@orbinum/sdk 0.14.1 → 0.16.0

package/dist/index.d.mts

@@ -664,6 +664,13 @@ type NoteInput = {
     counterpartyPk?: bigint;
     /** Circuit version to stamp on the note. Defaults to `CURRENT_CIRCUIT_VERSION`. */
     circuitVersion?: number;
+    /**
+     * 32-byte ephemeral secret for the memo ECDH. Self-notes pass a
+     * deterministic one (deriveSelfEphSk) so a cold restore recognizes them by
+     * ephPk equality with no trial ECDH. Ignored on the stealth path (it
+     * generates its own coordinated ephSk). Default: random.
+     */
+    ephSkOverride?: Uint8Array;
 };
 /**
  * Circuit version notes are created under today. A note carries its version
@@ -1920,11 +1927,17 @@ declare class NoteBuilder {
 /**
  * EncryptedMemo — TypeScript implementation of Orbinum's encrypted note memo.
  *
- * Mirrors primitives/encrypted-memo in the node repository; no WASM required.
+ * Native TypeScript implementation — no WASM required. This file IS the
+ * normative memo format: the chain treats memos as opaque 180-byte blobs.
  *
  * Layout (180 bytes, ECDH):
  *   nonce(12) || ciphertext+MAC(136) || ephPk_packed(32) = 180
  *
+ * View tag (memos built by SDK ≥ 0.15): nonce[0] = deriveViewTag(sharedSecret)
+ * — see memo.ts. Layout and size are unchanged; legacy memos carry a random
+ * byte there instead, so the filter is only sound at/after the wallet's
+ * tagActivationLeaf.
+ *
  * Plaintext layout (120 bytes):
  *   value_lo(8 LE) || value_hi(8 LE) || owner_pk(32) || blinding(32) || asset_id(4 LE) || counterparty_pk(32) || circuit_version(4 LE)
  *
@@ -2007,10 +2020,67 @@ declare const EncryptedMemo: {
      * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
      */
     extractSharedSecret(memoBytes: Uint8Array, viewingSecretKey: Uint8Array): Uint8Array | null;
+    /**
+     * Cheap view-tag check: does memo nonce[0] match the tag derived from
+     * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+     *
+     * Only meaningful for memos built with view tags (commitments at/after
+     * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+     * there and would false-negative 255/256 of the time.
+     */
+    checkViewTag(memoBytes: Uint8Array, sharedSecret: Uint8Array): boolean;
+    /**
+     * Decrypt with an already-computed shared secret (from
+     * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+     * fast scan path: ECDH once → tag check → decrypt only on match.
+     */
+    decryptWithSharedSecret(memoBytes: Uint8Array, commitment: Uint8Array, sharedSecret: Uint8Array): DecryptedMemo | null;
     /** @internal */
     _decrypt(memoBytes: Uint8Array, commitment: Uint8Array, viewingSecretKey: Uint8Array): DecryptedMemo | null;
 };
 
+/**
+ * Derive the 1-byte view tag (Monero-style fast-scan filter) from the ECDH
+ * shared secret:
+ *   view_tag = SHA256("orbinum-view-tag-v1" || sharedSecret)[0]
+ *
+ * The sender embeds it as the memo's first nonce byte (nonce[0]); a scanner
+ * that has computed the shared secret compares one byte and skips the AEAD
+ * decrypt on mismatch — 255/256 of foreign notes. Safe to publish: without
+ * the viewing key the shared secret is unknowable, so the byte reads as
+ * uniform noise to any observer.
+ *
+ * Nonce safety: the encryption key is unique per note (see
+ * deriveEncryptionKey), so each key encrypts exactly one message and the
+ * remaining 11 random nonce bytes are more than enough.
+ */
+declare function deriveViewTag(sharedSecret: Uint8Array): number;
+
+/**
+ * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
+ * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
+ */
+declare function deriveSelfEphSk(spendingKey: bigint, index: number): Uint8Array;
+/** One precomputed self-note window entry. */
+interface SelfEphWindowEntry {
+    index: number;
+    /** 0x-prefixed LE-packed ephPk — byte-identical to the memo's last 32 bytes. */
+    ephPkHex: string;
+    /** ECDH shared secret vs the wallet's own ivk — feeds decryptWithSharedSecret. */
+    sharedSecret: Uint8Array;
+}
+/**
+ * Precompute the self-note discovery window [from, from+count): for each
+ * index, the ephPk the wallet would have published and the shared secret
+ * needed to decrypt the memo. One EC pass up front; scanning then matches
+ * hints by ephPk hex equality with no per-hint EC work.
+ *
+ * @param spendingKey Wallet spending key (the seed of the derivation).
+ * @param ivkPacked   The wallet's OWN 32-byte LE packed viewing public key —
+ *                    self memos are encrypted to it.
+ */
+declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
+
 /**
  * NoteDecryptor
  *
@@ -2034,6 +2104,24 @@ declare const EncryptedMemo: {
  * deriveSpendingKeyFromSignature.
  */
 declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigint;
+interface TryDecryptOptions {
+    /**
+     * View-tag fast path: compute the ECDH shared secret once, compare the
+     * 1-byte tag in memo nonce[0], and skip the AEAD decrypt on mismatch
+     * (255/256 of foreign notes; `reason: 'view_tag_mismatch'`).
+     *
+     * Only enable for commitments at/after the wallet's tagActivationLeaf —
+     * legacy memos carry a random byte there and would be silently dropped.
+     */
+    viewTag?: boolean;
+    /**
+     * Precomputed ECDH shared secret (self-note discovery: the caller matched
+     * the hint's ephPk against a selfEphWindow and already holds the secret).
+     * Skips the ECDH and the view-tag gate entirely; the decrypt + commitment
+     * check still validate the note as usual.
+     */
+    sharedSecret?: Uint8Array;
+}
 /**
  * Attempt to decrypt an on-chain commitment using the recipient's viewing secret key.
  *
@@ -2047,13 +2135,14 @@ declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigi
  * @param spendingKey      Spending key bigint (for nullifier computation).
  * @param ownOwnerPk       The viewer's global BabyJubJub Ax (ownerPk). Required for stealth detection.
  *                         Pass 0n to disable stealth detection (legacy/own-note-only scanning).
+ * @param opts             See TryDecryptOptions (view-tag fast path).
  */
-declare function tryDecryptNote(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint): ZkNote | null;
+declare function tryDecryptNote(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint, opts?: TryDecryptOptions): ZkNote | null;
 /**
  * Like tryDecryptNote but also returns a human-readable reason for failure.
  * Useful for debugging scan issues (wrong key, corrupted memo, commitment mismatch).
  */
-declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint): {
+declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint, opts?: TryDecryptOptions): {
     note: ZkNote | null;
     reason?: string;
 };
@@ -4172,4 +4261,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.d.ts

@@ -664,6 +664,13 @@ type NoteInput = {
     counterpartyPk?: bigint;
     /** Circuit version to stamp on the note. Defaults to `CURRENT_CIRCUIT_VERSION`. */
     circuitVersion?: number;
+    /**
+     * 32-byte ephemeral secret for the memo ECDH. Self-notes pass a
+     * deterministic one (deriveSelfEphSk) so a cold restore recognizes them by
+     * ephPk equality with no trial ECDH. Ignored on the stealth path (it
+     * generates its own coordinated ephSk). Default: random.
+     */
+    ephSkOverride?: Uint8Array;
 };
 /**
  * Circuit version notes are created under today. A note carries its version
@@ -1920,11 +1927,17 @@ declare class NoteBuilder {
 /**
  * EncryptedMemo — TypeScript implementation of Orbinum's encrypted note memo.
  *
- * Mirrors primitives/encrypted-memo in the node repository; no WASM required.
+ * Native TypeScript implementation — no WASM required. This file IS the
+ * normative memo format: the chain treats memos as opaque 180-byte blobs.
  *
  * Layout (180 bytes, ECDH):
  *   nonce(12) || ciphertext+MAC(136) || ephPk_packed(32) = 180
  *
+ * View tag (memos built by SDK ≥ 0.15): nonce[0] = deriveViewTag(sharedSecret)
+ * — see memo.ts. Layout and size are unchanged; legacy memos carry a random
+ * byte there instead, so the filter is only sound at/after the wallet's
+ * tagActivationLeaf.
+ *
  * Plaintext layout (120 bytes):
  *   value_lo(8 LE) || value_hi(8 LE) || owner_pk(32) || blinding(32) || asset_id(4 LE) || counterparty_pk(32) || circuit_version(4 LE)
  *
@@ -2007,10 +2020,67 @@ declare const EncryptedMemo: {
      * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
      */
     extractSharedSecret(memoBytes: Uint8Array, viewingSecretKey: Uint8Array): Uint8Array | null;
+    /**
+     * Cheap view-tag check: does memo nonce[0] match the tag derived from
+     * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+     *
+     * Only meaningful for memos built with view tags (commitments at/after
+     * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+     * there and would false-negative 255/256 of the time.
+     */
+    checkViewTag(memoBytes: Uint8Array, sharedSecret: Uint8Array): boolean;
+    /**
+     * Decrypt with an already-computed shared secret (from
+     * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+     * fast scan path: ECDH once → tag check → decrypt only on match.
+     */
+    decryptWithSharedSecret(memoBytes: Uint8Array, commitment: Uint8Array, sharedSecret: Uint8Array): DecryptedMemo | null;
     /** @internal */
     _decrypt(memoBytes: Uint8Array, commitment: Uint8Array, viewingSecretKey: Uint8Array): DecryptedMemo | null;
 };
 
+/**
+ * Derive the 1-byte view tag (Monero-style fast-scan filter) from the ECDH
+ * shared secret:
+ *   view_tag = SHA256("orbinum-view-tag-v1" || sharedSecret)[0]
+ *
+ * The sender embeds it as the memo's first nonce byte (nonce[0]); a scanner
+ * that has computed the shared secret compares one byte and skips the AEAD
+ * decrypt on mismatch — 255/256 of foreign notes. Safe to publish: without
+ * the viewing key the shared secret is unknowable, so the byte reads as
+ * uniform noise to any observer.
+ *
+ * Nonce safety: the encryption key is unique per note (see
+ * deriveEncryptionKey), so each key encrypts exactly one message and the
+ * remaining 11 random nonce bytes are more than enough.
+ */
+declare function deriveViewTag(sharedSecret: Uint8Array): number;
+
+/**
+ * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
+ * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
+ */
+declare function deriveSelfEphSk(spendingKey: bigint, index: number): Uint8Array;
+/** One precomputed self-note window entry. */
+interface SelfEphWindowEntry {
+    index: number;
+    /** 0x-prefixed LE-packed ephPk — byte-identical to the memo's last 32 bytes. */
+    ephPkHex: string;
+    /** ECDH shared secret vs the wallet's own ivk — feeds decryptWithSharedSecret. */
+    sharedSecret: Uint8Array;
+}
+/**
+ * Precompute the self-note discovery window [from, from+count): for each
+ * index, the ephPk the wallet would have published and the shared secret
+ * needed to decrypt the memo. One EC pass up front; scanning then matches
+ * hints by ephPk hex equality with no per-hint EC work.
+ *
+ * @param spendingKey Wallet spending key (the seed of the derivation).
+ * @param ivkPacked   The wallet's OWN 32-byte LE packed viewing public key —
+ *                    self memos are encrypted to it.
+ */
+declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
+
 /**
  * NoteDecryptor
  *
@@ -2034,6 +2104,24 @@ declare const EncryptedMemo: {
  * deriveSpendingKeyFromSignature.
  */
 declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigint;
+interface TryDecryptOptions {
+    /**
+     * View-tag fast path: compute the ECDH shared secret once, compare the
+     * 1-byte tag in memo nonce[0], and skip the AEAD decrypt on mismatch
+     * (255/256 of foreign notes; `reason: 'view_tag_mismatch'`).
+     *
+     * Only enable for commitments at/after the wallet's tagActivationLeaf —
+     * legacy memos carry a random byte there and would be silently dropped.
+     */
+    viewTag?: boolean;
+    /**
+     * Precomputed ECDH shared secret (self-note discovery: the caller matched
+     * the hint's ephPk against a selfEphWindow and already holds the secret).
+     * Skips the ECDH and the view-tag gate entirely; the decrypt + commitment
+     * check still validate the note as usual.
+     */
+    sharedSecret?: Uint8Array;
+}
 /**
  * Attempt to decrypt an on-chain commitment using the recipient's viewing secret key.
  *
@@ -2047,13 +2135,14 @@ declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigi
  * @param spendingKey      Spending key bigint (for nullifier computation).
  * @param ownOwnerPk       The viewer's global BabyJubJub Ax (ownerPk). Required for stealth detection.
  *                         Pass 0n to disable stealth detection (legacy/own-note-only scanning).
+ * @param opts             See TryDecryptOptions (view-tag fast path).
  */
-declare function tryDecryptNote(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint): ZkNote | null;
+declare function tryDecryptNote(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint, opts?: TryDecryptOptions): ZkNote | null;
 /**
  * Like tryDecryptNote but also returns a human-readable reason for failure.
  * Useful for debugging scan issues (wrong key, corrupted memo, commitment mismatch).
  */
-declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint): {
+declare function tryDecryptNoteVerbose(commitment: ScanCommitment, viewingSecretKey: Uint8Array, spendingKey: bigint, ownOwnerPk?: bigint, opts?: TryDecryptOptions): {
     note: ZkNote | null;
     reason?: string;
 };
@@ -4172,4 +4261,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.js

@@ -73,12 +73,14 @@ __export(index_exports, {
   decryptNoteRecord: () => decryptNoteRecord,
   deriveMasterKeyBytes: () => deriveMasterKeyBytes,
   deriveOwnerPk: () => deriveOwnerPk,
+  deriveSelfEphSk: () => deriveSelfEphSk,
   deriveSpendingKeyFromSignature: () => deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage: () => deriveSpendingKeyMessage,
   deriveStealthOwnerPk: () => deriveStealthOwnerPk,
   deriveStealthSk: () => deriveStealthSk,
   deriveVaultBlindKey: () => deriveVaultBlindKey,
   deriveVaultKey: () => deriveVaultKey,
+  deriveViewTag: () => deriveViewTag,
   deriveViewingPublicKey: () => deriveViewingPublicKey,
   deriveViewingSecretKey: () => deriveViewingSecretKey,
   encryptJson: () => encryptJson,
@@ -116,6 +118,7 @@ __export(index_exports, {
   randomBlinding: () => randomBlinding,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   selectNotes: () => selectNotes,
+  selfEphWindow: () => selfEphWindow,
   shortHash: () => shortHash,
   substrateSs58ToAccountIdHex: () => substrateSs58ToAccountIdHex,
   substrateToEvm: () => substrateToEvm,
@@ -1207,6 +1210,32 @@ var import_chacha = require("@noble/ciphers/chacha.js");
 var import_utils = require("@noble/ciphers/utils.js");
 var import_baby_jubjub = require("@zk-kit/baby-jubjub");
 
+// src/utils/bjj-fast.ts
+var import_edwards = require("@noble/curves/abstract/edwards.js");
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = (0, import_edwards.edwards)({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
+
 // src/utils/bytes.ts
 function bigintTo32Le(n) {
   const buf = new Uint8Array(32);
@@ -1262,6 +1291,7 @@ var BABYJUB_SUBORDER = 273603035897990940278080071815715938607681397215856725920
 // src/shielded-pool/protocol/memo.ts
 var import_sha2 = require("@noble/hashes/sha2.js");
 var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
+var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
 var MEMO_PLAINTEXT_SIZE = 120;
 function serializeMemo(value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion) {
   const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
@@ -1282,6 +1312,12 @@ function deriveEncryptionKey(sharedSecret, commitment) {
   h.update(KEY_DOMAIN);
   return h.digest();
 }
+function deriveViewTag(sharedSecret) {
+  const h = import_sha2.sha256.create();
+  h.update(VIEW_TAG_DOMAIN);
+  h.update(sharedSecret);
+  return h.digest()[0];
+}
 
 // src/shielded-pool/protocol/EncryptedMemo.ts
 var NONCE_SIZE = 12;
@@ -1349,15 +1385,16 @@ var EncryptedMemo = {
       if (ephSkBytes.length !== 32)
         throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
       const ephSkScalar = bytesToBjjScalar(ephSkBytes);
-      const ephPkPoint = (0, import_baby_jubjub.mulPointEscalar)(import_baby_jubjub.Base8, ephSkScalar);
+      const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub.packPoint)(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
       const ivkPoint = (0, import_baby_jubjub.unpackPoint)(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
-      const sharedPoint = (0, import_baby_jubjub.mulPointEscalar)(ivkPoint, ephSkScalar);
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
       sharedSecret = bigintTo32Le(sharedPoint[0]);
     }
+    nonce[0] = deriveViewTag(sharedSecret);
     const encKey = deriveEncryptionKey(sharedSecret, commitment);
     const cipher = (0, import_chacha.chacha20poly1305)(encKey, nonce);
     const ciphertext = cipher.encrypt(plaintext);
@@ -1444,27 +1481,38 @@ var EncryptedMemo = {
     const ephPkPoint = (0, import_baby_jubjub.unpackPoint)(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-    const sharedPoint = (0, import_baby_jubjub.mulPointEscalar)(ephPkPoint, ivskScalar);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
     return bigintTo32Le(sharedPoint[0]);
   },
-  /** @internal */
-  _decrypt(memoBytes, commitment, viewingSecretKey) {
+  /**
+   * Cheap view-tag check: does memo nonce[0] match the tag derived from
+   * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+   *
+   * Only meaningful for memos built with view tags (commitments at/after
+   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+   * there and would false-negative 255/256 of the time.
+   */
+  checkViewTag(memoBytes, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
+    return memoBytes[0] === deriveViewTag(sharedSecret);
+  },
+  /**
+   * Decrypt with an already-computed shared secret (from
+   * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+   * fast scan path: ECDH once → tag check → decrypt only on match.
+   */
+  decryptWithSharedSecret(memoBytes, commitment, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
     const nonce = memoBytes.slice(0, NONCE_SIZE);
     const ciphertextWithMac = memoBytes.slice(NONCE_SIZE, NONCE_SIZE + CIPHERTEXT_SIZE);
-    const ephPkPackedBytes = memoBytes.slice(NONCE_SIZE + CIPHERTEXT_SIZE);
-    const ephPkPackedBigint = bytesToBigintLE(ephPkPackedBytes);
-    let sharedSecret;
-    if (ephPkPackedBigint === 0n) {
-      sharedSecret = new Uint8Array(32);
-    } else {
-      const ephPkPoint = (0, import_baby_jubjub.unpackPoint)(ephPkPackedBigint);
-      if (!ephPkPoint) return null;
-      const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-      const sharedPoint = (0, import_baby_jubjub.mulPointEscalar)(ephPkPoint, ivskScalar);
-      sharedSecret = bigintTo32Le(sharedPoint[0]);
-    }
     const encKey = deriveEncryptionKey(sharedSecret, commitment);
     return parsePlaintext(nonce, ciphertextWithMac, encKey);
+  },
+  /** @internal */
+  _decrypt(memoBytes, commitment, viewingSecretKey) {
+    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return null;
+    return EncryptedMemo.decryptWithSharedSecret(memoBytes, commitment, sharedSecret);
   }
 };
 
@@ -3814,7 +3862,8 @@ var NoteBuilder = class {
         commitmentBytes,
         input.viewingPublicKey,
         bigintTo32Le(counterpartyPk),
-        circuitVersion
+        circuitVersion,
+        input.ephSkOverride
       )
     ) : Array.from(EncryptedMemo.dummy());
     if (memo.length !== ENCRYPTED_MEMO_SIZE)
@@ -3864,15 +3913,45 @@ var NoteBuilder = class {
   }
 };
 
+// src/shielded-pool/protocol/selfEph.ts
+var import_sha23 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = import_sha23.sha256.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
 // src/shielded-pool/protocol/NoteDecryptor.ts
 var import_poseidon_lite2 = require("poseidon-lite");
 function computeNullifier(commitment, spendingKey) {
   return (0, import_poseidon_lite2.poseidon2)([commitment, spendingKey]);
 }
-function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n) {
-  return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk).note;
+function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
+  return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk, opts).note;
 }
-function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n) {
+function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
   if (!commitment.encryptedMemo) return { note: null, reason: "no_memo" };
   let commitmentBytes;
   let memoBytes;
@@ -3888,21 +3967,29 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
       reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
     };
   }
-  const plaintext = EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
+    sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
+      return { note: null, reason: "view_tag_mismatch" };
+    }
+  }
+  const plaintext = sharedSecret ? EncryptedMemo.decryptWithSharedSecret(memoBytes, commitmentBytes, sharedSecret) : EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
   if (!plaintext) return { note: null, reason: "decrypt_failed:wrong_key_or_corrupt_mac" };
   let effectiveOwnerPk = plaintext.ownerPk;
   let effectiveSpendingKey = spendingKey;
   if (ownOwnerPk !== 0n && plaintext.ownerPk !== ownOwnerPk) {
-    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
-    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    const ss = sharedSecret ?? EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!ss) return { note: null, reason: "stealth_shared_secret_failed" };
     const ownPkPoint = recoverOwnerPkPoint(ownOwnerPk);
     if (!ownPkPoint) return { note: null, reason: "stealth_invalid_own_owner_pk" };
-    const stealthOwnerPk = deriveStealthOwnerPk(sharedSecret, ownOwnerPk, ownPkPoint);
+    const stealthOwnerPk = deriveStealthOwnerPk(ss, ownOwnerPk, ownPkPoint);
     if (stealthOwnerPk !== plaintext.ownerPk) {
       return { note: null, reason: "commitment_mismatch" };
     }
     effectiveOwnerPk = stealthOwnerPk;
-    effectiveSpendingKey = deriveStealthSk(sharedSecret, ownOwnerPk, spendingKey);
+    effectiveSpendingKey = deriveStealthSk(ss, ownOwnerPk, spendingKey);
   }
   const recomputed = (0, import_poseidon_lite2.poseidon4)([
     plaintext.value,
@@ -4030,8 +4117,8 @@ function randomBlinding() {
 
 // src/privacy-keys/PrivacyKeys.ts
 var import_hkdf2 = require("@noble/hashes/hkdf.js");
-var import_sha23 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var import_sha24 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
 function deriveSpendingKeyMessage(chainId, address) {
   return `orbinum-spending-key-v1
@@ -4041,7 +4128,7 @@ ${address.toLowerCase()}`;
 async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const sigBytes = fromHex(signatureHex);
   const info = new TextEncoder().encode(`orbinum-sk-v1:${chainId}:${address.toLowerCase()}`);
-  return (0, import_hkdf2.hkdf)(import_sha23.sha256, sigBytes, new Uint8Array(0), info, 32);
+  return (0, import_hkdf2.hkdf)(import_sha24.sha256, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
@@ -4050,17 +4137,17 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return (0, import_hkdf2.hkdf)(import_sha23.sha256, ikm, void 0, IVK_DOMAIN, 32);
+  return (0, import_hkdf2.hkdf)(import_sha24.sha256, ikm, void 0, IVK_DOMAIN, 32);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
-  const ivkPoint = (0, import_baby_jubjub5.mulPointEscalar)(import_baby_jubjub5.Base8, ivskScalar);
-  const packed = (0, import_baby_jubjub5.packPoint)(ivkPoint);
+  const ivkPoint = (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, ivskScalar);
+  const packed = (0, import_baby_jubjub6.packPoint)(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
   try {
-    const pubPoint = (0, import_baby_jubjub5.mulPointEscalar)(import_baby_jubjub5.Base8, spendingKey);
+    const pubPoint = (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, spendingKey);
     return pubPoint[0];
   } catch {
     return 0n;
@@ -4369,7 +4456,7 @@ async function noteBlindTag(blindKey, hex) {
 // src/proof-generator/unshield.ts
 var import_proof_generator2 = require("@orbinum/proof-generator");
 var import_utils3 = require("@noble/ciphers/utils.js");
-var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
+var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
 var import_poseidon_lite4 = require("poseidon-lite");
 
 // src/proof-generator/merkle.ts
@@ -4392,7 +4479,7 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, inputs.spendingKey)[0];
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub7.mulPointEscalar)(import_baby_jubjub7.Base8, inputs.spendingKey)[0];
   const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils3.randomBytes)(32)) : 0n);
   const changeCommitment = changeValue > 0n ? (0, import_poseidon_lite4.poseidon4)([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
@@ -5297,12 +5384,14 @@ var import_polkadot_api4 = require("polkadot-api");
   decryptNoteRecord,
   deriveMasterKeyBytes,
   deriveOwnerPk,
+  deriveSelfEphSk,
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
   deriveVaultBlindKey,
   deriveVaultKey,
+  deriveViewTag,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
   encryptJson,
@@ -5340,6 +5429,7 @@ var import_polkadot_api4 = require("polkadot-api");
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,
+  selfEphWindow,
   shortHash,
   substrateSs58ToAccountIdHex,
   substrateToEvm,

package/dist/index.mjs

@@ -1074,7 +1074,33 @@ function resolveTx(unsafe, pallet, call) {
 // src/shielded-pool/protocol/EncryptedMemo.ts
 import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { randomBytes } from "@noble/ciphers/utils.js";
-import { mulPointEscalar, Base8, packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+import { packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+
+// src/utils/bjj-fast.ts
+import { edwards } from "@noble/curves/abstract/edwards.js";
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = edwards({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
 
 // src/utils/bytes.ts
 function bigintTo32Le(n) {
@@ -1131,6 +1157,7 @@ var BABYJUB_SUBORDER = 273603035897990940278080071815715938607681397215856725920
 // src/shielded-pool/protocol/memo.ts
 import { sha256 } from "@noble/hashes/sha2.js";
 var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
+var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
 var MEMO_PLAINTEXT_SIZE = 120;
 function serializeMemo(value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion) {
   const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
@@ -1151,6 +1178,12 @@ function deriveEncryptionKey(sharedSecret, commitment) {
   h.update(KEY_DOMAIN);
   return h.digest();
 }
+function deriveViewTag(sharedSecret) {
+  const h = sha256.create();
+  h.update(VIEW_TAG_DOMAIN);
+  h.update(sharedSecret);
+  return h.digest()[0];
+}
 
 // src/shielded-pool/protocol/EncryptedMemo.ts
 var NONCE_SIZE = 12;
@@ -1218,15 +1251,16 @@ var EncryptedMemo = {
       if (ephSkBytes.length !== 32)
         throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
       const ephSkScalar = bytesToBjjScalar(ephSkBytes);
-      const ephPkPoint = mulPointEscalar(Base8, ephSkScalar);
+      const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le(packPoint(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
       const ivkPoint = unpackPoint(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
-      const sharedPoint = mulPointEscalar(ivkPoint, ephSkScalar);
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
       sharedSecret = bigintTo32Le(sharedPoint[0]);
     }
+    nonce[0] = deriveViewTag(sharedSecret);
     const encKey = deriveEncryptionKey(sharedSecret, commitment);
     const cipher = chacha20poly1305(encKey, nonce);
     const ciphertext = cipher.encrypt(plaintext);
@@ -1313,27 +1347,38 @@ var EncryptedMemo = {
     const ephPkPoint = unpackPoint(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-    const sharedPoint = mulPointEscalar(ephPkPoint, ivskScalar);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
     return bigintTo32Le(sharedPoint[0]);
   },
-  /** @internal */
-  _decrypt(memoBytes, commitment, viewingSecretKey) {
+  /**
+   * Cheap view-tag check: does memo nonce[0] match the tag derived from
+   * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+   *
+   * Only meaningful for memos built with view tags (commitments at/after
+   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+   * there and would false-negative 255/256 of the time.
+   */
+  checkViewTag(memoBytes, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
+    return memoBytes[0] === deriveViewTag(sharedSecret);
+  },
+  /**
+   * Decrypt with an already-computed shared secret (from
+   * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+   * fast scan path: ECDH once → tag check → decrypt only on match.
+   */
+  decryptWithSharedSecret(memoBytes, commitment, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
     const nonce = memoBytes.slice(0, NONCE_SIZE);
     const ciphertextWithMac = memoBytes.slice(NONCE_SIZE, NONCE_SIZE + CIPHERTEXT_SIZE);
-    const ephPkPackedBytes = memoBytes.slice(NONCE_SIZE + CIPHERTEXT_SIZE);
-    const ephPkPackedBigint = bytesToBigintLE(ephPkPackedBytes);
-    let sharedSecret;
-    if (ephPkPackedBigint === 0n) {
-      sharedSecret = new Uint8Array(32);
-    } else {
-      const ephPkPoint = unpackPoint(ephPkPackedBigint);
-      if (!ephPkPoint) return null;
-      const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-      const sharedPoint = mulPointEscalar(ephPkPoint, ivskScalar);
-      sharedSecret = bigintTo32Le(sharedPoint[0]);
-    }
     const encKey = deriveEncryptionKey(sharedSecret, commitment);
     return parsePlaintext(nonce, ciphertextWithMac, encKey);
+  },
+  /** @internal */
+  _decrypt(memoBytes, commitment, viewingSecretKey) {
+    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return null;
+    return EncryptedMemo.decryptWithSharedSecret(memoBytes, commitment, sharedSecret);
   }
 };
 
@@ -3504,7 +3549,7 @@ var CURRENT_CIRCUIT_VERSION = 1;
 // src/utils/stealth.ts
 import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
-import { mulPointEscalar as mulPointEscalar2, Base8 as Base82, addPoint } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar, Base8, addPoint } from "@zk-kit/baby-jubjub";
 var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
 function deriveStealthScalar(sharedSecret, ownerPkBigint) {
   const salt = bigintTo32Le(ownerPkBigint);
@@ -3513,7 +3558,7 @@ function deriveStealthScalar(sharedSecret, ownerPkBigint) {
 }
 function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
   const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
-  const stealthPt = addPoint(mulPointEscalar2(Base82, stealthScalar), ownerPkPoint);
+  const stealthPt = addPoint(mulPointEscalar(Base8, stealthScalar), ownerPkPoint);
   return stealthPt[0];
 }
 function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
@@ -3522,7 +3567,7 @@ function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
 }
 
 // src/utils/bjj.ts
-import { mulPointEscalar as mulPointEscalar3 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar2 } from "@zk-kit/baby-jubjub";
 var BJJ_A = 168700n;
 var BJJ_D = 168696n;
 function _modpow(base, exp, mod) {
@@ -3577,7 +3622,7 @@ function recoverOwnerPkPoint(ax) {
   if (y === null) return null;
   const yAlt = BN254_R - y;
   try {
-    const check = mulPointEscalar3([ax, y], BABYJUB_SUBORDER);
+    const check = mulPointEscalar2([ax, y], BABYJUB_SUBORDER);
     return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
   } catch {
     return [ax, yAlt];
@@ -3585,7 +3630,7 @@ function recoverOwnerPkPoint(ax) {
 }
 
 // src/shielded-pool/protocol/NoteBuilder.ts
-import { mulPointEscalar as mulPointEscalar4, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar3, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
 import { randomBytes as randomBytes2 } from "@noble/ciphers/utils.js";
 import { poseidon2, poseidon4 } from "poseidon-lite";
 var NoteBuilder = class {
@@ -3621,7 +3666,7 @@ var NoteBuilder = class {
       if (!ivkPoint)
         throw new Error("NoteBuilder.build: invalid recipient viewing public key");
       const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
-      const sharedPoint = mulPointEscalar4(ivkPoint, ephSkScalar);
+      const sharedPoint = mulPointEscalar3(ivkPoint, ephSkScalar);
       const sharedSecret = bigintTo32Le(sharedPoint[0]);
       const recipientPkPoint = recoverOwnerPkPoint(recipientOwnerPk);
       if (!recipientPkPoint)
@@ -3686,7 +3731,8 @@ var NoteBuilder = class {
         commitmentBytes,
         input.viewingPublicKey,
         bigintTo32Le(counterpartyPk),
-        circuitVersion
+        circuitVersion,
+        input.ephSkOverride
       )
     ) : Array.from(EncryptedMemo.dummy());
     if (memo.length !== ENCRYPTED_MEMO_SIZE)
@@ -3736,15 +3782,45 @@ var NoteBuilder = class {
   }
 };
 
+// src/shielded-pool/protocol/selfEph.ts
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint2, unpackPoint as unpackPoint3 } from "@zk-kit/baby-jubjub";
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = sha2563.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = unpackPoint3(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le(packPoint2(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
 // src/shielded-pool/protocol/NoteDecryptor.ts
 import { poseidon2 as poseidon22, poseidon4 as poseidon42 } from "poseidon-lite";
 function computeNullifier(commitment, spendingKey) {
   return poseidon22([commitment, spendingKey]);
 }
-function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n) {
-  return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk).note;
+function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
+  return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk, opts).note;
 }
-function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n) {
+function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
   if (!commitment.encryptedMemo) return { note: null, reason: "no_memo" };
   let commitmentBytes;
   let memoBytes;
@@ -3760,21 +3836,29 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
       reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
     };
   }
-  const plaintext = EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
+    sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
+      return { note: null, reason: "view_tag_mismatch" };
+    }
+  }
+  const plaintext = sharedSecret ? EncryptedMemo.decryptWithSharedSecret(memoBytes, commitmentBytes, sharedSecret) : EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
   if (!plaintext) return { note: null, reason: "decrypt_failed:wrong_key_or_corrupt_mac" };
   let effectiveOwnerPk = plaintext.ownerPk;
   let effectiveSpendingKey = spendingKey;
   if (ownOwnerPk !== 0n && plaintext.ownerPk !== ownOwnerPk) {
-    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
-    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    const ss = sharedSecret ?? EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!ss) return { note: null, reason: "stealth_shared_secret_failed" };
     const ownPkPoint = recoverOwnerPkPoint(ownOwnerPk);
     if (!ownPkPoint) return { note: null, reason: "stealth_invalid_own_owner_pk" };
-    const stealthOwnerPk = deriveStealthOwnerPk(sharedSecret, ownOwnerPk, ownPkPoint);
+    const stealthOwnerPk = deriveStealthOwnerPk(ss, ownOwnerPk, ownPkPoint);
     if (stealthOwnerPk !== plaintext.ownerPk) {
       return { note: null, reason: "commitment_mismatch" };
     }
     effectiveOwnerPk = stealthOwnerPk;
-    effectiveSpendingKey = deriveStealthSk(sharedSecret, ownOwnerPk, spendingKey);
+    effectiveSpendingKey = deriveStealthSk(ss, ownOwnerPk, spendingKey);
   }
   const recomputed = poseidon42([
     plaintext.value,
@@ -3902,8 +3986,8 @@ function randomBlinding() {
 
 // src/privacy-keys/PrivacyKeys.ts
 import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
-import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
-import { mulPointEscalar as mulPointEscalar5, Base8 as Base83, packPoint as packPoint2 } from "@zk-kit/baby-jubjub";
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+import { mulPointEscalar as mulPointEscalar4, Base8 as Base82, packPoint as packPoint3 } from "@zk-kit/baby-jubjub";
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
 function deriveSpendingKeyMessage(chainId, address) {
   return `orbinum-spending-key-v1
@@ -3913,7 +3997,7 @@ ${address.toLowerCase()}`;
 async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const sigBytes = fromHex(signatureHex);
   const info = new TextEncoder().encode(`orbinum-sk-v1:${chainId}:${address.toLowerCase()}`);
-  return hkdf2(sha2563, sigBytes, new Uint8Array(0), info, 32);
+  return hkdf2(sha2564, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
@@ -3922,17 +4006,17 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return hkdf2(sha2563, ikm, void 0, IVK_DOMAIN, 32);
+  return hkdf2(sha2564, ikm, void 0, IVK_DOMAIN, 32);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
-  const ivkPoint = mulPointEscalar5(Base83, ivskScalar);
-  const packed = packPoint2(ivkPoint);
+  const ivkPoint = mulPointEscalar4(Base82, ivskScalar);
+  const packed = packPoint3(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
   try {
-    const pubPoint = mulPointEscalar5(Base83, spendingKey);
+    const pubPoint = mulPointEscalar4(Base82, spendingKey);
     return pubPoint[0];
   } catch {
     return 0n;
@@ -4245,7 +4329,7 @@ import {
   WebArtifactProvider as WebArtifactProvider2
 } from "@orbinum/proof-generator";
 import { randomBytes as randomBytes3 } from "@noble/ciphers/utils.js";
-import { mulPointEscalar as mulPointEscalar6, Base8 as Base84 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar5, Base8 as Base83 } from "@zk-kit/baby-jubjub";
 import { poseidon4 as poseidon44 } from "poseidon-lite";
 
 // src/proof-generator/merkle.ts
@@ -4268,7 +4352,7 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? mulPointEscalar6(Base84, inputs.spendingKey)[0];
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? mulPointEscalar5(Base83, inputs.spendingKey)[0];
   const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE(randomBytes3(32)) : 0n);
   const changeCommitment = changeValue > 0n ? poseidon44([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
@@ -5191,12 +5275,14 @@ export {
   decryptNoteRecord,
   deriveMasterKeyBytes,
   deriveOwnerPk,
+  deriveSelfEphSk,
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
   deriveVaultBlindKey,
   deriveVaultKey,
+  deriveViewTag,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
   encryptJson,
@@ -5234,6 +5320,7 @@ export {
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,
+  selfEphWindow,
   shortHash,
   substrateSs58ToAccountIdHex,
   substrateToEvm,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "0.14.1",
+  "version": "0.16.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",
@@ -46,6 +46,7 @@
   },
   "dependencies": {
     "@noble/ciphers": "2.2.0",
+    "@noble/curves": "^2.2.0",
     "@noble/hashes": "2.2.0",
     "@orbinum/proof-generator": "4.0.0",
     "@polkadot-api/metadata-builders": "0.14.2",