@orbinum/sdk 0.15.0 → 0.16.0

package/dist/index.d.mts

@@ -664,6 +664,13 @@ type NoteInput = {
     counterpartyPk?: bigint;
     /** Circuit version to stamp on the note. Defaults to `CURRENT_CIRCUIT_VERSION`. */
     circuitVersion?: number;
+    /**
+     * 32-byte ephemeral secret for the memo ECDH. Self-notes pass a
+     * deterministic one (deriveSelfEphSk) so a cold restore recognizes them by
+     * ephPk equality with no trial ECDH. Ignored on the stealth path (it
+     * generates its own coordinated ephSk). Default: random.
+     */
+    ephSkOverride?: Uint8Array;
 };
 /**
  * Circuit version notes are created under today. A note carries its version
@@ -1920,7 +1927,8 @@ declare class NoteBuilder {
 /**
  * EncryptedMemo — TypeScript implementation of Orbinum's encrypted note memo.
  *
- * Mirrors primitives/encrypted-memo in the node repository; no WASM required.
+ * Native TypeScript implementation — no WASM required. This file IS the
+ * normative memo format: the chain treats memos as opaque 180-byte blobs.
  *
  * Layout (180 bytes, ECDH):
  *   nonce(12) || ciphertext+MAC(136) || ephPk_packed(32) = 180
@@ -2048,6 +2056,31 @@ declare const EncryptedMemo: {
  */
 declare function deriveViewTag(sharedSecret: Uint8Array): number;
 
+/**
+ * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
+ * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
+ */
+declare function deriveSelfEphSk(spendingKey: bigint, index: number): Uint8Array;
+/** One precomputed self-note window entry. */
+interface SelfEphWindowEntry {
+    index: number;
+    /** 0x-prefixed LE-packed ephPk — byte-identical to the memo's last 32 bytes. */
+    ephPkHex: string;
+    /** ECDH shared secret vs the wallet's own ivk — feeds decryptWithSharedSecret. */
+    sharedSecret: Uint8Array;
+}
+/**
+ * Precompute the self-note discovery window [from, from+count): for each
+ * index, the ephPk the wallet would have published and the shared secret
+ * needed to decrypt the memo. One EC pass up front; scanning then matches
+ * hints by ephPk hex equality with no per-hint EC work.
+ *
+ * @param spendingKey Wallet spending key (the seed of the derivation).
+ * @param ivkPacked   The wallet's OWN 32-byte LE packed viewing public key —
+ *                    self memos are encrypted to it.
+ */
+declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
+
 /**
  * NoteDecryptor
  *
@@ -2081,6 +2114,13 @@ interface TryDecryptOptions {
      * legacy memos carry a random byte there and would be silently dropped.
      */
     viewTag?: boolean;
+    /**
+     * Precomputed ECDH shared secret (self-note discovery: the caller matched
+     * the hint's ephPk against a selfEphWindow and already holds the secret).
+     * Skips the ECDH and the view-tag gate entirely; the decrypt + commitment
+     * check still validate the note as usual.
+     */
+    sharedSecret?: Uint8Array;
 }
 /**
  * Attempt to decrypt an on-chain commitment using the recipient's viewing secret key.
@@ -4221,4 +4261,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.d.ts

@@ -664,6 +664,13 @@ type NoteInput = {
     counterpartyPk?: bigint;
     /** Circuit version to stamp on the note. Defaults to `CURRENT_CIRCUIT_VERSION`. */
     circuitVersion?: number;
+    /**
+     * 32-byte ephemeral secret for the memo ECDH. Self-notes pass a
+     * deterministic one (deriveSelfEphSk) so a cold restore recognizes them by
+     * ephPk equality with no trial ECDH. Ignored on the stealth path (it
+     * generates its own coordinated ephSk). Default: random.
+     */
+    ephSkOverride?: Uint8Array;
 };
 /**
  * Circuit version notes are created under today. A note carries its version
@@ -1920,7 +1927,8 @@ declare class NoteBuilder {
 /**
  * EncryptedMemo — TypeScript implementation of Orbinum's encrypted note memo.
  *
- * Mirrors primitives/encrypted-memo in the node repository; no WASM required.
+ * Native TypeScript implementation — no WASM required. This file IS the
+ * normative memo format: the chain treats memos as opaque 180-byte blobs.
  *
  * Layout (180 bytes, ECDH):
  *   nonce(12) || ciphertext+MAC(136) || ephPk_packed(32) = 180
@@ -2048,6 +2056,31 @@ declare const EncryptedMemo: {
  */
 declare function deriveViewTag(sharedSecret: Uint8Array): number;
 
+/**
+ * Derive the deterministic 32-byte ephemeral secret for self-note `index`.
+ * Feed it to EncryptedMemo.encrypt / NoteBuilder.build as `ephSkOverride`.
+ */
+declare function deriveSelfEphSk(spendingKey: bigint, index: number): Uint8Array;
+/** One precomputed self-note window entry. */
+interface SelfEphWindowEntry {
+    index: number;
+    /** 0x-prefixed LE-packed ephPk — byte-identical to the memo's last 32 bytes. */
+    ephPkHex: string;
+    /** ECDH shared secret vs the wallet's own ivk — feeds decryptWithSharedSecret. */
+    sharedSecret: Uint8Array;
+}
+/**
+ * Precompute the self-note discovery window [from, from+count): for each
+ * index, the ephPk the wallet would have published and the shared secret
+ * needed to decrypt the memo. One EC pass up front; scanning then matches
+ * hints by ephPk hex equality with no per-hint EC work.
+ *
+ * @param spendingKey Wallet spending key (the seed of the derivation).
+ * @param ivkPacked   The wallet's OWN 32-byte LE packed viewing public key —
+ *                    self memos are encrypted to it.
+ */
+declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from: number, count: number): SelfEphWindowEntry[];
+
 /**
  * NoteDecryptor
  *
@@ -2081,6 +2114,13 @@ interface TryDecryptOptions {
      * legacy memos carry a random byte there and would be silently dropped.
      */
     viewTag?: boolean;
+    /**
+     * Precomputed ECDH shared secret (self-note discovery: the caller matched
+     * the hint's ephPk against a selfEphWindow and already holds the secret).
+     * Skips the ECDH and the view-tag gate entirely; the decrypt + commitment
+     * check still validate the note as usual.
+     */
+    sharedSecret?: Uint8Array;
 }
 /**
  * Attempt to decrypt an on-chain commitment using the recipient's viewing secret key.
@@ -4221,4 +4261,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.js

@@ -73,6 +73,7 @@ __export(index_exports, {
   decryptNoteRecord: () => decryptNoteRecord,
   deriveMasterKeyBytes: () => deriveMasterKeyBytes,
   deriveOwnerPk: () => deriveOwnerPk,
+  deriveSelfEphSk: () => deriveSelfEphSk,
   deriveSpendingKeyFromSignature: () => deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage: () => deriveSpendingKeyMessage,
   deriveStealthOwnerPk: () => deriveStealthOwnerPk,
@@ -117,6 +118,7 @@ __export(index_exports, {
   randomBlinding: () => randomBlinding,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   selectNotes: () => selectNotes,
+  selfEphWindow: () => selfEphWindow,
   shortHash: () => shortHash,
   substrateSs58ToAccountIdHex: () => substrateSs58ToAccountIdHex,
   substrateToEvm: () => substrateToEvm,
@@ -1208,6 +1210,32 @@ var import_chacha = require("@noble/ciphers/chacha.js");
 var import_utils = require("@noble/ciphers/utils.js");
 var import_baby_jubjub = require("@zk-kit/baby-jubjub");
 
+// src/utils/bjj-fast.ts
+var import_edwards = require("@noble/curves/abstract/edwards.js");
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = (0, import_edwards.edwards)({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
+
 // src/utils/bytes.ts
 function bigintTo32Le(n) {
   const buf = new Uint8Array(32);
@@ -1357,13 +1385,13 @@ var EncryptedMemo = {
       if (ephSkBytes.length !== 32)
         throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
       const ephSkScalar = bytesToBjjScalar(ephSkBytes);
-      const ephPkPoint = (0, import_baby_jubjub.mulPointEscalar)(import_baby_jubjub.Base8, ephSkScalar);
+      const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub.packPoint)(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
       const ivkPoint = (0, import_baby_jubjub.unpackPoint)(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
-      const sharedPoint = (0, import_baby_jubjub.mulPointEscalar)(ivkPoint, ephSkScalar);
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
       sharedSecret = bigintTo32Le(sharedPoint[0]);
     }
     nonce[0] = deriveViewTag(sharedSecret);
@@ -1453,7 +1481,7 @@ var EncryptedMemo = {
     const ephPkPoint = (0, import_baby_jubjub.unpackPoint)(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-    const sharedPoint = (0, import_baby_jubjub.mulPointEscalar)(ephPkPoint, ivskScalar);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
     return bigintTo32Le(sharedPoint[0]);
   },
   /**
@@ -3834,7 +3862,8 @@ var NoteBuilder = class {
         commitmentBytes,
         input.viewingPublicKey,
         bigintTo32Le(counterpartyPk),
-        circuitVersion
+        circuitVersion,
+        input.ephSkOverride
       )
     ) : Array.from(EncryptedMemo.dummy());
     if (memo.length !== ENCRYPTED_MEMO_SIZE)
@@ -3884,6 +3913,36 @@ var NoteBuilder = class {
   }
 };
 
+// src/shielded-pool/protocol/selfEph.ts
+var import_sha23 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = import_sha23.sha256.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
 // src/shielded-pool/protocol/NoteDecryptor.ts
 var import_poseidon_lite2 = require("poseidon-lite");
 function computeNullifier(commitment, spendingKey) {
@@ -3908,8 +3967,8 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
       reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
     };
   }
-  let sharedSecret = null;
-  if (opts?.viewTag) {
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
     sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
     if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
     if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
@@ -4058,8 +4117,8 @@ function randomBlinding() {
 
 // src/privacy-keys/PrivacyKeys.ts
 var import_hkdf2 = require("@noble/hashes/hkdf.js");
-var import_sha23 = require("@noble/hashes/sha2.js");
-var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var import_sha24 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
 function deriveSpendingKeyMessage(chainId, address) {
   return `orbinum-spending-key-v1
@@ -4069,7 +4128,7 @@ ${address.toLowerCase()}`;
 async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const sigBytes = fromHex(signatureHex);
   const info = new TextEncoder().encode(`orbinum-sk-v1:${chainId}:${address.toLowerCase()}`);
-  return (0, import_hkdf2.hkdf)(import_sha23.sha256, sigBytes, new Uint8Array(0), info, 32);
+  return (0, import_hkdf2.hkdf)(import_sha24.sha256, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
@@ -4078,17 +4137,17 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return (0, import_hkdf2.hkdf)(import_sha23.sha256, ikm, void 0, IVK_DOMAIN, 32);
+  return (0, import_hkdf2.hkdf)(import_sha24.sha256, ikm, void 0, IVK_DOMAIN, 32);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
-  const ivkPoint = (0, import_baby_jubjub5.mulPointEscalar)(import_baby_jubjub5.Base8, ivskScalar);
-  const packed = (0, import_baby_jubjub5.packPoint)(ivkPoint);
+  const ivkPoint = (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, ivskScalar);
+  const packed = (0, import_baby_jubjub6.packPoint)(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
   try {
-    const pubPoint = (0, import_baby_jubjub5.mulPointEscalar)(import_baby_jubjub5.Base8, spendingKey);
+    const pubPoint = (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, spendingKey);
     return pubPoint[0];
   } catch {
     return 0n;
@@ -4397,7 +4456,7 @@ async function noteBlindTag(blindKey, hex) {
 // src/proof-generator/unshield.ts
 var import_proof_generator2 = require("@orbinum/proof-generator");
 var import_utils3 = require("@noble/ciphers/utils.js");
-var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
+var import_baby_jubjub7 = require("@zk-kit/baby-jubjub");
 var import_poseidon_lite4 = require("poseidon-lite");
 
 // src/proof-generator/merkle.ts
@@ -4420,7 +4479,7 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub6.mulPointEscalar)(import_baby_jubjub6.Base8, inputs.spendingKey)[0];
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? (0, import_baby_jubjub7.mulPointEscalar)(import_baby_jubjub7.Base8, inputs.spendingKey)[0];
   const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE((0, import_utils3.randomBytes)(32)) : 0n);
   const changeCommitment = changeValue > 0n ? (0, import_poseidon_lite4.poseidon4)([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
@@ -5325,6 +5384,7 @@ var import_polkadot_api4 = require("polkadot-api");
   decryptNoteRecord,
   deriveMasterKeyBytes,
   deriveOwnerPk,
+  deriveSelfEphSk,
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
@@ -5369,6 +5429,7 @@ var import_polkadot_api4 = require("polkadot-api");
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,
+  selfEphWindow,
   shortHash,
   substrateSs58ToAccountIdHex,
   substrateToEvm,

package/dist/index.mjs

@@ -1074,7 +1074,33 @@ function resolveTx(unsafe, pallet, call) {
 // src/shielded-pool/protocol/EncryptedMemo.ts
 import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
 import { randomBytes } from "@noble/ciphers/utils.js";
-import { mulPointEscalar, Base8, packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+import { packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+
+// src/utils/bjj-fast.ts
+import { edwards } from "@noble/curves/abstract/edwards.js";
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = edwards({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
 
 // src/utils/bytes.ts
 function bigintTo32Le(n) {
@@ -1225,13 +1251,13 @@ var EncryptedMemo = {
       if (ephSkBytes.length !== 32)
         throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
       const ephSkScalar = bytesToBjjScalar(ephSkBytes);
-      const ephPkPoint = mulPointEscalar(Base8, ephSkScalar);
+      const ephPkPoint = fastMulBase(ephSkScalar);
       ephPkPackedBytes = bigintTo32Le(packPoint(ephPkPoint));
       const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
       const ivkPoint = unpackPoint(ivkPackedBigint);
       if (!ivkPoint)
         throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
-      const sharedPoint = mulPointEscalar(ivkPoint, ephSkScalar);
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
       sharedSecret = bigintTo32Le(sharedPoint[0]);
     }
     nonce[0] = deriveViewTag(sharedSecret);
@@ -1321,7 +1347,7 @@ var EncryptedMemo = {
     const ephPkPoint = unpackPoint(ephPkPackedBigint);
     if (!ephPkPoint) return null;
     const ivskScalar = bytesToBjjScalar(viewingSecretKey);
-    const sharedPoint = mulPointEscalar(ephPkPoint, ivskScalar);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
     return bigintTo32Le(sharedPoint[0]);
   },
   /**
@@ -3523,7 +3549,7 @@ var CURRENT_CIRCUIT_VERSION = 1;
 // src/utils/stealth.ts
 import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 import { hkdf } from "@noble/hashes/hkdf.js";
-import { mulPointEscalar as mulPointEscalar2, Base8 as Base82, addPoint } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar, Base8, addPoint } from "@zk-kit/baby-jubjub";
 var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
 function deriveStealthScalar(sharedSecret, ownerPkBigint) {
   const salt = bigintTo32Le(ownerPkBigint);
@@ -3532,7 +3558,7 @@ function deriveStealthScalar(sharedSecret, ownerPkBigint) {
 }
 function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
   const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
-  const stealthPt = addPoint(mulPointEscalar2(Base82, stealthScalar), ownerPkPoint);
+  const stealthPt = addPoint(mulPointEscalar(Base8, stealthScalar), ownerPkPoint);
   return stealthPt[0];
 }
 function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
@@ -3541,7 +3567,7 @@ function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
 }
 
 // src/utils/bjj.ts
-import { mulPointEscalar as mulPointEscalar3 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar2 } from "@zk-kit/baby-jubjub";
 var BJJ_A = 168700n;
 var BJJ_D = 168696n;
 function _modpow(base, exp, mod) {
@@ -3596,7 +3622,7 @@ function recoverOwnerPkPoint(ax) {
   if (y === null) return null;
   const yAlt = BN254_R - y;
   try {
-    const check = mulPointEscalar3([ax, y], BABYJUB_SUBORDER);
+    const check = mulPointEscalar2([ax, y], BABYJUB_SUBORDER);
     return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
   } catch {
     return [ax, yAlt];
@@ -3604,7 +3630,7 @@ function recoverOwnerPkPoint(ax) {
 }
 
 // src/shielded-pool/protocol/NoteBuilder.ts
-import { mulPointEscalar as mulPointEscalar4, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar3, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
 import { randomBytes as randomBytes2 } from "@noble/ciphers/utils.js";
 import { poseidon2, poseidon4 } from "poseidon-lite";
 var NoteBuilder = class {
@@ -3640,7 +3666,7 @@ var NoteBuilder = class {
       if (!ivkPoint)
         throw new Error("NoteBuilder.build: invalid recipient viewing public key");
       const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
-      const sharedPoint = mulPointEscalar4(ivkPoint, ephSkScalar);
+      const sharedPoint = mulPointEscalar3(ivkPoint, ephSkScalar);
       const sharedSecret = bigintTo32Le(sharedPoint[0]);
       const recipientPkPoint = recoverOwnerPkPoint(recipientOwnerPk);
       if (!recipientPkPoint)
@@ -3705,7 +3731,8 @@ var NoteBuilder = class {
         commitmentBytes,
         input.viewingPublicKey,
         bigintTo32Le(counterpartyPk),
-        circuitVersion
+        circuitVersion,
+        input.ephSkOverride
       )
     ) : Array.from(EncryptedMemo.dummy());
     if (memo.length !== ENCRYPTED_MEMO_SIZE)
@@ -3755,6 +3782,36 @@ var NoteBuilder = class {
   }
 };
 
+// src/shielded-pool/protocol/selfEph.ts
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint2, unpackPoint as unpackPoint3 } from "@zk-kit/baby-jubjub";
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = sha2563.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = unpackPoint3(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le(packPoint2(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
 // src/shielded-pool/protocol/NoteDecryptor.ts
 import { poseidon2 as poseidon22, poseidon4 as poseidon42 } from "poseidon-lite";
 function computeNullifier(commitment, spendingKey) {
@@ -3779,8 +3836,8 @@ function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwn
       reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
     };
   }
-  let sharedSecret = null;
-  if (opts?.viewTag) {
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
     sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
     if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
     if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
@@ -3929,8 +3986,8 @@ function randomBlinding() {
 
 // src/privacy-keys/PrivacyKeys.ts
 import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
-import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
-import { mulPointEscalar as mulPointEscalar5, Base8 as Base83, packPoint as packPoint2 } from "@zk-kit/baby-jubjub";
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+import { mulPointEscalar as mulPointEscalar4, Base8 as Base82, packPoint as packPoint3 } from "@zk-kit/baby-jubjub";
 var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
 function deriveSpendingKeyMessage(chainId, address) {
   return `orbinum-spending-key-v1
@@ -3940,7 +3997,7 @@ ${address.toLowerCase()}`;
 async function deriveMasterKeyBytes(signatureHex, chainId, address) {
   const sigBytes = fromHex(signatureHex);
   const info = new TextEncoder().encode(`orbinum-sk-v1:${chainId}:${address.toLowerCase()}`);
-  return hkdf2(sha2563, sigBytes, new Uint8Array(0), info, 32);
+  return hkdf2(sha2564, sigBytes, new Uint8Array(0), info, 32);
 }
 async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
   const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
@@ -3949,17 +4006,17 @@ async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
 }
 function deriveViewingSecretKey(spendingKey) {
   const ikm = bigintTo32Le(spendingKey);
-  return hkdf2(sha2563, ikm, void 0, IVK_DOMAIN, 32);
+  return hkdf2(sha2564, ikm, void 0, IVK_DOMAIN, 32);
 }
 function deriveViewingPublicKey(ivsk) {
   const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
-  const ivkPoint = mulPointEscalar5(Base83, ivskScalar);
-  const packed = packPoint2(ivkPoint);
+  const ivkPoint = mulPointEscalar4(Base82, ivskScalar);
+  const packed = packPoint3(ivkPoint);
   return bigintTo32Le(packed);
 }
 function deriveOwnerPk(spendingKey) {
   try {
-    const pubPoint = mulPointEscalar5(Base83, spendingKey);
+    const pubPoint = mulPointEscalar4(Base82, spendingKey);
     return pubPoint[0];
   } catch {
     return 0n;
@@ -4272,7 +4329,7 @@ import {
   WebArtifactProvider as WebArtifactProvider2
 } from "@orbinum/proof-generator";
 import { randomBytes as randomBytes3 } from "@noble/ciphers/utils.js";
-import { mulPointEscalar as mulPointEscalar6, Base8 as Base84 } from "@zk-kit/baby-jubjub";
+import { mulPointEscalar as mulPointEscalar5, Base8 as Base83 } from "@zk-kit/baby-jubjub";
 import { poseidon4 as poseidon44 } from "poseidon-lite";
 
 // src/proof-generator/merkle.ts
@@ -4295,7 +4352,7 @@ async function generateUnshieldProof(inputs, options = {}) {
   if (changeValue < 0n) {
     throw new Error("changeValue must be >= 0.");
   }
-  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? mulPointEscalar6(Base84, inputs.spendingKey)[0];
+  const changeOwnerPubkey = inputs.changeOwnerPubkey ?? mulPointEscalar5(Base83, inputs.spendingKey)[0];
   const changeBlinding = inputs.changeBlinding ?? (changeValue > 0n ? bytesToBigintLE(randomBytes3(32)) : 0n);
   const changeCommitment = changeValue > 0n ? poseidon44([changeValue, inputs.assetId, changeOwnerPubkey, changeBlinding]) : 0n;
   const circuitInputs = {
@@ -5218,6 +5275,7 @@ export {
   decryptNoteRecord,
   deriveMasterKeyBytes,
   deriveOwnerPk,
+  deriveSelfEphSk,
   deriveSpendingKeyFromSignature,
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
@@ -5262,6 +5320,7 @@ export {
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,
+  selfEphWindow,
   shortHash,
   substrateSs58ToAccountIdHex,
   substrateToEvm,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",
@@ -46,6 +46,7 @@
   },
   "dependencies": {
     "@noble/ciphers": "2.2.0",
+    "@noble/curves": "^2.2.0",
     "@noble/hashes": "2.2.0",
     "@orbinum/proof-generator": "4.0.0",
     "@polkadot-api/metadata-builders": "0.14.2",