@orbinum/sdk 0.8.0 → 0.9.0

package/dist/index.d.mts

@@ -844,18 +844,35 @@ declare class IndexerClient {
      * For the current Orbinum testnet/mainnet scale this is the recommended approach.
      */
     getAllSpentNullifiers(): Promise<Set<string>>;
+    /** Server-enforced max items per by-nullifiers / by-commitments request. */
+    private static readonly TRANSFER_LOOKUP_CHUNK;
+    /**
+     * Chunked fetch for the transfer timestamp lookups. The reader silently
+     * truncates each request to 50 items, so larger inputs MUST be split or
+     * results are silently lost. Responses are merged per extrinsic
+     * (`blockNumber:extrinsicIndex`), concatenating the matched arrays, and
+     * sorted by block descending.
+     *
+     * Privacy note: these lookups send the wallet's own note identifiers to
+     * the indexer — a bounded, documented linkage tradeoff for timestamp
+     * recovery. They are NEVER used for spent-STATUS checks (PIR-A: status
+     * comes from the anonymous full-set `/shielded/nullifiers/all` download).
+     */
+    private fetchTransfersChunked;
     /**
      * Returns temporal metadata for private transfers that spent any of the given nullifiers.
      * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
      * between inputs and outputs to prevent graph reconstruction.
-     * Accepts up to 50 nullifiers (0x-prefixed hex).
+     * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+     * and merged per extrinsic.
      */
     getTransfersByNullifiers(nullifiers: string[]): Promise<PrivateTransferTimestamp[]>;
     /**
      * Returns temporal metadata for private transfers that produced any of the given commitments.
      * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
      * between outputs and inputs to prevent graph reconstruction.
-     * Accepts up to 50 commitments (0x-prefixed hex).
+     * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+     * and merged per extrinsic.
      */
     getTransfersByCommitments(commitments: string[]): Promise<PrivateTransferTimestamp[]>;
     /** Returns a paginated list of unshield events. */
@@ -2803,6 +2820,25 @@ declare function vaultReviver(_key: string, value: unknown): unknown;
  * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
  */
 declare function deriveVaultKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Derives an HMAC-SHA-256 key ("blind key") from the same master key bytes,
+ * for deterministically tagging note identifiers (commitment/nullifier) in the
+ * vault WITHOUT storing them in plaintext.
+ *
+ * The tag `HMAC(blindKey, hex)` is stable, so equality lookups still work
+ * (find a note by commitment/nullifier), but a raw storage dump reveals no
+ * on-chain identifiers — an attacker with disk access can't link the vault to
+ * chain activity. Derived from masterBytes, so it's device-independent and
+ * survives reload (unlike a random per-session salt).
+ *
+ * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
+ */
+declare function deriveVaultBlindKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Deterministic tag for a note identifier hex, as `0x`-prefixed HMAC-SHA-256.
+ * Used as the blinded storage key for commitment / nullifier / assetId.
+ */
+declare function blindTag(blindKey: CryptoKey, value: string): Promise<string>;
 /**
  * Serialises `payload` to JSON (bigint-safe) and encrypts it with AES-GCM.
  * Returns base64-encoded `iv` and `ciphertext`.
@@ -2824,18 +2860,26 @@ declare function decryptJson(key: CryptoKey, iv: string, ciphertext: string): Pr
  * Any backend (IndexedDB, SQLite, remote…) must produce/consume this shape
  * so that encryptNote / decryptNoteRecord work without modification.
  */
-/** A single encrypted note record as stored in the vault backend. */
+/**
+ * A single encrypted note record as stored in the vault backend.
+ *
+ * Note identifiers are BLINDED — stored as HMAC tags derived from the vault
+ * blind key, not the raw on-chain hex. A storage dump reveals no
+ * commitment/nullifier/asset that could be linked to chain activity, yet
+ * equality lookups (find-my-note) still work by comparing tags. `spent` /
+ * `spentAt` stay plaintext: they're local flags with no on-chain linkage.
+ */
 interface EncryptedNoteRecord {
-    /** Primary key — note commitmentHex */
-    commitmentHex: string;
+    /** Primary key — blinded commitment tag: HMAC(blindKey, commitmentHex). */
+    commitmentTag: string;
     /** AES-GCM IV for this record — base64 */
     iv: string;
     /** AES-GCM ciphertext of the full ZkNote JSON — base64 */
     ciphertext: string;
-    /** Unencrypted nullifierHex for quick spent-check without unlocking */
-    nullifierHex: string;
-    /** Unencrypted assetId (string form of bigint) for filtering */
-    assetId: string;
+    /** Blinded nullifier tag: HMAC(blindKey, nullifierHex). Quick spent-check. */
+    nullifierTag: string;
+    /** Blinded asset tag: HMAC(blindKey, assetId). Filter by asset without unlock. */
+    assetTag: string;
     /** Whether the note has already been spent/nullified on-chain. */
     spent?: boolean;
     /** When the app marked the note as spent locally, if known. */
@@ -2869,17 +2913,25 @@ declare class VaultLockedError extends Error {
  */
 declare function applyNoteStatus(note: ZkNote, status?: NoteStatusUpdate): ZkNote;
 /**
- * Encrypts a ZkNote into an EncryptedNoteRecord using AES-GCM.
- * The commitmentHex, nullifierHex, and assetId are stored in plaintext
- * for efficient filtering without requiring vault unlock.
+ * Encrypts a ZkNote into a v2 EncryptedNoteRecord.
+ *
+ * The full note (values, secrets) is AES-GCM encrypted under `key`; the note
+ * identifiers (commitment, nullifier, asset) are stored as BLIND TAGS under
+ * `blindKey` instead of plaintext — a storage dump reveals nothing linkable to
+ * chain activity, while equality lookups still work (compare tags).
  */
-declare function encryptNote(key: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
+declare function encryptNote(key: CryptoKey, blindKey: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
 /**
- * Decrypts an EncryptedNoteRecord back into a ZkNote using AES-GCM.
+ * Decrypts a note record back into a ZkNote.
  * Applies the record's spent/spentAt metadata onto the decrypted note.
  * Throws DOMException on authentication failure (wrong key or corrupted data).
  */
 declare function decryptNoteRecord(key: CryptoKey, rec: EncryptedNoteRecord): Promise<ZkNote>;
+/**
+ * Blind tag for a note identifier hex — use to build the storage key or to
+ * look a record up by commitment/nullifier without exposing the raw hex.
+ */
+declare function noteBlindTag(blindKey: CryptoKey, hex: string): Promise<string>;
 
 /**
  * Inputs required to generate an Unshield proof.
@@ -4474,4 +4526,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.d.ts

@@ -844,18 +844,35 @@ declare class IndexerClient {
      * For the current Orbinum testnet/mainnet scale this is the recommended approach.
      */
     getAllSpentNullifiers(): Promise<Set<string>>;
+    /** Server-enforced max items per by-nullifiers / by-commitments request. */
+    private static readonly TRANSFER_LOOKUP_CHUNK;
+    /**
+     * Chunked fetch for the transfer timestamp lookups. The reader silently
+     * truncates each request to 50 items, so larger inputs MUST be split or
+     * results are silently lost. Responses are merged per extrinsic
+     * (`blockNumber:extrinsicIndex`), concatenating the matched arrays, and
+     * sorted by block descending.
+     *
+     * Privacy note: these lookups send the wallet's own note identifiers to
+     * the indexer — a bounded, documented linkage tradeoff for timestamp
+     * recovery. They are NEVER used for spent-STATUS checks (PIR-A: status
+     * comes from the anonymous full-set `/shielded/nullifiers/all` download).
+     */
+    private fetchTransfersChunked;
     /**
      * Returns temporal metadata for private transfers that spent any of the given nullifiers.
      * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
      * between inputs and outputs to prevent graph reconstruction.
-     * Accepts up to 50 nullifiers (0x-prefixed hex).
+     * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+     * and merged per extrinsic.
      */
     getTransfersByNullifiers(nullifiers: string[]): Promise<PrivateTransferTimestamp[]>;
     /**
      * Returns temporal metadata for private transfers that produced any of the given commitments.
      * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
      * between outputs and inputs to prevent graph reconstruction.
-     * Accepts up to 50 commitments (0x-prefixed hex).
+     * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+     * and merged per extrinsic.
      */
     getTransfersByCommitments(commitments: string[]): Promise<PrivateTransferTimestamp[]>;
     /** Returns a paginated list of unshield events. */
@@ -2803,6 +2820,25 @@ declare function vaultReviver(_key: string, value: unknown): unknown;
  * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
  */
 declare function deriveVaultKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Derives an HMAC-SHA-256 key ("blind key") from the same master key bytes,
+ * for deterministically tagging note identifiers (commitment/nullifier) in the
+ * vault WITHOUT storing them in plaintext.
+ *
+ * The tag `HMAC(blindKey, hex)` is stable, so equality lookups still work
+ * (find a note by commitment/nullifier), but a raw storage dump reveals no
+ * on-chain identifiers — an attacker with disk access can't link the vault to
+ * chain activity. Derived from masterBytes, so it's device-independent and
+ * survives reload (unlike a random per-session salt).
+ *
+ * @param masterBytes 32-byte pre-modulus key material from deriveMasterKeyBytes().
+ */
+declare function deriveVaultBlindKey(masterBytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Deterministic tag for a note identifier hex, as `0x`-prefixed HMAC-SHA-256.
+ * Used as the blinded storage key for commitment / nullifier / assetId.
+ */
+declare function blindTag(blindKey: CryptoKey, value: string): Promise<string>;
 /**
  * Serialises `payload` to JSON (bigint-safe) and encrypts it with AES-GCM.
  * Returns base64-encoded `iv` and `ciphertext`.
@@ -2824,18 +2860,26 @@ declare function decryptJson(key: CryptoKey, iv: string, ciphertext: string): Pr
  * Any backend (IndexedDB, SQLite, remote…) must produce/consume this shape
  * so that encryptNote / decryptNoteRecord work without modification.
  */
-/** A single encrypted note record as stored in the vault backend. */
+/**
+ * A single encrypted note record as stored in the vault backend.
+ *
+ * Note identifiers are BLINDED — stored as HMAC tags derived from the vault
+ * blind key, not the raw on-chain hex. A storage dump reveals no
+ * commitment/nullifier/asset that could be linked to chain activity, yet
+ * equality lookups (find-my-note) still work by comparing tags. `spent` /
+ * `spentAt` stay plaintext: they're local flags with no on-chain linkage.
+ */
 interface EncryptedNoteRecord {
-    /** Primary key — note commitmentHex */
-    commitmentHex: string;
+    /** Primary key — blinded commitment tag: HMAC(blindKey, commitmentHex). */
+    commitmentTag: string;
     /** AES-GCM IV for this record — base64 */
     iv: string;
     /** AES-GCM ciphertext of the full ZkNote JSON — base64 */
     ciphertext: string;
-    /** Unencrypted nullifierHex for quick spent-check without unlocking */
-    nullifierHex: string;
-    /** Unencrypted assetId (string form of bigint) for filtering */
-    assetId: string;
+    /** Blinded nullifier tag: HMAC(blindKey, nullifierHex). Quick spent-check. */
+    nullifierTag: string;
+    /** Blinded asset tag: HMAC(blindKey, assetId). Filter by asset without unlock. */
+    assetTag: string;
     /** Whether the note has already been spent/nullified on-chain. */
     spent?: boolean;
     /** When the app marked the note as spent locally, if known. */
@@ -2869,17 +2913,25 @@ declare class VaultLockedError extends Error {
  */
 declare function applyNoteStatus(note: ZkNote, status?: NoteStatusUpdate): ZkNote;
 /**
- * Encrypts a ZkNote into an EncryptedNoteRecord using AES-GCM.
- * The commitmentHex, nullifierHex, and assetId are stored in plaintext
- * for efficient filtering without requiring vault unlock.
+ * Encrypts a ZkNote into a v2 EncryptedNoteRecord.
+ *
+ * The full note (values, secrets) is AES-GCM encrypted under `key`; the note
+ * identifiers (commitment, nullifier, asset) are stored as BLIND TAGS under
+ * `blindKey` instead of plaintext — a storage dump reveals nothing linkable to
+ * chain activity, while equality lookups still work (compare tags).
  */
-declare function encryptNote(key: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
+declare function encryptNote(key: CryptoKey, blindKey: CryptoKey, note: ZkNote): Promise<EncryptedNoteRecord>;
 /**
- * Decrypts an EncryptedNoteRecord back into a ZkNote using AES-GCM.
+ * Decrypts a note record back into a ZkNote.
  * Applies the record's spent/spentAt metadata onto the decrypted note.
  * Throws DOMException on authentication failure (wrong key or corrupted data).
  */
 declare function decryptNoteRecord(key: CryptoKey, rec: EncryptedNoteRecord): Promise<ZkNote>;
+/**
+ * Blind tag for a note identifier hex — use to build the storage key or to
+ * look a record up by commitment/nullifier without exposing the raw hex.
+ */
+declare function noteBlindTag(blindKey: CryptoKey, hex: string): Promise<string>;
 
 /**
  * Inputs required to generate an Unshield proof.
@@ -4474,4 +4526,4 @@ interface ExtrinsicFailedData {
     dispatch_info: DispatchInfo;
 }
 
-export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
+export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type ActivityBucket, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, type IndexedBlock, type IndexedEvmTx, type IndexedExtrinsic, type IndexedSession, type IndexedValidator, type IndexerActivity, IndexerClient, type IndexerClientConfig, type IndexerStats, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRoot, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifierStatusResult, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, type PaginatedResult, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type PrivateTransferTimestamp, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RegisteredAsset, type RelayFeeEvent, type RelayFeeSummaryEntry, type Relayer, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedAddressEvent, type ShieldedCommitment, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpentNullifier, type StatusChangeEvent, type StatusListener, type StealthScanHint, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TxResult, type UnsafeTxOptions, type Unshield, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };

package/dist/index.js

@@ -59,6 +59,7 @@ __export(index_exports, {
   bigintTo32Be: () => bigintTo32Be,
   bigintTo32Le: () => bigintTo32Le,
   bigintTo32LeArr: () => bigintTo32LeArr,
+  blindTag: () => blindTag,
   buildDummyTransferInput: () => buildDummyTransferInput,
   bytesToBigintLE: () => bytesToBigintLE,
   computeNullifier: () => computeNullifier,
@@ -75,6 +76,7 @@ __export(index_exports, {
   deriveSpendingKeyMessage: () => deriveSpendingKeyMessage,
   deriveStealthOwnerPk: () => deriveStealthOwnerPk,
   deriveStealthSk: () => deriveStealthSk,
+  deriveVaultBlindKey: () => deriveVaultBlindKey,
   deriveVaultKey: () => deriveVaultKey,
   deriveViewingPublicKey: () => deriveViewingPublicKey,
   deriveViewingSecretKey: () => deriveViewingSecretKey,
@@ -109,6 +111,7 @@ __export(index_exports, {
   mapExtrinsicArgs: () => mapExtrinsicArgs,
   mapZkEventData: () => mapZkEventData,
   normalizeEvmAddress: () => normalizeEvmAddress,
+  noteBlindTag: () => noteBlindTag,
   randomBlinding: () => randomBlinding,
   recoverOwnerPkPoint: () => recoverOwnerPkPoint,
   selectNotes: () => selectNotes,
@@ -1147,7 +1150,7 @@ var EvmExplorer = class _EvmExplorer {
 };
 
 // src/indexer/IndexerClient.ts
-var IndexerClient = class {
+var IndexerClient = class _IndexerClient {
   baseUrl;
   timeoutMs;
   constructor(config) {
@@ -1247,37 +1250,82 @@ var IndexerClient = class {
     return new Set(res.data.map((h) => h.toLowerCase()));
   }
   // ─── Private transfers ─────────────────────────────────────────────────────
+  /** Server-enforced max items per by-nullifiers / by-commitments request. */
+  static TRANSFER_LOOKUP_CHUNK = 50;
+  /**
+   * Chunked fetch for the transfer timestamp lookups. The reader silently
+   * truncates each request to 50 items, so larger inputs MUST be split or
+   * results are silently lost. Responses are merged per extrinsic
+   * (`blockNumber:extrinsicIndex`), concatenating the matched arrays, and
+   * sorted by block descending.
+   *
+   * Privacy note: these lookups send the wallet's own note identifiers to
+   * the indexer — a bounded, documented linkage tradeoff for timestamp
+   * recovery. They are NEVER used for spent-STATUS checks (PIR-A: status
+   * comes from the anonymous full-set `/shielded/nullifiers/all` download).
+   */
+  async fetchTransfersChunked(path, param, items, matchedField) {
+    if (items.length === 0) return [];
+    const normalized = items.map((i) => i.toLowerCase());
+    const chunks = [];
+    for (let i = 0; i < normalized.length; i += _IndexerClient.TRANSFER_LOOKUP_CHUNK) {
+      chunks.push(normalized.slice(i, i + _IndexerClient.TRANSFER_LOOKUP_CHUNK));
+    }
+    const responses = await Promise.all(
+      chunks.map((chunk) => {
+        const qs = this.buildQuery({ [param]: chunk.join(",") });
+        return this.get(
+          `${path}${qs}`
+        );
+      })
+    );
+    const byExtrinsic = /* @__PURE__ */ new Map();
+    for (const res of responses) {
+      for (const transfer of res.data) {
+        const key = `${transfer.blockNumber}:${transfer.extrinsicIndex ?? "null"}`;
+        const existing = byExtrinsic.get(key);
+        if (!existing) {
+          byExtrinsic.set(key, transfer);
+          continue;
+        }
+        const merged = /* @__PURE__ */ new Set([
+          ...existing[matchedField] ?? [],
+          ...transfer[matchedField] ?? []
+        ]);
+        existing[matchedField] = [...merged];
+      }
+    }
+    return [...byExtrinsic.values()].sort((a, b) => b.blockNumber - a.blockNumber);
+  }
   /**
    * Returns temporal metadata for private transfers that spent any of the given nullifiers.
    * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
    * between inputs and outputs to prevent graph reconstruction.
-   * Accepts up to 50 nullifiers (0x-prefixed hex).
+   * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+   * and merged per extrinsic.
    */
   async getTransfersByNullifiers(nullifiers) {
-    if (nullifiers.length === 0) return [];
-    const qs = this.buildQuery({
-      nullifiers: nullifiers.map((n) => n.toLowerCase()).join(",")
-    });
-    const res = await this.get(
-      `/shielded/transfers/by-nullifiers${qs}`
+    return this.fetchTransfersChunked(
+      "/shielded/transfers/by-nullifiers",
+      "nullifiers",
+      nullifiers,
+      "matchedNullifiers"
     );
-    return res.data;
   }
   /**
    * Returns temporal metadata for private transfers that produced any of the given commitments.
    * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
    * between outputs and inputs to prevent graph reconstruction.
-   * Accepts up to 50 commitments (0x-prefixed hex).
+   * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+   * and merged per extrinsic.
    */
   async getTransfersByCommitments(commitments) {
-    if (commitments.length === 0) return [];
-    const qs = this.buildQuery({
-      commitments: commitments.map((c) => c.toLowerCase()).join(",")
-    });
-    const res = await this.get(
-      `/shielded/transfers/by-commitments${qs}`
+    return this.fetchTransfersChunked(
+      "/shielded/transfers/by-commitments",
+      "commitments",
+      commitments,
+      "matchedCommitments"
     );
-    return res.data;
   }
   // ─── Unshields ─────────────────────────────────────────────────────────────
   /** Returns a paginated list of unshield events. */
@@ -4439,6 +4487,7 @@ function fromBase64(b64) {
 
 // src/vault/VaultCrypto.ts
 var VAULT_KEY_INFO = new TextEncoder().encode("orbinum-vault-key-v1");
+var VAULT_BLIND_INFO = new TextEncoder().encode("orbinum-vault-blind-v1");
 var IV_BYTES = 12;
 async function deriveVaultKey(masterBytes) {
   const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
@@ -4457,6 +4506,28 @@ async function deriveVaultKey(masterBytes) {
     ["encrypt", "decrypt"]
   );
 }
+async function deriveVaultBlindKey(masterBytes) {
+  const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: VAULT_BLIND_INFO
+    },
+    keyMaterial,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
+    false,
+    ["sign"]
+  );
+}
+async function blindTag(blindKey, value) {
+  const data = new TextEncoder().encode(value.toLowerCase());
+  const sig = await crypto.subtle.sign("HMAC", blindKey, data);
+  return "0x" + toBase64(sig).replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
 async function encryptJson(key, payload) {
   const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload, vaultReplacer));
@@ -4488,14 +4559,19 @@ function applyNoteStatus(note, status) {
     spentAt: status?.spentAt ?? note.spentAt ?? null
   };
 }
-async function encryptNote(key, note) {
+async function encryptNote(key, blindKey, note) {
   const { iv, ciphertext } = await encryptJson(key, note);
+  const [commitmentTag, nullifierTag, assetTag] = await Promise.all([
+    blindTag(blindKey, note.commitmentHex),
+    blindTag(blindKey, note.nullifierHex),
+    blindTag(blindKey, note.assetId.toString())
+  ]);
   return {
-    commitmentHex: note.commitmentHex,
+    commitmentTag,
     iv,
     ciphertext,
-    nullifierHex: note.nullifierHex,
-    assetId: note.assetId.toString(),
+    nullifierTag,
+    assetTag,
     spent: note.spent,
     spentAt: note.spentAt,
     updatedAt: Date.now()
@@ -4508,6 +4584,9 @@ async function decryptNoteRecord(key, rec) {
     spentAt: rec.spentAt ?? null
   });
 }
+async function noteBlindTag(blindKey, hex) {
+  return blindTag(blindKey, hex);
+}
 
 // src/proof-generator/unshield.ts
 var import_proof_generator = require("@orbinum/proof-generator");
@@ -5414,6 +5493,7 @@ var import_polkadot_api4 = require("polkadot-api");
   bigintTo32Be,
   bigintTo32Le,
   bigintTo32LeArr,
+  blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
   computeNullifier,
@@ -5430,6 +5510,7 @@ var import_polkadot_api4 = require("polkadot-api");
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
+  deriveVaultBlindKey,
   deriveVaultKey,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
@@ -5464,6 +5545,7 @@ var import_polkadot_api4 = require("polkadot-api");
   mapExtrinsicArgs,
   mapZkEventData,
   normalizeEvmAddress,
+  noteBlindTag,
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,

package/dist/index.mjs

@@ -1020,7 +1020,7 @@ var EvmExplorer = class _EvmExplorer {
 };
 
 // src/indexer/IndexerClient.ts
-var IndexerClient = class {
+var IndexerClient = class _IndexerClient {
   baseUrl;
   timeoutMs;
   constructor(config) {
@@ -1120,37 +1120,82 @@ var IndexerClient = class {
     return new Set(res.data.map((h) => h.toLowerCase()));
   }
   // ─── Private transfers ─────────────────────────────────────────────────────
+  /** Server-enforced max items per by-nullifiers / by-commitments request. */
+  static TRANSFER_LOOKUP_CHUNK = 50;
+  /**
+   * Chunked fetch for the transfer timestamp lookups. The reader silently
+   * truncates each request to 50 items, so larger inputs MUST be split or
+   * results are silently lost. Responses are merged per extrinsic
+   * (`blockNumber:extrinsicIndex`), concatenating the matched arrays, and
+   * sorted by block descending.
+   *
+   * Privacy note: these lookups send the wallet's own note identifiers to
+   * the indexer — a bounded, documented linkage tradeoff for timestamp
+   * recovery. They are NEVER used for spent-STATUS checks (PIR-A: status
+   * comes from the anonymous full-set `/shielded/nullifiers/all` download).
+   */
+  async fetchTransfersChunked(path, param, items, matchedField) {
+    if (items.length === 0) return [];
+    const normalized = items.map((i) => i.toLowerCase());
+    const chunks = [];
+    for (let i = 0; i < normalized.length; i += _IndexerClient.TRANSFER_LOOKUP_CHUNK) {
+      chunks.push(normalized.slice(i, i + _IndexerClient.TRANSFER_LOOKUP_CHUNK));
+    }
+    const responses = await Promise.all(
+      chunks.map((chunk) => {
+        const qs = this.buildQuery({ [param]: chunk.join(",") });
+        return this.get(
+          `${path}${qs}`
+        );
+      })
+    );
+    const byExtrinsic = /* @__PURE__ */ new Map();
+    for (const res of responses) {
+      for (const transfer of res.data) {
+        const key = `${transfer.blockNumber}:${transfer.extrinsicIndex ?? "null"}`;
+        const existing = byExtrinsic.get(key);
+        if (!existing) {
+          byExtrinsic.set(key, transfer);
+          continue;
+        }
+        const merged = /* @__PURE__ */ new Set([
+          ...existing[matchedField] ?? [],
+          ...transfer[matchedField] ?? []
+        ]);
+        existing[matchedField] = [...merged];
+      }
+    }
+    return [...byExtrinsic.values()].sort((a, b) => b.blockNumber - a.blockNumber);
+  }
   /**
    * Returns temporal metadata for private transfers that spent any of the given nullifiers.
    * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
    * between inputs and outputs to prevent graph reconstruction.
-   * Accepts up to 50 nullifiers (0x-prefixed hex).
+   * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+   * and merged per extrinsic.
    */
   async getTransfersByNullifiers(nullifiers) {
-    if (nullifiers.length === 0) return [];
-    const qs = this.buildQuery({
-      nullifiers: nullifiers.map((n) => n.toLowerCase()).join(",")
-    });
-    const res = await this.get(
-      `/shielded/transfers/by-nullifiers${qs}`
+    return this.fetchTransfersChunked(
+      "/shielded/transfers/by-nullifiers",
+      "nullifiers",
+      nullifiers,
+      "matchedNullifiers"
     );
-    return res.data;
   }
   /**
    * Returns temporal metadata for private transfers that produced any of the given commitments.
    * Only blockNumber, extrinsicIndex, timestampMs, and hash are returned — no cross-link
    * between outputs and inputs to prevent graph reconstruction.
-   * Accepts up to 50 commitments (0x-prefixed hex).
+   * Inputs of any size are transparently chunked into requests of 50 (the server cap)
+   * and merged per extrinsic.
    */
   async getTransfersByCommitments(commitments) {
-    if (commitments.length === 0) return [];
-    const qs = this.buildQuery({
-      commitments: commitments.map((c) => c.toLowerCase()).join(",")
-    });
-    const res = await this.get(
-      `/shielded/transfers/by-commitments${qs}`
+    return this.fetchTransfersChunked(
+      "/shielded/transfers/by-commitments",
+      "commitments",
+      commitments,
+      "matchedCommitments"
     );
-    return res.data;
   }
   // ─── Unshields ─────────────────────────────────────────────────────────────
   /** Returns a paginated list of unshield events. */
@@ -4312,6 +4357,7 @@ function fromBase64(b64) {
 
 // src/vault/VaultCrypto.ts
 var VAULT_KEY_INFO = new TextEncoder().encode("orbinum-vault-key-v1");
+var VAULT_BLIND_INFO = new TextEncoder().encode("orbinum-vault-blind-v1");
 var IV_BYTES = 12;
 async function deriveVaultKey(masterBytes) {
   const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
@@ -4330,6 +4376,28 @@ async function deriveVaultKey(masterBytes) {
     ["encrypt", "decrypt"]
   );
 }
+async function deriveVaultBlindKey(masterBytes) {
+  const keyMaterial = await crypto.subtle.importKey("raw", masterBytes.slice(0), "HKDF", false, [
+    "deriveKey"
+  ]);
+  return crypto.subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: VAULT_BLIND_INFO
+    },
+    keyMaterial,
+    { name: "HMAC", hash: "SHA-256", length: 256 },
+    false,
+    ["sign"]
+  );
+}
+async function blindTag(blindKey, value) {
+  const data = new TextEncoder().encode(value.toLowerCase());
+  const sig = await crypto.subtle.sign("HMAC", blindKey, data);
+  return "0x" + toBase64(sig).replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
+}
 async function encryptJson(key, payload) {
   const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload, vaultReplacer));
@@ -4361,14 +4429,19 @@ function applyNoteStatus(note, status) {
     spentAt: status?.spentAt ?? note.spentAt ?? null
   };
 }
-async function encryptNote(key, note) {
+async function encryptNote(key, blindKey, note) {
   const { iv, ciphertext } = await encryptJson(key, note);
+  const [commitmentTag, nullifierTag, assetTag] = await Promise.all([
+    blindTag(blindKey, note.commitmentHex),
+    blindTag(blindKey, note.nullifierHex),
+    blindTag(blindKey, note.assetId.toString())
+  ]);
   return {
-    commitmentHex: note.commitmentHex,
+    commitmentTag,
     iv,
     ciphertext,
-    nullifierHex: note.nullifierHex,
-    assetId: note.assetId.toString(),
+    nullifierTag,
+    assetTag,
     spent: note.spent,
     spentAt: note.spentAt,
     updatedAt: Date.now()
@@ -4381,6 +4454,9 @@ async function decryptNoteRecord(key, rec) {
     spentAt: rec.spentAt ?? null
   });
 }
+async function noteBlindTag(blindKey, hex) {
+  return blindTag(blindKey, hex);
+}
 
 // src/proof-generator/unshield.ts
 import {
@@ -5309,6 +5385,7 @@ export {
   bigintTo32Be,
   bigintTo32Le,
   bigintTo32LeArr,
+  blindTag,
   buildDummyTransferInput,
   bytesToBigintLE,
   computeNullifier,
@@ -5325,6 +5402,7 @@ export {
   deriveSpendingKeyMessage,
   deriveStealthOwnerPk,
   deriveStealthSk,
+  deriveVaultBlindKey,
   deriveVaultKey,
   deriveViewingPublicKey,
   deriveViewingSecretKey,
@@ -5359,6 +5437,7 @@ export {
   mapExtrinsicArgs,
   mapZkEventData,
   normalizeEvmAddress,
+  noteBlindTag,
   randomBlinding,
   recoverOwnerPkPoint,
   selectNotes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orbinum/sdk",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Official TypeScript SDK for Orbinum.",
   "author": "Orbinum",
   "license": "MIT",