@orbinum/sdk 0.25.0 → 1.0.0

package/dist/chunk-Y6LNYJAJ.mjs

@@ -0,0 +1,1242 @@
+// src/protocol/types.ts
+var CURRENT_CIRCUIT_VERSION = 1;
+
+// src/protocol/memo/EncryptedMemo.ts
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { randomBytes } from "@noble/ciphers/utils.js";
+import { packPoint, unpackPoint } from "@zk-kit/baby-jubjub";
+
+// src/foundation/crypto/bjj-fast.ts
+import { edwards } from "@noble/curves/abstract/edwards.js";
+var P = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var N = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+var BjjPoint = edwards({
+  p: P,
+  n: N,
+  h: 8n,
+  a: 168700n,
+  d: 168696n,
+  Gx: 5299619240641551281634865583518297030282874472190772894086521144482721001553n,
+  Gy: 16950150798460657717958625567821834550301663161624707787222815936182638968203n
+});
+function fastMulBase(scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.BASE.multiply(s).toAffine();
+  return [x, y];
+}
+function fastMulPoint(point, scalar) {
+  const s = scalar % N;
+  if (s === 0n) return [0n, 1n];
+  const { x, y } = BjjPoint.fromAffine({ x: point[0], y: point[1] }).multiplyUnsafe(s).toAffine();
+  return [x, y];
+}
+
+// src/foundation/encoding/hex.ts
+function toHex(bytes) {
+  return "0x" + Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+  if (clean.length % 2 !== 0) {
+    throw new Error(`Invalid hex string \u2014 odd length: "${hex}"`);
+  }
+  const bytes = new Uint8Array(clean.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    const byte = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    if (isNaN(byte)) throw new Error(`Invalid hex character at position ${i * 2}`);
+    bytes[i] = byte;
+  }
+  return bytes;
+}
+function ensureHexPrefix(hex) {
+  return hex.startsWith("0x") ? hex : `0x${hex}`;
+}
+function hexToNumber(hex) {
+  return parseInt(hex, 16);
+}
+function hexToBigint(hex) {
+  return BigInt(hex);
+}
+function scalarToHex(value) {
+  return "0x" + value.toString(16).padStart(64, "0");
+}
+
+// src/foundation/encoding/bytes.ts
+function bigintTo32Le(n) {
+  const buf = new Uint8Array(32);
+  let v = n;
+  for (let i = 0; i < 32; i++) {
+    buf[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return buf;
+}
+function bytesToBigintLE(bytes) {
+  let result = 0n;
+  for (let i = bytes.length - 1; i >= 0; i--) {
+    result = result << 8n | BigInt(bytes[i] ?? 0);
+  }
+  return result;
+}
+function bigintTo32Be(n) {
+  const buf = new Uint8Array(32);
+  let v = n;
+  for (let i = 31; i >= 0 && v > 0n; i--) {
+    buf[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return buf;
+}
+function bigintTo32LeArr(n) {
+  const out = new Array(32).fill(0);
+  let v = n;
+  for (let i = 0; i < 32; i++) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return out;
+}
+function computePathIndices(leafIndex, depth) {
+  const indices = [];
+  let idx = leafIndex;
+  for (let i = 0; i < depth; i++) {
+    indices.push(idx & 1);
+    idx >>= 1;
+  }
+  return indices;
+}
+function leHexToBigint(hex) {
+  return bytesToBigintLE(fromHex(hex));
+}
+
+// src/foundation/crypto/constants.ts
+var BN254_R = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+var BABYJUB_SUBORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041n;
+
+// src/protocol/memo/plaintext.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+var KEY_DOMAIN = new TextEncoder().encode("orbinum-note-encryption-v1");
+var VIEW_TAG_DOMAIN = new TextEncoder().encode("orbinum-view-tag-v1");
+var MEMO_PLAINTEXT_SIZE = 120;
+function serializeMemo(value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion) {
+  const buf = new Uint8Array(MEMO_PLAINTEXT_SIZE);
+  const view = new DataView(buf.buffer);
+  view.setBigUint64(0, value & 0xffffffffffffffffn, true);
+  view.setBigUint64(8, value >> 64n & 0xffffffffffffffffn, true);
+  buf.set(ownerPk.slice(0, 32), 16);
+  buf.set(blinding.slice(0, 32), 48);
+  view.setUint32(80, assetId >>> 0, true);
+  buf.set(counterpartyPk.slice(0, 32), 84);
+  view.setUint32(116, circuitVersion >>> 0, true);
+  return buf;
+}
+function deriveEncryptionKey(sharedSecret, commitment) {
+  const h = sha256.create();
+  h.update(sharedSecret);
+  h.update(commitment);
+  h.update(KEY_DOMAIN);
+  return h.digest();
+}
+function deriveViewTag(sharedSecret) {
+  const h = sha256.create();
+  h.update(VIEW_TAG_DOMAIN);
+  h.update(sharedSecret);
+  return h.digest()[0];
+}
+
+// src/protocol/memo/EncryptedMemo.ts
+var NONCE_SIZE = 12;
+var CIPHERTEXT_SIZE = 136;
+var EPH_PK_SIZE = 32;
+var ENCRYPTED_MEMO_SIZE = NONCE_SIZE + CIPHERTEXT_SIZE + EPH_PK_SIZE;
+function bytesToBjjScalar(bytes) {
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  return BigInt("0x" + hex) % BABYJUB_SUBORDER || 1n;
+}
+function parsePlaintext(nonce, ciphertextWithMac, encKey) {
+  try {
+    const cipher = chacha20poly1305(encKey, nonce);
+    const plaintext = cipher.decrypt(ciphertextWithMac);
+    const view = new DataView(plaintext.buffer, plaintext.byteOffset, plaintext.byteLength);
+    const valueLo = view.getBigUint64(0, true);
+    const valueHi = view.getBigUint64(8, true);
+    const value = valueLo | valueHi << 64n;
+    const ownerPk = bytesToBigintLE(plaintext.slice(16, 48));
+    const blinding = bytesToBigintLE(plaintext.slice(48, 80));
+    const assetId = BigInt(view.getUint32(80, true));
+    const counterpartyPk = bytesToBigintLE(plaintext.slice(84, 116));
+    const circuitVersion = view.getUint32(116, true);
+    return { value, ownerPk, blinding, assetId, counterpartyPk, circuitVersion };
+  } catch {
+    return null;
+  }
+}
+var EncryptedMemo = {
+  /**
+   * Build and encrypt a memo for a note using ECDH (v2, 180 bytes).
+   *
+   * @param value              Note value in planck.
+   * @param ownerPk            32-byte owner public key (LE).
+   * @param blinding           32-byte blinding scalar (LE).
+   * @param assetId            Asset identifier.
+   * @param commitment         32-byte commitment bytes (LE).
+   * @param recipientIvkPacked 32-byte LE-encoded packed BJJ viewing public key
+   *                           (from PrivacyKeyManager.getViewingPublicKeyPacked() or
+   *                           decoded from a privacy address).
+   *                           Pass `new Uint8Array(32)` (all zeros) for a publicly-readable memo.
+   * @param counterpartyPk     32-byte counterparty BJJ Ax. Default: all zeros.
+   * @param circuitVersion     ZK circuit version the note is spent under. Default: 0.
+   * @param ephSkOverride      32-byte ephemeral secret key (stealth coordination). Optional.
+   * @returns 180-byte encrypted memo: nonce(12) || ciphertext+MAC(136) || ephPk(32).
+   */
+  encrypt(value, ownerPk, blinding, assetId, commitment, recipientIvkPacked, counterpartyPk = new Uint8Array(32), circuitVersion = 0, ephSkOverride) {
+    const nonce = randomBytes(NONCE_SIZE);
+    const plaintext = serializeMemo(
+      value,
+      ownerPk,
+      blinding,
+      assetId,
+      counterpartyPk,
+      circuitVersion
+    );
+    const isZeroKey = recipientIvkPacked.every((b) => b === 0);
+    let sharedSecret;
+    let ephPkPackedBytes;
+    if (isZeroKey) {
+      sharedSecret = new Uint8Array(32);
+      ephPkPackedBytes = new Uint8Array(EPH_PK_SIZE);
+    } else {
+      const ephSkBytes = ephSkOverride ?? randomBytes(32);
+      if (ephSkBytes.length !== 32)
+        throw new Error("EncryptedMemo.encrypt: ephSkOverride must be 32 bytes");
+      const ephSkScalar = bytesToBjjScalar(ephSkBytes);
+      const ephPkPoint = fastMulBase(ephSkScalar);
+      ephPkPackedBytes = bigintTo32Le(packPoint(ephPkPoint));
+      const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
+      const ivkPoint = unpackPoint(ivkPackedBigint);
+      if (!ivkPoint)
+        throw new Error("EncryptedMemo.encrypt: invalid recipient viewing public key");
+      const sharedPoint = fastMulPoint(ivkPoint, ephSkScalar);
+      sharedSecret = bigintTo32Le(sharedPoint[0]);
+    }
+    nonce[0] = deriveViewTag(sharedSecret);
+    const encKey = deriveEncryptionKey(sharedSecret, commitment);
+    const cipher = chacha20poly1305(encKey, nonce);
+    const ciphertext = cipher.encrypt(plaintext);
+    const result = new Uint8Array(ENCRYPTED_MEMO_SIZE);
+    result.set(nonce, 0);
+    result.set(ciphertext, NONCE_SIZE);
+    result.set(ephPkPackedBytes, NONCE_SIZE + CIPHERTEXT_SIZE);
+    return result;
+  },
+  /**
+   * Returns a 180-byte public memo encrypted with a zero viewing key.
+   * Decryptable by anyone with `decrypt(memo, commitment, new Uint8Array(32))`.
+   * Convenience alias for `encrypt(..., new Uint8Array(32))`.
+   */
+  encryptPublic(value, ownerPk, blinding, assetId, commitment, circuitVersion = 0) {
+    return EncryptedMemo.encrypt(
+      value,
+      ownerPk,
+      blinding,
+      assetId,
+      commitment,
+      new Uint8Array(32),
+      new Uint8Array(32),
+      circuitVersion
+    );
+  },
+  /**
+   * Returns a 180-byte zeroed dummy memo (no information, always valid on-chain).
+   */
+  dummy() {
+    return new Uint8Array(ENCRYPTED_MEMO_SIZE);
+  },
+  /**
+   * Validates that `bytes` is a properly-sized encrypted memo.
+   * Throws an Error if the length is not ENCRYPTED_MEMO_SIZE (180 bytes).
+   *
+   * Call this at system boundaries (extrinsic builders, precompile encoders)
+   * to catch malformed memos before they reach the chain and fail on-chain.
+   *
+   * @param bytes   The memo bytes to validate.
+   * @param context Optional context string included in the error (e.g. 'shield', 'output[0]').
+   */
+  validate(bytes, context) {
+    if (bytes.length !== ENCRYPTED_MEMO_SIZE) {
+      const ctx = context ? ` (${context})` : "";
+      throw new Error(
+        `EncryptedMemo: invalid size${ctx} \u2014 expected ${ENCRYPTED_MEMO_SIZE} bytes, got ${bytes.length}`
+      );
+    }
+  },
+  /**
+   * Decrypt an on-chain EncryptedMemo using the recipient's viewing secret key.
+   * Returns null if decryption fails — wrong key, bad MAC, or malformed memo.
+   * Never throws; safe for scan loops.
+   *
+   * @param memoBytes        180-byte encrypted memo.
+   * @param commitment       32-byte note commitment (LE).
+   * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
+   */
+  decrypt(memoBytes, commitment, viewingSecretKey) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    return EncryptedMemo._decrypt(memoBytes, commitment, viewingSecretKey);
+  },
+  /**
+   * Extract the ECDH shared secret from an encrypted memo using the recipient's viewing secret key.
+   *
+   * Used by NoteDecryptor to obtain the shared secret needed for stealth address derivation
+   * without re-running the full decrypt path. Safe to call on any 180-byte memo.
+   *
+   * Returns `new Uint8Array(32)` (all zeros) for public/dummy memos (zero ephPk).
+   * Returns `null` if the memo is malformed or the ephPk is not a valid BJJ point.
+   * Never throws; safe for scan loops.
+   *
+   * @param memoBytes        180-byte encrypted memo.
+   * @param viewingSecretKey 32-byte HKDF viewing secret key from deriveViewingSecretKey().
+   */
+  extractSharedSecret(memoBytes, viewingSecretKey) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    const ephPkPackedBytes = memoBytes.slice(NONCE_SIZE + CIPHERTEXT_SIZE);
+    const ephPkPackedBigint = bytesToBigintLE(ephPkPackedBytes);
+    if (ephPkPackedBigint === 0n) {
+      return new Uint8Array(32);
+    }
+    const ephPkPoint = unpackPoint(ephPkPackedBigint);
+    if (!ephPkPoint) return null;
+    const ivskScalar = bytesToBjjScalar(viewingSecretKey);
+    const sharedPoint = fastMulPoint(ephPkPoint, ivskScalar);
+    return bigintTo32Le(sharedPoint[0]);
+  },
+  /**
+   * Cheap view-tag check: does memo nonce[0] match the tag derived from
+   * `sharedSecret`? One SHA256 + one byte compare — no AEAD work.
+   *
+   * Only meaningful for memos built with view tags (commitments at/after
+   * the wallet's tagActivationLeaf): a legacy memo carries a random byte
+   * there and would false-negative 255/256 of the time.
+   */
+  checkViewTag(memoBytes, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return false;
+    return memoBytes[0] === deriveViewTag(sharedSecret);
+  },
+  /**
+   * Decrypt with an already-computed shared secret (from
+   * extractSharedSecret), skipping the ECDH. Pair with checkViewTag for the
+   * fast scan path: ECDH once → tag check → decrypt only on match.
+   */
+  decryptWithSharedSecret(memoBytes, commitment, sharedSecret) {
+    if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) return null;
+    const nonce = memoBytes.slice(0, NONCE_SIZE);
+    const ciphertextWithMac = memoBytes.slice(NONCE_SIZE, NONCE_SIZE + CIPHERTEXT_SIZE);
+    const encKey = deriveEncryptionKey(sharedSecret, commitment);
+    return parsePlaintext(nonce, ciphertextWithMac, encKey);
+  },
+  /** @internal */
+  _decrypt(memoBytes, commitment, viewingSecretKey) {
+    const sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return null;
+    return EncryptedMemo.decryptWithSharedSecret(memoBytes, commitment, sharedSecret);
+  }
+};
+
+// src/foundation/crypto/stealth.ts
+import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { mulPointEscalar, Base8, addPoint } from "@zk-kit/baby-jubjub";
+var STEALTH_INFO = new TextEncoder().encode("orbinum-stealth-v1");
+function deriveStealthScalar(sharedSecret, ownerPkBigint) {
+  const salt = bigintTo32Le(ownerPkBigint);
+  const stealthBytes = hkdf(sha2562, sharedSecret, salt, STEALTH_INFO, 32);
+  return bytesToBigintLE(stealthBytes) % BABYJUB_SUBORDER || 1n;
+}
+function deriveStealthOwnerPk(sharedSecret, ownerPkBigint, ownerPkPoint) {
+  const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
+  const stealthPt = addPoint(mulPointEscalar(Base8, stealthScalar), ownerPkPoint);
+  return stealthPt[0];
+}
+function deriveStealthSk(sharedSecret, ownerPkBigint, spendingKey) {
+  const stealthScalar = deriveStealthScalar(sharedSecret, ownerPkBigint);
+  return (stealthScalar + spendingKey) % BABYJUB_SUBORDER || 1n;
+}
+
+// src/foundation/crypto/bjj.ts
+import { mulPointEscalar as mulPointEscalar2 } from "@zk-kit/baby-jubjub";
+var BJJ_A = 168700n;
+var BJJ_D = 168696n;
+function _modpow(base, exp, mod) {
+  let result = 1n;
+  base = base % mod;
+  while (exp > 0n) {
+    if (exp & 1n) result = result * base % mod;
+    exp >>= 1n;
+    base = base * base % mod;
+  }
+  return result;
+}
+function _sqrtModP(y2) {
+  if (y2 === 0n) return 0n;
+  if (_modpow(y2, (BN254_R - 1n) / 2n, BN254_R) !== 1n) return null;
+  let s = 0n;
+  let q = BN254_R - 1n;
+  while ((q & 1n) === 0n) {
+    q >>= 1n;
+    s++;
+  }
+  if (s === 1n) return _modpow(y2, (BN254_R + 1n) / 4n, BN254_R);
+  let z = 2n;
+  while (_modpow(z, (BN254_R - 1n) / 2n, BN254_R) === 1n) z++;
+  let m = s;
+  let c = _modpow(z, q, BN254_R);
+  let t = _modpow(y2, q, BN254_R);
+  let r = _modpow(y2, (q + 1n) / 2n, BN254_R);
+  for (; ; ) {
+    if (t === 1n) return r;
+    let i = 1n;
+    let tmp = t * t % BN254_R;
+    while (tmp !== 1n) {
+      tmp = tmp * tmp % BN254_R;
+      i++;
+    }
+    const b = _modpow(c, 1n << m - i - 1n, BN254_R);
+    m = i;
+    c = b * b % BN254_R;
+    t = t * c % BN254_R;
+    r = r * b % BN254_R;
+  }
+}
+function recoverOwnerPkPoint(ax) {
+  const x2 = ax * ax % BN254_R;
+  const num = ((1n - BJJ_A * x2) % BN254_R + BN254_R) % BN254_R;
+  const den = ((1n - BJJ_D * x2) % BN254_R + BN254_R) % BN254_R;
+  if (den === 0n) return null;
+  const denInv = _modpow(den, BN254_R - 2n, BN254_R);
+  const y2 = num * denInv % BN254_R;
+  const y = _sqrtModP(y2);
+  if (y === null) return null;
+  const yAlt = BN254_R - y;
+  try {
+    const check = mulPointEscalar2([ax, y], BABYJUB_SUBORDER);
+    return check[0] === 0n && check[1] === 1n ? [ax, y] : [ax, yAlt];
+  } catch {
+    return [ax, yAlt];
+  }
+}
+
+// src/protocol/note/NoteBuilder.ts
+import { mulPointEscalar as mulPointEscalar3, unpackPoint as unpackPoint2 } from "@zk-kit/baby-jubjub";
+import { randomBytes as randomBytes2 } from "@noble/ciphers/utils.js";
+import { poseidon2, poseidon4 } from "poseidon-lite";
+var NoteBuilder = class {
+  /**
+   * Build a ZkNote from the given inputs.
+   *
+   * @param input.value            Amount in planck (required).
+   * @param input.assetId          Asset ID — default 0n (native ORB-Privacy).
+   * @param input.ownerPk          Sender's or recipient's global BabyJubJub Ax — default 0n.
+   * @param input.blinding         Random scalar — defaults to BigInt(Date.now()).
+   * @param input.spendingKey      Secret key for nullifier — default 0n.
+   * @param input.viewingPublicKey Recipient's 32-byte LE packed BJJ ivk. Triggers memo encryption.
+   * @param input.recipientOwnerPk Recipient's global ownerPk. Required with viewingPublicKey
+   *                               to enable stealth address derivation. Without it, the
+   *                               commitment uses ownerPk directly (no stealth).
+   */
+  static async build(input) {
+    const value = input.value;
+    const assetId = input.assetId ?? 0n;
+    const ownerPk = input.ownerPk ?? 0n;
+    const blinding = input.blinding ?? BigInt(Date.now());
+    const spendingKey = input.spendingKey ?? 0n;
+    const counterpartyPk = input.counterpartyPk ?? 0n;
+    const circuitVersion = input.circuitVersion ?? CURRENT_CIRCUIT_VERSION;
+    const useStealth = input.viewingPublicKey !== void 0 && input.recipientOwnerPk !== void 0;
+    let memo;
+    if (useStealth) {
+      const recipientOwnerPk = input.recipientOwnerPk;
+      const recipientIvkPacked = input.viewingPublicKey;
+      const ephSk = randomBytes2(32);
+      const ivkPackedBigint = bytesToBigintLE(recipientIvkPacked);
+      const ivkPoint = unpackPoint2(ivkPackedBigint);
+      if (!ivkPoint)
+        throw new Error("NoteBuilder.build: invalid recipient viewing public key");
+      const ephSkScalar = BigInt(toHex(ephSk)) % BABYJUB_SUBORDER || 1n;
+      const sharedPoint = mulPointEscalar3(ivkPoint, ephSkScalar);
+      const sharedSecret = bigintTo32Le(sharedPoint[0]);
+      const recipientPkPoint = recoverOwnerPkPoint(recipientOwnerPk);
+      if (!recipientPkPoint)
+        throw new Error(
+          "NoteBuilder.build: recipientOwnerPk is not a valid BJJ x-coordinate"
+        );
+      const effectiveOwnerPk = deriveStealthOwnerPk(
+        sharedSecret,
+        recipientOwnerPk,
+        recipientPkPoint
+      );
+      const stealthCommitment = poseidon4([value, assetId, effectiveOwnerPk, blinding]);
+      const stealthCommitmentBytes = bigintTo32Le(stealthCommitment);
+      memo = Array.from(
+        EncryptedMemo.encrypt(
+          value,
+          bigintTo32Le(effectiveOwnerPk),
+          bigintTo32Le(blinding),
+          Number(assetId),
+          stealthCommitmentBytes,
+          recipientIvkPacked,
+          bigintTo32Le(counterpartyPk),
+          circuitVersion,
+          ephSk
+        )
+      );
+      const commitment2 = stealthCommitment;
+      const nullifier2 = poseidon2([commitment2, spendingKey]);
+      const commitmentBytes2 = stealthCommitmentBytes;
+      const nullifierBytes2 = bigintTo32Le(nullifier2);
+      if (memo.length !== ENCRYPTED_MEMO_SIZE)
+        throw new Error(
+          `NoteBuilder.build: invariant violated \u2014 memo must be ${ENCRYPTED_MEMO_SIZE} bytes, got ${memo.length}`
+        );
+      return {
+        value,
+        assetId,
+        ownerPk: effectiveOwnerPk,
+        blinding,
+        spendingKey,
+        circuitVersion,
+        spent: false,
+        spentAt: null,
+        commitment: commitment2,
+        nullifier: nullifier2,
+        commitmentHex: toHex(commitmentBytes2),
+        nullifierHex: toHex(nullifierBytes2),
+        memo,
+        counterpartyPk
+      };
+    }
+    const commitment = poseidon4([value, assetId, ownerPk, blinding]);
+    const nullifier = poseidon2([commitment, spendingKey]);
+    const commitmentBytes = bigintTo32Le(commitment);
+    const nullifierBytes = bigintTo32Le(nullifier);
+    memo = input.viewingPublicKey !== void 0 ? Array.from(
+      EncryptedMemo.encrypt(
+        value,
+        bigintTo32Le(ownerPk),
+        bigintTo32Le(blinding),
+        Number(assetId),
+        commitmentBytes,
+        input.viewingPublicKey,
+        bigintTo32Le(counterpartyPk),
+        circuitVersion,
+        input.ephSkOverride
+      )
+    ) : Array.from(EncryptedMemo.dummy());
+    if (memo.length !== ENCRYPTED_MEMO_SIZE)
+      throw new Error(
+        `NoteBuilder.build: invariant violated \u2014 memo must be ${ENCRYPTED_MEMO_SIZE} bytes, got ${memo.length}`
+      );
+    return {
+      value,
+      assetId,
+      ownerPk,
+      blinding,
+      spendingKey,
+      circuitVersion,
+      spent: false,
+      spentAt: null,
+      commitment,
+      nullifier,
+      commitmentHex: toHex(commitmentBytes),
+      nullifierHex: toHex(nullifierBytes),
+      memo,
+      counterpartyPk
+    };
+  }
+  /**
+   * Build the 180-byte ECDH-encrypted memo for a note.
+   *
+   * Pure TypeScript implementation — no WASM dependency.
+   * Uses ChaCha20-Poly1305 with ECDH key agreement (BabyJubJub ephemeral keypair).
+   *
+   * @param note                    The ZkNote whose fields populate the plaintext.
+   * @param recipientIvkPacked      32-byte LE packed BJJ viewing public key of the recipient.
+   *                                Pass `new Uint8Array(32)` (default) for a public/dummy memo.
+   * @param counterpartyPk          32-byte counterparty BabyJubJub Ax.
+   *                                Pass `new Uint8Array(32)` (default) for no counterparty.
+   */
+  static buildMemo(note, recipientIvkPacked, counterpartyPk) {
+    return EncryptedMemo.encrypt(
+      note.value,
+      bigintTo32Le(note.ownerPk),
+      bigintTo32Le(note.blinding),
+      Number(note.assetId),
+      bigintTo32Le(note.commitment),
+      recipientIvkPacked ?? new Uint8Array(32),
+      counterpartyPk ?? bigintTo32Le(note.counterpartyPk ?? 0n),
+      note.circuitVersion
+    );
+  }
+};
+
+// src/protocol/note/NoteDecryptor.ts
+import { poseidon2 as poseidon22, poseidon4 as poseidon42 } from "poseidon-lite";
+
+// src/protocol/spend/coinSelection.ts
+var TRANSFER_TREE_DEPTH = 20;
+var LEAVES_PER_TREE = 1 << TRANSFER_TREE_DEPTH;
+function isValidLeafIndex(leafIndex) {
+  return leafIndex !== null && leafIndex !== void 0 && Number.isSafeInteger(leafIndex) && leafIndex >= 0 && leafIndex < 2 ** 32;
+}
+function treeIdOf(note) {
+  const idx = note.leafIndex;
+  return isValidLeafIndex(idx) ? Math.floor(idx / LEAVES_PER_TREE) : 0;
+}
+function isSpendable(note) {
+  return !note.spent && note.value > 0n;
+}
+function canPairWith(a, b) {
+  return a.circuitVersion === b.circuitVersion && treeIdOf(a) === treeIdOf(b);
+}
+function selectNotes(notes, needed) {
+  const unspent = notes.filter(isSpendable);
+  const sorted = [...unspent].sort((a, b) => a.value < b.value ? -1 : 1);
+  const single = sorted.find((n) => n.value >= needed);
+  if (single) return [single, null];
+  for (let i = 0; i < sorted.length; i++) {
+    for (let j = i + 1; j < sorted.length; j++) {
+      const a = sorted[i];
+      const b = sorted[j];
+      if (a !== void 0 && b !== void 0 && canPairWith(a, b) && a.value + b.value >= needed) {
+        return [a, b];
+      }
+    }
+  }
+  for (let i = 0; i < sorted.length; i++) {
+    for (let j = i + 1; j < sorted.length; j++) {
+      const a = sorted[i];
+      const b = sorted[j];
+      if (a !== void 0 && b !== void 0 && a.circuitVersion === b.circuitVersion && a.value + b.value >= needed) {
+        return { needsConsolidation: true };
+      }
+    }
+  }
+  return null;
+}
+function buildDummyTransferInput(assetId) {
+  const zeroSibling = "0x" + "00".repeat(32);
+  return {
+    nullifier: 0n,
+    // Constraint 9: nullifier * is_dummy.out === 0 → must be 0
+    value: 0n,
+    // triggers is_dummy[i].out = 1 in the circuit
+    assetId,
+    // must match real note (Constraint 7)
+    ownerPk: 0n,
+    blinding: 0n,
+    spendingKey: 1n,
+    // arbitrary; EdDSA is disabled (enabled = 0) for dummy inputs
+    pathSiblings: Array(TRANSFER_TREE_DEPTH).fill(zeroSibling),
+    leafIndex: 0
+  };
+}
+
+// src/protocol/note/NoteDecryptor.ts
+function computeNullifier(commitment, spendingKey) {
+  return poseidon22([commitment, spendingKey]);
+}
+function commitmentHexOf(commitment) {
+  return toHex(bigintTo32Le(commitment));
+}
+function computeNoteCommitment(value, assetId, ownerPk, blinding) {
+  return poseidon42([value, assetId, ownerPk, blinding]);
+}
+function tryDecryptNote(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
+  return tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk, opts).note;
+}
+function tryDecryptNoteVerbose(commitment, viewingSecretKey, spendingKey, ownOwnerPk = 0n, opts) {
+  if (!commitment.encryptedMemo) return { note: null, reason: "no_memo" };
+  let commitmentBytes;
+  let memoBytes;
+  try {
+    commitmentBytes = fromHex(commitment.commitmentHex);
+    memoBytes = fromHex(commitment.encryptedMemo);
+  } catch {
+    return { note: null, reason: "hex_parse_error" };
+  }
+  if (memoBytes.length !== ENCRYPTED_MEMO_SIZE) {
+    return {
+      note: null,
+      reason: `memo_size_mismatch:got_${memoBytes.length}_expected_${ENCRYPTED_MEMO_SIZE}`
+    };
+  }
+  let sharedSecret = opts?.sharedSecret ?? null;
+  if (!sharedSecret && opts?.viewTag) {
+    sharedSecret = EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!sharedSecret) return { note: null, reason: "stealth_shared_secret_failed" };
+    if (!EncryptedMemo.checkViewTag(memoBytes, sharedSecret)) {
+      return { note: null, reason: "view_tag_mismatch" };
+    }
+  }
+  const plaintext = sharedSecret ? EncryptedMemo.decryptWithSharedSecret(memoBytes, commitmentBytes, sharedSecret) : EncryptedMemo.decrypt(memoBytes, commitmentBytes, viewingSecretKey);
+  if (!plaintext) return { note: null, reason: "decrypt_failed:wrong_key_or_corrupt_mac" };
+  let effectiveOwnerPk = plaintext.ownerPk;
+  let effectiveSpendingKey = spendingKey;
+  if (ownOwnerPk !== 0n && plaintext.ownerPk !== ownOwnerPk) {
+    const ss = sharedSecret ?? EncryptedMemo.extractSharedSecret(memoBytes, viewingSecretKey);
+    if (!ss) return { note: null, reason: "stealth_shared_secret_failed" };
+    const ownPkPoint = recoverOwnerPkPoint(ownOwnerPk);
+    if (!ownPkPoint) return { note: null, reason: "stealth_invalid_own_owner_pk" };
+    const stealthOwnerPk = deriveStealthOwnerPk(ss, ownOwnerPk, ownPkPoint);
+    if (stealthOwnerPk !== plaintext.ownerPk) {
+      return { note: null, reason: "commitment_mismatch" };
+    }
+    effectiveOwnerPk = stealthOwnerPk;
+    effectiveSpendingKey = deriveStealthSk(ss, ownOwnerPk, spendingKey);
+  }
+  const recomputed = poseidon42([
+    plaintext.value,
+    plaintext.assetId,
+    effectiveOwnerPk,
+    plaintext.blinding
+  ]);
+  if (recomputed !== bytesToBigintLE(commitmentBytes)) {
+    return { note: null, reason: "commitment_mismatch" };
+  }
+  const nullifier = poseidon22([recomputed, effectiveSpendingKey]);
+  return {
+    note: {
+      value: plaintext.value,
+      assetId: plaintext.assetId,
+      ownerPk: effectiveOwnerPk,
+      blinding: plaintext.blinding,
+      spendingKey: effectiveSpendingKey,
+      circuitVersion: plaintext.circuitVersion,
+      ...isValidLeafIndex(commitment.leafIndex) ? { leafIndex: commitment.leafIndex } : {},
+      spent: false,
+      spentAt: null,
+      commitment: recomputed,
+      nullifier,
+      commitmentHex: toHex(bigintTo32Le(recomputed)),
+      nullifierHex: toHex(bigintTo32Le(nullifier)),
+      memo: Array.from(memoBytes),
+      counterpartyPk: plaintext.counterpartyPk
+    }
+  };
+}
+
+// src/protocol/note/NoteDisclosure.ts
+import { poseidon4 as poseidon43 } from "poseidon-lite";
+
+// src/foundation/encoding/base64url.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function base64UrlEncode(input) {
+  const bytes = new TextEncoder().encode(input);
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = bytes[i + 1];
+    const c = bytes[i + 2];
+    out += ALPHABET[a >> 2];
+    out += ALPHABET[(a & 3) << 4 | (b ?? 0) >> 4];
+    if (b === void 0) break;
+    out += ALPHABET[(b & 15) << 2 | (c ?? 0) >> 6];
+    if (c === void 0) break;
+    out += ALPHABET[c & 63];
+  }
+  return out;
+}
+function base64UrlDecode(input) {
+  const lookup = new Map([...ALPHABET].map((ch, i) => [ch, i]));
+  const bytes = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const ch of input) {
+    const value = lookup.get(ch);
+    if (value === void 0) throw new Error(`Invalid base64url character: ${ch}`);
+    buffer = buffer << 6 | value;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(buffer >> bits & 255);
+    }
+  }
+  return new TextDecoder().decode(new Uint8Array(bytes));
+}
+
+// src/protocol/note/NoteDisclosure.ts
+var PREFIX = "orbdisc:";
+var VERSION = 1;
+function toHex2(n) {
+  return "0x" + n.toString(16);
+}
+function fromHex2(s) {
+  return BigInt(s);
+}
+function createNoteDisclosureKey(note) {
+  const payload = {
+    v: VERSION,
+    c: toHex2(note.commitment),
+    val: toHex2(note.value),
+    aid: toHex2(note.assetId),
+    opk: toHex2(note.ownerPk),
+    bld: toHex2(note.blinding)
+  };
+  return PREFIX + base64UrlEncode(JSON.stringify(payload));
+}
+function decodeNoteDisclosureKey(key) {
+  try {
+    if (!key.startsWith(PREFIX)) return null;
+    const payload = JSON.parse(base64UrlDecode(key.slice(PREFIX.length)));
+    if (payload.v !== VERSION) return null;
+    const disclosure = {
+      commitment: fromHex2(payload.c),
+      value: fromHex2(payload.val),
+      assetId: fromHex2(payload.aid),
+      ownerPk: fromHex2(payload.opk),
+      blinding: fromHex2(payload.bld)
+    };
+    const recomputed = poseidon43([
+      disclosure.value,
+      disclosure.assetId,
+      disclosure.ownerPk,
+      disclosure.blinding
+    ]);
+    if (recomputed !== disclosure.commitment) return null;
+    return disclosure;
+  } catch {
+    return null;
+  }
+}
+
+// src/protocol/eph/selfEph.ts
+import { sha256 as sha2563 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint2, unpackPoint as unpackPoint3 } from "@zk-kit/baby-jubjub";
+var SELF_EPH_DOMAIN = new TextEncoder().encode("orbinum-self-eph-v1");
+function deriveSelfEphSk(spendingKey, index) {
+  const h = sha2563.create();
+  h.update(SELF_EPH_DOMAIN);
+  h.update(bigintTo32Le(spendingKey));
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function selfEphWindow(spendingKey, ivkPacked, from, count) {
+  const ivkPoint = unpackPoint3(bytesToBigintLE(ivkPacked));
+  if (!ivkPoint) throw new Error("selfEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(deriveSelfEphSk(spendingKey, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le(packPoint2(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
+// src/protocol/eph/pairwiseEph.ts
+import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint3, unpackPoint as unpackPoint4 } from "@zk-kit/baby-jubjub";
+var PAIRWISE_EPH_DOMAIN = new TextEncoder().encode("orbinum-pairwise-eph-v1");
+function derivePairwiseSharedSecret(myViewingSk, theirIvkPacked) {
+  const theirPoint = unpackPoint4(bytesToBigintLE(theirIvkPacked));
+  if (!theirPoint) throw new Error("derivePairwiseSharedSecret: invalid viewing public key");
+  const shared = fastMulPoint(theirPoint, bytesToBjjScalar(myViewingSk));
+  return bigintTo32Le(shared[0]);
+}
+function derivePairwiseEphSk(pairSecret, index) {
+  const h = sha2564.create();
+  h.update(PAIRWISE_EPH_DOMAIN);
+  h.update(pairSecret);
+  const idx = new Uint8Array(4);
+  new DataView(idx.buffer).setUint32(0, index >>> 0, true);
+  h.update(idx);
+  return h.digest();
+}
+function pairwiseEphWindow(pairSecret, receiverIvkPacked, from, count) {
+  const ivkPoint = unpackPoint4(bytesToBigintLE(receiverIvkPacked));
+  if (!ivkPoint) throw new Error("pairwiseEphWindow: invalid viewing public key");
+  const entries = [];
+  for (let i = from; i < from + count; i++) {
+    const scalar = bytesToBjjScalar(derivePairwiseEphSk(pairSecret, i));
+    const ephPk = fastMulBase(scalar);
+    const sharedPoint = fastMulPoint(ivkPoint, scalar);
+    entries.push({
+      index: i,
+      ephPkHex: toHex(bigintTo32Le(packPoint3(ephPk))),
+      sharedSecret: bigintTo32Le(sharedPoint[0])
+    });
+  }
+  return entries;
+}
+
+// src/protocol/keys/PrivacyKeys.ts
+import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
+import { sha256 as sha2565 } from "@noble/hashes/sha2.js";
+import { packPoint as packPoint4 } from "@zk-kit/baby-jubjub";
+var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
+var KEY_VERSION = "v2";
+function deriveSpendingKeyFromMaster(masterBytes) {
+  const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
+  return skBigint === 0n ? 1n : skBigint;
+}
+function deriveViewingSecretKey(spendingKey) {
+  const ikm = bigintTo32Le(spendingKey);
+  return hkdf2(sha2565, ikm, void 0, IVK_DOMAIN, 32);
+}
+function deriveViewingPublicKey(ivsk) {
+  const ivskScalar = BigInt(toHex(ivsk)) % BABYJUB_SUBORDER || 1n;
+  const ivkPoint = fastMulBase(ivskScalar);
+  const packed = packPoint4(ivkPoint);
+  return bigintTo32Le(packed);
+}
+function deriveOwnerPk(spendingKey) {
+  try {
+    const pubPoint = fastMulBase(spendingKey);
+    return pubPoint[0];
+  } catch {
+    return 0n;
+  }
+}
+
+// src/wallet/worker/kernel/types.ts
+var SELF_EPH_WINDOW = 1024;
+var PAIRWISE_EPH_WINDOW = 64;
+var EMPTY_BATCH_RESULT = {
+  notes: [],
+  tagFiltered: 0,
+  selfMatched: 0,
+  pairwiseMatched: 0,
+  maxSelfEphIndex: null
+};
+
+// src/wallet/worker/kernel/ephWindow.ts
+var cachedWindow = null;
+function clearKnownEphWindow() {
+  cachedWindow = null;
+}
+function bytesKey(bytes) {
+  let out = "";
+  for (const b of bytes) out += b.toString(16).padStart(2, "0");
+  return out;
+}
+function getKnownEphWindow(keys) {
+  const selfSize = keys.selfEphWindowSize ?? SELF_EPH_WINDOW;
+  const pairSize = keys.pairwiseWindowSize ?? PAIRWISE_EPH_WINDOW;
+  const counterparties = keys.pairwiseCounterparties ?? [];
+  if (!keys.selfEph && counterparties.length === 0) return null;
+  const cacheKey = `${keys.spendingKey.toString(16)}:${keys.selfEph ? selfSize : 0}:${pairSize}:` + counterparties.map((c) => bytesKey(c)).join(",");
+  if (cachedWindow?.cacheKey === cacheKey) return cachedWindow.window;
+  try {
+    const ivkPacked = deriveViewingPublicKey(keys.viewingKey);
+    const byEphPk = /* @__PURE__ */ new Map();
+    if (keys.selfEph) {
+      for (const e of selfEphWindow(keys.spendingKey, ivkPacked, 0, selfSize)) {
+        byEphPk.set(e.ephPkHex.toLowerCase(), {
+          sharedSecret: e.sharedSecret,
+          index: e.index,
+          source: "self"
+        });
+      }
+    }
+    for (const theirIvk of counterparties) {
+      const pairSecret = derivePairwiseSharedSecret(keys.viewingKey, theirIvk);
+      for (const e of pairwiseEphWindow(pairSecret, ivkPacked, 0, pairSize)) {
+        const hex = e.ephPkHex.toLowerCase();
+        if (!byEphPk.has(hex)) {
+          byEphPk.set(hex, {
+            sharedSecret: e.sharedSecret,
+            index: e.index,
+            source: "pairwise"
+          });
+        }
+      }
+    }
+    cachedWindow = { cacheKey, window: { byEphPk } };
+    return cachedWindow.window;
+  } catch {
+    return null;
+  }
+}
+
+// src/wallet/worker/kernel/decryptBatch.ts
+function hintEphPkHex(hint) {
+  if (hint.ephPkHex) return hint.ephPkHex.toLowerCase();
+  const memo = hint.encryptedMemo;
+  if (!memo || memo.length < 66) return null;
+  return ("0x" + memo.slice(-64)).toLowerCase();
+}
+function decryptHintBatch(hints, keys) {
+  const activation = keys.viewTagActivationLeaf ?? null;
+  const knownWindow = getKnownEphWindow(keys);
+  let tagFiltered = 0;
+  let selfMatched = 0;
+  let pairwiseMatched = 0;
+  let maxSelfEphIndex = null;
+  const notes = hints.map((hint) => {
+    try {
+      const known = knownWindow?.byEphPk.get(hintEphPkHex(hint) ?? "");
+      if (known) {
+        const result2 = tryDecryptNoteVerbose(
+          hint,
+          keys.viewingKey,
+          keys.spendingKey,
+          keys.ownerPk,
+          { sharedSecret: known.sharedSecret }
+        );
+        if (result2.note) {
+          if (known.source === "self") {
+            selfMatched++;
+            if (maxSelfEphIndex === null || known.index > maxSelfEphIndex) {
+              maxSelfEphIndex = known.index;
+            }
+          } else {
+            pairwiseMatched++;
+          }
+          return result2.note;
+        }
+      }
+      const viewTag = activation !== null && hint.leafIndex >= activation;
+      const result = tryDecryptNoteVerbose(
+        hint,
+        keys.viewingKey,
+        keys.spendingKey,
+        keys.ownerPk,
+        { viewTag }
+      );
+      if (result.reason === "view_tag_mismatch") tagFiltered++;
+      return result.note;
+    } catch {
+      return null;
+    }
+  });
+  return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+}
+
+// src/foundation/errors/abort.ts
+function scanAbortError() {
+  if (typeof DOMException !== "undefined") {
+    return new DOMException("Scan aborted", "AbortError");
+  }
+  const err = new Error("Scan aborted");
+  err.name = "AbortError";
+  return err;
+}
+function isAbortError(err) {
+  return err instanceof Error && err.name === "AbortError";
+}
+
+// src/wallet/worker/pool/types.ts
+var MAX_WORKERS = 4;
+var DECRYPT_YIELD_EVERY = 25;
+var WORKER_CRASHED = "Decrypt worker crashed";
+
+// src/wallet/worker/pool/mainThreadPool.ts
+function yieldToBrowser() {
+  const scheduler = globalThis.scheduler;
+  if (scheduler?.yield) return scheduler.yield();
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+function createMainThreadPool() {
+  return {
+    async decryptBatch(hints, keys, signal) {
+      const notes = [];
+      let tagFiltered = 0;
+      let selfMatched = 0;
+      let pairwiseMatched = 0;
+      let maxSelfEphIndex = null;
+      for (let i = 0; i < hints.length; i += DECRYPT_YIELD_EVERY) {
+        if (i > 0) {
+          await yieldToBrowser();
+          if (signal?.aborted) throw scanAbortError();
+        }
+        const burst = decryptHintBatch(hints.slice(i, i + DECRYPT_YIELD_EVERY), keys);
+        notes.push(...burst.notes);
+        tagFiltered += burst.tagFiltered;
+        selfMatched += burst.selfMatched;
+        pairwiseMatched += burst.pairwiseMatched;
+        if (burst.maxSelfEphIndex !== null) {
+          maxSelfEphIndex = Math.max(maxSelfEphIndex ?? -1, burst.maxSelfEphIndex);
+        }
+      }
+      return { notes, tagFiltered, selfMatched, pairwiseMatched, maxSelfEphIndex };
+    },
+    terminate() {
+      clearKnownEphWindow();
+    }
+  };
+}
+
+// src/wallet/worker/pool/workerRpc.ts
+function runOnWorker(worker, payload, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      reject(scanAbortError());
+    };
+    const cleanup = () => {
+      worker.onmessage = null;
+      worker.onerror = null;
+      signal?.removeEventListener("abort", onAbort);
+    };
+    worker.onmessage = (event) => {
+      cleanup();
+      const data = event.data;
+      if (data.error !== void 0) {
+        reject(new Error(data.error));
+        return;
+      }
+      resolve({
+        notes: data.notes ?? [],
+        tagFiltered: data.tagFiltered ?? 0,
+        selfMatched: data.selfMatched ?? 0,
+        pairwiseMatched: data.pairwiseMatched ?? 0,
+        maxSelfEphIndex: data.maxSelfEphIndex ?? null
+      });
+    };
+    worker.onerror = () => {
+      cleanup();
+      reject(new Error(WORKER_CRASHED));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    worker.postMessage(payload);
+  });
+}
+
+// src/wallet/worker/pool/workerPool.ts
+function sliceForWorkers(hints, size) {
+  const sliceLength = Math.ceil(hints.length / size);
+  const slices = [];
+  for (let i = 0; i < hints.length; i += sliceLength) {
+    slices.push(hints.slice(i, i + sliceLength));
+  }
+  return slices;
+}
+function mergeResults(results) {
+  return {
+    notes: results.flatMap((r) => r.notes),
+    tagFiltered: results.reduce((sum, r) => sum + r.tagFiltered, 0),
+    selfMatched: results.reduce((sum, r) => sum + r.selfMatched, 0),
+    pairwiseMatched: results.reduce((sum, r) => sum + r.pairwiseMatched, 0),
+    maxSelfEphIndex: results.reduce(
+      (max, r) => r.maxSelfEphIndex === null ? max : Math.max(max ?? -1, r.maxSelfEphIndex),
+      null
+    )
+  };
+}
+function createWorkerPool(factory, size) {
+  const workers = [];
+  const workerAt = (i) => workers[i] ??= factory();
+  return {
+    async decryptBatch(hints, keys, signal) {
+      if (signal?.aborted) throw scanAbortError();
+      if (hints.length === 0) return { ...EMPTY_BATCH_RESULT, notes: [] };
+      try {
+        const results = await Promise.all(
+          sliceForWorkers(hints, size).map(
+            (slice, i) => runOnWorker(workerAt(i), { hints: slice, keys }, signal)
+          )
+        );
+        return mergeResults(results);
+      } catch (err) {
+        this.terminate();
+        throw err;
+      }
+    },
+    terminate() {
+      for (const worker of workers.splice(0)) worker.terminate();
+    }
+  };
+}
+
+// src/wallet/worker/pool/createDecryptPool.ts
+function createDecryptPool(options) {
+  const { factory } = options;
+  if (!factory) return createMainThreadPool();
+  let pool = createWorkerPool(factory, Math.min(options.size ?? MAX_WORKERS, MAX_WORKERS));
+  return {
+    async decryptBatch(hints, keys, signal) {
+      try {
+        return await pool.decryptBatch(hints, keys, signal);
+      } catch (err) {
+        if (!(err instanceof Error) || err.message !== WORKER_CRASHED) throw err;
+        pool = createMainThreadPool();
+        return pool.decryptBatch(hints, keys, signal);
+      }
+    },
+    terminate: () => pool.terminate()
+  };
+}
+
+export {
+  toHex,
+  fromHex,
+  ensureHexPrefix,
+  hexToNumber,
+  hexToBigint,
+  scalarToHex,
+  bigintTo32Le,
+  bytesToBigintLE,
+  bigintTo32Be,
+  bigintTo32LeArr,
+  computePathIndices,
+  leHexToBigint,
+  base64UrlEncode,
+  base64UrlDecode,
+  BN254_R,
+  BABYJUB_SUBORDER,
+  recoverOwnerPkPoint,
+  fastMulBase,
+  fastMulPoint,
+  deriveStealthOwnerPk,
+  deriveStealthSk,
+  scanAbortError,
+  isAbortError,
+  serializeMemo,
+  deriveViewTag,
+  ENCRYPTED_MEMO_SIZE,
+  bytesToBjjScalar,
+  EncryptedMemo,
+  deriveSelfEphSk,
+  selfEphWindow,
+  derivePairwiseSharedSecret,
+  derivePairwiseEphSk,
+  pairwiseEphWindow,
+  CURRENT_CIRCUIT_VERSION,
+  NoteBuilder,
+  LEAVES_PER_TREE,
+  isValidLeafIndex,
+  treeIdOf,
+  isSpendable,
+  canPairWith,
+  selectNotes,
+  buildDummyTransferInput,
+  computeNullifier,
+  commitmentHexOf,
+  computeNoteCommitment,
+  tryDecryptNote,
+  tryDecryptNoteVerbose,
+  createNoteDisclosureKey,
+  decodeNoteDisclosureKey,
+  KEY_VERSION,
+  deriveSpendingKeyFromMaster,
+  deriveViewingSecretKey,
+  deriveViewingPublicKey,
+  deriveOwnerPk,
+  SELF_EPH_WINDOW,
+  PAIRWISE_EPH_WINDOW,
+  EMPTY_BATCH_RESULT,
+  clearKnownEphWindow,
+  getKnownEphWindow,
+  decryptHintBatch,
+  MAX_WORKERS,
+  DECRYPT_YIELD_EVERY,
+  WORKER_CRASHED,
+  createMainThreadPool,
+  createWorkerPool,
+  createDecryptPool
+};