@orbinum/sdk 0.25.0 → 1.0.0

package/dist/wallet/worker/index.js

@@ -0,0 +1,859 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/wallet/worker/index.ts
+var worker_exports = {};
+__export(worker_exports, {
+  DECRYPT_YIELD_EVERY: () => DECRYPT_YIELD_EVERY,
+  EMPTY_BATCH_RESULT: () => EMPTY_BATCH_RESULT,
+  MAX_WORKERS: () => MAX_WORKERS,
+  PAIRWISE_EPH_WINDOW: () => PAIRWISE_EPH_WINDOW,
+  SELF_EPH_WINDOW: () => SELF_EPH_WINDOW,
+  WORKER_CRASHED: () => WORKER_CRASHED,
+  clearKnownEphWindow: () => clearKnownEphWindow,
+  createDecryptPool: () => createDecryptPool,
+  createMainThreadPool: () => createMainThreadPool,
+  createWorkerPool: () => createWorkerPool,
+  decryptHintBatch: () => decryptHintBatch,
+  getKnownEphWindow: () => getKnownEphWindow
+});
+module.exports = __toCommonJS(worker_exports);
+
+// src/protocol/memo/EncryptedMemo.ts
+var import_chacha = require("@noble/ciphers/chacha.js");
+var import_utils = require("@noble/ciphers/utils.js");
+var import_baby_jubjub = require("@zk-kit/baby-jubjub");
+
+// src/foundation/crypto/bjj-fast.ts
+var import_edwards = require("@noble/curves/abstract/edwards.js");
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = (0, import_edwards.edwards)({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
+
+// src/foundation/encoding/hex.ts
+function toHex(bytes) {
+  return "0x" + Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (clean.length % 2 !== 0) {
+    throw new Error(`Invalid hex string \u2014 odd length: "${hex}"`);
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    const byte = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    if (isNaN(byte)) throw new Error(`Invalid hex character at position ${i * 2}`);
+    bytes[i] = byte;
+  }
+  return bytes;
+}
+
+// src/foundation/encoding/bytes.ts
+function bigintTo32Le(n) {
+  const buf = new Uint8Array(32);
+  let v = n;
+  for (let i = 0; i < 32; i++) {
+    buf[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return buf;
+}
+function bytesToBigintLE(bytes) {
+  let result = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    result = result << 8n | BigInt(bytes[i] ?? 0);
+  }
+  return result;
+}
+
+// src/foundation/crypto/constants.ts
+var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+
+// src/protocol/memo/plaintext.ts
+var import_sha2 = require("@noble/hashes/sha2.js");
+var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
+var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
+var MEMO_PLAINTEXT_SIZE = 120;
+function serializeMemo(value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion) {
+  const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
+  const view = new DataView(buf.buffer);
+  view.setBigUint64(0, value & 0xffffffffffffffffn, true);
+  view.setBigUint64(8, value >> 64n & 0xffffffffffffffffn, true);
+  buf.set(ownerPk.slice(0, 32), 16);
+  buf.set(blinding.slice(0, 32), 48);
+  view.setUint32(80, assetId >>> 0, true);
+  buf.set(counterpartyPk.slice(0, 32), 84);
+  view.setUint32(116, circuitVersion >>> 0, true);
+  return buf;
+}
+function deriveEncryptionKey(sharedSecret, commitment) {
+  const h = import_sha2.sha256.create();
+  h.update(sharedSecret);
+  h.update(commitment);
+  h.update(KEY_DOMAIN);
+  return h.digest();
+}
+function deriveViewTag(sharedSecret) {
+  const h = import_sha2.sha256.create();
+  h.update(VIEW_TAG_DOMAIN);
+  h.update(sharedSecret);
+  return h.digest()[0];
+}
+
+// src/protocol/memo/EncryptedMemo.ts
+var NONCE_SIZE = 12;
+var CIPHERTEXT_SIZE = 136;
+var EPH_PK_SIZE = 32;
+var ENCRYPTED_MEMO_SIZE = NONCE_SIZE + CIPHERTEXT_SIZE + EPH_PK_SIZE;
+function bytesToBjjScalar(bytes) {
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  return BigInt("0x" + hex) % BABYJUB_SUBORDER || 1n;
+}
+function parsePlaintext(nonce, ciphertextWithMac, encKey) {
+  try {
+    const cipher = (0, import_chacha.chacha20poly1305)(encKey, nonce);
+    const plaintext = cipher.decrypt(ciphertextWithMac);
+    const view = new DataView(plaintext.buffer, plaintext.byteOffset, plaintext.byteLength);
+    const valueLo = view.getBigUint64(0, true);
+    const valueHi = view.getBigUint64(8, true);
+    const value = valueLo | valueHi << 64n;
+    const ownerPk = bytesToBigintLE(plaintext.slice(16, 48));
+    const blinding = bytesToBigintLE(plaintext.slice(48, 80));
+    const assetId = BigInt(view.getUint32(80, true));
+    const counterpartyPk = bytesToBigintLE(plaintext.slice(84, 116));
+    const circuitVersion = view.getUint32(116, true);
+    return { value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion };
+  } catch {
+    return null;
+  }
+}
+var EncryptedMemo = {
+  /**
+   * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+   *
+   * @param value              Note value in planck.
+   * @param ownerPk            32-byte owner public key (LE).
+   * @param blinding           32-byte blinding scalar (LE).
+   * @param assetId            Asset identifier.
+   * @param commitment         32-byte commitment bytes (LE).
+   * @param recipientIvkPacked 32-byte LE-encoded packed BJJ viewing public key
+   *                           (from PrivacyKeyManager.getViewingPublicKeyPacked() or
+   *                           decoded from a privacy address).
+   *                           Pass `new Uint8Array(32)` (all zeros) for a publicly-readable memo.
+   * @param counterpartyPk     32-byte counterparty BJJ Ax. Default: all zeros.
+   * @param circuitVersion     ZK circuit version the note is spent under. Default: 0.
+   * @param ephSkOverride      32-byte ephemeral secret key (stealth coordination). Optional.
+   * @returns 180-byte encrypted memo: nonce(12) || ciphertext+MAC(136) || ephPk(32).
+   */
+  encrypt(value, ownerPk, blinding, assetId, commitment, recipientIvkPacked, counterpartyPk = new Uint8Array(32), circuitVersion = 0, ephSkOverride) {
+    const nonce = (0, import_utils.randomBytes)(NONCE_SIZE);
+    const plaintext = serializeMemo(
+      value,
+      ownerPk,
+      blinding,
+      assetId,
+      counterpartyPk,
+      circuitVersion
+    );
+    const isZeroKey = recipientIvkPacked.every((b) => b === 0);
+    let sharedSecret;
+    let ephPkPackedBytes;
+    if (isZeroKey) {
+      sharedSecret = new Uint8Array(32);
+      ephPkPackedBytes = new Uint8Array(EPH_PK_SIZE);
+    } else {
+      const ephSkBytes = ephSkOverride ?? (0, import_utils.randomBytes)(32);
+      if (ephSkBytes.length !== 32)
+        throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
+      const ephSkScalar = bytesToBjjScalar(ephSkBytes);
+      const ephPkPoint = fastMulBase(ephSkScalar);
+      ephPkPackedBytes = bigintTo32Le((0, import_baby_jubjub.packPoint)(ephPkPoint));
+      const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
+      const ivkPoint = (0, import_baby_jubjub.unpackPoint)(ivkPackedBigint);
+      if (!ivkPoint)
+        throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
+      sharedSecret = bigintTo32Le(sharedPoint[0]);
+    }
+    nonce[0] = deriveViewTag(sharedSecret);
+    const encKey = deriveEncryptionKey(sharedSecret, commitment);
+    const cipher = (0, import_chacha.chacha20poly1305)(encKey, nonce);
+    const ciphertext = cipher.encrypt(plaintext);
+    const result = new Uint8Array(ENCRYPTED_MEMO_SIZE);
+    result.set(nonce, 0);
+    result.set(ciphertext, NONCE_SIZE);
+    result.set(ephPkPackedBytes, NONCE_SIZE + CIPHERTEXT_SIZE);
+    return result;
+  },
+  /**
+   * Returns a 180-byte public memo encrypted with a zero viewing key.
+   * Decryptable by anyone with `decrypt(memo, commitment, new Uint8Array(32))`.
+   * Convenience alias for `encrypt(..., new Uint8Array(32))`.
+   */
+  encryptPublic(value, ownerPk, blinding, assetId, commitment, circuitVersion = 0) {
+    return EncryptedMemo.encrypt(
+      value,
+      ownerPk,
+      blinding,
+      assetId,
+      commitment,
+      new Uint8Array(32),
+      new Uint8Array(32),
+      circuitVersion
+    );
+  },
+  /**
+   * Returns a 180-byte zeroed dummy memo (no information, always valid on-chain).
+   */
+  dummy() {
+    return new Uint8Array(ENCRYPTED_MEMO_SIZE);
+  },
+  /**
+   * Validates that `bytes` is a properly-sized encrypted memo.
+   * Throws an Error if the length is not ENCRYPTED_MEMO_SIZE (180 bytes).
+   *
+   * Call this at system boundaries (extrinsic builders, precompile encoders)
+   * to catch malformed memos before they reach the chain and fail on-chain.
+   *
+   * @param bytes   The memo bytes to validate.
+   * @param context Optional context string included in the error (e.g. 'shield', 'output[0]').
+   */
+  validate(bytes, context) {
+    if (bytes.length !== ENCRYPTED_MEMO_SIZE) {
+      const ctx = context ? ` (${context})` : "";
+      throw new Error(
+        `EncryptedMemo: invalid size${ctx} \u2014 expected ${ENCRYPTED_MEMO_SIZE} bytes, got ${bytes.length}`
+      );
+    }
+  },
+  /**
+   * Decrypt an on-chain EncryptedMemo using the recipient's viewing secret key.
+   * Returns null if decryption fails — wrong key, bad MAC, or malformed memo.
+   * Never throws; safe for scan loops.
+   *
+   * @param memoBytes        180-byte encrypted memo.
+   * @param commitment       32-byte note commitment (LE).
+   * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
+   */
+  decrypt(memoBytes, commitment, viewingSecretKey) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    return EncryptedMemo._decrypt(memoBytes, commitment, viewingSecretKey);
+  },
+  /**
+   * Extract the ECDH shared secret from an encrypted memo using the recipient's viewing secret key.
+   *
+   * Used by NoteDecryptor to obtain the shared secret needed for stealth address derivation
+   * without re-running the full decrypt path. Safe to call on any 180-byte memo.
+   *
+   * Returns `new Uint8Array(32)` (all zeros) for public/dummy memos (zero ephPk).
+   * Returns `null` if the memo is malformed or the ephPk is not a valid BJJ point.
+   * Never throws; safe for scan loops.
+   *
+   * @param memoBytes        180-byte encrypted memo.
+   * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
+   */
+  extractSharedSecret(memoBytes, viewingSecretKey) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    const ephPkPackedBytes = memoBytes.slice(NONCE_SIZE + CIPHERTEXT_SIZE);
+    const ephPkPackedBigint = bytesToBigintLE(ephPkPackedBytes);
+    if (ephPkPackedBigint === 0n) {
+      return new Uint8Array(32);
+    }
+    const ephPkPoint = (0, import_baby_jubjub.unpackPoint)(ephPkPackedBigint);
+    if (!ephPkPoint) return null;
+    const ivskScalar = bytesToBjjScalar(viewingSecretKey);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
+    return bigintTo32Le(sharedPoint[0]);
+  },
+  /**
+   * Cheap view-tag check: does memo nonce[0] match the tag derived from
+   * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+   *
+   * Only meaningful for memos built with view tags (commitments at/after
+   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+   * there and would false-negative 255/256 of the time.
+   */
+  checkViewTag(memoBytes, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
+    return memoBytes[0] === deriveViewTag(sharedSecret);
+  },
+  /**
+   * Decrypt with an already-computed shared secret (from
+   * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+   * fast scan path: ECDH once → tag check → decrypt only on match.
+   */
+  decryptWithSharedSecret(memoBytes, commitment, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    const nonce = memoBytes.slice(0, NONCE_SIZE);
+    const ciphertextWithMac = memoBytes.slice(NONCE_SIZE, NONCE_SIZE + CIPHERTEXT_SIZE);
+    const encKey = deriveEncryptionKey(sharedSecret, commitment);
+    return parsePlaintext(nonce, ciphertextWithMac, encKey);
+  },
+  /** @internal */
+  _decrypt(memoBytes, commitment, viewingSecretKey) {
+    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return null;
+    return EncryptedMemo.decryptWithSharedSecret(memoBytes, commitment, sharedSecret);
+  }
+};
+
+// src/foundation/crypto/stealth.ts
+var import_sha22 = require("@noble/hashes/sha2.js");
+var import_hkdf = require("@noble/hashes/hkdf.js");
+var import_baby_jubjub2 = require("@zk-kit/baby-jubjub");
+var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
+function deriveStealthScalar(sharedSecret, ownerPkBigint) {
+  const salt = bigintTo32Le(ownerPkBigint);
+  const stealthBytes = (0, import_hkdf.hkdf)(import_sha22.sha256, sharedSecret, salt, STEALTH_INFO, 32);
+  return bytesToBigintLE(stealthBytes) % BABYJUB_SUBORDER || 1n;
+}
+function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
+  const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
+  const stealthPt = (0, import_baby_jubjub2.addPoint)((0, import_baby_jubjub2.mulPointEscalar)(import_baby_jubjub2.Base8, stealthScalar), ownerPkPoint);
+  return stealthPt[0];
+}
+function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
+  const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
+  return (stealthScalar + spendingKey) % BABYJUB_SUBORDER || 1n;
+}
+
+// src/foundation/crypto/bjj.ts
+var import_baby_jubjub3 = require("@zk-kit/baby-jubjub");
+var BJJ_A = 168700n;
+var BJJ_D = 168696n;
+function _modpow(base, exp, mod) {
+  let result = 1n;
+  base = base % mod;
+  while (exp > 0n) {
+    if (exp & 1n) result = result * base % mod;
+    exp >>= 1n;
+    base = base * base % mod;
+  }
+  return result;
+}
+function _sqrtModP(y2) {
+  if (y2 === 0n) return 0n;
+  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
+  let s = 0n;
+  let q = BN254_R - 1n;
+  while ((q & 1n) === 0n) {
+    q >>= 1n;
+    s++;
+  }
+  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
+  let z = 2n;
+  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
+  let m = s;
+  let c = _modpow(z, q, BN254_R);
+  let t = _modpow(y2, q, BN254_R);
+  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
+  for (; ; ) {
+    if (t === 1n) return r;
+    let i = 1n;
+    let tmp = t * t % BN254_R;
+    while (tmp !== 1n) {
+      tmp = tmp * tmp % BN254_R;
+      i++;
+    }
+    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
+    m = i;
+    c = b * b % BN254_R;
+    t = t * c % BN254_R;
+    r = r * b % BN254_R;
+  }
+}
+function recoverOwnerPkPoint(ax) {
+  const x2 = ax * ax % BN254_R;
+  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
+  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
+  if (den === 0n) return null;
+  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
+  const y2 = num * denInv % BN254_R;
+  const y = _sqrtModP(y2);
+  if (y === null) return null;
+  const yAlt = BN254_R - y;
+  try {
+    const check = (0, import_baby_jubjub3.mulPointEscalar)([ax, y], BABYJUB_SUBORDER);
+    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
+  } catch {
+    return [ax, yAlt];
+  }
+}
+
+// src/protocol/note/NoteDecryptor.ts
+var import_poseidon_lite = require("poseidon-lite");
+
+// src/protocol/spend/coinSelection.ts
+var TRANSFER_TREE_DEPTH = 20;
+var LEAVES_PER_TREE = 1 << TRANSFER_TREE_DEPTH;
+function isValidLeafIndex(leafIndex) {
+  return leafIndex !== null && leafIndex !== void 0 && Number.isSafeInteger(leafIndex) && leafIndex >= 0 && leafIndex < 2 ** 32;
+}
+
+// src/protocol/note/NoteDecryptor.ts
+function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
+  if (!commitment.encryptedMemo) return { note: null, reason: "no_memo" };
+  let commitmentBytes;
+  let memoBytes;
+  try {
+    commitmentBytes = fromHex(commitment.commitmentHex);
+    memoBytes = fromHex(commitment.encryptedMemo);
+  } catch {
+    return { note: null, reason: "hex_parse_error" };
+  }
+  if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) {
+    return {
+      note: null,
+      reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
+    };
+  }
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
+    sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
+      return { note: null, reason: "view_tag_mismatch" };
+    }
+  }
+  const plaintext = sharedSecret ? EncryptedMemo.decryptWithSharedSecret(memoBytes, commitmentBytes, sharedSecret) : EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
+  if (!plaintext) return { note: null, reason: "decrypt_failed:wrong_key_or_corrupt_mac" };
+  let effectiveOwnerPk = plaintext.ownerPk;
+  let effectiveSpendingKey = spendingKey;
+  if (ownOwnerPk !== 0n && plaintext.ownerPk !== ownOwnerPk) {
+    const ss = sharedSecret ?? EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!ss) return { note: null, reason: "stealth_shared_secret_failed" };
+    const ownPkPoint = recoverOwnerPkPoint(ownOwnerPk);
+    if (!ownPkPoint) return { note: null, reason: "stealth_invalid_own_owner_pk" };
+    const stealthOwnerPk = deriveStealthOwnerPk(ss, ownOwnerPk, ownPkPoint);
+    if (stealthOwnerPk !== plaintext.ownerPk) {
+      return { note: null, reason: "commitment_mismatch" };
+    }
+    effectiveOwnerPk = stealthOwnerPk;
+    effectiveSpendingKey = deriveStealthSk(ss, ownOwnerPk, spendingKey);
+  }
+  const recomputed = (0, import_poseidon_lite.poseidon4)([
+    plaintext.value,
+    plaintext.assetId,
+    effectiveOwnerPk,
+    plaintext.blinding
+  ]);
+  if (recomputed !== bytesToBigintLE(commitmentBytes)) {
+    return { note: null, reason: "commitment_mismatch" };
+  }
+  const nullifier = (0, import_poseidon_lite.poseidon2)([recomputed, effectiveSpendingKey]);
+  return {
+    note: {
+      value: plaintext.value,
+      assetId: plaintext.assetId,
+      ownerPk: effectiveOwnerPk,
+      blinding: plaintext.blinding,
+      spendingKey: effectiveSpendingKey,
+      circuitVersion: plaintext.circuitVersion,
+      ...isValidLeafIndex(commitment.leafIndex) ? { leafIndex: commitment.leafIndex } : {},
+      spent: false,
+      spentAt: null,
+      commitment: recomputed,
+      nullifier,
+      commitmentHex: toHex(bigintTo32Le(recomputed)),
+      nullifierHex: toHex(bigintTo32Le(nullifier)),
+      memo: Array.from(memoBytes),
+      counterpartyPk: plaintext.counterpartyPk
+    }
+  };
+}
+
+// src/protocol/eph/selfEph.ts
+var import_sha23 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub4 = require("@zk-kit/baby-jubjub");
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = import_sha23.sha256.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = (0, import_baby_jubjub4.unpackPoint)(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub4.packPoint)(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
+// src/protocol/eph/pairwiseEph.ts
+var import_sha24 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub5 = require("@zk-kit/baby-jubjub");
+var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
+function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
+  const theirPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(theirIvkPacked));
+  if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
+  const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
+  return bigintTo32Le(shared[0]);
+}
+function derivePairwiseEphSk(pairSecret, index) {
+  const h = import_sha24.sha256.create();
+  h.update(PAIRWISE_EPH_DOMAIN);
+  h.update(pairSecret);
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
+  const ivkPoint = (0, import_baby_jubjub5.unpackPoint)(bytesToBigintLE(receiverIvkPacked));
+  if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(derivePairwiseEphSk(pairSecret, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le((0, import_baby_jubjub5.packPoint)(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
+// src/protocol/keys/PrivacyKeys.ts
+var import_hkdf2 = require("@noble/hashes/hkdf.js");
+var import_sha25 = require("@noble/hashes/sha2.js");
+var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
+var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
+function deriveViewingPublicKey(ivsk) {
+  const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
+  const ivkPoint = fastMulBase(ivskScalar);
+  const packed = (0, import_baby_jubjub6.packPoint)(ivkPoint);
+  return bigintTo32Le(packed);
+}
+
+// src/wallet/worker/kernel/types.ts
+var SELF_EPH_WINDOW = 1024;
+var PAIRWISE_EPH_WINDOW = 64;
+var EMPTY_BATCH_RESULT = {
+  notes: [],
+  tagFiltered: 0,
+  selfMatched: 0,
+  pairwiseMatched: 0,
+  maxSelfEphIndex: null
+};
+
+// src/wallet/worker/kernel/ephWindow.ts
+var cachedWindow = null;
+function clearKnownEphWindow() {
+  cachedWindow = null;
+}
+function bytesKey(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function getKnownEphWindow(keys) {
+  const selfSize = keys.selfEphWindowSize ?? SELF_EPH_WINDOW;
+  const pairSize = keys.pairwiseWindowSize ?? PAIRWISE_EPH_WINDOW;
+  const counterparties = keys.pairwiseCounterparties ?? [];
+  if (!keys.selfEph && counterparties.length === 0) return null;
+  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:` + counterparties.map((c) => bytesKey(c)).join(",");
+  if (cachedWindow?.cacheKey === cacheKey) return cachedWindow.window;
+  try {
+    const ivkPacked = deriveViewingPublicKey(keys.viewingKey);
+    const byEphPk = /* @__PURE__ */ new Map();
+    if (keys.selfEph) {
+      for (const e of selfEphWindow(keys.spendingKey, ivkPacked, 0, selfSize)) {
+        byEphPk.set(e.ephPkHex.toLowerCase(), {
+          sharedSecret: e.sharedSecret,
+          index: e.index,
+          source: "self"
+        });
+      }
+    }
+    for (const theirIvk of counterparties) {
+      const pairSecret = derivePairwiseSharedSecret(keys.viewingKey, theirIvk);
+      for (const e of pairwiseEphWindow(pairSecret, ivkPacked, 0, pairSize)) {
+        const hex = e.ephPkHex.toLowerCase();
+        if (!byEphPk.has(hex)) {
+          byEphPk.set(hex, {
+            sharedSecret: e.sharedSecret,
+            index: e.index,
+            source: "pairwise"
+          });
+        }
+      }
+    }
+    cachedWindow = { cacheKey, window: { byEphPk } };
+    return cachedWindow.window;
+  } catch {
+    return null;
+  }
+}
+
+// src/wallet/worker/kernel/decryptBatch.ts
+function hintEphPkHex(hint) {
+  if (hint.ephPkHex) return hint.ephPkHex.toLowerCase();
+  const memo = hint.encryptedMemo;
+  if (!memo || memo.length < 66) return null;
+  return ("0x" + memo.slice(-64)).toLowerCase();
+}
+function decryptHintBatch(hints, keys) {
+  const activation = keys.viewTagActivationLeaf ?? null;
+  const knownWindow = getKnownEphWindow(keys);
+  let tagFiltered = 0;
+  let selfMatched = 0;
+  let pairwiseMatched = 0;
+  let maxSelfEphIndex = null;
+  const notes = hints.map((hint) => {
+    try {
+      const known = knownWindow?.byEphPk.get(hintEphPkHex(hint) ?? "");
+      if (known) {
+        const result2 = tryDecryptNoteVerbose(
+          hint,
+          keys.viewingKey,
+          keys.spendingKey,
+          keys.ownerPk,
+          { sharedSecret: known.sharedSecret }
+        );
+        if (result2.note) {
+          if (known.source === "self") {
+            selfMatched++;
+            if (maxSelfEphIndex === null || known.index > maxSelfEphIndex) {
+              maxSelfEphIndex = known.index;
+            }
+          } else {
+            pairwiseMatched++;
+          }
+          return result2.note;
+        }
+      }
+      const viewTag = activation !== null && hint.leafIndex >= activation;
+      const result = tryDecryptNoteVerbose(
+        hint,
+        keys.viewingKey,
+        keys.spendingKey,
+        keys.ownerPk,
+        { viewTag }
+      );
+      if (result.reason === "view_tag_mismatch") tagFiltered++;
+      return result.note;
+    } catch {
+      return null;
+    }
+  });
+  return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+}
+
+// src/foundation/errors/abort.ts
+function scanAbortError() {
+  if (typeof DOMException !== "undefined") {
+    return new DOMException("Scan aborted", "AbortError");
+  }
+  const err = new Error("Scan aborted");
+  err.name = "AbortError";
+  return err;
+}
+
+// src/wallet/worker/pool/types.ts
+var MAX_WORKERS = 4;
+var DECRYPT_YIELD_EVERY = 25;
+var WORKER_CRASHED = "Decrypt worker crashed";
+
+// src/wallet/worker/pool/mainThreadPool.ts
+function yieldToBrowser() {
+  const scheduler = globalThis.scheduler;
+  if (scheduler?.yield) return scheduler.yield();
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+function createMainThreadPool() {
+  return {
+    async decryptBatch(hints, keys, signal) {
+      const notes = [];
+      let tagFiltered = 0;
+      let selfMatched = 0;
+      let pairwiseMatched = 0;
+      let maxSelfEphIndex = null;
+      for (let i = 0; i < hints.length; i += DECRYPT_YIELD_EVERY) {
+        if (i > 0) {
+          await yieldToBrowser();
+          if (signal?.aborted) throw scanAbortError();
+        }
+        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), keys);
+        notes.push(...burst.notes);
+        tagFiltered += burst.tagFiltered;
+        selfMatched += burst.selfMatched;
+        pairwiseMatched += burst.pairwiseMatched;
+        if (burst.maxSelfEphIndex !== null) {
+          maxSelfEphIndex = Math.max(maxSelfEphIndex ?? -1, burst.maxSelfEphIndex);
+        }
+      }
+      return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+    },
+    terminate() {
+      clearKnownEphWindow();
+    }
+  };
+}
+
+// src/wallet/worker/pool/workerRpc.ts
+function runOnWorker(worker, payload, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      reject(scanAbortError());
+    };
+    const cleanup = () => {
+      worker.onmessage = null;
+      worker.onerror = null;
+      signal?.removeEventListener("abort", onAbort);
+    };
+    worker.onmessage = (event) => {
+      cleanup();
+      const data = event.data;
+      if (data.error !== void 0) {
+        reject(new Error(data.error));
+        return;
+      }
+      resolve({
+        notes: data.notes ?? [],
+        tagFiltered: data.tagFiltered ?? 0,
+        selfMatched: data.selfMatched ?? 0,
+        pairwiseMatched: data.pairwiseMatched ?? 0,
+        maxSelfEphIndex: data.maxSelfEphIndex ?? null
+      });
+    };
+    worker.onerror = () => {
+      cleanup();
+      reject(new Error(WORKER_CRASHED));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    worker.postMessage(payload);
+  });
+}
+
+// src/wallet/worker/pool/workerPool.ts
+function sliceForWorkers(hints, size) {
+  const sliceLength = Math.ceil(hints.length / size);
+  const slices = [];
+  for (let i = 0; i < hints.length; i += sliceLength) {
+    slices.push(hints.slice(i, i + sliceLength));
+  }
+  return slices;
+}
+function mergeResults(results) {
+  return {
+    notes: results.flatMap((r) => r.notes),
+    tagFiltered: results.reduce((sum, r) => sum + r.tagFiltered, 0),
+    selfMatched: results.reduce((sum, r) => sum + r.selfMatched, 0),
+    pairwiseMatched: results.reduce((sum, r) => sum + r.pairwiseMatched, 0),
+    maxSelfEphIndex: results.reduce(
+      (max, r) => r.maxSelfEphIndex === null ? max : Math.max(max ?? -1, r.maxSelfEphIndex),
+      null
+    )
+  };
+}
+function createWorkerPool(factory, size) {
+  const workers = [];
+  const workerAt = (i) => workers[i] ??= factory();
+  return {
+    async decryptBatch(hints, keys, signal) {
+      if (signal?.aborted) throw scanAbortError();
+      if (hints.length === 0) return { ...EMPTY_BATCH_RESULT, notes: [] };
+      try {
+        const results = await Promise.all(
+          sliceForWorkers(hints, size).map(
+            (slice, i) => runOnWorker(workerAt(i), { hints: slice, keys }, signal)
+          )
+        );
+        return mergeResults(results);
+      } catch (err) {
+        this.terminate();
+        throw err;
+      }
+    },
+    terminate() {
+      for (const worker of workers.splice(0)) worker.terminate();
+    }
+  };
+}
+
+// src/wallet/worker/pool/createDecryptPool.ts
+function createDecryptPool(options) {
+  const { factory } = options;
+  if (!factory) return createMainThreadPool();
+  let pool = createWorkerPool(factory, Math.min(options.size ?? MAX_WORKERS, MAX_WORKERS));
+  return {
+    async decryptBatch(hints, keys, signal) {
+      try {
+        return await pool.decryptBatch(hints, keys, signal);
+      } catch (err) {
+        if (!(err instanceof Error) || err.message !== WORKER_CRASHED) throw err;
+        pool = createMainThreadPool();
+        return pool.decryptBatch(hints, keys, signal);
+      }
+    },
+    terminate: () => pool.terminate()
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DECRYPT_YIELD_EVERY,
+  EMPTY_BATCH_RESULT,
+  MAX_WORKERS,
+  PAIRWISE_EPH_WINDOW,
+  SELF_EPH_WINDOW,
+  WORKER_CRASHED,
+  clearKnownEphWindow,
+  createDecryptPool,
+  createMainThreadPool,
+  createWorkerPool,
+  decryptHintBatch,
+  getKnownEphWindow
+});