGlobalIndex);
+    return { indices: all, realIndex };
+}
+/**
+ * Convert absolute global indices to relative offsets (as stored in tx).
+ */
+function toRelativeOffsets(sortedIndices) {
+    const offsets = [BigInt(sortedIndices[0])];
+    for (let i = 1; i < sortedIndices.length; i++) {
+        offsets.push(BigInt(sortedIndices[i] - sortedIndices[i - 1]));
+    }
+    return offsets;
+}
+
+/**
+ * Monero transaction binary serialization.
+ * Reference: monero/src/cryptonote_basic/cryptonote_format_utils.cpp
+ */
+/**
+ * Encode a number as a Monero varint (7 bits per byte, MSB = continuation flag).
+ */
+function writeVarint(n) {
+    let val = typeof n === 'number' ? BigInt(n) : n;
+    const bytes = [];
+    while (val >= BigInt(0x80)) {
+        bytes.push(Number(val & BigInt(0x7f)) | 0x80);
+        val >>= BigInt(7);
+    }
+    bytes.push(Number(val & BigInt(0x7f)));
+    return new Uint8Array(bytes);
+}
+/**
+ * Helper class for building binary buffers.
+ */
+class TxWriter {
+    constructor() {
+        this.parts = [];
+    }
+    writeBytes(data) {
+        this.parts.push(data);
+    }
+    writeVarint(n) {
+        this.parts.push(writeVarint(n));
+    }
+    writeKey(key) {
+        if (key.length !== 32)
+            throw new Error(`Expected 32-byte key, got ${key.length}`);
+        this.parts.push(key);
+    }
+    writeByte(b) {
+        this.parts.push(new Uint8Array([b]));
+    }
+    toBytes() {
+        const totalLen = this.parts.reduce((sum, p) => sum + p.length, 0);
+        const result = new Uint8Array(totalLen);
+        let offset = 0;
+        for (const part of this.parts) {
+            result.set(part, offset);
+            offset += part.length;
+        }
+        return result;
+    }
+}
+function serializeInput(w, input) {
+    w.writeByte(0x02); // txin_to_key tag
+    w.writeVarint(input.amount);
+    w.writeVarint(input.keyOffsets.length);
+    for (const offset of input.keyOffsets) {
+        w.writeVarint(offset);
+    }
+    w.writeKey(input.keyImage);
+}
+function serializeOutput(w, output) {
+    w.writeVarint(output.amount);
+    w.writeByte(0x03); // txout_to_tagged_key variant tag
+    w.writeKey(output.key);
+    w.writeByte(output.viewTag); // 1-byte view tag for fast scanning
+}
+/**
+ * Serialize the transaction prefix (everything except RingCT signatures).
+ */
+function serializeTxPrefix(tx) {
+    const w = new TxWriter();
+    w.writeVarint(tx.version);
+    w.writeVarint(tx.unlockTime);
+    // Inputs
+    w.writeVarint(tx.inputs.length);
+    for (const input of tx.inputs) {
+        serializeInput(w, input);
+    }
+    // Outputs
+    w.writeVarint(tx.outputs.length);
+    for (const output of tx.outputs) {
+        serializeOutput(w, output);
+    }
+    // Extra
+    w.writeVarint(tx.extra.length);
+    w.writeBytes(tx.extra);
+    return w.toBytes();
+}
+/**
+ * Compute the transaction prefix hash (keccak256 of serialized prefix).
+ * This is the message signed by CLSAG.
+ */
+function txPrefixHash(tx) {
+    return sha3.keccak_256(serializeTxPrefix(tx));
+}
+/**
+ * Serialize the RCT signature base (type, fee, encrypted amounts, output commitments).
+ */
+function serializeRctBase(rct) {
+    const w = new TxWriter();
+    w.writeByte(rct.type);
+    w.writeVarint(rct.txnFee);
+    // Encrypted amounts (8 bytes each for v2)
+    for (const ecdh of rct.ecdhInfo) {
+        w.writeBytes(ecdh);
+    }
+    // Output commitments
+    for (const outPk of rct.outPk) {
+        w.writeKey(outPk);
+    }
+    return w.toBytes();
+}
+/**
+ * Serialize a CLSAG signature.
+ */
+function serializeClsag(sig) {
+    const w = new TxWriter();
+    // s scalars
+    for (const s of sig.s) {
+        w.writeKey(s);
+    }
+    // c1 challenge
+    w.writeKey(sig.c1);
+    // D (commitment key image, already scaled by 1/8)
+    w.writeKey(sig.D);
+    return w.toBytes();
+}
+/**
+ * Serialize a Bulletproofs+ proof.
+ */
+function serializeBPPlus(proof) {
+    const w = new TxWriter();
+    w.writeKey(proof.A);
+    w.writeKey(proof.A1);
+    w.writeKey(proof.B);
+    w.writeKey(proof.r1);
+    w.writeKey(proof.s1);
+    w.writeKey(proof.d1);
+    // L and R vectors
+    w.writeVarint(proof.L.length);
+    for (const l of proof.L) {
+        w.writeKey(l);
+    }
+    for (const r of proof.R) {
+        w.writeKey(r);
+    }
+    return w.toBytes();
+}
+/**
+ * Serialize the prunable RCT data (pseudo-outputs, CLSAGs, BP+ proofs).
+ */
+function serializeRctPrunable(rct) {
+    const w = new TxWriter();
+    // BP+ proofs count + data
+    w.writeVarint(rct.bppProofs.length);
+    for (const proof of rct.bppProofs) {
+        w.writeBytes(serializeBPPlus(proof));
+    }
+    // CLSAGs
+    for (const clsag of rct.clsags) {
+        w.writeBytes(serializeClsag(clsag));
+    }
+    // Pseudo-outputs
+    for (const po of rct.pseudoOuts) {
+        w.writeKey(po);
+    }
+    return w.toBytes();
+}
+/**
+ * Compute the RCT signature hash (message for CLSAG signing).
+ * hash = keccak256(prefixHash || keccak256(rctBase) || keccak256(rctPrunable))
+ */
+function rctSigHash(prefixHash, rctBase, rctPrunable) {
+    const combined = new Uint8Array(96);
+    combined.set(prefixHash, 0);
+    combined.set(sha3.keccak_256(rctBase), 32);
+    combined.set(sha3.keccak_256(rctPrunable), 64);
+    return sha3.keccak_256(combined);
+}
+/**
+ * Serialize a complete transaction.
+ */
+function serializeTransaction(tx) {
+    const w = new TxWriter();
+    w.writeBytes(serializeTxPrefix(tx));
+    w.writeBytes(serializeRctBase(tx.rctSignatures));
+    w.writeBytes(serializeRctPrunable(tx.rctSignatures));
+    return w.toBytes();
+}
+
+/**
+ * Monero transaction builder.
+ * Orchestrates: stealth addresses, Pedersen commitments, ECDH encryption,
+ * CLSAG signatures, Bulletproofs+ range proofs, and serialization.
+ *
+ * Reference: monero/src/wallet/wallet2.cpp (create_transactions_2)
+ */
+const L = BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989');
+function randomScalar() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return scReduce32(bytes);
+}
+/**
+ * Build a complete Monero RingCT transaction.
+ *
+ * @param inputs - Spendable outputs to use as inputs
+ * @param destinations - Recipients + amounts
+ * @param changeDestination - Change address keys (pubView, pubSpend)
+ * @param fee - Transaction fee in piconero
+ * @param privViewKey - Sender's private view key
+ * @param privSpendKey - Sender's private spend key
+ * @param daemonUrl - Daemon RPC URL for decoy selection
+ * @returns Built transaction ready for broadcast
+ */
+function buildTransaction(inputs, destinations, changeDestination, fee, privViewKey, privSpendKey, daemonUrl) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (inputs.length === 0)
+            throw new Error('No inputs');
+        if (destinations.length === 0)
+            throw new Error('No destinations');
+        const totalIn = inputs.reduce((sum, inp) => sum + inp.amount, BigInt(0));
+        const totalOut = destinations.reduce((sum, d) => sum + d.amount, BigInt(0));
+        if (totalIn < totalOut + fee)
+            throw new Error('Insufficient funds');
+        // Add change output if needed
+        const change = totalIn - totalOut - fee;
+        const allDestinations = [...destinations];
+        if (change > BigInt(0)) {
+            allDestinations.push({
+                pubViewKey: changeDestination.pubViewKey,
+                pubSpendKey: changeDestination.pubSpendKey,
+                amount: change,
+            });
+        }
+        // Generate tx private key
+        const txPrivKey = randomScalar();
+        const txPubKey = secretKeyToPublicKey(txPrivKey);
+        // --- Build outputs ---
+        const txOutputs = [];
+        const outAmounts = [];
+        const outMasks = [];
+        const outCommitments = [];
+        const ecdhInfo = [];
+        for (let i = 0; i < allDestinations.length; i++) {
+            const dest = allDestinations[i];
+            // ECDH shared secret for this output
+            const sharedSecret = deriveSharedSecret(txPrivKey, dest.pubViewKey);
+            // One-time output key
+            const outputKey = deriveOutputKey(txPrivKey, dest.pubViewKey, dest.pubSpendKey, i);
+            const viewTag = computeViewTag(sharedSecret, i);
+            txOutputs.push({ amount: BigInt(0), key: outputKey, viewTag });
+            // Output commitment mask
+            const outMask = randomScalar();
+            outMasks.push(outMask);
+            outAmounts.push(dest.amount);
+            // Pedersen commitment: C = mask*G + amount*H
+            const commitment = commit(outMask, dest.amount);
+            outCommitments.push(commitment.toRawBytes());
+            // ECDH encrypted amount
+            const encrypted = encryptAmount(dest.amount, sharedSecret, i);
+            ecdhInfo.push(encrypted);
+        }
+        // --- Build inputs with decoys ---
+        const distData = yield getOutputDistribution(daemonUrl);
+        const height = yield getHeight(daemonUrl);
+        const numOutputs = distData.distribution[distData.distribution.length - 1];
+        const txInputs = [];
+        const rings = [];
+        const realIndices = [];
+        const inputPrivKeys = [];
+        const inputMasks = [];
+        const keyImages = [];
+        const pseudoOuts = [];
+        const pseudoMasks = [];
+        for (let i = 0; i < inputs.length; i++) {
+            const inp = inputs[i];
+            // Derive the one-time private key for this input
+            const inputPrivKey = deriveInputKey(inp.txPubKey, privViewKey, privSpendKey, inp.outputIndex);
+            inputPrivKeys.push(inputPrivKey);
+            // Key image
+            const ki = generateKeyImage(inputPrivKey, inp.publicKey);
+            keyImages.push(ki);
+            // Select decoys
+            const decoys = selectDecoys(inp.globalIndex, numOutputs, height, distData.distribution, distData.startHeight);
+            const { indices: ringIndices, realIndex } = buildRingIndices(inp.globalIndex, decoys);
+            realIndices.push(realIndex);
+            const offsets = toRelativeOffsets(ringIndices);
+            // Fetch ring member public keys and commitments from daemon
+            const outsReq = ringIndices.map((idx) => ({ amount: 0, index: idx }));
+            const outs = yield getOuts(daemonUrl, outsReq);
+            const ring = outs.map((out) => ({
+                dest: hexToBytes(out.key),
+                mask: hexToBytes(out.mask),
+            }));
+            rings.push(ring);
+            txInputs.push({
+                amount: BigInt(0),
+                keyOffsets: offsets,
+                keyImage: ki,
+            });
+            inputMasks.push(inp.mask);
+            // Pseudo-output commitment (random mask, same amount as real input)
+            const pseudoMask = randomScalar();
+            pseudoMasks.push(pseudoMask);
+            const pseudoCommitment = commit(pseudoMask, inp.amount);
+            pseudoOuts.push(pseudoCommitment.toRawBytes());
+        }
+        // Adjust last pseudo-output mask so commitments balance:
+        // sum(pseudoMasks) = sum(outMasks) + 0 (fee mask is 0)
+        // So: pseudoMasks[last] = sum(outMasks) - sum(pseudoMasks[0..n-2])
+        if (inputs.length > 0) {
+            let sumOutMasks = BigInt(0);
+            for (const m of outMasks)
+                sumOutMasks = (sumOutMasks + utils.bytesToNumberLE(m)) % L;
+            let sumPseudoMasks = BigInt(0);
+            for (let i = 0; i < pseudoMasks.length - 1; i++) {
+                sumPseudoMasks = (sumPseudoMasks + utils.bytesToNumberLE(pseudoMasks[i])) % L;
+            }
+            let lastMask = (sumOutMasks - sumPseudoMasks) % L;
+            if (lastMask < BigInt(0))
+                lastMask += L;
+            const lastIdx = pseudoMasks.length - 1;
+            pseudoMasks[lastIdx] = new Uint8Array(utils.numberToBytesLE(lastMask, 32));
+            // Recompute last pseudo-output commitment
+            pseudoOuts[lastIdx] = commit(pseudoMasks[lastIdx], inputs[lastIdx].amount).toRawBytes();
+        }
+        // --- Bulletproofs+ range proof ---
+        const bppProof = bulletproofPlusProve(outAmounts, outMasks);
+        // --- Build tx extra (tx public key) ---
+        const extra = concatBytes(new Uint8Array([0x01]), txPubKey); // tag 0x01 = tx pubkey
+        // --- Assemble transaction ---
+        const rctSig = {
+            type: 6, // RCTTypeBulletproofPlus
+            txnFee: fee,
+            ecdhInfo,
+            outPk: outCommitments,
+            pseudoOuts,
+            clsags: [], // filled below
+            bppProofs: [bppProof],
+        };
+        const tx = {
+            version: 2,
+            unlockTime: BigInt(0),
+            inputs: txInputs,
+            outputs: txOutputs,
+            extra,
+            rctSignatures: rctSig,
+        };
+        // --- Sign each input with CLSAG ---
+        const prefixHash = txPrefixHash(tx);
+        const rctBase = serializeRctBase(rctSig);
+        const rctPrunable = serializeRctPrunable(rctSig);
+        const sigMessage = rctSigHash(prefixHash, rctBase, rctPrunable);
+        for (let i = 0; i < inputs.length; i++) {
+            // z = inputMask - pseudoMask
+            let z = (utils.bytesToNumberLE(inputMasks[i]) - utils.bytesToNumberLE(pseudoMasks[i])) % L;
+            if (z < BigInt(0))
+                z += L;
+            const zBytes = new Uint8Array(utils.numberToBytesLE(z, 32));
+            const sig = clsagSign(sigMessage, rings[i], pseudoOuts[i], inputPrivKeys[i], zBytes, realIndices[i], keyImages[i]);
+            tx.rctSignatures.clsags.push(sig);
+        }
+        // Serialize
+        const txBytes = serializeTransaction(tx);
+        const txHex = bytesToHex(txBytes);
+        // Monero txid = keccak256(prefixHash || keccak256(rctBase) || keccak256(rctPrunable))
+        // Must recompute rctPrunable after CLSAGs are filled in
+        const finalRctPrunable = serializeRctPrunable(rctSig);
+        const txHash = bytesToHex(rctSigHash(prefixHash, rctBase, finalRctPrunable));
+        return { tx, txHex, txHash };
+    });
+}
+
+/**
+ * Daemon-based blockchain scanner for Monero.
+ * Scans blocks using the view key to find owned outputs and detect spent outputs.
+ * Used as fallback when no LWS (Light Wallet Server) is available.
+ *
+ * This is intentionally slow — scanning the full chain from genesis is impractical.
+ * Use a restore height close to when the wallet was created.
+ */
+const ExtPoint = ed25519.ed25519.ExtendedPoint;
+/**
+ * Parse tx public key from the extra field of a decoded Monero transaction.
+ * The extra field is an array of bytes; tag 0x01 followed by 32 bytes is the tx pub key.
+ */
+function parseTxPubKey(extraBytes) {
+    for (let i = 0; i < extraBytes.length; i++) {
+        if (extraBytes[i] === 0x01 && i + 32 < extraBytes.length) {
+            return new Uint8Array(extraBytes.slice(i + 1, i + 33));
+        }
+        // Tag 0x02 = nonce, skip its length
+        if (extraBytes[i] === 0x02 && i + 1 < extraBytes.length) {
+            i += extraBytes[i + 1] + 1;
+        }
+    }
+    return null;
+}
+/**
+ * Compute the ECDH shared secret for amount decryption: a*R (view key * tx pub key).
+ * Returns compressed point bytes.
+ */
+function computeSharedSecret(privViewKey, txPubKey) {
+    const a = utils.bytesToNumberLE(privViewKey);
+    const R = ExtPoint.fromHex(txPubKey);
+    // Monero's generate_key_derivation: derivation = 8 * a * R (cofactor multiplication)
+    return R.multiply(a).multiply(BigInt(8)).toRawBytes();
+}
+/**
+ * Process decoded transactions to find owned outputs and spent key images.
+ */
+function processTransactions(decodedTxs, privViewKey, pubSpendKey, privSpendKey, heightTimestampMap) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    const ownedOutputs = [];
+    const spentKeyImages = new Set();
+    for (const txEntry of decodedTxs) {
+        let txJson;
+        try {
+            txJson = JSON.parse(txEntry.as_json);
+        }
+        catch (_j) {
+            continue;
+        }
+        // Collect spent key images from inputs
+        if (txJson.vin) {
+            for (const input of txJson.vin) {
+                const ki = ((_a = input.key) === null || _a === void 0 ? void 0 : _a.key_image) || ((_b = input.key) === null || _b === void 0 ? void 0 : _b.k_image);
+                if (ki)
+                    spentKeyImages.add(ki);
+            }
+        }
+        if (!txJson.extra || !txJson.vout)
+            continue;
+        const txPubKey = parseTxPubKey(txJson.extra);
+        if (!txPubKey)
+            continue;
+        const sharedSecret = computeSharedSecret(privViewKey, txPubKey);
+        const meta = (_c = heightTimestampMap.get(txEntry.tx_hash)) !== null && _c !== void 0 ? _c : {
+            height: txEntry.block_height,
+            timestamp: txEntry.block_timestamp,
+        };
+        for (let i = 0; i < txJson.vout.length; i++) {
+            const out = txJson.vout[i];
+            const outputKeyHex = (_e = (_d = out.target.tagged_key) === null || _d === void 0 ? void 0 : _d.key) !== null && _e !== void 0 ? _e : out.target.key;
+            if (!outputKeyHex)
+                continue;
+            // View tag optimization: skip EC math if view tag doesn't match
+            const viewTag = (_f = out.target.tagged_key) === null || _f === void 0 ? void 0 : _f.view_tag;
+            if (viewTag !== undefined) {
+                const expected = computeViewTag(sharedSecret, i);
+                if (expected !== parseInt(viewTag, 16))
+                    continue;
+            }
+            const outputKey = hexToBytes(outputKeyHex);
+            try {
+                if (!isOutputForUs(txPubKey, privViewKey, pubSpendKey, outputKey, i))
+                    continue;
+            }
+            catch (_k) {
+                continue;
+            }
+            // Decrypt amount from RingCT ecdhInfo
+            let amount = BigInt(0);
+            if ((_h = (_g = txJson.rct_signatures) === null || _g === void 0 ? void 0 : _g.ecdhInfo) === null || _h === void 0 ? void 0 : _h[i]) {
+                const encryptedHex = txJson.rct_signatures.ecdhInfo[i].amount;
+                const encrypted = hexToBytes(encryptedHex);
+                try {
+                    amount = decryptAmount(encrypted, sharedSecret, i);
+                }
+                catch (_l) {
+                    continue;
+                }
+            }
+            // Compute key image for spent detection
+            const oneTimePrivKey = deriveInputKey(txPubKey, privViewKey, privSpendKey, i);
+            const keyImage = bytesToHex(generateKeyImage(oneTimePrivKey, outputKey));
+            ownedOutputs.push({
+                txHash: txEntry.tx_hash,
+                outputIndex: i,
+                amount,
+                globalIndex: -1, // Not available from get_transactions; outputs from daemon scan cannot be spent directly
+                publicKey: outputKey,
+                txPubKey,
+                keyImage,
+                height: meta.height,
+                timestamp: meta.timestamp,
+            });
+        }
+    }
+    return { ownedOutputs, spentKeyImages };
+}
+/**
+ * Scan a range of blocks for owned outputs.
+ * Uses batched RPC calls: fetches block tx hashes in parallel, then
+ * fetches all transactions in a single get_transactions call per batch.
+ */
+function scanBlocks(daemonUrl, privViewKey, pubSpendKey, privSpendKey, fromHeight, toHeight, onProgress) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const allOwnedOutputs = [];
+        const allSpentKeyImages = new Set();
+        // Step 1: Fetch all block headers in one RPC call to find blocks with txs
+        const HEADER_BATCH = 500;
+        const blocksWithTxs = [];
+        for (let h = fromHeight; h <= toHeight; h += HEADER_BATCH) {
+            const rangeEnd = Math.min(h + HEADER_BATCH - 1, toHeight);
+            try {
+                const headers = yield getBlockHeadersRange(daemonUrl, h, rangeEnd);
+                for (const hdr of headers) {
+                    if (hdr.num_txes > 0) {
+                        blocksWithTxs.push({ height: hdr.height, timestamp: hdr.timestamp });
+                    }
+                }
+            }
+            catch (err) {
+                console.error(`[XMR scanner] getBlockHeadersRange failed for ${h}-${rangeEnd}:`, err.message);
+            }
+        }
+        console.log(`[XMR scanner] ${blocksWithTxs.length} blocks with transactions out of ${toHeight - fromHeight + 1} total`);
+        // Step 2: For each block with txs, fetch tx hashes sequentially
+        const allTxHashes = [];
+        const heightMap = new Map();
+        for (const block of blocksWithTxs) {
+            try {
+                const result = yield getBlockTxHashes(daemonUrl, block.height);
+                for (const txHash of result.txHashes) {
+                    allTxHashes.push(txHash);
+                    heightMap.set(txHash, { height: block.height, timestamp: block.timestamp });
+                }
+            }
+            catch (err) {
+                console.warn(`[XMR scanner] getBlockTxHashes failed for height ${block.height}:`, err.message);
+            }
+        }
+        console.log(`[XMR scanner] collected ${allTxHashes.length} tx hashes from ${blocksWithTxs.length} blocks`);
+        // Step 3: Fetch and process transactions in small batches (process-as-you-go to limit memory)
+        const TX_BATCH = 25;
+        let processedTxs = 0;
+        console.log(`[XMR scanner] processing ${allTxHashes.length} txs in batches of ${TX_BATCH}...`);
+        for (let t = 0; t < allTxHashes.length; t += TX_BATCH) {
+            const slice = allTxHashes.slice(t, t + TX_BATCH);
+            try {
+                const decodedTxs = yield getTransactionsDecoded(daemonUrl, slice);
+                const result = processTransactions(decodedTxs, privViewKey, pubSpendKey, privSpendKey, heightMap);
+                allOwnedOutputs.push(...result.ownedOutputs);
+                for (const ki of result.spentKeyImages)
+                    allSpentKeyImages.add(ki);
+                processedTxs += decodedTxs.length;
+            }
+            catch (err) {
+                console.error(`[XMR scanner] getTransactionsDecoded failed (batch ${t}):`, err.message);
+            }
+            if (onProgress) {
+                const progress = Math.min(t + TX_BATCH, allTxHashes.length) / allTxHashes.length;
+                onProgress({
+                    currentHeight: fromHeight + Math.floor(progress * (toHeight - fromHeight)),
+                    totalHeight: toHeight,
+                    outputsFound: allOwnedOutputs.length,
+                });
+            }
+        }
+        console.log(`[XMR scanner] processed ${processedTxs} txs, found ${allOwnedOutputs.length} owned outputs`);
+        return { ownedOutputs: allOwnedOutputs, spentKeyImages: allSpentKeyImages };
+    });
+}
+/**
+ * Compute balance from scan results.
+ * Balance = sum of owned outputs whose key images are NOT in the spent set.
+ */
+function computeBalance(ownedOutputs, spentKeyImages) {
+    let balance = BigInt(0);
+    for (const out of ownedOutputs) {
+        if (!spentKeyImages.has(out.keyImage)) {
+            balance += out.amount;
+        }
+    }
+    return balance;
+}
+/**
+ * Get unspent outputs from scan results.
+ */
+function getUnspentOutputs(ownedOutputs, spentKeyImages) {
+    return ownedOutputs.filter((out) => !spentKeyImages.has(out.keyImage));
+}
+
+class Client extends xchainClient.BaseXChainClient {
+    constructor(params = defaultXMRParams) {
+        var _a, _b, _c, _d;
+        super(XMRChain, Object.assign(Object.assign({}, defaultXMRParams), params));
+        this.lwsLoggedIn = false;
+        /** Cached scan state for daemon fallback */
+        this.scanCache = null;
+        this.explorerProviders = (_a = params.explorerProviders) !== null && _a !== void 0 ? _a : defaultXMRParams.explorerProviders;
+        this.daemonUrls = (_b = params.daemonUrls) !== null && _b !== void 0 ? _b : defaultXMRParams.daemonUrls;
+        this.lwsUrls = (_c = params.lwsUrls) !== null && _c !== void 0 ? _c : defaultXMRParams.lwsUrls;
+        this.restoreHeight = (_d = params.restoreHeight) !== null && _d !== void 0 ? _d : 0;
+    }
+    getAssetInfo() {
+        return {
+            asset: AssetXMR,
+            decimal: XMR_DECIMALS,
+        };
+    }
+    getExplorerUrl() {
+        return this.explorerProviders[this.getNetwork()].getExplorerUrl();
+    }
+    getExplorerAddressUrl(address) {
+        return this.explorerProviders[this.getNetwork()].getExplorerAddressUrl(address);
+    }
+    getExplorerTxUrl(txID) {
+        return this.explorerProviders[this.getNetwork()].getExplorerTxUrl(txID);
+    }
+    getFullDerivationPath(walletIndex) {
+        if (!this.rootDerivationPaths) {
+            throw Error('Can not generate derivation path due to root derivation path is undefined');
+        }
+        return `${this.rootDerivationPaths[this.getNetwork()]}${walletIndex}'`;
+    }
+    /**
+     * Get the current address asynchronously.
+     * Derives keys from mnemonic and encodes as Monero address (pure JS, no WASM).
+     */
+    getAddressAsync(index) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const spendKey = this.getPrivateSpendKey(index !== null && index !== void 0 ? index : 0);
+            const keys = deriveKeyPairs(spendKey);
+            const networkType = getMoneroNetworkType(this.getNetwork());
+            return encodeAddress(keys.publicSpendKey, keys.publicViewKey, networkType);
+        });
+    }
+    /**
+     * @deprecated Use getAddressAsync instead
+     */
+    getAddress() {
+        throw Error('Sync method not supported');
+    }
+    validateAddress(address) {
+        return validateMoneroAddress(address);
+    }
+    /**
+     * Get balance via LWS, falling back to daemon scanning if LWS is unavailable.
+     */
+    getBalance(address) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Try LWS first
+            const urls = this.lwsUrls[this.getNetwork()];
+            if (urls && urls.length > 0) {
+                const viewKeyHex = this.getViewKeyHex(0);
+                for (const url of urls) {
+                    try {
+                        if (!this.lwsLoggedIn) {
+                            yield login(url, address, viewKeyHex);
+                            this.lwsLoggedIn = true;
+                        }
+                        const info = yield getAddressInfo(url, address, viewKeyHex);
+                        const received = BigInt(info.total_received);
+                        const sent = BigInt(info.total_sent);
+                        const balance = received - sent;
+                        return [{ asset: AssetXMR, amount: xchainUtil.baseAmount(balance.toString(), XMR_DECIMALS) }];
+                    }
+                    catch (error) {
+                        console.warn(`LWS ${url} failed for getBalance:`, error.message);
+                        this.lwsLoggedIn = false;
+                        continue;
+                    }
+                }
+            }
+            // Fallback: daemon scanning
+            console.warn('LWS unavailable, falling back to daemon scanning (this may be slow)');
+            const scanResult = yield this.daemonScan();
+            const balance = computeBalance(scanResult.ownedOutputs, scanResult.spentKeyImages);
+            return [{ asset: AssetXMR, amount: xchainUtil.baseAmount(balance.toString(), XMR_DECIMALS) }];
+        });
+    }
+    /**
+     * Get transaction fees via daemon RPC.
+     */
+    getFees() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const urls = this.daemonUrls[this.getNetwork()];
+            for (const url of urls) {
+                try {
+                    const feeEstimate = yield getFeeEstimate(url);
+                    const fee = xchainUtil.baseAmount(feeEstimate.toString(), XMR_DECIMALS);
+                    return {
+                        type: xchainClient.FeeType.FlatFee,
+                        [xchainClient.FeeOption.Average]: fee,
+                        [xchainClient.FeeOption.Fast]: fee,
+                        [xchainClient.FeeOption.Fastest]: fee,
+                    };
+                }
+                catch (error) {
+                    console.warn(`Daemon ${url} failed for getFees:`, error.message);
+                    continue;
+                }
+            }
+            throw Error('No daemon able to get fees');
+        });
+    }
+    /**
+     * Get transaction details by hash via daemon RPC.
+     */
+    getTransactionData(txId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const urls = this.daemonUrls[this.getNetwork()];
+            for (const url of urls) {
+                try {
+                    const txs = yield getTransactions(url, [txId]);
+                    if (!txs.length)
+                        throw Error('Transaction not found');
+                    const tx = txs[0];
+                    return {
+                        asset: AssetXMR,
+                        date: new Date(tx.block_timestamp * 1000),
+                        type: xchainClient.TxType.Transfer,
+                        hash: tx.tx_hash,
+                        from: [],
+                        to: [],
+                    };
+                }
+                catch (error) {
+                    console.warn(`Daemon ${url} failed for getTransactionData:`, error.message);
+                    continue;
+                }
+            }
+            throw Error('No daemon able to get transaction data');
+        });
+    }
+    /**
+     * Get transaction history via LWS, falling back to daemon scanning.
+     * Due to Monero privacy, counterparty addresses are unavailable;
+     * the own address is used with net amount for from/to.
+     */
+    getTransactions(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const address = (params === null || params === void 0 ? void 0 : params.address) || (yield this.getAddressAsync(0));
+            const offset = (_a = params === null || params === void 0 ? void 0 : params.offset) !== null && _a !== void 0 ? _a : 0;
+            const limit = (_b = params === null || params === void 0 ? void 0 : params.limit) !== null && _b !== void 0 ? _b : 10;
+            // Try LWS first
+            const urls = this.lwsUrls[this.getNetwork()];
+            if (urls && urls.length > 0) {
+                const viewKeyHex = this.getViewKeyHex(0);
+                for (const url of urls) {
+                    try {
+                        if (!this.lwsLoggedIn) {
+                            yield login(url, address, viewKeyHex);
+                            this.lwsLoggedIn = true;
+                        }
+                        const result = yield getAddressTxs(url, address, viewKeyHex);
+                        const confirmedTxs = ((_c = result.transactions) !== null && _c !== void 0 ? _c : [])
+                            .filter((tx) => !tx.mempool && tx.height > 0)
+                            .sort((a, b) => b.height - a.height);
+                        const paginated = confirmedTxs.slice(offset, offset + limit);
+                        const txs = paginated.map((tx) => {
+                            const received = BigInt(tx.total_received);
+                            const sent = BigInt(tx.total_sent);
+                            const netAmount = received - sent;
+                            const isIncoming = netAmount > BigInt(0);
+                            return {
+                                asset: AssetXMR,
+                                date: new Date(tx.timestamp),
+                                type: xchainClient.TxType.Transfer,
+                                hash: tx.hash,
+                                from: isIncoming
+                                    ? []
+                                    : [{ from: address, amount: xchainUtil.baseAmount((BigInt(-1) * netAmount).toString(), XMR_DECIMALS) }],
+                                to: isIncoming ? [{ to: address, amount: xchainUtil.baseAmount(netAmount.toString(), XMR_DECIMALS) }] : [],
+                            };
+                        });
+                        return { total: confirmedTxs.length, txs };
+                    }
+                    catch (error) {
+                        console.warn(`LWS ${url} failed for getTransactions:`, error.message);
+                        this.lwsLoggedIn = false;
+                        continue;
+                    }
+                }
+            }
+            // Fallback: daemon scanning
+            console.warn('LWS unavailable, falling back to daemon scanning for tx history');
+            const scanResult = yield this.daemonScan();
+            const allOutputs = scanResult.ownedOutputs.sort((a, b) => b.height - a.height);
+            const paginated = allOutputs.slice(offset, offset + limit);
+            const txs = paginated.map((out) => ({
+                asset: AssetXMR,
+                date: new Date(out.timestamp * 1000),
+                type: xchainClient.TxType.Transfer,
+                hash: out.txHash,
+                from: [],
+                to: [{ to: address, amount: xchainUtil.baseAmount(out.amount.toString(), XMR_DECIMALS) }],
+            }));
+            return { total: allOutputs.length, txs };
+        });
+    }
+    /**
+     * Transfer XMR to a recipient address.
+     * Builds a complete RingCT transaction with CLSAG signatures and Bulletproofs+ range proof.
+     */
+    transfer(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const { recipient, amount } = params;
+            if (!recipient)
+                throw new Error('Recipient address is required');
+            if (!amount)
+                throw new Error('Amount is required');
+            const recipientKeys = decodeAddress(recipient);
+            const spendKey = this.getPrivateSpendKey((_a = params.walletIndex) !== null && _a !== void 0 ? _a : 0);
+            const keys = deriveKeyPairs(spendKey);
+            // Get daemon URL
+            const daemonUrls = this.daemonUrls[this.getNetwork()];
+            if (!daemonUrls || daemonUrls.length === 0)
+                throw new Error('No daemon URLs configured');
+            const daemonUrl = daemonUrls[0];
+            // Get LWS URL for unspent outputs
+            const lwsUrls = this.lwsUrls[this.getNetwork()];
+            if (!lwsUrls || lwsUrls.length === 0)
+                throw new Error('No LWS URLs configured');
+            const address = yield this.getAddressAsync((_b = params.walletIndex) !== null && _b !== void 0 ? _b : 0);
+            const viewKeyHex = this.getViewKeyHex((_c = params.walletIndex) !== null && _c !== void 0 ? _c : 0);
+            if (!this.lwsLoggedIn) {
+                yield login(lwsUrls[0], address, viewKeyHex);
+                this.lwsLoggedIn = true;
+            }
+            // Get unspent outputs
+            const unspent = yield getUnspentOuts(lwsUrls[0], address, viewKeyHex, amount.amount().toString());
+            // Convert LWS outputs to SpendableOutput format
+            const amountPiconero = BigInt(amount.amount().toString());
+            const fee = BigInt(unspent.per_byte_fee) * BigInt(3000); // approximate tx size * per byte fee
+            // Select inputs to cover amount + fee
+            const spendableOutputs = [];
+            let selectedTotal = BigInt(0);
+            const needed = amountPiconero + fee;
+            for (const out of unspent.outputs) {
+                if (selectedTotal >= needed)
+                    break;
+                const outAmount = BigInt(out.amount);
+                // Parse rct field: first 64 chars = commitment, next 64 = mask
+                if (out.rct.length < 128) {
+                    console.warn(`Skipping output ${out.global_index}: invalid rct data (length ${out.rct.length})`);
+                    continue;
+                }
+                const rctMask = hexToBytes(out.rct.substring(64, 128));
+                spendableOutputs.push({
+                    globalIndex: out.global_index,
+                    amount: outAmount,
+                    mask: rctMask,
+                    txPubKey: hexToBytes(out.tx_pub_key),
+                    outputIndex: out.index,
+                    publicKey: hexToBytes(out.public_key),
+                });
+                selectedTotal += outAmount;
+            }
+            if (selectedTotal < needed) {
+                throw new Error(`Insufficient funds: have ${selectedTotal}, need ${needed}`);
+            }
+            const destinations = [
+                {
+                    pubViewKey: recipientKeys.publicViewKey,
+                    pubSpendKey: recipientKeys.publicSpendKey,
+                    amount: amountPiconero,
+                },
+            ];
+            const changeKeys = {
+                pubViewKey: keys.publicViewKey,
+                pubSpendKey: keys.publicSpendKey,
+            };
+            const built = yield buildTransaction(spendableOutputs, destinations, changeKeys, fee, keys.privateViewKey, spendKey, daemonUrl);
+            // Broadcast
+            yield this.broadcastTx(built.txHex);
+            return built.txHash;
+        });
+    }
+    /**
+     * Broadcast a signed transaction hex to the network.
+     * Note: The returned hash is keccak256 of the raw tx blob, which differs from
+     * the canonical Monero txid (three-hash construction). Use transfer() for the correct txid.
+     */
+    broadcastTx(txHex) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const urls = this.daemonUrls[this.getNetwork()];
+            for (const url of urls) {
+                try {
+                    yield sendRawTransaction(url, txHex);
+                    const txBytes = hexToBytes(txHex);
+                    return bytesToHex(sha3.keccak_256(txBytes));
+                }
+                catch (error) {
+                    console.warn(`Daemon ${url} failed for broadcastTx:`, error.message);
+                    continue;
+                }
+            }
+            throw Error('No daemon able to broadcast transaction');
+        });
+    }
+    /**
+     * Prepare an unsigned transaction.
+     * Monero transactions require private key context for ring signature
+     * construction, so this method is not supported.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    prepareTx(_params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            throw Error('prepareTx is not supported for Monero. Use transfer() instead.');
+        });
+    }
+    /**
+     * Get the private view key hex for a wallet index.
+     */
+    getViewKeyHex(index) {
+        const spendKey = this.getPrivateSpendKey(index);
+        const keys = deriveKeyPairs(spendKey);
+        return bytesToHex(keys.privateViewKey);
+    }
+    /**
+     * Derives private spend key from BIP-39 mnemonic via SLIP-10 derivation.
+     */
+    getPrivateSpendKey(index) {
+        if (!this.phrase)
+            throw new Error('Phrase must be provided');
+        const seed = xchainCrypto.getSeed(this.phrase);
+        const hd = slip10__default.default.fromMasterSeed(seed);
+        const derivedKey = hd.derive(this.getFullDerivationPath(index)).privateKey;
+        return scReduce32(derivedKey);
+    }
+    /**
+     * Scan the blockchain via daemon RPC to find owned outputs.
+     * Uses cached results and scans incrementally from the last scanned height.
+     */
+    daemonScan() {
+        return __awaiter(this, arguments, void 0, function* (walletIndex = 0) {
+            const daemonUrls = this.daemonUrls[this.getNetwork()];
+            if (!daemonUrls || daemonUrls.length === 0) {
+                throw new Error('No daemon URLs configured');
+            }
+            const daemonUrl = daemonUrls[0];
+            const currentHeight = yield getHeight(daemonUrl);
+            const fromHeight = this.scanCache ? this.scanCache.lastHeight + 1 : this.restoreHeight;
+            if (fromHeight >= currentHeight && this.scanCache) {
+                return this.scanCache;
+            }
+            const spendKey = this.getPrivateSpendKey(walletIndex);
+            const keys = deriveKeyPairs(spendKey);
+            const result = yield scanBlocks(daemonUrl, keys.privateViewKey, keys.publicSpendKey, spendKey, fromHeight, currentHeight - 1);
+            // Merge with cached results
+            const ownedOutputs = this.scanCache ? [...this.scanCache.ownedOutputs, ...result.ownedOutputs] : result.ownedOutputs;
+            const spentKeyImages = this.scanCache
+                ? new Set([...this.scanCache.spentKeyImages, ...result.spentKeyImages])
+                : result.spentKeyImages;
+            this.scanCache = {
+                lastHeight: currentHeight - 1,
+                ownedOutputs,
+                spentKeyImages,
+            };
+            return this.scanCache;
+        });
+    }
+}
+
+exports.AssetXMR = AssetXMR;
+exports.Client = Client;
+exports.XMRChain = XMRChain;
+exports.XMR_DECIMALS = XMR_DECIMALS;
+exports.computeBalance = computeBalance;
+exports.defaultXMRParams = defaultXMRParams;
+exports.getUnspentOutputs = getUnspentOutputs;
+exports.scanBlocks = scanBlocks;