@orbinum/sdk 0.16.0 → 0.18.0

package/dist/index.d.mts

@@ -105,6 +105,18 @@ declare class SubstrateClient {
     private constructor();
     private _dynamicBuilder;
     private _extDecoder;
+    private _inflightTxCount;
+    /**
+     * `true` while any submitted transaction is still waiting for finalization.
+     * Connection managers use this to defer destroying the client — killing the
+     * WS mid-submit rejects the pending tx with "Client destroyed" even though
+     * it may still land on-chain.
+     *
+     * Only covers promise-based submits (`submit`, `submitUnsignedAndWatch`,
+     * `signAndSubmit`); observable-based `submitAndWatch` callers are not tracked.
+     */
+    get hasInflightTx(): boolean;
+    private trackTx;
     /**
      * Connects to the Orbinum node via WebSocket.
      * Throws if the node does not respond within `timeoutMs`.
@@ -285,14 +297,25 @@ declare class EvmClient {
     }): Promise<bigint>;
     /** Returns a transaction receipt by hash, or `null` if the transaction has not been mined yet. */
     getTransactionReceipt(txHash: string): Promise<Record<string, unknown> | null>;
+    /**
+     * Fetches a transaction by hash, or `null` when the node no longer knows it
+     * (never mined and evicted from the pool). Unlike `request`, a `null`
+     * result is a valid answer here, not an error.
+     */
+    getTransactionByHash(txHash: string): Promise<Record<string, unknown> | null>;
     /**
      * Polls `eth_getTransactionReceipt` until the transaction is included in a block.
      *
+     * After `timeoutMs`, the tx-pool is consulted: a tx no longer known to the
+     * node is reported as dropped (safe to retry), while a tx still in the pool
+     * gets an extended grace window (up to 4× `timeoutMs`) before a "still
+     * pending" error — it may confirm later, so callers must NOT blindly retry.
+     *
      * @param txHash - The transaction hash to wait for.
      * @param intervalMs - Polling interval in milliseconds (default: 500).
      * @param timeoutMs - Maximum time to wait in milliseconds (default: 60_000).
      * @returns The transaction receipt once mined.
-     * @throws If the transaction is not mined within `timeoutMs` or if it reverted (`status == 0x0`).
+     * @throws If the transaction dropped, is still pending after the grace window, or reverted (`status == 0x0`).
      */
     waitForReceipt(txHash: string, intervalMs?: number, timeoutMs?: number): Promise<Record<string, unknown>>;
 }
@@ -1776,6 +1799,7 @@ declare class OrbinumClientProvider {
     private _reconnectTimer;
     private _stableTimer;
     private _reconnectAttempt;
+    private _probeFailures;
     private _listeners;
     /** Creates a new provider with the given configuration. Does not connect automatically — call `connect()` to initiate. */
     constructor(config: ClientProviderConfig);
@@ -1806,6 +1830,21 @@ declare class OrbinumClientProvider {
      * On failure: destroys any orphaned client and transitions to `'disconnected'`.
      */
     private attemptConnect;
+    /**
+     * Consecutive failed probes required before the client is torn down. A
+     * single missed probe is routine (throttled background tab, node busy
+     * verifying a ZK proof, transient network blip) — destroying the client on
+     * it rejects every in-flight request with "Client destroyed" even though
+     * the tx may still land on-chain.
+     */
+    private static readonly PROBE_FAILURE_THRESHOLD;
+    /**
+     * With a tx awaiting finalization, tolerate more missed probes: an unsigned
+     * private_transfer/unshield makes the node CPU-bound on proof verification,
+     * which is exactly when probes time out — tearing down then kills the very
+     * tx being processed.
+     */
+    private static readonly PROBE_FAILURE_THRESHOLD_INFLIGHT;
     /** Starts the periodic heartbeat loop. Replaces any existing timer. */
     private startHeartbeat;
     /** Clears the heartbeat interval timer if active. */
@@ -2104,6 +2143,14 @@ declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from:
  * deriveSpendingKeyFromSignature.
  */
 declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigint;
+/**
+ * Computes a note commitment.
+ *   commitment = Poseidon4(value, assetId, ownerPk, blinding)
+ *
+ * Mirrors NoteCommitment in note.circom — use it to verify a stored note
+ * against its on-chain commitment before spending it.
+ */
+declare function computeNoteCommitment(value: bigint, assetId: bigint, ownerPk: bigint, blinding: bigint): bigint;
 interface TryDecryptOptions {
     /**
      * View-tag fast path: compute the ECDH shared secret once, compare the
@@ -4261,4 +4308,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.d.ts

@@ -105,6 +105,18 @@ declare class SubstrateClient {
     private constructor();
     private _dynamicBuilder;
     private _extDecoder;
+    private _inflightTxCount;
+    /**
+     * `true` while any submitted transaction is still waiting for finalization.
+     * Connection managers use this to defer destroying the client — killing the
+     * WS mid-submit rejects the pending tx with "Client destroyed" even though
+     * it may still land on-chain.
+     *
+     * Only covers promise-based submits (`submit`, `submitUnsignedAndWatch`,
+     * `signAndSubmit`); observable-based `submitAndWatch` callers are not tracked.
+     */
+    get hasInflightTx(): boolean;
+    private trackTx;
     /**
      * Connects to the Orbinum node via WebSocket.
      * Throws if the node does not respond within `timeoutMs`.
@@ -285,14 +297,25 @@ declare class EvmClient {
     }): Promise<bigint>;
     /** Returns a transaction receipt by hash, or `null` if the transaction has not been mined yet. */
     getTransactionReceipt(txHash: string): Promise<Record<string, unknown> | null>;
+    /**
+     * Fetches a transaction by hash, or `null` when the node no longer knows it
+     * (never mined and evicted from the pool). Unlike `request`, a `null`
+     * result is a valid answer here, not an error.
+     */
+    getTransactionByHash(txHash: string): Promise<Record<string, unknown> | null>;
     /**
      * Polls `eth_getTransactionReceipt` until the transaction is included in a block.
      *
+     * After `timeoutMs`, the tx-pool is consulted: a tx no longer known to the
+     * node is reported as dropped (safe to retry), while a tx still in the pool
+     * gets an extended grace window (up to 4× `timeoutMs`) before a "still
+     * pending" error — it may confirm later, so callers must NOT blindly retry.
+     *
      * @param txHash - The transaction hash to wait for.
      * @param intervalMs - Polling interval in milliseconds (default: 500).
      * @param timeoutMs - Maximum time to wait in milliseconds (default: 60_000).
      * @returns The transaction receipt once mined.
-     * @throws If the transaction is not mined within `timeoutMs` or if it reverted (`status == 0x0`).
+     * @throws If the transaction dropped, is still pending after the grace window, or reverted (`status == 0x0`).
      */
     waitForReceipt(txHash: string, intervalMs?: number, timeoutMs?: number): Promise<Record<string, unknown>>;
 }
@@ -1776,6 +1799,7 @@ declare class OrbinumClientProvider {
     private _reconnectTimer;
     private _stableTimer;
     private _reconnectAttempt;
+    private _probeFailures;
     private _listeners;
     /** Creates a new provider with the given configuration. Does not connect automatically — call `connect()` to initiate. */
     constructor(config: ClientProviderConfig);
@@ -1806,6 +1830,21 @@ declare class OrbinumClientProvider {
      * On failure: destroys any orphaned client and transitions to `'disconnected'`.
      */
     private attemptConnect;
+    /**
+     * Consecutive failed probes required before the client is torn down. A
+     * single missed probe is routine (throttled background tab, node busy
+     * verifying a ZK proof, transient network blip) — destroying the client on
+     * it rejects every in-flight request with "Client destroyed" even though
+     * the tx may still land on-chain.
+     */
+    private static readonly PROBE_FAILURE_THRESHOLD;
+    /**
+     * With a tx awaiting finalization, tolerate more missed probes: an unsigned
+     * private_transfer/unshield makes the node CPU-bound on proof verification,
+     * which is exactly when probes time out — tearing down then kills the very
+     * tx being processed.
+     */
+    private static readonly PROBE_FAILURE_THRESHOLD_INFLIGHT;
     /** Starts the periodic heartbeat loop. Replaces any existing timer. */
     private startHeartbeat;
     /** Clears the heartbeat interval timer if active. */
@@ -2104,6 +2143,14 @@ declare function selfEphWindow(spendingKey: bigint, ivkPacked: Uint8Array, from:
  * deriveSpendingKeyFromSignature.
  */
 declare function computeNullifier(commitment: bigint, spendingKey: bigint): bigint;
+/**
+ * Computes a note commitment.
+ *   commitment = Poseidon4(value, assetId, ownerPk, blinding)
+ *
+ * Mirrors NoteCommitment in note.circom — use it to verify a stored note
+ * against its on-chain commitment before spending it.
+ */
+declare function computeNoteCommitment(value: bigint, assetId: bigint, ownerPk: bigint, blinding: bigint): bigint;
 interface TryDecryptOptions {
     /**
      * View-tag fast path: compute the ECDH shared secret once, compare the
@@ -4261,4 +4308,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.js

@@ -63,6 +63,7 @@ __export(index_exports, {
   blindTag: () => blindTag,
   buildDummyTransferInput: () => buildDummyTransferInput,
   bytesToBigintLE: () => bytesToBigintLE,
+  computeNoteCommitment: () => computeNoteCommitment,
   computeNullifier: () => computeNullifier,
   computePathIndices: () => computePathIndices,
   connectInjectedExtension: () => import_pjs_signer.connectInjectedExtension,
@@ -224,6 +225,27 @@ var SubstrateClient = class _SubstrateClient {
   _httpUrl;
   _dynamicBuilder = null;
   _extDecoder = null;
+  _inflightTxCount = 0;
+  /**
+   * `true` while any submitted transaction is still waiting for finalization.
+   * Connection managers use this to defer destroying the client — killing the
+   * WS mid-submit rejects the pending tx with "Client destroyed" even though
+   * it may still land on-chain.
+   *
+   * Only covers promise-based submits (`submit`, `submitUnsignedAndWatch`,
+   * `signAndSubmit`); observable-based `submitAndWatch` callers are not tracked.
+   */
+  get hasInflightTx() {
+    return this._inflightTxCount > 0;
+  }
+  async trackTx(p) {
+    this._inflightTxCount++;
+    try {
+      return await p;
+    } finally {
+      this._inflightTxCount--;
+    }
+  }
   /**
    * Connects to the Orbinum node via WebSocket.
    * Throws if the node does not respond within `timeoutMs`.
@@ -436,7 +458,7 @@ var SubstrateClient = class _SubstrateClient {
    * Submits a pre-signed extrinsic (hex string) and waits for finalization.
    */
   async submit(signedHex) {
-    return this._papi.submit(import_polkadot_api.Binary.fromHex(signedHex));
+    return this.trackTx(this._papi.submit(import_polkadot_api.Binary.fromHex(signedHex)));
   }
   /**
    * Submits a pre-signed extrinsic and returns an Observable of tx lifecycle events.
@@ -451,14 +473,14 @@ var SubstrateClient = class _SubstrateClient {
    * The bare tx bytes are produced by `tx.getBareTx()` from polkadot-api.
    */
   async submitUnsignedAndWatch(bareTx) {
-    return this._papi.submit(bareTx);
+    return this.trackTx(this._papi.submit(bareTx));
   }
   /**
    * Convenience: wrap raw call bytes and sign+submit in one step.
    */
   async signAndSubmit(callData, signer) {
     const tx = await this.txFromCallData(callData);
-    return tx.signAndSubmit(signer);
+    return this.trackTx(tx.signAndSubmit(signer));
   }
   /** Closes the WebSocket connection. */
   destroy() {
@@ -715,17 +737,46 @@ var EvmClient = class {
     }
     return json.result ?? null;
   }
+  /**
+   * Fetches a transaction by hash, or `null` when the node no longer knows it
+   * (never mined and evicted from the pool). Unlike `request`, a `null`
+   * result is a valid answer here, not an error.
+   */
+  async getTransactionByHash(txHash) {
+    const res = await postJsonWithRetry(
+      this.rpcUrl,
+      JSON.stringify({
+        id: 1,
+        jsonrpc: "2.0",
+        method: "eth_getTransactionByHash",
+        params: [txHash]
+      })
+    );
+    if (!res.ok) throw new Error(`EVM HTTP ${res.status}: ${res.statusText}`);
+    const json = await res.json();
+    if (json.error) {
+      throw new Error(`EVM RPC [${json.error.code}]: ${json.error.message}`);
+    }
+    return json.result ?? null;
+  }
   /**
    * Polls `eth_getTransactionReceipt` until the transaction is included in a block.
    *
+   * After `timeoutMs`, the tx-pool is consulted: a tx no longer known to the
+   * node is reported as dropped (safe to retry), while a tx still in the pool
+   * gets an extended grace window (up to 4× `timeoutMs`) before a "still
+   * pending" error — it may confirm later, so callers must NOT blindly retry.
+   *
    * @param txHash - The transaction hash to wait for.
    * @param intervalMs - Polling interval in milliseconds (default: 500).
    * @param timeoutMs - Maximum time to wait in milliseconds (default: 60_000).
    * @returns The transaction receipt once mined.
-   * @throws If the transaction is not mined within `timeoutMs` or if it reverted (`status == 0x0`).
+   * @throws If the transaction dropped, is still pending after the grace window, or reverted (`status == 0x0`).
    */
   async waitForReceipt(txHash, intervalMs = 500, timeoutMs = 6e4) {
-    const deadline = Date.now() + timeoutMs;
+    const start = Date.now();
+    const hardDeadline = start + timeoutMs * 4;
+    let deadline = start + timeoutMs;
     while (Date.now() < deadline) {
       const receipt = await this.getTransactionReceipt(txHash);
       if (receipt !== null) {
@@ -736,10 +787,7 @@ var EvmClient = class {
           if (!revertDetail) {
             try {
               const blockParam = receipt["blockNumber"] ?? "latest";
-              const rawTx = await this.request(
-                "eth_getTransactionByHash",
-                [txHash]
-              ).catch(() => null);
+              const rawTx = await this.getTransactionByHash(txHash).catch(() => null);
               if (rawTx) {
                 const calldata = rawTx["input"] ?? rawTx["data"];
                 if (calldata) {
@@ -762,8 +810,19 @@ var EvmClient = class {
         return receipt;
       }
       await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      if (Date.now() >= deadline && Date.now() < hardDeadline) {
+        const known = await this.getTransactionByHash(txHash).catch(() => void 0);
+        if (known === null) {
+          throw new Error(
+            `Transaction dropped from the tx pool (not mined within ${Date.now() - start}ms): ${txHash}`
+          );
+        }
+        deadline = Math.min(deadline + timeoutMs, hardDeadline);
+      }
     }
-    throw new Error(`Transaction not mined within ${timeoutMs}ms: ${txHash}`);
+    throw new Error(
+      `Transaction still pending after ${Date.now() - start}ms: ${txHash} \u2014 it may still confirm; check the hash on the explorer before retrying`
+    );
   }
 };
 
@@ -3367,7 +3426,7 @@ var DEFAULT_HEARTBEAT_TIMEOUT_MS = 4e3;
 var DEFAULT_RECONNECT_BASE_MS = 3e3;
 var DEFAULT_RECONNECT_MAX_MS = 3e4;
 var DEFAULT_STABLE_AFTER_MS = 1e4;
-var OrbinumClientProvider = class {
+var OrbinumClientProvider = class _OrbinumClientProvider {
   config;
   connectTimeoutMs;
   heartbeatIntervalMs;
@@ -3384,6 +3443,7 @@ var OrbinumClientProvider = class {
   _reconnectTimer = null;
   _stableTimer = null;
   _reconnectAttempt = 0;
+  _probeFailures = 0;
   // ─── Events ─────────────────────────────────────────────────────────────
   _listeners = /* @__PURE__ */ new Set();
   /** Creates a new provider with the given configuration. Does not connect automatically — call `connect()` to initiate. */
@@ -3516,13 +3576,36 @@ var OrbinumClientProvider = class {
     }
   }
   // ─── Heartbeat ──────────────────────────────────────────────────────────
+  /**
+   * Consecutive failed probes required before the client is torn down. A
+   * single missed probe is routine (throttled background tab, node busy
+   * verifying a ZK proof, transient network blip) — destroying the client on
+   * it rejects every in-flight request with "Client destroyed" even though
+   * the tx may still land on-chain.
+   */
+  static PROBE_FAILURE_THRESHOLD = 2;
+  /**
+   * With a tx awaiting finalization, tolerate more missed probes: an unsigned
+   * private_transfer/unshield makes the node CPU-bound on proof verification,
+   * which is exactly when probes time out — tearing down then kills the very
+   * tx being processed.
+   */
+  static PROBE_FAILURE_THRESHOLD_INFLIGHT = 6;
   /** Starts the periodic heartbeat loop. Replaces any existing timer. */
   startHeartbeat() {
     this.stopHeartbeat();
+    this._probeFailures = 0;
     this._heartbeatTimer = setInterval(async () => {
       if (this._status !== "connected" || !this._orbinumClient) return;
       const alive = await this.probe();
-      if (!alive && this._status === "connected") {
+      if (this._status !== "connected") return;
+      if (alive) {
+        this._probeFailures = 0;
+        return;
+      }
+      this._probeFailures++;
+      const threshold = this._orbinumClient?.substrate.hasInflightTx ? _OrbinumClientProvider.PROBE_FAILURE_THRESHOLD_INFLIGHT : _OrbinumClientProvider.PROBE_FAILURE_THRESHOLD;
+      if (this._probeFailures >= threshold) {
         this.setStatus("disconnected", "Node is unreachable");
         this.teardownClient();
         this.scheduleReconnect();
@@ -3948,6 +4031,9 @@ var import_poseidon_lite2 = require("poseidon-lite");
 function computeNullifier(commitment, spendingKey) {
   return (0, import_poseidon_lite2.poseidon2)([commitment, spendingKey]);
 }
+function computeNoteCommitment(value, assetId, ownerPk, blinding) {
+  return (0, import_poseidon_lite2.poseidon4)([value, assetId, ownerPk, blinding]);
+}
 function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
   return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk, opts).note;
 }
@@ -5374,6 +5460,7 @@ var import_polkadot_api4 = require("polkadot-api");
   blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
+  computeNoteCommitment,
   computeNullifier,
   computePathIndices,
   connectInjectedExtension,

package/dist/index.mjs

@@ -90,6 +90,27 @@ var SubstrateClient = class _SubstrateClient {
   _httpUrl;
   _dynamicBuilder = null;
   _extDecoder = null;
+  _inflightTxCount = 0;
+  /**
+   * `true` while any submitted transaction is still waiting for finalization.
+   * Connection managers use this to defer destroying the client — killing the
+   * WS mid-submit rejects the pending tx with "Client destroyed" even though
+   * it may still land on-chain.
+   *
+   * Only covers promise-based submits (`submit`, `submitUnsignedAndWatch`,
+   * `signAndSubmit`); observable-based `submitAndWatch` callers are not tracked.
+   */
+  get hasInflightTx() {
+    return this._inflightTxCount > 0;
+  }
+  async trackTx(p) {
+    this._inflightTxCount++;
+    try {
+      return await p;
+    } finally {
+      this._inflightTxCount--;
+    }
+  }
   /**
    * Connects to the Orbinum node via WebSocket.
    * Throws if the node does not respond within `timeoutMs`.
@@ -302,7 +323,7 @@ var SubstrateClient = class _SubstrateClient {
    * Submits a pre-signed extrinsic (hex string) and waits for finalization.
    */
   async submit(signedHex) {
-    return this._papi.submit(Binary.fromHex(signedHex));
+    return this.trackTx(this._papi.submit(Binary.fromHex(signedHex)));
   }
   /**
    * Submits a pre-signed extrinsic and returns an Observable of tx lifecycle events.
@@ -317,14 +338,14 @@ var SubstrateClient = class _SubstrateClient {
    * The bare tx bytes are produced by `tx.getBareTx()` from polkadot-api.
    */
   async submitUnsignedAndWatch(bareTx) {
-    return this._papi.submit(bareTx);
+    return this.trackTx(this._papi.submit(bareTx));
   }
   /**
    * Convenience: wrap raw call bytes and sign+submit in one step.
    */
   async signAndSubmit(callData, signer) {
     const tx = await this.txFromCallData(callData);
-    return tx.signAndSubmit(signer);
+    return this.trackTx(tx.signAndSubmit(signer));
   }
   /** Closes the WebSocket connection. */
   destroy() {
@@ -581,17 +602,46 @@ var EvmClient = class {
     }
     return json.result ?? null;
   }
+  /**
+   * Fetches a transaction by hash, or `null` when the node no longer knows it
+   * (never mined and evicted from the pool). Unlike `request`, a `null`
+   * result is a valid answer here, not an error.
+   */
+  async getTransactionByHash(txHash) {
+    const res = await postJsonWithRetry(
+      this.rpcUrl,
+      JSON.stringify({
+        id: 1,
+        jsonrpc: "2.0",
+        method: "eth_getTransactionByHash",
+        params: [txHash]
+      })
+    );
+    if (!res.ok) throw new Error(`EVM HTTP ${res.status}: ${res.statusText}`);
+    const json = await res.json();
+    if (json.error) {
+      throw new Error(`EVM RPC [${json.error.code}]: ${json.error.message}`);
+    }
+    return json.result ?? null;
+  }
   /**
    * Polls `eth_getTransactionReceipt` until the transaction is included in a block.
    *
+   * After `timeoutMs`, the tx-pool is consulted: a tx no longer known to the
+   * node is reported as dropped (safe to retry), while a tx still in the pool
+   * gets an extended grace window (up to 4× `timeoutMs`) before a "still
+   * pending" error — it may confirm later, so callers must NOT blindly retry.
+   *
    * @param txHash - The transaction hash to wait for.
    * @param intervalMs - Polling interval in milliseconds (default: 500).
    * @param timeoutMs - Maximum time to wait in milliseconds (default: 60_000).
    * @returns The transaction receipt once mined.
-   * @throws If the transaction is not mined within `timeoutMs` or if it reverted (`status == 0x0`).
+   * @throws If the transaction dropped, is still pending after the grace window, or reverted (`status == 0x0`).
    */
   async waitForReceipt(txHash, intervalMs = 500, timeoutMs = 6e4) {
-    const deadline = Date.now() + timeoutMs;
+    const start = Date.now();
+    const hardDeadline = start + timeoutMs * 4;
+    let deadline = start + timeoutMs;
     while (Date.now() < deadline) {
       const receipt = await this.getTransactionReceipt(txHash);
       if (receipt !== null) {
@@ -602,10 +652,7 @@ var EvmClient = class {
           if (!revertDetail) {
             try {
               const blockParam = receipt["blockNumber"] ?? "latest";
-              const rawTx = await this.request(
-                "eth_getTransactionByHash",
-                [txHash]
-              ).catch(() => null);
+              const rawTx = await this.getTransactionByHash(txHash).catch(() => null);
               if (rawTx) {
                 const calldata = rawTx["input"] ?? rawTx["data"];
                 if (calldata) {
@@ -628,8 +675,19 @@ var EvmClient = class {
         return receipt;
       }
       await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      if (Date.now() >= deadline && Date.now() < hardDeadline) {
+        const known = await this.getTransactionByHash(txHash).catch(() => void 0);
+        if (known === null) {
+          throw new Error(
+            `Transaction dropped from the tx pool (not mined within ${Date.now() - start}ms): ${txHash}`
+          );
+        }
+        deadline = Math.min(deadline + timeoutMs, hardDeadline);
+      }
     }
-    throw new Error(`Transaction not mined within ${timeoutMs}ms: ${txHash}`);
+    throw new Error(
+      `Transaction still pending after ${Date.now() - start}ms: ${txHash} \u2014 it may still confirm; check the hash on the explorer before retrying`
+    );
   }
 };
 
@@ -3236,7 +3294,7 @@ var DEFAULT_HEARTBEAT_TIMEOUT_MS = 4e3;
 var DEFAULT_RECONNECT_BASE_MS = 3e3;
 var DEFAULT_RECONNECT_MAX_MS = 3e4;
 var DEFAULT_STABLE_AFTER_MS = 1e4;
-var OrbinumClientProvider = class {
+var OrbinumClientProvider = class _OrbinumClientProvider {
   config;
   connectTimeoutMs;
   heartbeatIntervalMs;
@@ -3253,6 +3311,7 @@ var OrbinumClientProvider = class {
   _reconnectTimer = null;
   _stableTimer = null;
   _reconnectAttempt = 0;
+  _probeFailures = 0;
   // ─── Events ─────────────────────────────────────────────────────────────
   _listeners = /* @__PURE__ */ new Set();
   /** Creates a new provider with the given configuration. Does not connect automatically — call `connect()` to initiate. */
@@ -3385,13 +3444,36 @@ var OrbinumClientProvider = class {
     }
   }
   // ─── Heartbeat ──────────────────────────────────────────────────────────
+  /**
+   * Consecutive failed probes required before the client is torn down. A
+   * single missed probe is routine (throttled background tab, node busy
+   * verifying a ZK proof, transient network blip) — destroying the client on
+   * it rejects every in-flight request with "Client destroyed" even though
+   * the tx may still land on-chain.
+   */
+  static PROBE_FAILURE_THRESHOLD = 2;
+  /**
+   * With a tx awaiting finalization, tolerate more missed probes: an unsigned
+   * private_transfer/unshield makes the node CPU-bound on proof verification,
+   * which is exactly when probes time out — tearing down then kills the very
+   * tx being processed.
+   */
+  static PROBE_FAILURE_THRESHOLD_INFLIGHT = 6;
   /** Starts the periodic heartbeat loop. Replaces any existing timer. */
   startHeartbeat() {
     this.stopHeartbeat();
+    this._probeFailures = 0;
     this._heartbeatTimer = setInterval(async () => {
       if (this._status !== "connected" || !this._orbinumClient) return;
       const alive = await this.probe();
-      if (!alive && this._status === "connected") {
+      if (this._status !== "connected") return;
+      if (alive) {
+        this._probeFailures = 0;
+        return;
+      }
+      this._probeFailures++;
+      const threshold = this._orbinumClient?.substrate.hasInflightTx ? _OrbinumClientProvider.PROBE_FAILURE_THRESHOLD_INFLIGHT : _OrbinumClientProvider.PROBE_FAILURE_THRESHOLD;
+      if (this._probeFailures >= threshold) {
         this.setStatus("disconnected", "Node is unreachable");
         this.teardownClient();
         this.scheduleReconnect();
@@ -3817,6 +3899,9 @@ import { poseidon2 as poseidon22, poseidon4 as poseidon42 } from "poseidon-lite"
 function computeNullifier(commitment, spendingKey) {
   return poseidon22([commitment, spendingKey]);
 }
+function computeNoteCommitment(value, assetId, ownerPk, blinding) {
+  return poseidon42([value, assetId, ownerPk, blinding]);
+}
 function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
   return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk, opts).note;
 }
@@ -5265,6 +5350,7 @@ export {
   blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
+  computeNoteCommitment,
   computeNullifier,
   computePathIndices,
   connectInjectedExtension,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",