jevonearth · Apr 11, 2026 · Apr 11, 2026 · Apr 11, 2026 · Apr 11, 2026
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 ECAD Labs Inc.
+Copyright (c) Papers.ch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 
 [![npm](https://img.shields.io/npm/v/@taquito/sapling-wasm.svg?colorB=brightgreen)](https://www.npmjs.com/package/@taquito/sapling-wasm)
 
-Sapling Wasm bindings around [Zcash Rust crates](https://github.com/zcash/librustzcash), maintained in the Taquito npm namespace from the ECAD fork.
+Sapling Wasm bindings around [Zcash Rust crates](https://github.com/zcash/librustzcash), maintained in the Taquito npm namespace from the ECAD-managed fork of [airgap-it/airgap-sapling](https://github.com/airgap-it/airgap-sapling).
 
 ## Project Overview
 
@@ -12,6 +12,12 @@ The project is divided into the following packages:
 
 The published npm package is `@taquito/sapling-wasm`. Repository ownership and maintenance live in the ECAD-managed fork at `ecadlabs/sapling-wasm`.
 
+This repository was forked from the work of the AirGap team. We are grateful to the people behind `airgap-it/airgap-sapling` for the original implementation and foundation.
+
+Stable releases are published from GitHub Actions with npm provenance enabled. The bootstrap prerelease `0.1.0-alpha.0` was created manually so the package could be registered and connected to npm trusted publishing.
+
+The repository is distributed under the MIT license. See [LICENSE](./LICENSE).
+
 ## Sapling Wasm
 
 ### Install

diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+We currently provide security fixes for the latest `@taquito/sapling-wasm` release line.
+
+| Release Line | Supported          |
+| ------------ | ------------------ |
+| 0.1.x        | :white_check_mark: |
+| < 0.1.0      | :x:                |
+
+Current supported Node.js runtimes for this repository are:
+
+| Node.js | Supported          |
+| ------- | ------------------ |
+| 24.x    | :white_check_mark: |
+| 22.x    | :white_check_mark: |
+| < 22    | :x:                |
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities in public GitHub issues, discussions, or pull requests.
+
+Private vulnerability reporting is enabled on GitHub for this repository and is the preferred reporting channel:
+
+1. Go to the repository [Security](https://github.com/ecadlabs/sapling-wasm/security) page.
+2. Open the advisories section.
+3. Use **Report a vulnerability** to send the report privately.
+
+If GitHub private reporting is not suitable for your case, email [security@ecadlabs.com](mailto:security@ecadlabs.com).
+
+When possible, include:
+
+- A clear description of the issue and impacted package surface or workflow.
+- Steps to reproduce the problem or a proof of concept.
+- The affected `@taquito/sapling-wasm` version and Node.js version.
+- Any suggested mitigations or fixes you are aware of.
+
+We will review the report, acknowledge receipt, and coordinate remediation privately.
diff --git a/package.json b/package.json
@@ -4,6 +4,7 @@
   "description": "Sapling Wasm workspace for Taquito and compatible consumers.",
   "private": true,
   "author": "ECAD Labs Inc <info@ecadlabs.com>",
+  "license": "MIT",
   "contributors": [
     "Papers.ch <contact@papers.ch>",
     "Jev Bjorsell <jev@ecadlabs.com>"
@@ -26,9 +27,11 @@
   "scripts": {
     "clean": "rimraf node_modules packages/sapling-wasm/node_modules packages/sapling-wasm/dist packages/sapling-wasm/pkg",
     "build": "npm run -w @taquito/sapling-wasm build",
-    "test": "node --test tests/*.test.mjs && cargo test --manifest-path packages/sapling/Cargo.toml",
-    "test:repo": "node --test tests/*.test.mjs",
-    "test:rust": "cargo test --manifest-path packages/sapling/Cargo.toml",
+    "test": "npm run test:repo && npm run test:rust",
+    "test:repo": "npm run build && node --test tests/*.test.mjs",
+    "test:rust": "cargo test --manifest-path packages/sapling/Cargo.toml && npm run test:rust:warnings && npm run test:rust:wasm-warnings",
+    "test:rust:warnings": "RUSTFLAGS='-D warnings' cargo test --manifest-path packages/sapling/Cargo.toml --quiet",
+    "test:rust:wasm-warnings": "RUSTFLAGS='-D warnings' cargo check --manifest-path packages/sapling/Cargo.toml --features wasm_bindings --quiet",
     "version:check": "node scripts/sync-workspace-version.js --check",
     "version:sync": "node scripts/sync-workspace-version.js"
   },

diff --git a/packages/sapling-wasm/LICENSE b/packages/sapling-wasm/LICENSE
@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 ECAD Labs Inc.
+Copyright (c) Papers.ch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/packages/sapling-wasm/package.json b/packages/sapling-wasm/package.json
@@ -3,6 +3,7 @@
   "version": "0.1.0",
   "description": "Sapling Wasm bindings for Taquito and compatible consumers.",
   "author": "ECAD Labs Inc <info@ecadlabs.com>",
+  "license": "MIT",
   "homepage": "https://github.com/ecadlabs/sapling-wasm",
   "repository": {
     "type": "git",

diff --git a/packages/sapling/LICENSE b/packages/sapling/LICENSE
@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 ECAD Labs Inc.
+Copyright (c) Papers.ch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/packages/sapling/src/address/errors.rs b/packages/sapling/src/address/errors.rs
@@ -15,7 +15,9 @@ impl DetailedError for SaplingAddressError {
 
         match self {
             DiversifierSpaceExhausted => String::from("diversifier space is exhausted"),
-            InvalidAddressLength(len) => format!("invalid address length, expected 43, got {}", len),
+            InvalidAddressLength(len) => {
+                format!("invalid address length, expected 43, got {}", len)
+            }
             SerializationFailed(err) => err.to_string(),
         }
     }
@@ -28,8 +30,10 @@ impl PartialEq for SaplingAddressError {
         match (self, other) {
             (DiversifierSpaceExhausted, DiversifierSpaceExhausted) => true,
             (InvalidAddressLength(size), InvalidAddressLength(other_size)) => size == other_size,
-            (SerializationFailed(err), SerializationFailed(other_err)) => err.to_string() == other_err.to_string(),
-            _ => false
+            (SerializationFailed(err), SerializationFailed(other_err)) => {
+                err.to_string() == other_err.to_string()
+            }
+            _ => false,
         }
     }
 }
@@ -45,7 +49,9 @@ impl DetailedError for IndexedAddressError {
         use IndexedAddressError::*;
 
         match self {
-            InvalidAddressLength(len) => format!("invalid address length, expected 43, got {}", len),
+            InvalidAddressLength(len) => {
+                format!("invalid address length, expected 43, got {}", len)
+            }
             SerializationFailed(err) => err.to_string(),
         }
     }
@@ -57,8 +63,10 @@ impl PartialEq for IndexedAddressError {
 
         match (self, other) {
             (InvalidAddressLength(size), InvalidAddressLength(other_size)) => size == other_size,
-            (SerializationFailed(err), SerializationFailed(other_err)) => err.to_string() == other_err.to_string(),
-            _ => false
+            (SerializationFailed(err), SerializationFailed(other_err)) => {
+                err.to_string() == other_err.to_string()
+            }
+            _ => false,
         }
     }
-}
+}
diff --git a/packages/sapling/src/address/indexed_address.rs b/packages/sapling/src/address/indexed_address.rs
@@ -13,7 +13,10 @@ use crate::common::utils::assert_utils::assert_value_or_error;
 pub struct IndexedAddress(pub [u8; 11], pub PaymentAddress);
 
 impl IndexedAddress {
-    pub fn new(diversifier_index: DiversifierIndex, payment_address: PaymentAddress) -> IndexedAddress {
+    pub fn new(
+        diversifier_index: DiversifierIndex,
+        payment_address: PaymentAddress,
+    ) -> IndexedAddress {
         IndexedAddress(diversifier_index.0, payment_address)
     }
 }
@@ -33,7 +36,8 @@ impl Serializable<Vec<u8>, SaplingError> for IndexedAddress {
 
         let address = &self.1.serialize()?;
 
-        bytes.write_all(&self.0)
+        bytes
+            .write_all(&self.0)
             .and_then(|_| bytes.write_all(address))
             .map_err(IndexedAddressError::SerializationFailed)
             .map_err(SaplingError::caused_by)?;
@@ -45,4 +49,4 @@ impl Serializable<Vec<u8>, SaplingError> for IndexedAddress {
 fn assert_byte_length(bytes: &[u8]) -> Result<(), IndexedAddressError> {
     let len = bytes.len();
     assert_value_or_error(len == 43, IndexedAddressError::InvalidAddressLength(len))
-}
+}
diff --git a/packages/sapling/src/address/ivk_address.rs b/packages/sapling/src/address/ivk_address.rs
@@ -1,9 +1,15 @@
-use zcash_primitives::primitives::{PaymentAddress, Diversifier};
-use crate::common::errors::{SaplingError, CausedBy};
+use crate::common::errors::{CausedBy, SaplingError};
+use zcash_primitives::primitives::{Diversifier, PaymentAddress};
 
-pub fn get_ivk_address(ivk: jubjub::Scalar, diversifier: Diversifier) -> Result<PaymentAddress, SaplingError> {
-    let g_d = diversifier.g_d().ok_or_else(|| SaplingError::caused_by("invalid diversifier"))?;
+pub fn get_ivk_address(
+    ivk: jubjub::Scalar,
+    diversifier: Diversifier,
+) -> Result<PaymentAddress, SaplingError> {
+    let g_d = diversifier
+        .g_d()
+        .ok_or_else(|| SaplingError::caused_by("invalid diversifier"))?;
     let pk_d = g_d * ivk;
 
-    PaymentAddress::from_parts(diversifier, pk_d).ok_or_else(|| SaplingError::caused_by("invalid pk_d"))
-}
+    PaymentAddress::from_parts(diversifier, pk_d)
+        .ok_or_else(|| SaplingError::caused_by("invalid pk_d"))
+}
diff --git a/packages/sapling/src/address/mod.rs b/packages/sapling/src/address/mod.rs
@@ -1,13 +1,10 @@
-pub use errors::SaplingAddressError;
-pub use ivk_address::get_ivk_address;
-pub use xfvk_address::{
-    get_next_xfvk_address,
-    get_xfvk_address,
-};
+#[cfg(any(feature = "c_bindings", feature = "wasm_bindings"))]
+pub(crate) use ivk_address::get_ivk_address;
+#[cfg(any(feature = "c_bindings", feature = "wasm_bindings"))]
+pub(crate) use xfvk_address::{get_next_xfvk_address, get_xfvk_address};
 
-mod payment_address;
+mod errors;
 mod indexed_address;
 mod ivk_address;
+mod payment_address;
 mod xfvk_address;
-mod errors;
-
diff --git a/packages/sapling/src/address/payment_address.rs b/packages/sapling/src/address/payment_address.rs
@@ -24,4 +24,4 @@ impl Serializable<Vec<u8>, SaplingError> for PaymentAddress {
 fn assert_byte_length(bytes: &[u8]) -> Result<(), SaplingAddressError> {
     let len = bytes.len();
     assert_value_or_error(len == 43, SaplingAddressError::InvalidAddressLength(len))
-}
+}